Square Attacks on Reduced-Round FEA-1 and FEA-2.

FEA-1 and FEA-2 are the South Korean Format-Preserving Encryption (FPE) standards. In this paper, we discuss the security of FEA-1 and FEA-2 against the square attacks. More specifically, we present a three-round distinguishing attack against FEA-1 and FEA-2. The data complexity of this three-round distinguisher is $$2^8$$ plaintexts. We use this three-round distinguisher for key recovery against four rounds of FEA-1. The time complexity of this key recovery attacks is $$2^{137.6}$$ , for both 192-bit and 256-bit key sizes. In addition, we extend the three-round distinguisher to a five-round distinguisher for FEA-2 using the tweak schedule. We use this distinguisher to mount six round key recovery attack with complexity $$2^{137.6}$$ , for 192-bit and 256-bit key sizes.