Improving the Efficiency of Impossible Differential Cryptanalysis of Reduced Camellia and MISTY1

Camellia and MISTY1 are Feistel block ciphers. In this paper, we observe that, when conducting impossible differential cryptanalysis on Camellia and MISTY1, their round structures allow us to partially determine whether a candidate pair is right by guessing only a small fraction of the unknown required subkey bits of a relevant round at a time, instead of all of them. This reduces the computational complexity of an attack, and may allow us to break more rounds of a cipher. Taking advantage of this main observation, we significantly improve previous impossible differential cryptanalysis on reduced Camellia and MISTY1, obtaining the best published cryptanalytic results against both the ciphers.