Linear Cryptanalysis of Reduced-Round Versions of the SAFER Block Cipher Family

This paper presents a linear cryptanalytic attack against reduced round variants of the SAFER family of block ciphers. Compared with the 1.5 round linear relations by Harpes et al., the following new linear relations were found: a 3.75-round non-homomorphic linear relation for both SAFER-K and SAFER-SK with bias = 2−29; a 2.75 round relation for SAFER+ with bias = 2−49. For a 32-bit block mini-version of SAFER a 4.75-round relation with bias = 2−16 has been identified. These linear relations apply only to certain weak key classes. The results show that by considering non-homomorphic linear relations, more rounds of the SAFER block cipher family can be attacked. The new attacks pose no threat to any member of the SAFER family.