Security Analysis of the Compression Function of Lesamnta and its Impact

This section describes a correlation among a key, a plaintext, and a ciphertext in Lesamnta’s block cipher. The correlation was discovered by Bouillaguet et al. [1]. We only describe the observation on Lesamnta-256, but we can obtain similar observation on Lesamnta-512; the difference is just word size. We follow symbols and notations of [2] and consider Lesamnta-256’s block cipher EncComp256. Let C[r][0] and C[r][1] be the left part and the right part of the r-th round constant in the key schedule function (see Figure 18 of [2]). For example, C[0][0] = 00000001 and C[0][1] = 00000000 according to p.14 of [2]. We define a difference ∆r as ∆r = C[r][0]⊕ C[r][1] (1)