Square Attacks on Reduced-Round FEA-1 and FEA-2

FEA-1 and FEA-2 are the South Korean Format-Preserving Encryption (FPE) standards. In this paper, we discuss the security of FEA-1 and FEA-2 against the square attacks. More specifically, we present a three-round distinguishing attack against FEA-1 and FEA-2. The data complexity of this three-round distinguisher is 28 plaintexts. We use this three-round distinguisher for key recovery against four rounds of FEA-1. The time complexity of this key recovery attacks is 2137.6, for both 192-bit and 256-bit key sizes. In addition, we extend the three-round distinguisher to a five-round distinguisher for FEA-2 using the tweak schedule. We use this distinguisher to mount six round key recovery attack with complexity 2137.6, for 192-bit and 256-bit key sizes.