▁is ▁contained ▁in ▁the ▁S - box es . ▁ ▁There ▁is ▁a ▁differential ▁attack ▁on ▁ 1 6 ▁r ounds ▁of ▁Kh uf u ▁which ▁can ▁recover ▁the ▁secret ▁key . ▁It ▁requires ▁ 2 4 3 ▁chosen ▁plain text s ▁and ▁has ▁a ▁ 2 4 3 ▁time ▁complexity ▁( G il bert ▁and ▁Ch au va ud , ▁ 1 9 9 4 ). ▁ 2 3 2 ▁plain text s ▁and ▁complexity ▁are ▁required ▁merely ▁to ▁distinguish ▁the ▁ci pher ▁from ▁random . ▁A ▁bo omer ang ▁attack ▁( W agner , ▁ 1 9 9 9 ) ▁can ▁be ▁used ▁in ▁an ▁adapt ive ▁chosen ▁plain text ▁/ ▁chosen ▁ci pher text ▁scenario ▁with ▁ 2 1 8 ▁queries ▁and ▁a ▁similar ▁time ▁complexity . ▁Kh uf u ▁is ▁also ▁sus cept ible ▁to ▁an ▁impossible ▁differential ▁attack , ▁which ▁can ▁break ▁up ▁to ▁ 1 8 ▁r ounds ▁of ▁the ▁ci pher ▁( Bi ham ▁et ▁al ., ▁ 1 9 9 9 ). ▁ ▁Schne ier ▁and ▁K else y ▁( 1 9 9 6 ) ▁categor ise ▁Kh af re ▁and ▁Kh uf u ▁as ▁" even ▁incomplete ▁heter ogeneous ▁target - he avy ▁Un bal anced ▁Fe ist el ▁Network s ". ▁ ▁Kh af re ▁ ▁Kh af re ▁is ▁similar ▁to ▁Kh uf u , ▁but ▁uses ▁a ▁standard ▁set ▁of ▁S - box es , ▁and ▁does ▁not ▁compute ▁them ▁from ▁the ▁key . ▁( R ather , ▁they ▁are ▁generated