A Geometric Approach to Linear Cryptanalysis

Beyne, Tim

doi:10.1007/978-3-030-92062-3_2

Cited by 8 publications

(9 citation statements)

References 37 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The following result summarizes some of the basic properties of quasidifferential transition matrices. Properties (1) to ( 3) are identical to those of corrrelation matrices [4,Theorem 3.1], and their proofs are nearly identical. For Theorem 3.2 (2), the Kronecker product of two quasidifferential transition matrices is defined by…”

Section: Definition 32 (Quasidifferential Transition Matrix)mentioning

confidence: 85%

See 1 more Smart Citation

Differential Cryptanalysis in the Fixed-Key Model

Beyne

Rijmen

2022

Advances in Cryptology – CRYPTO 2022

Self Cite

View full text Add to dashboard Cite

A systematic approach to the fixed-key analysis of differential probabilities is proposed. It is based on the propagation of 'quasidifferential trails', which keep track of probabilistic linear relations on the values satisfying a differential characteristic in a theoretically sound way. It is shown that the fixed-key probability of a differential can be expressed as the sum of the correlations of its quasidifferential trails. The theoretical foundations of the method are based on an extension of the difference-distribution table, which we call the quasidifferential transition matrix. The role of these matrices is analogous to that of correlation matrices in linear cryptanalysis. This puts the theory of differential and linear cryptanalysis on an equal footing. The practical applicability of the proposed methodology is demonstrated by analyzing several differentials for RECTANGLE, KNOT, Speck and Simon. The analysis is automated and applicable to other SPN and ARX designs. Several attacks are shown to be invalid, most others turn out to work only for some keys but can be improved for weak-keys.

show abstract

Section: Definition 32 (Quasidifferential Transition Matrix)mentioning

confidence: 85%

“…It allows propagating probabilistic linear relations on the values satisfying differential characteristics in a theoretically sound way. The theoretical foundations of the proposed approach are inspired by the correlation matrix framework [10] and its recent generalization [4] that provide a natural description of linear cryptanalysis.…”

Section: Introductionmentioning

confidence: 99%

Differential Cryptanalysis in the Fixed-Key Model

Beyne

Rijmen

2022

Advances in Cryptology – CRYPTO 2022

Self Cite

View full text Add to dashboard Cite

show abstract

“…Linear cryptanalysis is based on the correlation between Boolean functions and linear functions, which can be exploited as a distinguishing feature of a cipher. We follow the interpretation by Beyne [Bey21].…”

Section: Linear Cryptanalysismentioning

confidence: 94%

“…Daemen et al [DGV95] define the correlation matrix of a vectorial Boolean function F as the matrix C F such that each coordinate is equal the correlation of a linear approximation. Beyne [Bey21] defines it as the Fourier transformation of the transition matrix of F . Both definitions are equivalent, but using the second definition the properties of the transition matrix can be translated to properties of the correlation matrix.…”

Section: Correlation Matricesmentioning

confidence: 99%

Integral Cryptanalysis Using Algebraic Transition Matrices

Beyne,

Verbauwhede

2023

ToSC

View full text Add to dashboard Cite

In this work we introduce algebraic transition matrices as the basis for a new approach to integral cryptanalysis that unifies monomial trails (Hu et al., Asiacrypt 2020) and parity sets (Boura and Canteaut, Crypto 2016). Algebraic transition matrices allow for the computation of the algebraic normal form of a primitive based on the algebraic normal forms of its components by means of wellunderstood operations from linear algebra. The theory of algebraic transition matrices leads to better insight into the relation between integral properties of F and F−1. In addition, we show that the link between invariants and eigenvectors of correlation matrices (Beyne, Asiacrypt 2018) carries over to algebraic transition matrices. Finally, algebraic transition matrices suggest a generalized definition of integral properties that subsumes previous notions such as extended division properties (Lambin, Derbez and Fouque, DCC 2020). On the practical side, a new algorithm is described to search for these generalized properties and applied to Present, resulting in new properties. The algorithm can be instantiated with any existing automated search method for integral cryptanalysis.

show abstract

“…They showed that the existence of a balanced-non linear invariant 13 of a function F : F n 2 → F n 2 could be interpreted as (and is actually equivalent) to the existence of a linear approximation α → α with absolute correlation 1 for a conjugate G • F • G −1 of F , where G is non-linear. They then used this insight to reinterpret previous distinguishers from the literature [TLS19]: the only constraint for such G, α, g to exist is that α • G = g. It is pointed out in [BCL18], and later adressed by Beyne [Bey21], that Remark 2. This does not apply to the genuine Midori because 1 / ∈ V .…”

Section: A Connexions Between Commutative Cryptanalysis and Conjugationmentioning

confidence: 96%

Commutative Cryptanalysis Made Practical

Baudrin,

Felke,

Leander

et al. 2023

ToSC

View full text Add to dashboard Cite

About 20 years ago, Wagner showed that most of the (then) known techniques used in the cryptanalysis of block ciphers were particular cases of what he called commutative diagram cryptanalysis. However, to the best of our knowledge, this general framework has not yet been leveraged to find concrete attacks.In this paper, we focus on a particular case of this framework and develop commutative cryptanalysis, whereby an attacker targeting a primitive E constructs affine permutations A and B such that E ○ A = B ○ E with a high probability, possibly for some weak keys. We develop the tools needed for the practical use of this technique: first, we generalize differential uniformity into “A-uniformity” and differential trails into “commutative trails”, and second we investigate the commutative behaviour of S-box layers, matrix multiplications, and key additions.Equipped with these new techniques, we find probability-one distinguishers using only two chosen plaintexts for large classes of weak keys in both a modified Midori and in Scream. For the same weak keys, we deduce high probability truncated differentials that can cover an arbitrary number of rounds, but which do not correspond to any high probability differential trails. Similarly, we show the existence of a trade-off in our variant of Midori whereby the probability of the commutative trail can be decreased in order to increase the weak key density. We also show some statistical patterns in the AES super S-box that have a much higher probability than the best differentials, and which hold for a class of weak keys of density about 2−4.5.

show abstract

A Geometric Approach to Linear Cryptanalysis

Cited by 8 publications

References 37 publications

Differential Cryptanalysis in the Fixed-Key Model

Differential Cryptanalysis in the Fixed-Key Model

Integral Cryptanalysis Using Algebraic Transition Matrices

Commutative Cryptanalysis Made Practical

Contact Info

Product

Resources

About