Analysis of AES, SKINNY, and Others with Constraint Programming

Sun, Siwei; Gerault, David; Lafourcade, Pascal; Yang, Qianqian; Todo, Yosuke; Qiao, Kexin; Hu, Lei

doi:10.46586/tosc.v2017.i1.281-306

Cited by 45 publications

(17 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In the related-key setting, we only considered differential cryptanalysis, as there is no cancellation of active S-boxes between subkeys and the state in linear approximations. In [ 73 ], it is shown that in the related-key setting, there are at least 21 active S-boxes in consecutive 6 rounds of AES-128, and the optimal 6-round differential has probability . Therefore, no useful related-key differential characteristic covering more than can be found no matter whether there is a difference in the tweak or not.…”

Section: Concrete Proposalsmentioning

confidence: 99%

TNT: How to Tweak a Block Cipher

Bao

Guo

et al. 2020

Advances in Cryptology – EUROCRYPT 2020

View full text Add to dashboard Cite

In this paper, we propose Tweak-aNd-Tweak ( for short) mode, which builds a tweakable block cipher from three independent block ciphers. handles the tweak input by simply XOR-ing the unmodified tweak into the internal state of block ciphers twice. Due to its simplicity, can also be viewed as a way of turning a block cipher into a tweakable block cipher by dividing the block cipher into three chunks, and adding the tweak at the two cutting points only. is proven to be of beyond-birthday-bound security, under the assumption that the three chunks are independent secure n -bit SPRPs. It clearly brings minimum possible overhead to both software and hardware implementations. To demonstrate this, an instantiation named TNT-AES with , , rounds of AES as the underlying block ciphers is proposed. Besides the inherent proven security bound and tweak-independent rekeying feature of the mode, the performance of TNT-AES is comparable with all existing TBCs designed through modular methods.

show abstract

Section: Concrete Proposalsmentioning

confidence: 99%

TNT: How to Tweak a Block Cipher

Bao

Guo

et al. 2020

Advances in Cryptology – EUROCRYPT 2020

View full text Add to dashboard Cite

show abstract

“…On top of that, designers also assume that the probability of a differential (∆ p , ∆ c ) is close to the probability of the best characteristic (∆ p → • • • → ∆ c ), and they prove a cipher is secure against differential cryptanalysis by showing that characteristics with high probability cannot cover most rounds of the cipher. While these assumptions do not always hold, currently this is the best systematic approach to argue security against differential cryptanalysis, and this heuristic approach is widely used for ARX ciphers in practice [18,19,23,25,33,34]. SMT solvers.…”

Section: Differential Cryptanalysismentioning

confidence: 99%

A Bit-Vector Differential Model for the Modular Addition by a Constant

Azimi

Ranea

Salmasizadeh

et al. 2020

Advances in Cryptology – ASIACRYPT 2020

View full text Add to dashboard Cite

ARX algorithms are a class of symmetric-key algorithms constructed by Addition, Rotation, and XOR, which achieve the best software performances in low-end microcontrollers. To evaluate the resistance of an ARX cipher against differential cryptanalysis and its variants, the recent automated methods employ constraint satisfaction solvers, such as SMT solvers, to search for optimal characteristics. The main difficulty to formulate this search as a constraint satisfaction problem is obtaining the differential models of the non-linear operations, that is, the constraints describing the differential probability of each non-linear operation of the cipher. While an efficient bit-vector differential model was obtained for the modular addition with two variable inputs, no differential model for the modular addition by a constant has been proposed so far, preventing ARX ciphers including this operation from being evaluated with automated methods. In this paper, we present the first bit-vector differential model for the nbit modular addition by a constant input. Our model contains O(log 2 (n)) basic bit-vector constraints and describes the binary logarithm of the differential probability. We also represent an SMT-based automated method to look for differential characteristics of ARX, including constant additions, and we provide an open-source tool ArxPy to find ARX differential characteristics in a fully automated way. To provide some examples, we have searched for related-key differential characteristics of TEA, XTEA, HIGHT, and LEA, obtaining better results than previous works. Our differential model and our automated tool allow cipher designers to select the best constant inputs for modular additions and cryptanalysts to evaluate the resistance of ARX ciphers against differential attacks.

show abstract

“…Even if they have been used to mount attacks in the related-key settings [6], the key schedules are in most cases merely involved in the key recovery attack to reduce the guessing complexity by exploring the relations among the round keys. As a matter of fact, the key schedules are considered irrelevant to the distinguishers themselves in the single-key setting, such as the search of differential characteristics with an automated tool [32] and the differential enumerating technique developed for improving the meet-in-the-middle attack [14].…”

Section: Block Ciphers and Differential Cryptanalysismentioning

confidence: 99%

The phantom of differential characteristics

Liu

Zhang

Sun

et al. 2020

Des. Codes Cryptogr.

View full text Add to dashboard Cite

For differential cryptanalysis under the single-key model, the key schedules hardly need to be exploited in constructing the characteristics, which is based on the hypothesis of stochastic equivalence. In this paper, we study a profound effect of the key schedules on the validity of the differential characteristics. Noticing the sensitivity in the probability of the characteristics to specific keys, we label the keys where a characteristic has nonzero probability by effective keys. We propose the concept of singular characteristics which are characteristics with no effective keys, and exploit an algorithm to sieve them out by studying the key schedule. We show by a differential characteristic of PRINCE whose expected differential probability is much larger than that of a random permutation, i.e., 2 −35 vs. 2 −64 . Yet, it is indeed singular which could be mis-used to mount a differential attack. Singular characteristics are found for 3-round AES and 3-round Midori-128 as well. Furthermore, taking the possible mismatches of the effective keys in a number of differential characteristics into consideration, we present singular clusters which indicates an empty intersection of the corresponding effective keys, and this is evidenced by showing two differential characteristics of the 2-round AES. We also show that characteristics are tightly linked to the key schedule, as shown in the paper, a valid characteristic in the AES-128 can be singular for the AES-192. Our results indicate a gap over the perspectives of the designers and the attackers, which warns the latter to validate the theoretically-built distinguishers. Therefore, a closer look into the characteristics is inevitable before any attack is claimed.

show abstract

Analysis of AES, SKINNY, and Others with Constraint Programming

Cited by 45 publications

References 21 publications

TNT: How to Tweak a Block Cipher

TNT: How to Tweak a Block Cipher

A Bit-Vector Differential Model for the Modular Addition by a Constant

The phantom of differential characteristics

Contact Info

Product

Resources

About