Bounds for the Security of Ascon against Differential and Linear Cryptanalysis

Abstract

The NIST Lightweight Cryptography project aims to standardize symmetric cryptographic designs, including authenticated encryption and hashing, suitable for constrained devices. One essential criterion for the evaluation of the 10 finalists is the evidence for their security against attacks like linear and differential cryptanalysis. For Ascon, one of the finalists and previous winner of the CAESAR competition in the ‘lightweight’ category, there is a large gap between the proven bounds and the best known characteristics found with heuristic tools: The bounds only cover up to 3 rounds with 15 differentially and 13 linearly active S-boxes, insufficient for proving a level of security for the full constructions.In this paper, we propose a new modeling strategy for SAT solvers and derive strong bounds for the round-reduced Ascon permutation. We prove that 4 rounds already ensure that any single characteristic has a differential probability or squared correlation of at most 2−72, and 6 rounds at most 2−108. This is significantly below the bound that could be exploited within the query limit for keyed Ascon modes. These bounds are probably not tight. To achieve this result, we propose a new search strategy of dividing the search space into a large number of subproblems based on ‘girdle patterns’, and show how to exploit the rotational symmetry of Ascon using necklace theory. Additionally, we evaluate and optimize several aspects of the pure SAT model, including the counter implementation and parallelizability, which we expect to be useful for future applications to other models.

Towards Tight Differential Bounds of Ascon

“…The STP and Gurobi (when used independently) were unable to compute the minimum weight of a 3-round differential trail while using our hybrid approach we are able to prove that this weight equals 40. On a separate note, the same result was also obtained in [EME22] using SAT solvers.…”

“…Moreover, we show that there are only 9289 cases to check for feasibility in order to obtain the tight lower bound. We also give an estimate on the time complexity to solve these cases and provide comparisons with [EME22].…”

“…Thus, it is enough to consider one equivalent representative for each of these rotations. Following the approach of [EME22], which is further inspired from [Mor72], we consider 2-ary necklaces of length 64 in this work. We say a 64-bead necklace given by e = (e 0 , e 1 , • • • , e 63 ) has a weight n if the Hamming weight of e is n. For n = 3, 4 and 5, the number of such necklaces are 651, 9936 and 119133, respectively.…”

“…Using a simple Python script we find that there are only 11496 cases to check for feasibility. Moreover, if we assume that the number of active Sboxes is at least 36 (result from [EME22]) then this number reduces to 9793. Consequently, we need to solve these 9793 cases to find the minimum number of active Sboxes for 4 rounds.…”

“…Very recently, at ToSC 2022, Erlacher et al [EME22] have proved that any 4-round differential trail must have at least 36 active Sboxes. This reduces our first problem to finding whether there exits a 4-round differential trail with the number of active Sboxes in between 36 and 43.…”