Cryptanalysis of SP Networks with Partial Non-Linear Layers

Abstract

Design of SP networks in which the non-linear layer is applied to only a part of the state in each round was suggested by Gérard et al. at CHES 2013. Besides performance advantage on certain platforms, such a design allows for more efficient masking techniques that can mitigate side-channel attacks with a small performance overhead.In this paper we present generic techniques for differential and linear cryptanalysis of SP networks with partial non-linear layers, including an automated characteristic search tool and dedicated key-recovery algorithms. Our techniques can be used both for cryptanalysis of such schemes and for proving their security with respect to basic differential and linear cryptanalysis, succeeding where previous automated analysis tools seem to fail.We first apply our techniques to the block cipher Zorro (designed by Gérard et al. following their methodology), obtaining practical attacks on the cipher which where fully simulated on a single desktop PC in a few days. Then, we propose a mild change to Zorro, and formally prove its security against basic differential and linear cryptanalysis. We conclude that there is no inherent flaw in the design strategy of Gérard et al., and it can be used in future designs, where our tools should prove useful.

Out of Oddity – New Cryptanalytic Techniques Against Symmetric Primitives Optimized for Integrity Proof Systems

“…However, several attacks on this type of constructions, e.g. [12,21,23,32] show that it is much more difficult to estimate the security level of these constructions than that of classical SPNs. The basic principle of the HADES construction is then to combine both aspects: the inner rounds in the cipher have a partial Sbox layer to increase the resistance to algebraic attacks at a reduced implementation cost, whereas the outer rounds consist of traditional SPN rounds, with a full Sbox layer.…”

Ciphers for MPC and FHE

“…Zorro [GGNPS13] is the first SPN cipher in the literature that uses a nonfull Sbox layer and is related to LowMC in this respect. However, recent attacks on Zorro that exploit this particular property [WWGY13,RASA14,GNPW13,BODD+14], highlight the need to be very careful with this design strategy. In our analysis of LowMC in Section 5 we are able to take these into account.…”

Cryptanalysis of symmetric-key primitives and its application to backdoor design

“…Furthermore, this relation also implies that the two active columns of ∆K 1 can only choose 2 8 values at most. To sum up, there are 2 16 valid values for ∆K 1 , each are denoted by ∆K 1 i , 1 ď i ď 2 16 . For a secret key K 0 , the key structure S k is generated by adding the non-zero difference ∆K 1 i to the second subkey of K 0 , from which a new secret key K i can be uniquely determined, see Figure 3.2a.…”

“…For a secret key K 0 , the key structure S k is generated by adding the non-zero difference ∆K 1 i to the second subkey of K 0 , from which a new secret key K i can be uniquely determined, see Figure 3.2a. Finally, the key structure consists of 2 16 keys, from which 2 31 unordered key pairs can be composed.…”

“…Therefore, in order to obtain 4 right quartets, 2 3 plaintext structures are required. We for each of the 2 16 keys K in the key structure S K do for each of the 2 72 plaintexts P in the plaintext structure do Encrypt P under key K, denote the ciphertext as C. Compute C 1 " C ' ∆C. Decrypt C 1 with K 1 , K 1 being computed from the corresponding K, and denote the new plaintext by P 1 .…”