Differential Cryptanalysis in the Fixed-Key Model

Beyne, Tim; Rijmen, Vincent

doi:10.1007/978-3-031-15982-4_23

Cited by 8 publications

(3 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Even for a keyed primitive like a block cipher, the average probability of a given differential often provides little information on the behavior of the primitive with respect to differential cryptanalysis. Indeed, as extensively analyzed in [BR22], many ciphers are vulnerable to differential cryptanalysis only for some keys. It is therefore important to estimate the differential uniformity of the fixed-key primitive, even for a block cipher.…”

Section: Fixed-key Maximal Differential Probability Of Some Monomialb...mentioning

confidence: 99%

Propagation of Subspaces in Primitives with Monomial Sboxes: Applications to Rescue and Variants of the AES

Boeuf,

Canteaut,

Perrin

2023

ToSC

View full text Add to dashboard Cite

Motivated by progress in the field of zero-knowledge proofs, so-called Arithmetization-Oriented (AO) symmetric primitives have started to appear in the literature, such as MiMC, Poseidon or Rescue. Due to the design constraints implied by this setting, these algorithms are defined using simple operations over large (possibly prime) fields. In particular, many rely on simple low-degree monomials for their non-linear layers, essentially using x ↦ x3 as an S-box.In this paper, we show that the structure of the material injected in each round (be it subkeys in a block cipher or round constants in a public permutation) could allow a specific pattern, whereby a well-defined affine space is mapped to another by the round function, and then to another, etc. Such chains of one-dimensional subspaces always exist over 2 rounds, and they can be extended to an arbitrary number of rounds, for any linear layer, provided that the round-constants are well chosen.As a consequence, for several ciphers like Rescue, or a variant of AES with a monomial Sbox, there exist some round-key sequences for which the cipher has an abnormally high differential uniformity, exceeding the size of the Sbox alphabet.Well-known security arguments, in particular based on the wide-trail strategy, have been reused in the AO setting by many designers. Unfortunately, our results show that such a traditional study may not be sufficient to guarantee security. To illustrate this, we present two new primitives (the tweakable block cipher Snare and the permutation-based hash function Stir) that are built using state-of-the-art security arguments, but which are actually deeply flawed. Indeed, the key schedule of Snare ensures the presence of a subspace chain that significantly simplifies an algebraic attack against it, and the round constants of Stir force the presence of a subspace chain aligned with the rate and capacity of the permutation. This in turns implies the existence of many easy-to-find solutions to the so-called CICO problem.

show abstract

Section: Fixed-key Maximal Differential Probability Of Some Monomialb...mentioning

confidence: 99%

Propagation of Subspaces in Primitives with Monomial Sboxes: Applications to Rescue and Variants of the AES

Boeuf,

Canteaut,

Perrin

2023

ToSC

View full text Add to dashboard Cite

show abstract

“…We introduce a new framework for integral cryptanalysis that aims to simplify the propagation of integral properties by relying on linear algebra. Inspired by the correlation-matrix description of linear cryptanalysis [DGV95] and the quasidifferential transition matrices that were proposed at Crypto 2022 [BR22], we introduce algebraic transition matrices. Algebraic transition matrices have similar properties to correlation matrices.…”

Section: Contributionsmentioning

confidence: 99%

Integral Cryptanalysis Using Algebraic Transition Matrices

Beyne,

Verbauwhede

2023

ToSC

View full text Add to dashboard Cite

In this work we introduce algebraic transition matrices as the basis for a new approach to integral cryptanalysis that unifies monomial trails (Hu et al., Asiacrypt 2020) and parity sets (Boura and Canteaut, Crypto 2016). Algebraic transition matrices allow for the computation of the algebraic normal form of a primitive based on the algebraic normal forms of its components by means of wellunderstood operations from linear algebra. The theory of algebraic transition matrices leads to better insight into the relation between integral properties of F and F−1. In addition, we show that the link between invariants and eigenvectors of correlation matrices (Beyne, Asiacrypt 2018) carries over to algebraic transition matrices. Finally, algebraic transition matrices suggest a generalized definition of integral properties that subsumes previous notions such as extended division properties (Lambin, Derbez and Fouque, DCC 2020). On the practical side, a new algorithm is described to search for these generalized properties and applied to Present, resulting in new properties. The algorithm can be instantiated with any existing automated search method for integral cryptanalysis.

show abstract

“…Inspired by this, Beyne and Rijmen [BR22] studied differential cryptanalysis under fixedkey, developed a general methodology to analyze the fixed-key probabilities of differentials. They assert that several attacks are shown to be invalid, most others turn out to work only for some keys but can be improved for weak keys.…”

Section: Introduction 1backgroundmentioning

confidence: 99%

Finding Impossible Differentials in ARX Ciphers under Weak Keys

Ling,

Cui,

et al. 2024

ToSC

View full text Add to dashboard Cite

Impossible differential cryptanalysis is very important in the field of symmetric ciphers. Currently, there are many automatic search approaches to find impossible differentials. However, these methods have two underlying assumptions: Markov cipher assumption and key independence assumption. Actually, these two assumptions are not true in ARX ciphers, especially lightweight ones. In this paper, we study the impossible differentials in ARX cipher under weak keys for the first time. Firstly, we propose several accurate difference propagation properties on consecutive two and three modular additions. Then, these properties are applied to four typical local constructions composed of two consecutive modular additions, two modular additions with a rotation operation, xoring secret key or constant in the middle, to find impossible differentials under weak keys or special constants. What’s more, we propose a more accurate difference propagation property on three consecutive modular additions. It can be used to find impossible differentials on more complex local constructions under weak keys or special constants. In practical ciphers, these impossible differentials on local constructions can be used to find contradictions. Lastly, combining our new findings with traditional automatic search methods for impossible differentials, we propose a framework to find impossible differentials in ARX ciphers under weak keys. As applications, we apply the framework to SPECK-32/64, LEA and CHAM-64/128. As a result, we find two 8-round impossible differentials for SPECK-32/64 under 260 weak keys, and one 11-round impossible differential for LEA under 2k−1 weak keys, where k is the key size. These impossible differentials can start from any round. Furthermore, we find two 22-round impossible differentials for CHAM-64/128 under 2127 weak keys starting from certain rounds. As far as we know, all these impossible differentials are longer than previous ones.

show abstract

Differential Cryptanalysis in the Fixed-Key Model

Cited by 8 publications

References 29 publications

Propagation of Subspaces in Primitives with Monomial Sboxes: Applications to Rescue and Variants of the AES

Propagation of Subspaces in Primitives with Monomial Sboxes: Applications to Rescue and Variants of the AES

Integral Cryptanalysis Using Algebraic Transition Matrices

Finding Impossible Differentials in ARX Ciphers under Weak Keys

Contact Info

Product

Resources

About