Generalization of Matsui’s Algorithm 1 to linear hull for key-alternating block ciphers

Röck, Andrea; Nyberg, Kaisa

doi:10.1007/s10623-012-9679-1

Cited by 9 publications

(17 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…From (13) we see that the correlation is determined by the values of Z, Z + z 0 , Z + z 1 + 1, and Z + z 0 + z 1 . Table 1 considers the 8 possible assignments for these variables and their correlations.…”

Section: Correlation Contributions Of the Trailsmentioning

confidence: 87%

“…In this section, we investigate how the success rate of Matsui's Algorithm 1 is influenced by all the trails in the same linear hull. As described already in [13], this phenomenon can be used to extend Matsui's Algorithm 1 and to extract multiple key-bits. We illustrate this for reduced Simon in Section 6.5.…”

Section: On Matsui's Algorithmmentioning

confidence: 87%

“…When all trails are taken into account, Matsui's Algorithm 1 can be extended and recover more than a single bit, cf. also [13]. The approach can be summarized as follows.…”

Section: Knowing All Trailsmentioning

confidence: 99%

“…When several trails with correlation contributions of comparable magnitude and different signs exist, the performance of Matsui's Algorithm 1 strongly depends on the values of some roundkey bits. When this dependency is taken into account, the algorithm can be extended to recover multiple roundkey bits [13]. When this fact is neglected, the average success rate of Algorithm 1 drops, sometimes dramatically.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

On Linear Hulls and Trails

Ashur

Rijmen

2016

Progress in Cryptology – INDOCRYPT 2016

View full text Add to dashboard Cite

This paper improves the understanding of linear cryptanalysis by highlighting some previously overlooked aspects. It shows that linear hulls are sometimes formed already in a single round, and that overlooking such hulls may lead to a wrong estimation of the linear correlation, and thus of the data complexity. It shows how correlation matrices can be used to avoid this, and provides a tutorial on how to use them properly. By separating the input and output masks from the key mask it refines the formulas for computing the expected correlation and the expected linear potential. Finally, it shows that when the correlation of a hull is not properly estimated (e.g., by using the correlation of a single trail as the correlation of the hull), the success probability of Matsui's Algorithm 1 drops, sometimes drastically. It also shows that when the trails composing the hull are properly accounted for, more than a single key bit can be recovered using Algorithm 1. All the ideas presented in this paper are followed by examples comparing previous methods to the corrected ones, and verified experimentally with reduced-round versions of Simon32/64.

show abstract

Section: Correlation Contributions Of the Trailsmentioning

confidence: 87%

Section: On Matsui's Algorithmmentioning

confidence: 87%

“…When all trails are taken into account, Matsui's Algorithm 1 can be extended and recover more than a single bit, cf. also [13]. The approach can be summarized as follows.…”

Section: Knowing All Trailsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

On Linear Hulls and Trails

Ashur

Rijmen

2016

Progress in Cryptology – INDOCRYPT 2016

View full text Add to dashboard Cite

show abstract

“…Kim [19] studies the combined related-key linear-differential attacks on block ciphers. Interestingly, a linear-hull version of Matsui's Algorithm 1 by Röck and Nyberg [32] uses the fact that, in some ciphers, the linear characteristic biases ε θ are the same for different keys.…”

Section: Linear Cryptanalysis Linear Approximations and Biasmentioning

confidence: 99%

Key Difference Invariant Bias in Block Ciphers

Bogdanov

Boura

Rijmen

et al. 2013

Advances in Cryptology - ASIACRYPT 2013

View full text Add to dashboard Cite

Abstract. In this paper, we reveal a fundamental property of block ciphers: There can exist linear approximations such that their biases ε are deterministically invariant under key difference. This behaviour is highly unlikely to occur in idealized ciphers but persists, for instance, in 5-round AES. Interestingly, the property of key difference invariant bias is independent of the bias value ε itself and only depends on the form of linear characteristics comprising the linear approximation in question as well as on the key schedule of the cipher.We propose a statistical distinguisher for this property and turn it into an key recovery. As an illustration, we apply our novel cryptanalytic technique to mount related-key attacks on two recent block ciphersLBlock and TWINE. In these cases, we break 2 and 3 more rounds, respectively, than the best previous attacks.

show abstract

Linear Cryptanalysis

NYBERG,

FLÓREZ‐GUTIÉRREZ

2023

Symmetric Cryptography 2

View full text Add to dashboard Cite

Generalization of Matsui’s Algorithm 1 to linear hull for key-alternating block ciphers

Cited by 9 publications

References 6 publications

On Linear Hulls and Trails

On Linear Hulls and Trails

Key Difference Invariant Bias in Block Ciphers

Linear Cryptanalysis

Contact Info

Product

Resources

About