MILP-aided bit-based division property for ARX ciphers

Sun, L.; Wang, Wei; Liu, Ru; Wang, Meiqin

doi:10.1007/s11432-017-9321-7

Cited by 21 publications

(21 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Definition 2 (the objective function [16]). Some notations for differential are used in the model; e.g., S j denotes the activity of an s-box and the objective function is as follows.…”

Section: Constraints For Nonlinear and Linearmentioning

confidence: 99%

Differential Cryptanalysis on Block Cipher Skinny with MILP Program

Zhang

2018

Security and Communication Networks

View full text Add to dashboard Cite

With the widespread use of RFID technology and the rapid development of Internet of Things, the research of lightweight block cipher has become one of the hot issues in cryptography research. In recent years, lightweight block ciphers have emerged and are widely used, and their security is also crucial. Skinny-64/192 can be used to protect data security such as the applications of wireless multimedia and wireless sensor networks. In this paper, we use the new method to verify the security of Skinny-64/192. The method is called mixed-integer linear programming (MILP) which can characterize precisely the linear operation and nonlinear operation in a round function. By applying MILP program, we can automatically find a 11-round differential characteristic for Skinny-64/192 with the minimum number of active s-boxes. The probability of differential trail is 2 -147 , that is, far greater than 2 -192 which is the probability of success for an exhaustive search. In addition, comparing this method with the one proposed by Sun et al., we also have a great improvement; that is, no new variables will be added in ShiftRows operation. It can reduce greatly the number of variables and improve the running speed of the computer. Besides, the experimental result proves that Skinny-64/192 is safe on 11-round differential analysis and validates the effectiveness of the MILP method.

show abstract

“…Definition 2 (the objective function [16]). Some notations for differential are used in the model; e.g., S j denotes the activity of an s-box and the objective function is as follows.…”

Section: Constraints For Nonlinear and Linearmentioning

confidence: 99%

Differential Cryptanalysis on Block Cipher Skinny with MILP Program

Zhang

2018

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…Xiang et al [XZBL16] have proposed an MILP-based method to find integral distinguishers based on the division property [Tod15] and applied it to 6 lightweight block ciphers. Soon after, their approach was extended to primitives with non-bit permutation linear layers and ARX based primitives [SWW16,SWLW16]. However, their solutions were found to encompass some infeasible division trails which could affect the search results and yield shorter integral distinguishers as shown in [ZR17].…”

Section: Related Workmentioning

confidence: 99%

MILP Modeling for (Large) S-boxes to Optimize Probability of Differential Characteristics

Abdelkhalek

Sasaki

Todo

et al. 2017

ToSC

View full text Add to dashboard Cite

Current Mixed Integer Linear Programming (MILP)-based search against symmetric-key primitives with 8-bit S-boxes can only build word-wise model to search for truncated differential characteristics. In such a model, the properties of the Differential Distribution Table (DDT) are not considered. To take these properties into account, a bit-wise model is necessary, which can be generated by the H-representation of the convex hull or the logical condition modeling. However, the complexity of both approaches becomes impractical when the size of the S-box exceeds 5 bits. In this paper, we propose a new modeling for large (8-bit or more) S-boxes. In particular, we first propose an algorithm to generate a bit-wise model of the DDT for large S-boxes. We observe that the problem of generating constraints in logical condition modeling can be converted into the problem of minimizing the product-of-sum of Boolean functions, which is a well-studied problem. Hence, classical off-the-shelf solutions such as the Quine-McCluskey algorithm or the Espresso algorithm can be utilized, which makes building a bit-wise model, for 8-bit or larger S-boxes, practical. Then this model is further extended to search for the best differential characteristic by considering the probabilities of each propagation in the DDT, which is a much harder problem than searching for the lower bound on the number of active S-boxes. Our idea is to separate the DDT into multiple tables for each probability and add conditional constraints to control the behavior of these multiple tables. The proposed modeling is first applied to SKINNY-128 to find that there is no differential characteristic having probability higher than 2−128 for 14 rounds, while the designers originally expected that 15 rounds were required. We also applied the proposed modeling to two, arbitrarily selected, constructions of the seven AES round function based constructions proposed in FSE 2016 and managed to improve the lower bound on the number of the active S-boxes in one construction and the upper bound on the differential characteristic for the other.

show abstract

“…In order to overcome this bottleneck, Xiang et al transformed the searching for the BDP to Mixed Integral Linear Programming (MILP) problems at Asiacrypt 2016 [XZBL16], which had been commonly applied to search for differential and linear characteristics [MWGP11, SHW + 14, FWG + 16, CLCW19]. As a result, the BDP of ciphers with the block sizes much larger than 32 bits can be obtained efficiently, based on which improved integral attacks for many ciphers can be achieved [SWW20,FTIM17,WGR18,SWLW18]. Since then, MILP-aided automatic search techniques have become the dominant tools for finding the BDP.…”

Section: Introductionmentioning

confidence: 99%

Finding Bit-Based Division Property for Ciphers with Complex Linear Layers

Wang

2020

ToSC

Self Cite

View full text Add to dashboard Cite

The bit-based division property (BDP) is the most effective technique for finding integral characteristics of symmetric ciphers. Recently, automatic search tools have become one of the most popular approaches to evaluating the security of designs against many attacks. Constraint-aided automatic tools for the BDP have been applied to many ciphers with simple linear layers like bit-permutation. Constructing models of complex linear layers accurately and efficiently remains hard. A straightforward method proposed by Sun et al. (called the S method), decomposes a complex linear layer into basic operations like COPY and XOR, then models them one by one. However, this method can easily insert invalid division trails into the solution pool, which results in a quicker loss of the balanced property than the cipher itself would. In order to solve this problem, Zhang and Rijmen propose the ZR method to link every valid trail with an invertible sub-matrix of the matrix corresponding to the linear layer, and then generate linear inequalities to represent all the invertible sub-matrices. Unfortunately, the ZR method is only applicable to invertible binary matrices (defined in Definition 3).To avoid generating a huge number of inequalities for all the sub-matrices, we build a new model that only includes that the sub-matrix corresponding to a valid trail should be invertible. The computing scale of our model can be tackled by most of SMT/SAT solvers, which makes our method practical. For applications, we improve the previous BDP for LED and MISTY1. We also give the 7-round BDP results for Camellia with FL/FL−1, which is the longest to date.Furthermore, we remove the restriction of the ZR method that the matrix has to be invertible, which provides more choices for future designs. Thanks to this, we also reproduce 5-round key-dependent integral distinguishers proposed at Crypto 2016 which cannot be obtained by either the S or ZR methods.

show abstract

MILP-aided bit-based division property for ARX ciphers

Cited by 21 publications

References 2 publications

Differential Cryptanalysis on Block Cipher Skinny with MILP Program

Differential Cryptanalysis on Block Cipher Skinny with MILP Program

MILP Modeling for (Large) S-boxes to Optimize Probability of Differential Characteristics

Finding Bit-Based Division Property for Ciphers with Complex Linear Layers

Contact Info

Product

Resources

About