Multidimensional Linear Cryptanalysis

Abstract

Linear cryptanalysis introduced by Matsui is a statistical attack which exploits a binary linear relation between plaintext, ciphertext and key, either in Algorithm 1 for recovering one bit of information of the secret key of a block cipher, or in Algorithm 2 for ranking candidate values for a part of the key. The statistical model is based on the expected and observed bias of a single binary value. Multiple linear approximations have been used with the goal to make the linear attack more efficient. More bits of information of the key can potentially be recovered possibly using less data. But then also more elaborated statistical models are needed to capture the joint behaviour of several not necessarily independent binary variables. Also more options are available for generalising the statistics of a single variable to several variables. The multidimensional extension of linear cryptanalysis to be introduced in this paper considers using multiple linear approximations that form a linear subspace. Different extensions of Algorithm 1 and Algorithm 2 will be presented and studied. The methods will be based on known statistical tools such as goodness-of-fit test and log-likelihood ratio. The efficiency of the different methods will be measured and compared in theory and experiments using the concept of advantage introduced by Selçuk. The block cipher Serpent with a reduced number of rounds will be used as test bed. The multidimensional linear cryptanalysis will also be compared with previous methods that use biasedness of multiple linear approximations. It will be shown in the simulations that the multidimensional method is potentially more powerful. Its main theoretical advantage is that the statistical model can be given without the assumption about statistical independence of the linear approximations.

Linear Cryptanalysis of Reduced-Round Simon Using Super Rounds

“…It might be worth investigating how to combine our model with more general multidimensional cryptanalysis, where approximation independency is not assumed [8]. Table 2.…”

“…In this section, we describe how to recover the entire master key in a 20-round attack. First, we extend the seven-linear approximations (Equations (8) and (9)) into 12-round linear trails, with bias 2 −19 for the left-half and the right-half (see Figure 10):…”

“…• 19 bits of k 20 i for i = 2, 9, 16, 10, 17, 0, 18,1,8,6,13,20,7,14,22,5,12,23, counted as a half bit • 10 bits of the sum k 20 i+2 ⊕ k 19 i for i = 1,8,9,16,17,5,0,12,21,4 The time complexity of the attack is 2 4.58 × 2 45.42 × 2 16.5 × 2 19.5 = 2 86 . The success probability with an 8-bit advantage is 8%.…”

“…2,9,16,10,17,24,14,21,28,18,25,31,3,11,18,19,26, these bits are counted as a half bit. Additionally, there are 8 bits of the sum k 22 i+2 ⊕ k 21 i for i = 1,8,9,16,13,20,17,24. Thus, the time complexity of 23-round linear attacks is 2 5 × 2 51 × 2 21.5 × 2 16.5 = 2 94 .…”

“…Moreover, appending the extra rounds costs guessing 56 key bits, which consists of 31 for the four-rounds encryption and 24 bits for the decryption. There are 18 bits of k 23 i for i = 4,11,18,12,19,26,20,27,2,1,8,5,9,16,17,24,21,28. Also, there are 6 bits of the sum k 23 i+2 ⊕ k 22 i for i = 11, 18, 3, 10, 17, 24.…”