On hidden sums compatible with a given block cipher diffusion layer

Abstract

Sometimes it is possible to embed an algebraic trapdoor into a block cipher. Building on previous research, in this paper we investigate an especially dangerous algebraic structure, which is called a hidden sum and which is related to some regular subgroups of the affine group. Mixing group theory arguments and cryptographic tools, we pass from characterizing our hidden sums to designing an efficient algorithm to perform the necessary preprocessing for the exploitation of the trapdoor.

Differential biases, $c$-differential uniformity, and their relation to differential attacks

“…The c-differential uniformity thus seems to be just a tool to measure the resistance of a cipher against a specific differential attack based on this operation. We want to note that the general form of differential as described in Definition III.1 was analysed in a series of papers [37], [38] with the idea to find specific binary operations that can lead to efficient differential attacks (or, possibly, for a malicious designer, to a "hidden", non-public binary operation that serves as a trapdoor to a cipher resistant against the usual attacks). However, the authors in those papers only analyse a subclass of binary operations that excludes the specific binary operation • that we identified as being related to the c-differential uniformity here.…”

Regular subgroups with large intersection

“…This is also the case for T g . In [CS17,BCS19] the authors designed a toy cipher whose set of encryption functions is contained in a conjugate AGL(V ) g for some g ∈ Sym(V ). In other words, the encryption functions are affine with respect to the new operation, different from the classical bitwise XOR, defined as above from T g .…”

Differential attacks: using alternative operations

“…As we will discuss later, the mentioned problem is of general interest in cryptography, and results in this direction will produce examples of XOR-based trapdoor ciphers for which a non-XOR distinguisher may exist. Unfortunately, only partial solutions to this problem are known [14,17,18]. Keeping our focus in this direction, after performing some computational experiments, we are able to design a toy cipher similar to the one in Civino et al [14], with 4 parallel s-boxes of 4 bits each 4 together with an alternative parallel operation • that can be used to attack it.…”