On the Wrong Key Randomisation and Key Equivalence Hypotheses in Matsui’s Algorithm 2

Bogdanov, Andrey; Tischhauser, Elmar

doi:10.1007/978-3-662-43933-3_2

Cited by 28 publications

(94 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…p of the key we observed in this paper has been considered, and more advanced statistical models have been developed. The variance due to random key was first integrated in the wrong key model of one-dimensional linear cryptanalysis [8], then to the model of the cipher [21] and finally for both [6] considering also explicitly the case of sampling without replacement. Since 2012, the hypothesis testing model has been adopted in many works on statistical cryptanalysis to determine distinguishing complexity [7] and data complexity for key recovery.…”

Section: Later Developmentsmentioning

confidence: 99%

Multidimensional Linear Cryptanalysis

2018

View full text Add to dashboard Cite

Linear cryptanalysis introduced by Matsui is a statistical attack which exploits a binary linear relation between plaintext, ciphertext and key, either in Algorithm 1 for recovering one bit of information of the secret key of a block cipher, or in Algorithm 2 for ranking candidate values for a part of the key. The statistical model is based on the expected and observed bias of a single binary value. Multiple linear approximations have been used with the goal to make the linear attack more efficient. More bits of information of the key can potentially be recovered possibly using less data. But then also more elaborated statistical models are needed to capture the joint behaviour of several not necessarily independent binary variables. Also more options are available for generalising the statistics of a single variable to several variables. The multidimensional extension of linear cryptanalysis to be introduced in this paper considers using multiple linear approximations that form a linear subspace. Different extensions of Algorithm 1 and Algorithm 2 will be presented and studied. The methods will be based on known statistical tools such as goodness-of-fit test and log-likelihood ratio. The efficiency of the different methods will be measured and compared in theory and experiments using the concept of advantage introduced by Selçuk. The block cipher Serpent with a reduced number of rounds will be used as test bed. The multidimensional linear cryptanalysis will also be compared with previous methods that use biasedness of multiple linear approximations. It will be shown in the simulations that the multidimensional method is potentially more powerful. Its main theoretical advantage is that the statistical model can be given without the assumption about statistical independence of the linear approximations.

show abstract

Section: Later Developmentsmentioning

confidence: 99%

Multidimensional Linear Cryptanalysis

2018

View full text Add to dashboard Cite

show abstract

“…Then, by considering many trails in one approximation [24,25], the linear hull effect raises interesting discussions about fixed-key behaviors in single linear approximations [22,21]. Daemen et al gave a fixed-key probability distribution for single linear correlations [13], leading to subsequent works on e.g., fundamental assumptions [9], the effect of key schedules [1] and measures for data complexity [19], all for single linear attacks. However, we still do not understand the situation in multidimensional linear cryptanalysis.…”

Section: Introductionmentioning

confidence: 99%

“…However, neither is correct. As we know, the key equivalent hypothesis has been questioned for single linear approximations and differential trails [9,5,12]. Now this hypothesis also requires adjustment in multidimensional linear setting.…”

Section: Introductionmentioning

confidence: 99%

Capacity and Data Complexity in Multidimensional Linear Attack

Huang

Vaudenay

Lai

et al. 2015

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Multidimensional linear attacks are one of the most powerful variants of linear cryptanalytic techniques now. However, there is no knowledge on the key-dependent capacity and data complexity so far. Their values were assumed to be close to the average value for a vast majority of keys. This assumption is not accurate. In this paper, under a reasonable condition, we explicitly formulate the capacity as a Gamma distribution and the data complexity as an Inverse Gamma distribution, in terms of the average linear probability and the dimension. The capacity distribution is experimentally verified on the 5-round PRESENT. Regarding to complexity, we solve the problem of estimating the average data complexity, which was difficult to estimate because of the existence of zero correlations. We solve the problem of using the median complexity in multidimensional linear attacks, which is an open problem since proposed in Eurocrypt 2011. We also evaluate the difference among the median complexity, the average complexity and a lower bound of the average complexity -the reciprocal of average capacity. In addition, we estimate more accurately the key equivalent hypothesis, and reveal the fact that the average complexity only provides an accurate estimate for less than half of the keys no matter how many linear approximations are involved. Finally, we revisit the so far best attack on PRESENT based on our theoretical result.

show abstract

“…As shown in [4], the most deviations between the two models occur when adversary seeks a particularly big advantage or the data complexity gets close to the whole codebook. The advantage a in our attack is only 8, thus we try to reduce the data complexity in the next subsection.…”

Section: -Round Linear Approximationmentioning

confidence: 99%

“…By studying the 25 linear approximations, we found that they could S-box1 S-box2 0x1f 0x33 0x23 0x4e 0x3c 0x8c 0x95 0xbf 0xa9 0xf1 [12], the success rate P S = Φ( √ N C p − Φ −1 (1 − 2 −m−a )) = 89.55%; if we evaluate the success rate by means of [4], it will be 88.71%.…”

Section: Reducing the Data Complexity Of The 23-round Attack By Multimentioning

confidence: 99%

Improved Linear Attacks on the Chinese Block Cipher Standard

Liu

Chen

2014

J. Comput. Sci. Technol.

View full text Add to dashboard Cite

Abstract. The block cipher used in the Chinese Wireless LAN Standard (WAPI), SMS4, was recently renamed as SM4, and became the block cipher standard issued by the Chinese government 3 . This paper improves the previous linear cryptanalysis of SMS4 by giving the first 19-round onedimensional approximations. The 19-round approximations hold with bias 2 −62.27 ; we use one of them to leverage a linear attack on 23-round SMS4. Our attack improves the previous 23-round attacks by reducing the time complexity. Furthermore, the data complexity of our attack is further improved by the multidimensional linear approach.

show abstract

On the Wrong Key Randomisation and Key Equivalence Hypotheses in Matsui’s Algorithm 2

Cited by 28 publications

References 25 publications

Multidimensional Linear Cryptanalysis

Multidimensional Linear Cryptanalysis

Capacity and Data Complexity in Multidimensional Linear Attack

Improved Linear Attacks on the Chinese Block Cipher Standard

Contact Info

Product

Resources

About