Statistical Integral Distinguisher with Multi-structure and Its Application on AES

Cui, Tingting; Sun, L.; Chen, Huaifeng; Wang, Meiqin

doi:10.1007/978-3-319-60055-0_21

Cited by 7 publications

(15 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…2nd Conjecture "The reader might wonder whether the technique we used to derive a known-key distinguisher for the 10 Our results are summarized in Table 2. Referring to the 1st and the 2nd conjectures given in the main text, in this table we emphasize which ones of our results disprove them.…”

Section: Analysis Of Gilbert's Known-key Distinguisher: Refuting Bothmentioning

confidence: 99%

“…Under Gilbert's assumption-no key-schedule holds, the verifier can work independently on k 0 and k 10 . Instead of checking all the 2 • 2 128 = 2 129 possible values of k 0 and k 10 , the idea proposed in [16] is to check uniform distribution working on single columns of S R(c i ) and of S R −1 ( p i ) (the strategy proposed by Gilbert 10 is similar to the one proposed in Algorithm 1). In this way, the verifier must guess only 32 bits instead of 128, and she has to repeat this operation 4 times (one for each anti-diagonal/diagonal) for each key.…”

Section: Extension To 10 Rounds Of Aesmentioning

confidence: 99%

“…Finally, we mention for completeness that at ACISP 2017 the distinguishers proposed by Gilbert in [16] has been improved by T. Cui, L. Sun, H. Chen and M. Wang [10]. In this paper, authors turn both the 8-and 10-round Gilbert's distinguishers into "statistical integral ones" [32] with the goal to reduce the data/time complexity.…”

Section: Statistical Integral Distinguisher With Multiple Structuresmentioning

confidence: 99%

“…Then, the player asks the oracle for the corresponding ciphertexts. The idea is to check if there exists a subkey k 10 and n tuples such that the two ciphertexts of each of these n tuples belong to the same coset of M l one round before. We remember that it is not necessary that the subkey for which this condition is satisfied is the real one (similar for the plaintext).…”

Section: The Generic Playermentioning

confidence: 99%

“…A that makes ≤ N = 2 • 2 64 = 2 65 oracle queries to a perfect random permutation Π or Π −1 of {0, 1} 128 , the probability that A outputs n ≥ 2 sets of 2 64 -tuple (X i , Y i ) for i = 0, ..., 2 64 − 1 that satisfy Y i = Π(X i ) and also satisfy R defined previously is upper bounded by 10 5 × 2 512 × Proof If at least one of the N pairs (X i , Y i ) output by A does not result from a query X i to Π or a query Y i to Π −1 , then the probability that for this pair Y i = Π(X i ) and consequently the success probability of A is upper bounded by 1 2 128 −(N −1) . So from now on we only consider the opposite case, i.e.…”

Section: Proposition 1 For Any Oracle Algorithmmentioning

confidence: 99%

See 4 more Smart Citations

Revisiting Gilbert’s known-key distinguisher

Grassi

Rechberger

2020

Des. Codes Cryptogr.

View full text Add to dashboard Cite

Known-key distinguishers have been introduced by Knudsen and Rijmen in 2007 to better understand the security of block ciphers in situations where the key can not be considered to be secret, i.e. the "thing between secret-key model and hash function use-cases". Trying to find a rigorous model to fit this intuition is still ongoing. The most recent advance by Gilbert (Asiacrypt 2014) describes a new model that-even if it is well justified-seemingly does not match this intuition. AES is often considered as a target of such analyses, simply because AES or its building blocks are used in many settings that go beyond classical encryption. Consider AES-128. Results in the secret-key model cover up to 6 rounds, while results in the chosen-key model reach up to 9 rounds. Gilbert however showed a result in the knownkey model that goes even further, covering 10 rounds. Does it mean that the use cases corresponding to the cryptanalysis of hash-function use-cases are inherently less efficient, or is it rather an artifact of the new model? In this paper we give strong evidence for the latter. In Gilbert's work, two types of arguments or rather conjectures are put forward suggesting that the new model is meaningful. Firstly that the number of "extension rounds" due to the new model is limited to two. And secondly that only a distinguisher that exploits the uniform distribution property can be extended in such way. We disprove both conjectures and arrive at the following results: First, we are also able to show that more than two extension rounds are possible. As a result of this, we describe the first known-key distinguishers on 12 rounds of AES that fit into Gilbert's model. The second conjecture is disproven by showing that the technique proposed by Gilbert can also be used to extend a known-key distinguisher based on another property: truncated differentials. A potential conclusion of this work would be that the counter-intuitive gap between Gilbert's known-key model and the chosen-key model is wider than initially thought. We however conclude that results in Gilbert's model are due to an artifact in the model. To remedy this situation, we propose a refinement of the known-key model which restores its original intent to fit the original intuition. Communicated by T. Iwata.

show abstract

Section: Analysis Of Gilbert's Known-key Distinguisher: Refuting Bothmentioning

confidence: 99%

Section: Extension To 10 Rounds Of Aesmentioning

confidence: 99%