Structural Evaluation by Generalized Integral Property

Todo, Yosuke

doi:10.1007/978-3-662-46800-5_12

Cited by 243 publications

(242 citation statements)

References 24 publications

Supporting

Mentioning

240

Contrasting

Unclassified

Order By: Relevance

“…When the round functions are bijective, such patterns always exist in Feistel Networks with up to at least 5 round. We also show that these distinguishers can be interpreted as particular integral distinguishers and describe some relations between our results and Todo's division property [9]. Due to their integral nature, our distinguishers are extremely memory efficient: we only need to store a block containing the sum studied.…”

Section: Introductionmentioning

confidence: 67%

“…This tool for finding integral attacks was introduced by Todo in [9] and later used by the same author to attack the full MISTY1 [21]. In his seminal paper, Todo gives some integral distinguishers against Feistel Network for various block sizes, number of rounds, degree of the Feistel functions for both bijective and non-bijective Feistel functions.…”

Section: Integral Attacksmentioning

confidence: 99%

See 1 more Smart Citation

Algebraic Insights into the Secret Feistel Network

Perrin

Udovenko

2016

Fast Software Encryption

View full text Add to dashboard Cite

Abstract. We introduce the high-degree indicator matrix (HDIM), an object closely related with both the linear approximation table and the algebraic normal form (ANF) of a permutation. We show that the HDIM of a Feistel Network contains very specific patterns depending on the degree of the Feistel functions, the number of rounds and whether the Feistel functions are 1-to-1 or not. We exploit these patterns to distinguish Feistel Networks, even if the Feistel Network is whitened using unknown affine layers. We also present a new type of structural attack exploiting monomials that cannot be present at round − 1 to recover the ANF of the last Feistel function of a -round Feistel Network. Finally, we discuss the relations between our findings, integral attacks, cube attacks, Todo's division property and the congruence modulo 4 of the Linear Approximation Table.

show abstract

Section: Introductionmentioning

confidence: 67%

Section: Integral Attacksmentioning

confidence: 99%

Algebraic Insights into the Secret Feistel Network

Perrin

Udovenko

2016

Fast Software Encryption

View full text Add to dashboard Cite

show abstract

“…As the linear layers we consider may be weaker than usual designing spn, it is also crucial that we ensure that ciphers built using such a linear layer are not vulnerable to integral attacks [18], in particular those based on the division property [19]. Incidentally, this gives us a criteria quantifying the diffusion provided by several steps of the cipher.…”

Section: Choosing the Linear Layer: Bounding The Medcp And Melcc Whilmentioning

confidence: 99%

“…This attack strategy has been further improved by Todo [19] who proposed the so-called division property as a means to track which bit should be fixed in the input to have a balanced output. He also described an algorithm allowing an attacker to easily find such distinguishers.…”

Section: Ensuring Resilience Against Integral Attacksmentioning

confidence: 99%

Design Strategies for ARX with Provable Bounds: Sparx and LAX

Dinu

Perrin

Udovenko

et al. 2016

Lecture Notes in Computer Science

100

View full text Add to dashboard Cite

Abstract. We present, for the first time, a general strategy for designing ARX symmetric-key primitives with provable resistance against singletrail differential and linear cryptanalysis. The latter has been a long standing open problem in the area of ARX design. The wide trail design strategy (WTS), that is at the basis of many S-box based ciphers, including the AES, is not suitable for ARX designs due to the lack of S-boxes in the latter. In this paper we address the mentioned limitation by proposing the long trail design strategy (LTS) -a dual of the WTS that is applicable (but not limited) to ARX constructions. In contrast to the WTS, that prescribes the use of small and efficient S-boxes at the expense of heavy linear layers with strong mixing properties, the LTS advocates the use of large (ARX-based) S-Boxes together with sparse linear layers. With the help of the so-called Long Trail argument, a designer can bound the maximum differential and linear probabilities for any number of rounds of a cipher built according to the LTS. To illustrate the effectiveness of the new strategy, we propose Sparx -a family of ARX-based block ciphers designed according to the LTS. Sparx has 32-bit ARX-based S-boxes and has provable bounds against differential and linear cryptanalysis. In addition, Sparx is very efficient on a number of embedded platforms. Its optimized software implementation ranks in the top 6 of the most software-efficient ciphers along with Simon, Speck, Chaskey, LEA and RECTANGLE. As a second contribution we propose another strategy for designing ARX ciphers with provable properties, that is completely independent of the LTS. It is motivated by a challenge proposed earlier by Wallén and uses the differential properties of modular addition to minimize the maximum differential probability across multiple rounds of a cipher. A new primitive, called LAX, is designed following those principles. LAX partly solves the Wallén challenge.

show abstract

“…In [39], by using the division property, the author proposed a 6-round integral distinguisher of Camellia without F L/F L −1 layers as the best known integral distinguisher which could be built without knowing the details of the S-box. Based on the 8-round zero correlation linear hull presented in Example 1, the integral distinguisher which is independent with the choices of S-box could be improved from 6-round to 8-round:…”

Section: -Round Integral Distinguisher Of Camellia Without F L/f L −mentioning

confidence: 99%

Links Among Impossible Differential, Integral and Zero Correlation Linear Cryptanalysis

Sun

Liu

Rijmen

et al. 2015

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. As two important cryptanalytic methods, impossible differential cryptanalysis and integral cryptanalysis have attracted much attention in recent years. Although relations among other important cryptanalytic approaches have been investigated, the link between these two methods has been missing. The motivation in this paper is to fix this gap and establish links between impossible differential cryptanalysis and integral cryptanalysis.Firstly, by introducing the concept of structure and dual structure, we prove that a → b is an impossible differential of a structure E if and only if it is a zero correlation linear hull of the dual structure E ⊥ . More specifically, constructing a zero correlation linear hull of a Feistel structure with SP -type round function where P is invertible, is equivalent to constructing an impossible differential of the same structure with P T instead of P . Constructing a zero correlation linear hull of an SPN structure is equivalent to constructing an impossible differential of the same structure with (P −1 ) T instead of P . Meanwhile, our proof shows that the automatic search tool presented by Wu and Wang could find all impossible differentials of both Feistel structures with SP -type round functions and SPN structures, which is useful in provable security of block ciphers against impossible differential cryptanalysis.Secondly, by establishing some boolean equations, we show that a zero correlation linear hull always indicates the existence of an integral distinguisher while a special integral implies the existence of a zero correlation linear hull. With this observation we improve the integral distinguishers of Feistel structures by 1 round, build a 24-round integral distinguisher of CAST-256 based on which we propose the best known key recovery attack on reduced round CAST-256 in the non-weak key model, present a 12-round integral distinguisher of SMS4 and an 8-round integral distinguisher of Camellia without F L/F L −1 . Moreover, this result provides a novel way for establishing integral distinguishers and converting known plaintext attacks to chosen plaintext attacks.Finally, we conclude that an r-round impossible differential of E always leads to an r-round integral distinguisher of the dual structure E ⊥ . In the case that E and E ⊥ are linearly equivalent, we derive a direct link between impossible differentials and integral distinguishers of E . Specifically, we obtain that an r-round impossible differential of an SPN structure, which adopts a bit permutation as its linear layer, always indicates the existence of an r-round integral distinguisher. Based on this newly established link, we deduce that impossible differentials of SNAKE(2), PRESENT, PRINCE and ARIA, which are independent of the choices of the S-boxes, always imply the existence of integral distinguishers.Our results could help to classify different cryptanalytic tools. Furthermore, when designing a block cipher, the designers need to demonstrate that the cipher has sufficient security margins against impo...

show abstract

Structural Evaluation by Generalized Integral Property

Cited by 243 publications

References 24 publications

Algebraic Insights into the Secret Feistel Network

Algebraic Insights into the Secret Feistel Network

Design Strategies for ARX with Provable Bounds: Sparx and LAX

Links Among Impossible Differential, Integral and Zero Correlation Linear Cryptanalysis

Contact Info

Product

Resources

About