The phantom of differential characteristics

Abstract

For differential cryptanalysis under the single-key model, the key schedules hardly need to be exploited in constructing the characteristics, which is based on the hypothesis of stochastic equivalence. In this paper, we study a profound effect of the key schedules on the validity of the differential characteristics. Noticing the sensitivity in the probability of the characteristics to specific keys, we label the keys where a characteristic has nonzero probability by effective keys. We propose the concept of singular characteristics which are characteristics with no effective keys, and exploit an algorithm to sieve them out by studying the key schedule. We show by a differential characteristic of PRINCE whose expected differential probability is much larger than that of a random permutation, i.e., 2 −35 vs. 2 −64 . Yet, it is indeed singular which could be mis-used to mount a differential attack. Singular characteristics are found for 3-round AES and 3-round Midori-128 as well. Furthermore, taking the possible mismatches of the effective keys in a number of differential characteristics into consideration, we present singular clusters which indicates an empty intersection of the corresponding effective keys, and this is evidenced by showing two differential characteristics of the 2-round AES. We also show that characteristics are tightly linked to the key schedule, as shown in the paper, a valid characteristic in the AES-128 can be singular for the AES-192. Our results indicate a gap over the perspectives of the designers and the attackers, which warns the latter to validate the theoretically-built distinguishers. Therefore, a closer look into the characteristics is inevitable before any attack is claimed.

On the Effect of the Key-Expansion Algorithm in Simon-like Ciphers

“…This approach appears intuitive in our case since RX-cryptanalysis is a related-key attack. However, following the work of Sadeghi et al in [27] and the additional constraints we add in Section 3 it is important to reconsider if conclusions of previous work were not based on incompatible or phantom (see [17,19]) characteristics.…”

Differential Cryptanalysis in the Fixed-Key Model

“…Daemen and Rijmen [11] showed that the fixed-key probability of two-round characteristics of AES is either zero or 2 h , with h an integer independent of the key. Such characteristics are called plateau characteristics, and have been used in several other contexts [9,20,22,27]. Although plateau characteristics are the only systematic method to analyze fixed-key probabilities for S-box-based ciphers, their scope remains limited.…”