Abstract
Linear cryptanalysis is an important evaluation method for cryptographic primitives against key recovery attack. In this paper, we revisit the Walsh transformation for linear correlation calculation of modular addition, and an efficient algorithm is proposed to construct the input-output mask space of specified correlation weight. By filtering out the impossible large correlation weights in the first round, the search space of the first round can be substantially reduced. We introduce a concept of combinational linear approximation table (cLAT) for modular addition with two inputs. When one input mask is fixed, another input mask and the output mask can be obtained by the Splitting-Lookup-Recombination approach. We first split the n-bit fixed input mask into several subvectors and then find the corresponding bits of other masks, and in the recombination phase, pruning conditions can be used. By this approach, a large number of search branches in the middle rounds can be pruned. With the combination of the optimization strategies and the branch-and-bound search algorithm, we can improve the search efficiency for linear characteristics on ARX ciphers. The linear hulls for SPECK32/48/64 with a higher average linear potential (ALP) than existing results have been obtained. For SPARX variants, an 11-round linear trail and a 10-round linear hull have been found for SPARX-64 and a 10-round linear trail and a 9-round linear hull are obtained for SPARX-128. For Chaskey, a 5-round linear trail with a correlation of 2−61 has been obtained. For CHAM-64, 34/35-round optimal linear characteristics with a correlation of 2−31/2−33 are found.
Highlights
For modular addition x ⊞ y z, let (v, w) be the input masks, u be the output mask, and · be the standard inner product
Let μ(t) (− 1)t, the linear correlation of modular addition can be denoted by Walsh transformation, and Table 1: Summary of the linear characteristics on SPECK, SPARX, Chaskey, and CHAM-64, where “s,” “m,” “h,” and “d” represent seconds, minutes, hours, and days, respectively
Assuming that there are NA additions modulo 2n with two inputs in ith round, Γin and Γout are the input and output masks of the r-round linear trail, and the correlation of it can be denoted by r NA
Summary
9 2− 14 N/A 2− 29.1 N/A 9 2− 14 N/A 2− 28 N/A 9 2− 14 9 s 2− 27.78 25 s [18] [16] is paper. In [13], Wallen introduced the theorem to calculate the linear correlation by analyzing the carry high-order approximation function recursively. Assuming that there are NA additions modulo 2n with two inputs in ith round, Γin and Γout are the input and output masks of the r-round linear trail, and the correlation of it can be denoted by r NA. E corresponding correlation weight of the round function is Cw. CHAM is a family of lightweight block ciphers that was proposed by Koo et al at ICISC′17, which blends the good designs of SIMON and SPECK [7].
Sign-in/Register to view highlights & summary Sign-in/Register to access full text options 
Free) 
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a call
