Divisible Properties for Asymptotically Tracially Approximation of C*-algebras

Division property is a generalized integral property proposed by Todo at Eurocrypt 2015. Previous tools for automatic searching are mainly based on the Mixed Integer Linear Programming (MILP) method and trace the division property propagation at the bit level. In this paper, we propose automatic tools to detect ARX ciphers’ division property at the bit level and some specific ciphers’ division property at the word level. For ARX ciphers, we construct the automatic searching tool relying on Boolean Satisfiability Problem (SAT) instead of MILP, since SAT method is more suitable in the search of ARX ciphers’ differential/linear characteristics. The propagation of division property is translated into a system of logical equations in Conjunctive Normal Form (CNF). Some logical equations can be dynamically adjusted according to different initial division properties and stopping rule, while the others corresponding to r-round propagations remain the same. Moreover, our approach can efficiently identify some optimized distinguishers with lower data complexity. As a result, we obtain a 17-round distinguisher for SHACAL-2, which gains four more rounds than previous work, and an 8-round distinguisher for LEA, which covers one more round than the former one. For word-based division property, we develop the automatic search based on Satisfiability Modulo Theories (SMT), which is a generalization of SAT. We model division property propagations of basic operations and S-boxes by logical formulas, and turn the searching problem into an SMT problem. With some available solvers, we achieve some new distinguishers. For CLEFIA, 10-round distinguishers are obtained, which cover one more round than the previous work. For the internal block cipher of Whirlpool, the data complexities of 4/5-round distinguishers are improved. For Rijndael-192 and Rijndael-256, 6-round distinguishers are presented, which attain two more rounds than the published ones. Besides, the integral attacks for CLEFIA are improved by one round with the newly obtained distinguishers.

The division property proposed at Eurocrypt’15 is a novel technique to find integral distinguishers, which has been applied to most kinds of symmetric ciphers such as block ciphers, stream ciphers, and authenticated encryption, etc. The original division property is word-oriented, and later the bit-based one was proposed at FSE’16 to get better integral property, which is composed of conventional bit-based division property (two-subset division property) and bit-based division property using three subsets (three-subset division property). Three-subset division property has more potential to achieve better integral distinguishers compared with the two-subset division property. The bit-based division property could not be to apply to ciphers with large block sizes due to its unpractical complexity. At Asiacrypt’16, the two-subset division property was modeled using Mixed Integral Linear Programming (MILP) technique, and the limits of block sizes were eliminated. However, there is still no efficient method searching for three-subset division property. The propagation rule of the XOR operation for $$\mathbb {L}$$ (The definition of $$\mathbb {L}$$ and $$\mathbb {K}$$ is introduced in Sect. 2.), which is a set used in the three-subset division property but not in two-subset one, requires to remove some specific vectors, and new vectors generated from $$\mathbb {L}$$ should be appended to $$\mathbb {K}$$ when Key-XOR operation is applied, both of which are difficult for common automatic tools such as MILP, SMT or CP. In this paper, we overcome one of the two challenges, concretely, we address the problem to add new vectors into $$\mathbb {K}$$ from $$\mathbb {L}$$ in an automatic search model. Moreover, we present a new model automatically searching for a variant three-subset division property (VTDP) with STP solver. The variant is weaker than the original three-subset division property (OTDP) but it is still powerful in some ciphers. Most importantly, this model has no constraints on the block size of target ciphers, which can also be applied to ARX and S-box based ciphers. As illustrations, some improved integral distinguishers have been achieved for SIMON32, SIMON32/48/64(102), SPECK32 and KATAN/KTANTAN32/48/64 according to the number of rounds or number of even/odd-parity bits.

In this paper, we compare several non-tight degree evaluation methods i.e., Boura and Canteaut’s formula, Carlet’s formula as well as Liu’s numeric mapping and division property proposed by Todo, and hope to find the best one from these methodsfor practical applications. Specifically, for the substitution-permutation-network (SPN) ciphers, we first deeply explore the relationships between division property of an Sbox and its algebraic properties (e.g., the algebraic degree of its inverse). Based on these findings, we can prove theoretically that division property is never worse than Boura and Canteaut’s and Carlet’s formulas, and we also experimentally verified that the division property can indeed give a better bound than the latter two methods. In addition, for the nonlinear feedback shift registers (NFSR) based ciphers, according to the propagation of division property and the core idea of numeric mapping, we give a strict proof that the estimated degree using division property is never greater than that of numeric mapping. Moreover, our experimental results on Trivium and Kreyvium indicate the division property actually derives a much better bound than the numeric mapping. To the best of our knowledge, this is the first time to give a formal discussion on the relationships between division property and other degree evaluation methods, and we present the first theoretical proof and give the experimental verification to illustrate that division property is the optimal one among these methods in terms of the accuracy of the upper bounds on algebraic degree.

Bit-based division property was first proposed to find integral for SIMON32 by Todo \(et al.\) at FSE 2016. Xiang \(et al.\) improved the work with aid of Mixed Integer Linear Programming(MILP) method and applied the method to block ciphers with wider block size. Later on, Sun \(et al.\) applied division property to ARX block ciphers. Todo \(et al.\) proposed a more precise division property using three subsets method to describe integral propagation at FSE 2016, which can not be applied to wide state ARX block ciphers. In this paper, we extend bit-based division property using three subsets and propose an automatic method for finding integral distinguishers for ARX block ciphers with SAT/SMT solvers. Firstly, we study bit-based division property using three subsets through three basic operations (Copy, AND, XOR). Then, we model division property using three subsets through Addition Modulo function. Finally, by constructing and solving division property using three subsets propagation system, we find integral distinguishers for round reduced ARX block cipher. As a result, we propose 15 round integral distinguishers for SIMON32 automatically and verify the secure margins Todo \(et al.\) proposed for \(\hbox {SIMON}48,64,96,128\). Also, we can find one more 6 round integral distinguishers for SPECK32, which can not be found with conventional division property without using three subsets. It is interesting that no more integral distinguishers are found for SPECK48,64,96,128. Moreover, we apply to SIMECK, HIGHT, LEA, TEA and XTEA \(et al.\) Unfortunately, we find no more new results than conventional division property can do.

Modular addition is often the most complex component of typical Addition- Rotation-XOR (ARX) ciphers, and the division property is the most effective tool for detecting integral distinguishers. Thus, having a precise division property model for modular addition is crucial in the search for integral distinguishers in ARX ciphers. Current division property models for modular addition either (a) express the operation as a Boolean circuit and apply standard propagation rules for basic operations (COPY, XOR, AND), or (b) treat it as a sequence of smaller functions with carry bits, modeling each function individually. Both approaches were originally proposed for the twosubset bit-based division property (2BDP), which is theoretically imprecise and may overlook some balanced bits.Recently, more precise versions of the division property, such as parity sets, threesubset bit-based division property without unknown subsets (3BDPwoU) or monomial prediction (MP), and algebraic transition matrices have been proposed. However, little attention has been given to modular addition within these precise models.The propagation rule for the precise division property of a vectorial Boolean function f requires that u can propagate to v if and only if the monomial πu(x) appears in πv(f). Braeken and Semaev (FSE 2005) studied the algebraic structure of modular addition and showed that for x ⊞ y = z, the monomial πu(x)πv(y) appears in πw(z) if and only if u + v = w. Their theorem directly leads to a precise division property model for modular addition. Surprisingly, this model has not been applied in division property searches, to the best of our knowledge.In this paper, we apply Braeken and Semaev’s theorem to search for integral distinguishers in ARX ciphers, leading to several new results. First, we improve the state-of-the-art integral distinguishers for all variants of the Speck family, significantly enhancing search efficiency for Speck-32/48/64/96 and detecting new integral distinguishers for Speck-48/64/96/128. Second, we determine the exact degrees of output bits for 7-round Speck-32 and all/16/2 output bits for 2/3/4-round Alzette for the first time. Third, we revisit the choice of rotation parameters in Speck instances, providing a criterion that enhances resistance against integral distinguishers. Additionally, we offer a simpler proof for Braeken and Semaev’s theorem using monomial prediction, demonstrating the potential of division property methods in the study of Boolean functions.We hope that the proposed methods will be valuable in the future design of ARX ciphers.

Division property is a cryptanalysis method that proves to be very efficient on block ciphers. Computer-aided techniques such as MILP have been widely and successfully used to study various cryptanalysis techniques, and it especially led to many new results for the division property. Nonetheless, we claim that the previous techniques do not consider the full search space. We show that even if the previous techniques fail to find a distinguisher based on the division property over a given function, we can potentially find a relevant distinguisher over a linearly equivalent function. We show that the representation of the block cipher heavily influences the propagation of the division property, and exploiting this, we give an algorithm to efficiently search for such linear mappings. As a result, we exhibit a new distinguisher over 10 rounds of RECTANGLE, while the previous best was over 9 rounds, and rule out such a distinguisher over more than 9 rounds of PRESENT. We also give some insight about the construction of an S-box to strengthen a block cipher against our technique. We prove that using an S-box satisfying a certain criterion is optimal in term of resistance against classical division property. Accordingly, we exhibit stronger variants of RECTANGLE and PRESENT, improving the resistance against division property based distinguishers by 2 rounds.

Catastrophe Markov chain population models have received a lot of attention in the recent past. We herewith consider two special cases of such models involving total disasters, both in discrete and in continuous-time. Depending on the parameters range, the two models can show up a recurrence/transience transition and, in the critical case, a positive/null recurrence transition. The collapse transition probabilities are chosen in such a way that the models are exactly solvable and, in case of positive recurrence, intimately related to the extended Sibuya and Pareto–Zipf distributions whose divisibility and self-decomposability properties are shown relevant. The study includes: existence and shape of the invariant measure, time-reversal, return time to the origin, contact probability at the origin, extinction probability, height and length of the excursions, a renewal approach to the fraction of time spent in the catastrophic state, scale function, first time to collapse and first-passage times, divisibility properties.

The division property method is a technique for automatic searching integral distinguishers on block ciphers. Previous methods only use word-based division property to search integral distinguishers for block ciphers with large S-boxes. Since using bit-based division property may find longer integral distinguishers than word-based division property, we propose a method to automatically search the integral distinguishers based on bit-based division property for block ciphers with large S-boxes. To achieve this goal, we propose a new division property propagation table for S-boxes. Theoretically, we prove that using both the new table and the traditional method to describe the bit-based division property propagation rule of S-box will lead to the same integral distinguishers. Technically, we design a mixed-integer linear programming-based tool to search the integral distinguisher based on the new table, which helps to search new integral distinguishers for block ciphers with large S-boxes efficiently. As a result, we apply our tool to derive new integral distinguishers and get the tight bound on the rounds that no integral distinguishers exist for ICEBERG, KHAZAD, Camellia, CS-Cipher, ITUbee and SMS4. Besides, to show the availability of our integral distinguishers, we form the present best five-round and the first six-round integral attack for ICEBERG as an example.

In recent years, we have witnessed numerous new results on divisibility properties concerning binomial sums. Many conjectures and results were proposed by Z.-W. Sun. Some of these conjectures were proved by himself, and also by some scholars such as V.J.W. Guo, G.S. Mao, B. He, and Y.P. Mu. Motivated by their work, we study the WZ method and its applications to prove divisibility properties of binomial sums. In this paper, we propose a method which can be used to explore more such divisibility properties. Additionally, we give some generalized divisibility properties which can imply those divisibility properties established by Z.-W. Sun and B. He.

A new distinguishing property against block ciphers, called the division property, was introduced by Todo at Eurocrypti?ź2015. Our work gives a new approach to it by the introduction of the notion of parity sets. First of all, this new notion permits us to formulate and characterize in a simple way the division property of any order. At a second step, we are interested in the way of building distinguishers on a block cipher by considering some further properties of parity sets, generalising the division property. We detail in particular this approach for substitution-permutation networks. To illustrate our method, we provide low-data distinguishers against reduced-round Present. These distinguishers reach a much higher number of rounds than generic distinguishers based on the division property and demonstrate, amongst others, how the distinguishers can be improved when the properties of the linear and the Sbox layers are taken into account. At last, this work provides an analysis of the resistance of Sboxes against this type of attacks, demonstrates links with the algebraic normal form of an Sbox as well as its inverse Sbox and exhibit design criteria for Sboxes to resist such attacks.

Cube attack, a simplified type of algebraic attack, is widely utilised to cryptanalyse ciphers. However, since the cube attack works without considering the cipher structure, it is highly complex. In 2017, division property, a successful approach to finding integral distinguishers, was used to extract cube distinguishers in a non-blackbox manner for stream ciphers, which led to a significant improvement of the previous results. This is the first paper employing division property for cube distinguisher extraction in block ciphers. To do this, first, an approach relying on Boolean satisfiability problem (SAT) is presented to evaluate the propagation of division property. Indeed, extraction of zero-sum distinguisher is mapped on a SAT problem and SAT solvers are used to finding division trails efficiently and automatically. Then, this approach is extended and adapted to extract cube distinguishers in block ciphers. However, there are similarities between our contribution and others but the different structure of block and stream ciphers lead to disparity in applying division property to extract cube distinguisher for block ciphers. To prove the efficiency of the presented approach, it is applied to the lightweight block cipher Katan and the cube distinguishers are extended to a higher round in comparison with previous results.

Some Sufficient Conditions for the Division Property of Invariant Subspaces in Weighted Bergman Spaces

Cube attacks are an important type of key recovery attacks against stream ciphers. In particular, they are shown to be powerful against Trivium-like ciphers. Traditional cube attacks are experimental attacks which could only exploit cubes of size less than 40. At CRYPTO 2017, division property based cube attacks were proposed by Todo et al., and an advantage of introducing the division property to cube attacks is that large cube sizes which are beyond the experimental range could be explored, and so powerful theoretical attacks were mounted on many lightweight stream ciphers.In this paper, we revisit the division property based cube attacks. There is an important assumption, called Weak Assumption, proposed in division property based cube attacks to support the effectiveness of key recovery. Todo et al. in CRYPTO 2017 said that the Weak Assumption was expected to hold for theoretically recovered superpolies of Trivium according to some experimental results on small cubes. In this paper, it is shown that the Weak Assumption often fails in cube attacks against Trivium, and moreover a new method to recover the exact superpoly of a given cube is developed based on the bit-based division property. With our method, for the cube I proposed by Todo et al. at CRYPTO 2017 to attack the 832-round Trivium, we recover its superpoly pI(x, v) = v68v78 · (x58⊕v70) · (x59x60⊕x34⊕x61). Furthermore, we prove that some best key recovery results given at CRYPTO 2018 on Trivium are actually distinguishing attacks. Hopefully this paper gives some new insights on accurately recovering the superpolies with the bit-based division property and also attract some attention on the validity of division property based cube attacks against stream ciphers.

The division property proposed by Todo at EUROCRYPT 2015 as a generalized integral property has been applied to many symmetric ciphers. Automatic search methods of the division property assisted by modeling technique, such as Mixed Integer Linear Programming (MILP) and Boolean Satisfiability Problem (SAT), have become the most popular approach to searching integral distinguishers. The accuracy of the model in searching algorithms has an effect on the search results of integral distinguishers. For the block cipher, constructing an accurate and efficient model of the division property propagation on complex linear layers remains hard. This paper observes that the non-independent propagations of the bit-based division property (BDP) on complex linear layers can generate redundant division trails, which will affect the accuracy of the model if it is not taken into account in modeling. Based on this, we propose a method that can build a more accurate model by handling matrices containing non-independent propagations in the linear layer. To verify the effectiveness of our method, we apply the method to two block ciphers uBlock-128 and MIBS. For uBlock-128, our results improve the previous 8-round integral distinguisher by more balanced bits. For MIBS, a 9-round integral distinguisher is given for the first time, which is 4 rounds longer than the previous best.KeywordsDivision propertyLinear layerBlock cipherMILPCryptanalysis

This work surveys mathematical aspects of division property, which is a state-of-the-art technique in cryptanalysis of symmetric-key algorithms, such as authenticated encryption, block ciphers and stream ciphers. It aims to find integral distinguishers and cube attacks, which exploit weaknesses in the algebraic normal forms of the output coordinates of the involved vectorial Boolean functions. Division property can also be used to provide arguments for security of primitives against these attacks. The focus of this work is a formal presentation of the theory behind the division property, including rigorous proofs, which were often omitted in the existing literature. This survey covers the two major variants of division property, namely conventional and perfect division property. In addition, we explore relationships of the technique with classic degree bounds.