Integral Attacks on Reduced-Round PRESENT

Abstract

Integral attack is a powerful technique to recover the secret key of block ciphers by usually exploiting the fact that specific parts of the output after several round encryptions has a zero-sum property in a set of chosen plaintexts. In FSE 2008, bit-based integral attack proposed by Z'aba et al. revealed that integral attacks may be not only suitable for byte-based block ciphers but also still applied to bit-based block ciphers. In this work, we show that integral attack against bit-based block ciphers can be improved not only by the theorem of higher-order differential attack but also by using specific algebraic properties of Sboxes, and the order of plaintexts in a set, which is important in bit-based integral attack, is not required here. We focus on the block cipher PRESENT. Based on some algebraic properties of its Sbox, we propose two integral distinguishers: a 5 round (4-th order) integral distinguisher and a 7 round (16-th order) integral distinguishers, which can be used to attack 10 (out of 31) round PRESENT. As far as we know, it is the first time that a 7 round integral distinguisher of PRESENT is reported. Algebraic techniques used in this paper may be also applied to other block ciphers to improve their known integral attacks.