Provable Security Evaluation of Structures Against Impossible Differential and Zero Correlation Linear Cryptanalysis

Abstract

Impossible differential and zero correlation linear cryptanalysis are two of the most important cryptanalytic vectors. To characterize the impossible differentials and zero correlation linear hulls which are independent of the choices of the non-linear components, Sun et al. proposed the structure deduced by a block cipher at CRYPTO 2015. Based on that, we concentrate in this paper on the security of the SPN structure and Feistel structure with SP-type round functions. Firstly, we prove that for an SPN structure, if $$\alpha _1\rightarrow \beta _1$$ and $$\alpha _2\rightarrow \beta _2$$ are possible differentials, $$\alpha _1|\alpha _2\rightarrow \beta _1|\beta _2$$ is also a possible differential, i.e., the OR “|” operation preserves differentials. Secondly, we show that for an SPN structure, there exists an r-round impossible differential if and only if there exists an r-round impossible differential $$\alpha \not \rightarrow \beta $$ where the Hamming weights of both $$\alpha $$ and $$\beta $$ are 1. Thus for an SPN structure operating on m bytes, the computation complexity for deciding whether there exists an impossible differential can be reduced from $$\mathcal O(2^{2m})$$ to $$\mathcal O(m^2)$$ . Thirdly, we associate a primitive index with the linear layers of SPN structures. Based on the matrices theory over integer rings, we prove that the length of impossible differentials of an SPN structure is upper bounded by the primitive index of the linear layers. As a result we show that, unless the details of the S-boxes are considered, there do not exist 5-round impossible differentials for the AES and ARIA. Lastly, based on the links between impossible differential and zero correlation linear hull, we projected these results on impossible differentials to zero correlation linear hulls. It is interesting to note some of our results also apply to the Feistel structures with SP-type round functions.