The reality of backdoored S-Boxes—An eye opener

Abstract

The real-life incidents researched in academia have revealed that (possibly) state-level efforts are made to camouflage the intentional flaws in the mathematical layer of an S-Box for exploiting the information-theoretic properties, i.e., Kuznyechik. To investigate the common features in the intentionally weakened mappings, this research thoroughly examines the backdoored structures from the perspective of 24 cryptanalytic attack vectors available in the open literature. We have debunked the earlier claims by the backdoor engineers that the proposed designs are stealthy against statistical distinguishers. Although a backdoored architecture fulfils the notions of randomness, it lacks the strength to resist sophisticated cryptanalytic attacks. Our analysis has revealed that during the backdoor insertion phase, a malicious designer compromises vital cryptographic properties, prominently the algebraic degree, differential trails, avalanche characteristics and leaving the open ground for hybrid cryptanalytic attacks. It is also observed that these mappings attain the upper bound of BCT, FBCT and DLCT, paving the way for hybrid attacks with high probability and lower data complexity.