ARX Ciphers Research Articles

Finding Complete Impossible Differential Attacks on AndRX Ciphers and Efficient Distinguishers for ARX Designs

The impossible differential (ID) attack is one of the most important cryptanalytic techniques for block ciphers. There are two phases to finding an ID attack: searching for the distinguisher and building a key recovery upon it. Previous works only focused on automated distinguisher discovery, leaving key recovery as a manual post-processing task, which may lead to a suboptimal final complexity. At EUROCRYPT 2023, Hadipour et al. introduced a unified constraint programming (CP) approach based on satisfiability for finding optimal complete ID attacks in strongly aligned ciphers. While this approach was extended to weakly-aligned designs like PRESENT at ToSC 2024, its application to ARX and AndRX ciphers remained as future work. Moreover, this method only exploited ID distinguishers with direct contradictions at the junction of two deterministic transitions. In contrast, some ID distinguishers, particularly for ARX and AndRX designs, may not be detectable by checking only the existence of direct contradictions.This paper fills these gaps by extending Hadipour et al.’s method to handle indirect contradictions and adapting it for ARX and AndRX designs. We also present a similar method for identifying zero-correlation (ZC) distinguishers. Moreover, we extend our new model for finding ID distinguishers to a unified optimization problem that includes both the distinguisher and the key recovery for AndRX designs. Our method improves ID attacks and introduces new distinguishers for several ciphers, such as SIMON, SPECK, Simeck, ChaCha, Chaskey, LEA, and SipHash. For example, we achieve a one-round improvement in ID attacks against SIMON-64-96, SIMON-64-128, SIMON-128-128, SIMON-128-256 and a two-round improvement against SIMON-128- 192. These results significantly contribute to our understanding of the effectiveness of automated tools in the cryptanalysis of different design paradigms.

Finding Impossible Differentials in ARX Ciphers under Weak Keys

Impossible differential cryptanalysis is very important in the field of symmetric ciphers. Currently, there are many automatic search approaches to find impossible differentials. However, these methods have two underlying assumptions: Markov cipher assumption and key independence assumption. Actually, these two assumptions are not true in ARX ciphers, especially lightweight ones. In this paper, we study the impossible differentials in ARX cipher under weak keys for the first time. Firstly, we propose several accurate difference propagation properties on consecutive two and three modular additions. Then, these properties are applied to four typical local constructions composed of two consecutive modular additions, two modular additions with a rotation operation, xoring secret key or constant in the middle, to find impossible differentials under weak keys or special constants. What’s more, we propose a more accurate difference propagation property on three consecutive modular additions. It can be used to find impossible differentials on more complex local constructions under weak keys or special constants. In practical ciphers, these impossible differentials on local constructions can be used to find contradictions. Lastly, combining our new findings with traditional automatic search methods for impossible differentials, we propose a framework to find impossible differentials in ARX ciphers under weak keys. As applications, we apply the framework to SPECK-32/64, LEA and CHAM-64/128. As a result, we find two 8-round impossible differentials for SPECK-32/64 under 260 weak keys, and one 11-round impossible differential for LEA under 2k−1 weak keys, where k is the key size. These impossible differentials can start from any round. Furthermore, we find two 22-round impossible differentials for CHAM-64/128 under 2127 weak keys starting from certain rounds. As far as we know, all these impossible differentials are longer than previous ones.

On the additive differential probability of ARX construction

Aim The additive differential cryptanalysis is a significant technique used in the analysis of ARX ciphers. In this paper, we will focus on accurately and efficiently calculating the additive differential probability of $$ x \lll d \oplus y \lll e $$ . Methods Inspired by the work of Niu et al . at Crypto 2022, we use a delicate partition of $$ \mathbf{F}_2^m \times \mathbf{F}_2^m $$ into subsets. Result We derive an algorithm that can calculate it with linear time complexity. Compared with our algorithm, the one proposed by Velichkov et al . is only suitable when $$ e=0 $$ . Conclusion For the ARX construction: $$ (x \boxplus y) \lll d \oplus y \lll e $$ , which appears in Alzette, Speck, etc. , our algorithm can find more accurate additive differential characteristics for such ARX constructions. It is essential to evaluate the resistance of such ARX primitives against Additive differential cryptanalysis.

Improved Differential-Linear Attacks with Applications to ARX Ciphers

We present several improvements to the framework of differential-linear attacks with a special focus on ARX ciphers. As a demonstration of their impact, we apply them to Chaskey and ChaCha and we are able to significantly improve upon the best attacks published so far.

A bit-vector differential model for the modular addition by a constant and its applications to differential and impossible-differential cryptanalysis.

ARX algorithms are a class of symmetric-key algorithms constructed by Addition, Rotation, and XOR. To evaluate the resistance of an ARX cipher against differential and impossible-differential cryptanalysis, the recent automated methods employ constraint satisfaction solvers to search for optimal characteristics or impossible differentials. The main difficulty in formulating this search is finding the differential models of the non-linear operations. While an efficient bit-vector differential model was obtained for the modular addition with two variable inputs, no differential model for the modular addition by a constant has been proposed so far, preventing ARX ciphers including this operation from being evaluated with automated methods. In this paper, we present the first bit-vector differential model for the n-bit modular addition by a constant input. Our model contains O(log _2(n)) basic bit-vector constraints and describes the binary logarithm of the differential probability. We describe an SMT-based automated method that includes our model to search for differential characteristics of ARX ciphers including constant additions. We also introduce a new automated method for obtaining impossible differentials where we do not search over a small pre-defined set of differences, such as low-weight differences, but let the SMT solver search through the space of differences. Moreover, we implement both methods in our open-source tool ArxPy to find characteristics and impossible differentials of ARX ciphers with constant additions in a fully automated way. As some examples, we provide related-key impossible differentials and differential characteristics of TEA, XTEA, HIGHT, LEA, SHACAL-1, and SHACAL-2, which achieve better results compared to previous works.

New Strategies To Improve Differential-Linear Attacks With Applications To Chaskey

Abstract Differential-linear cryptanalysis, as the combination of differential and linear cryptanalysis, is an efficient way to attack many kinds of ciphers. Recently, various refinements to this cryptanalytic technique have been proposed, especially with good effects on ARX ciphers. In the current framework of a differential-linear attack, a cipher $E$ is often divided into three parts: a differential part $E_1$, a linear part $E_2$ and a connective part $E_m$. It is a challenging problem to deal with the connective part when building a differential-linear distinguisher, and for ARX ciphers, estimating the correlation of $ E_m $ experimentally under given input difference $\Delta _m$ and output linear mask $\Gamma _m$ is the main approach so far. In this paper, we discuss the effects of $ \Delta _{m} $ and $ \Gamma _{m} $ on the correlation of $ E_m $ for the first time. As a result, we propose a new strategy to find $\Delta _m$ and $\Gamma _m$ to build differential-linear distinguishers with high correlations for ARX ciphers based on algebraic equations derived from their round functions. For the key recovery parts of differential-linear attacks, we also find a new partitioning technique which will reduce the time complexity. Based on our new methods, we improve the differential-linear attack on 7-round Chaskey.

Another Perspective on Automatic Construction of Integral Distinguishers for ARX Ciphers

This paper introduces a method to construct integral distinguishers for ARX ciphers. The basic idea of this method is to utilize the symmetry between the zero-correlation linear distinguishers and integral distinguishers. Combined with an automatic searching method on zero-correlation linear distinguishers of ARX ciphers, a subspace for the distinguishers is constructed. This subspace can finally be turned into an integral distinguisher based on the symmetry between these two distinguishers. Three ARX block ciphers, HIGHT, LEA and SPECK, are used to validate the effectiveness of this method. For LEA, four nine-round integral distinguishers are constructed, which is one more round than the previous best result derived with division property. For SPECK32, two more six-round integral distinguishers are constructed, whose number of active bits is reduced by one bit.

On the Probability and Automatic Search of Rotational-XOR Cryptanalysis on ARX Ciphers

Abstract Rotational-XOR cryptanalysis is a very recent technique for ARX ciphers. In this paper, the probability propagation formula of RX-cryptanalysis in modular addition is extended, and the calculation of RX-difference probability for any rotation parameter ($0<k<n$) can be realized. By proposing a concept of RX-offset and constructing the corresponding distribution table, the propagation of RX-difference in modular addition can be derived from the propagation of XOR-difference. Combined with the improvement of the automatic search tool for XOR-differential characteristics of ARX ciphers, we only need to add one more operation in each round, i.e. traverse the possible value of RX-offset and XOR it with the output XOR-difference of modular addition, thus it can achieve the search for RX-differential characteristics. With this method, the RX-differential distinguisher of ARX-C primitives without or with linear key schedule can be searched. For the applications, we have obtained the third-party RX-cryptanalysis results for Alzette and CHAM for the first time as far as we know.

Shadow: A Lightweight Block Cipher for IoT Nodes

The advancement of the Internet of Things (IoT) has promoted the rapid development of low-power and multifunctional sensors. However, it is seriously significant to ensure the security of data transmission of these nodes. Meanwhile, sensor nodes have the characteristics of converting analog signals into digital signals for operation processing in wireless sensor networks (WSNs). Given the particularity of Addition or AND, Rotation, and XOR (ARX) operations, its round function can only be based on the Feistel structure or generalized Feistel structure, otherwise, the process of decryption cannot be completed correctly. Furthermore, the existing ARX ciphers have the problems of only changing half of the plaintext block in one round and iterating for many rounds. In this article, a new logical combination method of generalized Feistel structure and ARX operations is proposed to improve the diffusion speed of ARX ciphers, called Shadow. Shadow overcomes the shortcomings of traditional ARX ciphers that only diffuse half of the block in one round. To ensure the efficiency of the encryption hardware circuit while ensuring the security of the physical-layer signal, we studied the round-based hardware architecture and the serial hardware architecture for Shadow cipher. Particularly, we conducted a series of performance tests on Shadow, including the avalanche effect, FPGA implementation, and ASIC implementation. Also, we conducted a security analysis of the Shadow. As shown by our experiments and comparisons, Shadow is compact in IoT nodes and is of high security against cryptanalysis.

A New Method for Searching Optimal Differential and Linear Trails in ARX Ciphers

In this paper, we propose an automatic tool to search for optimal differential and linear trails in ARX ciphers. It’s shown that a modulo addition can be divided into sequential small modulo additions with carry bit, which turns an ARX cipher into an S-box-like cipher. From this insight, we introduce the concepts of carry-bit-dependent difference distribution table (CDDT) and carry-bit-dependent linear approximation table (CLAT). Based on them, we give efficient methods to trace all possible output differences and linear masks of a big modulo addition, with returning their differential probabilities and linear correlations simultaneously. Then an adapted Matsui’s algorithm is introduced, which can find the optimal differential and linear trails in ARX ciphers. Besides, the superiority of our tool’s potency is also confirmed by experimental results for round-reduced versions of HIGHT and SPECK. More specifically, we find the optimal differential trails for up to 10 rounds of HIGHT, reported for the first time. We also find the optimal differential trails for 10, 12, 16, 8 and 8 rounds of SPECK32/48/64/96/128, and report the provably optimal differential trails for SPECK48 and SPECK64 for the first time. The optimal linear trails for up to 9 rounds of HIGHT are reported for the first time, and the optimal linear trails for 22, 13, 15, 9 and 9 rounds of SPECK32/48/64/96/128 are also found respectively. These results evaluate the security of HIGHT and SPECK against differential and linear cryptanalysis. Also, our tool is useful to estimate the security in the design of ARX ciphers.

Automatic Search for the Linear (Hull) Characteristics of ARX Ciphers: Applied to SPECK, SPARX, Chaskey, and CHAM-64

Linear cryptanalysis is an important evaluation method for cryptographic primitives against key recovery attack. In this paper, we revisit the Walsh transformation for linear correlation calculation of modular addition, and an efficient algorithm is proposed to construct the input-output mask space of specified correlation weight. By filtering out the impossible large correlation weights in the first round, the search space of the first round can be substantially reduced. We introduce a concept of combinational linear approximation table (cLAT) for modular addition with two inputs. When one input mask is fixed, another input mask and the output mask can be obtained by the Splitting-Lookup-Recombination approach. We first split the n-bit fixed input mask into several subvectors and then find the corresponding bits of other masks, and in the recombination phase, pruning conditions can be used. By this approach, a large number of search branches in the middle rounds can be pruned. With the combination of the optimization strategies and the branch-and-bound search algorithm, we can improve the search efficiency for linear characteristics on ARX ciphers. The linear hulls for SPECK32/48/64 with a higher average linear potential (ALP) than existing results have been obtained. For SPARX variants, an 11-round linear trail and a 10-round linear hull have been found for SPARX-64 and a 10-round linear trail and a 9-round linear hull are obtained for SPARX-128. For Chaskey, a 5-round linear trail with a correlation of 2−61 has been obtained. For CHAM-64, 34/35-round optimal linear characteristics with a correlation of 2−31/2−33 are found.

SAT Attacks on ARX Ciphers with Automated Equations Generation

SAT Attacks on ARX Ciphers with Automated Equations Generation

MILP-aided bit-based division property for ARX ciphers

MILP-aided bit-based division property for ARX ciphers

Finding Differential Paths in ARX Ciphers through Nested Monte-Carlo Search

We propose the adaptation of Nested Monte-Carlo Search algorithm for finding differential trails in the class of ARX ciphers. The practical application of the algorithm is demonstrated on round-reduced variants of block ciphers from the SPECK family. More specifically, we report the best differential trails,up to 9 rounds, for SPECK32.

Automatic search of impossible differentials and zero-correlation linear hulls for ARX ciphers

In lightweight cryptographic primitives, round functions with only simple operations XOR, modular addition and rotation are widely used nowadays. This kind of ciphers is called ARX ciphers. For ARX ciphers, impossible differential cryptanalysis and zero-correlation linear cryptanalysis are among the most powerful attacks, and the key problems for these two attacks are discovering more and longer impossible differentials (IDs) and zero-correlation linear hulls (ZCLHs). However, finding new IDs and ZCLHs for ARX ciphers has been a manual work for a long time, which has been an obstacle in improving these two attacks. This paper proposes an automatic search method to improve the efficiency of finding new IDs and ZCLHs for ARX ciphers. In order to prove the efficiency of this new tool, we take HIGHT, LEA, SPECK three typical ARX algorithms as examples to explore their longer and new impossible differentials and zero-correlation linear hulls. To the best of our knowledge, this is the first application of automatic search method for ARX ciphers on finding new IDs and ZCLHs. For HIGHT, we find more 17 round IDs and multiple 17 round ZCLHs. This is the first discovery of 17 round ZCLHs for HIGHT. For LEA, we find extra four 10 round IDs and several 9 round ZCLHs. In the specification of LEA, the designers just identified three 10 round IDs and one 7 round ZCLH. For SPECK, we find thousands of 6 round IDs and forty-four 6 round ZCLHs. Neither IDs nor ZCLHs of SPECK has been proposed before. The successful application of our new tool shows great potential in improving the impossible differential cryptanalysis and zero-correlation linear cryptanalysis on ARX ciphers.

Differential Cryptanalysis of Round-Reduced LEA

In this paper, we focus on the differential cryptanalysis dedicated to a particular class of cryptographic algorithms, namely ARX ciphers. We propose a new algorithm inspired by the Nested Monte-Carlo Search algorithm to find a differential path in ARX ciphers. We apply our algorithm to a round reduced variant of the block cipher LEA. For small blocks of ARX ciphers, our algorithm works perfectly and in an extremely concise time. Taking into account that our algorithm takes longer for bigger blocks, we use the concept of a partial difference distribution table (pDDT) in our algorithm. This methodology reduced the search space of the algorithm by using only those differentials whose probabilities are greater than or equal to a pre-defined threshold. Using this concept, we removed many differentials which are not valid or whose probabilities are very low. This led to a decreased time of finding a differential path by our nested algorithm due to a smaller search space. This partial difference distribution table also made our nested algorithm suitable for bigger block size ARX ciphers. In previous works, finding long differential characteristics has been shown to be a problem of a harder nature where algorithms have been shown to take many hours or days to find differential characteristics in ARX ciphers. In this paper, our algorithm finds the differential characteristics in just a few minutes with a very simple framework. We report the differential path for up to nine rounds in LEA. To construct differential characteristics for a large number of rounds, we use techniques to divide long characteristics into short ones, by constructing a large characteristic from two short characteristics. Furthermore, instead of starting from the first round as most algorithms do, we start from the middle and run experiments in the forward as well as in the reverse direction. Using this method, we improved our results and report the differential path for up to 12 rounds and with the given path we attacked 14 rounds of cipher. Overall, it is clear to see that the best property of our algorithm is that it has the potential to provide state-of-the-art results but within a simpler framework as well as in less time than previous attempts. Our algorithm provides a reusable framework for future avenues of research, as it could be applied to other ARX ciphers with the potential for interesting and efficient resultss.