Cryptanalysis Of Block Ciphers Research Articles

Combined and General Methodologies of Key Space Partition for the Cryptanalysis of Block Ciphers

This paper proposes two new methods of key space partitioning for the cryptanalysis of block ciphers. The first one is called combined methodology of key space partition (CoMeKSPar), which allows us to simultaneously set some of the first and last consecutive bits of the key. In this way, the search is performed using the remaining middle bits. CoMeKSPar is a combination of two methods already proposed in the scientific literature, the Borges, Borges, Monier (BBM) and the Tito, Borges, Borges (TBB). The second method is called the general algorithm of key space reduction (GAKSRed), which makes it possible to perform a genetic algorithm search in the space formed by the unknown bits of the key, regardless of their distribution in the binary block. Furthermore, a method of attacking block ciphers is presented for the case where some key bits are known; the basic idea is to deduce some of the remaining bits of the block. An advantage of these methods is that they allow parallel computing, which allows simultaneous searches in different sub-blocks of key bits, thereby increasing the probability of success. The experiments are performed with the KLEIN (Small) lightweight block cipher using the genetic algorithm.

Cryptanalysis of Selected ARX-Based Block Ciphers

The security of digital communication and information systems is mostly dependent on block ciphers. ARX-based ciphers are widely used due to their simplicity and efficiency. This paper provides an exhaustive cryptanalysis of a subset of ARX-based block ciphers, with particular emphasis on SIMON, SPECK, and IDEA. These ciphers need to be exposed for their weaknesses in algebraic attack resistance and cryptographic properties such as key sensitivity. In addition, we assess the resource utilization and speed of these ciphers, both of which are critical for practical implementation. SMT (Satisfiability Modulo Theories) framework is utilized to tackle constraint fulfillment problems based on first-order logic. The following cryptographic steps use SMT solvers: differential cryptanalysis, collision attack, pre-image attack, modular root-finding, and cryptographic primitive verification. We show that SMT solvers can solve block cipher cryptanalysis constraints. In a cryptanalytic attack, we convert block cipher boolean equations to Z3py. The proposed cryptanalysis method evaluates ARX cipher performance. This method recovers the partial secret key using plaintext and ciphertext pairs, partial key bits, and a predetermined number of rounds. To determine whether SIMON, SPECK, or IDEA are appropriate for distinct security requirements, we conducted a comparative analysis of the results and presented them in tabulated form. This research builds a better understanding of ARX-based block ciphers and allows us to develop more robust and efficient cryptographic algorithms to protect sensitive data in modern communication systems.

Utilizing FWT in linear cryptanalysis of block ciphers with various structures

Utilizing FWT in linear cryptanalysis of block ciphers with various structures

Automatic boomerang attacks search on Rijndael

Abstract Boomerang attacks were introduced in 1999 by Wagner (The boomerang attack. In: Knudsen LR, editor. FSE’99. vol. 1636 of LNCS. Heidelberg: Springer; 1999. p. 156–70) as a powerful tool in differential cryptanalysis of block ciphers, especially dedicated to ciphers with good short differentials. They have been generalized to the related-key case by Biham et al. (Related-key boomerang and rectangle attacks. In: Cramer R, editor. Advances in Cryptology - EUROCRYPT 2005, 24th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Aarhus, Denmark, May 22–26, 2005, Proceedings. vol. 3494 of Lecture Notes in Computer Science. Springer; 2005. p. 507–25. doi: 10.1007/11426639_30). In this article, we show how to adapt the model proposed in 2020 by Delaune et al. (Catching the fastest boomerangs application to SKINNY. IACR Trans Symm Cryptol. 2020;2020(4):104–29) for related-key boomerang attacks on the block cipher SKINNY to the Rijndael case. Rijndael is composed of 25 instances that could be seen as generalizations of the Advanced Encryption Standard. We detail our models and present the results we obtain concerning related-key boomerang attacks on Rijndael. Notably, we present a nine-round attack against Rijndael-128-160, which has 11 rounds and beats all previous cryptanalytic results against Rijdael-128-160.

Automatic Search of Differential Characteristics and Improved Differential Cryptanalysis for PRINCE, QARMA, and MANTIS

Reflection structure has a significant advantage that realizing decryption and encryption results in minimum additional costs, and many block ciphers tend to adopt such structure to achieve the requirement of low overhead. PRINCE, MANTIS, QARMA, and PRINCEv2 are lightweight block ciphers with reflection feature proposed in recent years. In this paper, we consider the automatic differential cryptanalysis of reflection block ciphers based on Boolean satisfiability (SAT) method. Since reflection block ciphers have different round functions, we extend forward and backward from the middle structure and achieve to accelerate the search of the optimal differential characteristics for such block ciphers with the Matsui’s bounding conditions. As a result, we present the optimal differential characteristics for PRINCE up to 12 rounds (full round), and they are also the optimal characteristics for PRINCEv2. We also find the optimal differential characteristics for MANTIS, QARMA‐64, and QARMA‐128 up to 10, 12, and 8 rounds, respectively. To mount an efficient differential attack on such block ciphers, we present a uniform SAT model by combining the differential characteristic searching process and the key recovery process. With this model, we find two sets of 7‐round differential characteristics for PRINCE with less guessed key bits and use them to present a multiple differential attack against 11‐round PRINCE, which improves the known single‐key attack on PRINCE by one round to our knowledge.

Cryptanalysis of full-round SFN Block Cipher a Lightweight Block Cipher, Targeting IoT Systems

Cryptanalysis of full-round SFN Block Cipher a Lightweight Block Cipher, Targeting IoT Systems

Deep-Learning-Based Cryptanalysis of Lightweight Block Ciphers Revisited.

With the development of artificial intelligence, deep-learning-based cryptanalysis has been actively studied. There are many cryptanalysis techniques. Among them, cryptanalysis was performed to recover the secret key used for cryptography encryption using known plaintext. In this paper, we propose a cryptanalysis method based on state-of-art deep learning technologies (e.g., residual connections and gated linear units) for lightweight block ciphers (e.g., S-DES, S-AES, and S-SPECK). The number of parameters required for training is significantly reduced by 93.16%, and the average of bit accuracy probability increased by about 5.3% compared with previous the-state-of-art work. In addition, cryptanalysis for S-AES and S-SPECK was possible with up to 12-bit and 6-bit keys, respectively. Through this experiment, we confirmed that the-state-of-art deep-learning-based key recovery techniques for modern cryptography algorithms with the full round and the full key are practically infeasible.

RAFA: Redundancies-assisted Algebraic Fault Analysis and its implementation on SPN block ciphers

Algebraic Fault Analysis (AFA) is a cryptanalysis for block ciphers proposed by Courtois et al., which incorporates algebraic cryptanalysis to overcome the complexity of manual analysis within the context of Differential Fault Analysis (DFA). The effectiveness of AFA on lightweight block ciphers has been demonstrated. However, the complexity of the algebraic systems prevents it from attacking heavyweight block ciphers efficiently. In this paper, we propose a novel cryptanalysis called Redundancies-assisted Algebraic Fault Analysis (RAFA) to facilitate the solution of algebraic systems in the setting of heavyweight block ciphers. The core idea of RAFA is to expedite SAT solvers by modifying the algebraic systems, which is accomplished via two methods. The first method introduces redundant constraints, which is proposed for the first time in the context of algebraic cryptanalysis. The second one is a sophisticated linearization of the nonlinear Algebraic Normal Form (ANF). It takes RAFA for about 9.68 hours to attack AES-128. To the best of our knowledge, this is the first work that uses a general SAT solver to attack AES with only a single injection of byte-fault. Moreover, RAFA can attack AES-128 in 50.92 and 27.54 minutes for nibble- and bit-based fault model, respectively. In comparison, the traditional DFA algorithm implemented by pure C takes 4 ~ 5 hours under all three fault models investigated in this work. Moreover, in order to show the generality of RAFA, we also apply it to other heavyweight block ciphers. The best results show that RAFA could recover the key of Serpent-256 and SPEEDY-r-192 in 20.7 and 1.5 hours using only three faults, respectively. In comparison, AFA could not break these two ciphers even when 30 bits and 50 bits of their keys are known, respectively. Furthermore, no DFA work on Serpent or SPEEDY is known using comparable fault models.

Cryptanalysis of Full-Round Magpie Block Cipher

Cryptanalysis of Full-Round Magpie Block Cipher

On the Fitness Functions Involved in Genetic Algorithms and the Cryptanalysis of Block Ciphers

There are many algorithms used with different purposes in the area of cryptography. Amongst these, Genetic Algorithms have been used, particularly in the cryptanalysis of block ciphers. Interest in the use of and research on such algorithms has increased lately, with a special focus on the analysis and improvement of the properties and characteristics of these algorithms. In this way, the present work focuses on studying the fitness functions involved in Genetic Algorithms. First, a methodology was proposed to verify that the closeness to 1 of some fitness functions' values that use decimal distance implies decimal closeness to the key. On the other hand, the foundation of a theory is developed in order to characterize such fitness functions and determine, a priori, if one method is more effective than another in the attack to block ciphers using Genetic Algorithms.

Bayesian Modeling for Differential Cryptanalysis of Block Ciphers: A DES Instance

Encryption algorithms based on block ciphers are among the most widely adopted solutions for providing information security. Over the years, a variety of methods have been proposed to evaluate the robustness of these algorithms to different types of security attacks. One of the most effective analysis techniques is differential cryptanalysis, whose aim is to study how variations in the input propagate on the output. In this work we address the modeling of differential attacks to block cipher algorithms by defining a Bayesian framework that allows a probabilistic estimation of the secret key. In order to prove the validity of the proposed approach, we present as case study a differential attack to the Data Encryption Standard (DES) which, despite being one of the methods that has been most thoroughly analyzed, is still of great interest to the scientific community since its vulnerabilities may have implications on other ciphers.

Differential cryptanalysis of full-round ANU-II ultra-lightweight block cipher

Lightweight ciphers are often used as the underlying encryption algorithm in resource-constrained devices. Their cryptographic security is a mandatory goal for ensuring the security of data transmission. Differential cryptanalysis is one of the most fundamental methods applicable primarily to block ciphers, and the resistance against this type of cryptanalysis is a necessary design criterion. ANU-II is an ultra-lightweight block cipher proposed in 2017, whose design offers many advantages such as the use of fewer hardware resources (logic gates), low power consumption and fast encryption for Internet of Things devices. The designers of ANU-II claimed its resistance against differential cryptanalysis and postulated that the design is safe enough for Internet of Things devices. However, as addressed in this article, the security claims made by designers appear not to be well grounded. Using mixed-integer linear programming–like techniques, we identify one-round differential characteristic that holds with probability 1, which is then efficiently employed in mounting the key recovery attack on full-round ANU-II with only 22 chosen plaintexts and 262.4 full-round encryptions. The result shows that the designers’ security evaluation of ANU-II against differential cryptanalysis is incorrect and the design rationale is flawed. To remedy this weakness, we provide an improved variant of ANU-II, which has much better resistance to differential cryptanalysis without affecting the hardware and/or software implementation cost.

Formal Analysis of Boomerang Probabilities

In the past 20 years since their conception, boomerang attacks have become an important tool in the cryptanalysis of block ciphers. In the classical estimate of their success probability, assumptions are made about the independence of the underlying differential trails that are not well-founded. We underline the problems inherent in these independence assumptions by using them to prove that for any boomerang there exists a differential trail over the entire cipher with a higher probability than the boomerang.While cryptanalysts today have a clear understanding that the trails can be dependent, the focus of previous research has mostly gone into using these dependencies to improve attacks but little effort has been put into giving boomerangs and their success probabilities a stronger theoretical underpinning. With this publication, we provide such a formalization.We provide a framework which allows us to formulate and prove rigorous statements about the probabilities involved in boomerang attacks without relying on independence assumptions of the trails. Among these statements is a proof that two-round boomerangs on SPNs with differentially 4-uniform S-boxes always deviate from the classical probability estimate to the largest degree possible.We applied the results of this formalization to analyze the validity of some of the first boomerang attacks. We show that the boomerang constructed in the amplified boomerang attack on Serpent by Kelsey, Kohno, and Schneier has probability zero. For the rectangle attack on Serpent by Dunkelman, Biham, and Keller, we demonstrate that a minuscule fraction of only 2−43.4 of all differential trail combinations used in the original attack have a non-zero probability. In spite of this, the probability of the boomerang is in fact a little higher than the original estimate suggests as the non-zero trails have a vastly higher probability than the classical estimate predicts.

Automated Deep Learning BLACK-BOX Attack for Multimedia P-BOX Security Assessment

Resistance to differential cryptanalysis is a fundamental security requirement for symmetric block ciphers, and recently, deep learning has attracted the interest of cryptography experts, particularly in the field of block cipher cryptanalysis, where the bulk of these studies are differential distinguisher based black-box attacks. This paper provides a deep learning-based decryptor technique for investigating the permutation primitives used in multimedia block cipher encryption algorithms.We aim to investigate how deep learning can be used to improve on previous classical works by employing cipher text pair aspects to maximize information extraction with low-data constraints by using convolution neural network features to discover the correlation among permutable atoms to extract the plain text from the ciphered text without any P-box expertise. The evaluation of testing methods has been conceptualized as a regression task in which neural networks are supervised using a variety of parameters such as variations between input and output, number of iterations, and P-box generation patterns. On the other hand, the transfer learning skills demonstrated in this study indicate that discovering suitable testing models from the ground is also achievable using our model with optimum prior cryptographic expertise, where we contribute the results of deep learning in the field of deep learning based differential cryptanalysis development.Various experiments were performed on discrete and continuous chaotic and non-chaotic permutation patterns, and the best-performing model had an MSE of 1.8217 <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">e</i> <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">-04</sup> and an <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">R</i> <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> of 1, demonstrating the practicality of the suggested technique.

Study of Parameters in the Genetic Algorithm for the Attack on Block Ciphers

In recent years, the use of Genetic Algorithms (GAs) in symmetric cryptography, in particular in the cryptanalysis of block ciphers, has increased. In this work, the study of certain parameters that intervene in GAs was carried out, such as the time it takes to execute a certain number of iterations, so that a number of generations to be carried out in an available time can be estimated. Accordingly, the size of the set of individuals that constitute admissible solutions for GAs can be chosen. On the other hand, several fitness functions were introduced, and which ones led to better results was analyzed. The experiments were performed with the block ciphers AES(t), for t∈{3,4,7}.

Generalized differential-linear cryptanalysis of block cipher

Differential-linear cryptanalysis of block ciphers was proposed in 1994. It turns out to be more efficient in comparison with (separately) differential and linear cryptanalytic methods, but its scientific substantiation remains the subject of further research. There are several publications devoted to formalization of differential-linear cryptanalysis and clarification of the conditions under which its complexity can be mathematically accurately assessed. However, the problem of the differential-linear cryptanalytic method substantiation remains completely unresolved.&#x0D; This paper presents first results obtained by the author in the direction of solving this problem. The class of differential-linear attacks on block ciphers is expanded. Namely, both distinguishing attacks and attacks aimed at recovering one bit of information about a key are considered. In this case, no assumptions are made (as in well-known publications) about the possibility of representing the cipher in the form of some two components. Lower bounds of information complexity of these attacks are obtained. The expressions of these bounds depend on the averaged (by keys) values of the elements’ squares of the generalized autocorrelation table of the encryption transformation. In contrast to the known ones, the obtained bounds are not based on any heuristic assumptions about the investigated block ciphers and are valid for a wider class of attacks as compared to the traditional differential-linear attack. Relations between, respectively, differential, linear and differential-linear properties of bijective Boolean mappings are given. In contrast to the well-known works, the matrix form of the relations is used that makes it possible to clarify better their essence and simplify the proofs. A new relation is derived for the elements of the generalized autocorrelation table of the encryption transformation of the product of two block ciphers, which may be useful in further research.

Pushing the Limit of PFA: Enhanced Persistent Fault Analysis on Block Ciphers

Persistent fault analysis (PFA) is a newly proposed cryptanalysis for block ciphers. Although the injected fault is persistent during the entire encryption, the corresponding analysis is only applied to the last round in the original PFA. In this article, the enhanced PFA (EPFA) is proposed, which can push the limit of PFA by exploiting the fault leakage in deeper rounds and target to reduce the number of required ciphertexts as small as possible. EPFA is first introduced as a general method with a specific application to advanced encryption standard (AES). Then it is extended to other substitution–permutation network (SPN)-based block ciphers, such as LED and SKINNY, both of which have unique features that EPFA fits well. To improve the efficiency of EPFA, a parallel algorithm based on mixed radix numbers is developed, which fully utilizes the power of GPU. Our experimental results show that EPFA can reduce the number of required ciphertexts to be under 1000, which is only about 40% of the 2500 ciphertexts in previous PFA on AES. In contrast to the single-threaded implementation, the parallel EPFA can have a speedup roughly about 200 times.

Lightweight Block Cipher Security Evaluation Based on Machine Learning Classifiers and Active S-Boxes

Machine learning has recently started to gain the attention of cryptographic researchers, notably in block cipher cryptanalysis. Most of these machine learning-based approaches are black box attacks that are cipher-specific. Thus, more research is required to understand the capabilities and limitations of machine learning when being used to evaluate block cipher security. We contribute to this body of knowledge by investigating the capability of linear and nonlinear machine learning classifiers in evaluating block cipher security. We frame block cipher security evaluation as a classification problem, whereby the machine learning models attempt to classify a given block cipher output as secure or insecure based on the number of active S-boxes. We also train the machine learning models with common block cipher features such as truncated differences, the number of rounds, and permutation pattern. Various experiments were performed on small-scale (4-branch) generalized Feistel ciphers to identify the best performing machine learning model for the given security evaluation problem. Results show that nonlinear machine learning models outperform linear models, achieving a prediction accuracy of up to 93% when evaluating inputs from ciphers that they have seen before during training. When evaluating inputs from other unseen ciphers, nonlinear models again outperformed linear models with an accuracy of up to 71%. We then showcase the feasibility of our approach when used to evaluate a real-world 16-branch generalized Feistel cipher, TWINE. By training the best performing nonlinear classifiers (k-nearest neighbour and decision tree) using data from other similar ciphers, the nonlinear classifiers achieved a 74% accuracy when evaluating differential data generated from TWINE. In addition, the trained classifiers were capable of generalizing to a larger number of rounds than they were trained for. Our findings showcase the feasibility of using simple machine learning classifiers as a security evaluation tool to assess block cipher security.

Improving Matsui’s Search Algorithm For The Best Differential/Linear Trails And Its Applications For DES, DESL And GIFT

Abstract Automatic search methods have been widely used for cryptanalysis of block ciphers, especially for the most classic cryptanalysis methods—differential and linear cryptanalysis. However, the automatic search methods, no matter based on MILP, SMT/SAT or CP techniques, can be inefficient when the search space is too large. In this paper, we propose three new methods to improve Matsui’s branch-and-bound search algorithm, which is known as the first generic algorithm for finding the best differential and linear trails. The three methods, named reconstructing DDT and LAT according to weight, executing linear layer operations in minimal cost and merging two 4-bit S-boxes into one 8-bit S-box, respectively, can efficiently speed up the search process by reducing the search space as much as possible and reducing the cost of executing linear layer operations. We apply our improved algorithm to DESL and GIFT, which are still the hard instances for the automatic search methods. As a result, we find the best differential trails for DESL (up to 14-round) and GIFT-128 (up to 19-round). The best linear trails for DESL (up to 16-round), GIFT-128 (up to 10-round) and GIFT-64 (up to 15-round) are also found. To the best of our knowledge, these security bounds for DESL and GIFT under single-key scenario are given for the first time. Meanwhile, it is the longest exploitable (differential or linear) trails for DESL and GIFT. Furthermore, benefiting from the efficiency of the improved algorithm, we do experiments to demonstrate that the clustering effect of differential trails for 13-round DES and DESL are both weak.

Applied study on cryptographic functions for algorithms used in communications security protocols

Communications security is one of the most important fields to take into account when designing a system that manages information, especially when implementing such a system for the military, no matter which branch, Navy, Air Force or Army. One important field when talking about information security in general is cryptology and within cryptology linear and nonlinear Boolean functions and maps are essential, important building blocks. They are used in the design of several block and stream ciphers. The study of cryptographic properties of these functions does not only help cryptanalysis but also plays an important role in the design of cryptographic algorithms that resist well against various cryptographic attacks. Linear and differential cryptanalysis of block ciphers is mainly based on determining and exploiting linear combinations of their components. The most useful mathematical tool for studying linearity of Boolean functions is the Walsh (or Hadamard) transform. This can be regarded as a size-2 discrete Fourier transform. Another method for determining linear combinations of cipher components is that of finding and solving linear systems of equations. This article reflects the authors’ effort to shed some light on this field.