Higher Order Differential Attack Research Articles

Higher-order Differential Attack on Reduced-round SLIM

Higher-order Differential Attack on Reduced-round SLIM

Low differentially uniform permutations from the Dobbertin APN function over [formula omitted

Substitution boxes (S-boxes) play a central role in block ciphers. In substitution-permutation networks, the S-boxes should be permutation functions over F2n to realize the invertibility of the encryption. More importantly, the S-boxes should have low differential uniformity, high nonlinearity, and high algebraic degree in order to resist differential attacks, linear attacks, and higher order differential attacks, respectively. In this paper, we construct new classes of differentially 4 and 6-uniform permutations by modifying the image of the Dobbertin APN function xd with d=24k+23k+22k+2k−1 over a subfield of F2n. In addition, the algebraic degree and the lower bound of the nonlinearity of the constructed functions are given.

Quantum Algorithm to Identify Division Property of a Multiset

Division property-based integral attack is the generalization of integral property developed by blending saturation attack and higher-order differential attack. This attack is considered as a chosen-plaintext attack because the cryptanalyst generates a multiset of plaintext which possesses a certain division property. However, in real-world applications, it is required to find the division property of a given multiset which turns the attack into a known-plaintext attack. The problem, finding the division property of a given multiset $$\mathbb {X}$$ of size $$|\mathbb {X}|$$ with each element of n-bit, when solved on a classical computer has the time complexity of $$O(n2^n|\mathbb {X}|)$$ (fixed in both average and worst cases). In this paper, a better and comparable algorithm using quantum computing is presented along with its quantum oracle designs that can find the correct division property of a multiset in the average case time complexity of $$O \left( \log (n)2^n\sqrt{|\mathbb {X}|} \right) $$ and worst case time complexity of $$O\left( \log (n) 2^n|\mathbb {X}| \right) $$ using $$\left( n + \lceil \log |\mathbb {X}|\rceil + p \right) $$ -qubits, where p are the precision qubits required by the quantum counting subroutine.

An Algorithm for Improving Algebraic Degree of S-Box Coordinate Boolean Functions Based on Affine Equivalence Transformation

The Substitution box (\(S\)-box) plays an important role in a block cipher as it is the only nonlinear part of the cipher in most cases. \(S\)-box \(S\) can be considered as a vectorial Boolean function consisting of \(m\) individual Boolean functions \(f_1,f_2,\dots,f_m\), where \(f_i: GF (2^n)\to GF (2)\) and \( f_i(x)=y_i\) for \(i=1,2,\dots,m\). These functions are called coordinate Boolean functions of the \(S\)-box \(S\). To avoid various attacks on the ciphers and for efficient software implementation, the coordinate Boolean functions of \(S\)-boxes are required to satisfy a lot of properties, for instance being a permutation defined on the fields with even degrees, with a high nonlinearity, a low differential uniformity and a high algebraic degree, etc. However, it seems very difficult to find an \(S\)-box with the coordinate Boolean functions to satisfy all the criteria. The \(S\)-box with low algebraic degree of the coordinate Boolean functions is vulnerable to many attacks such as linear and differential cryptanalysis, for instance higher-order differential attacks, algebraic attacks or cube attacks. In this paper we propose an algorithm for improving algebraic degree of the $S$-box coordinate Boolean functions while not affecting its other important properties. The algorithm is based on affine equivalence transformation of the \(S\)-boxes.

An Algorithm for Improving Algebraic Degree of S-Box Based on Affine Equivalence Transformation

The Substitution box (S-box) plays an important role in a block cipher as it is the only nonlinear part of the cipher in most cases. To avoid various attacks on the ciphers and for efficient software implementation, S-boxes are required to satisfy a lot of properties, for instance being a permutation defined on the fields with even degrees, with a high algebraic degree, a low differential uniformity and a high nonlinearity, etc. However, it seems very difficult to find an S-box to satisfy all the criteria. The S-box of low algebraic degree is vulnerable to many attacks such as linear and differential cryptanalysis, for instance higher-order differential attacks, algebraic attacks or cube attacks. In this paper the authors propose an algorithm for improving algebraic degree of the S-box while not affecting its other important properties. The algorithm is based on affine equivalence transformation of the S-boxes.

On the Influence of the Algebraic Degree of $F^{-1}$ on the Algebraic Degree of $G \circ F$

We present a study on the algebraic degree of iterated permutations seen as multivariate polynomials. The main result shows that this degree depends on the algebraic degree of the inverse of the permutation which is iterated. This result is also extended to noninjective balanced vectorial functions where the relevant quantity is the minimal degree of the inverse of a permutation expanding the function. This property has consequences in symmetric cryptography since several attacks or distinguishers exploit a low algebraic degree, like higher order differential attacks, cube attacks, and cube testers, or algebraic attacks. Here, we present some applications of this improved bound to a higher degree variant of the block cipher KN, to the block cipher Rijndael-256 and to the inner permutations of the hash functions ECHO and JH.

Another Look at the Integral Attack by the Higher-Order Differential Attack

Another Look at the Integral Attack by the Higher-Order Differential Attack

Cryptographic properties and application of a Generalized Unbalanced Feistel Network structure

In this paper, we study GF-NLFSR, a Generalized Unbalanced Feistel Network (GUFN) which can be considered as an extension of the outer function FO of the KASUMI block cipher. We show that the differential and linear probabilities of any n?+?1 rounds of an n-cell GF-NLFSR are both bounded by p 2, where the corresponding probability of the round function is p. Besides analyzing security against differential and linear cryptanalysis, we provide a frequency distribution for upper bounds on the true differential and linear hull probabilities. From the frequency distribution, we deduce that the proportion of input-output differences/mask values with probability bounded by p n is close to 1 whereas only a negligible proportion has probability bounded by p 2. We also recall an n 2-round integral attack distinguisher and (n 2?+?n???2)-round impossible differential distinguisher on the n-cell GF-NLFSR by Li et al. and Wu et al. As an application, we design a new 30-round block cipher Four-Cell?+? based on a 4-cell GF-NLFSR. We prove the security of Four-Cell?+? against differential, linear, and boomerang attack. Four-Cell?+? also resists existing key recovery attacks based on the 16-round integral attack distinguisher and 18-round impossible differential distinguisher. Furthermore, Four-Cell?+? can be shown to be secure against other attacks such as higher order differential attack, cube attack, interpolation attack, XSL attack and slide attack.

Security Analysis of 7-Round MISTY1 against Higher Order Differential Attacks

MISTY1 is a 64-bit block cipher that has provable security against differential and linear cryptanalysis. MISTY1 is one of the algorithms selected in the European NESSIE project, and it has been recommended for Japanese e-Government ciphers by the CRYPTREC project. This paper shows that higher order differential attacks can be successful against 7-round versions of MISTY1 with FL functions. The attack on 7-round MISTY1 can recover a partial subkey with a data complexity of 254.1 and a computational complexity of 2120.8, which signifies the first successful attack on 7-round MISTY1 with no limitation such as a weak key. This paper also evaluates the complexity of this higher order differential attack on MISTY1 in which the key schedule is replaced by a pseudorandom function. It is shown that resistance to the higher order differential attack is not substantially improved even in 7-round MISTY1 in which the key schedule is replaced by a pseudorandom function.

Higher Order Differential Attack on 6-Round MISTY1

MISTY1 is a 64-bit block cipher that has provable security against differential and linear cryptanalysis. MISTY1 is one of the algorithms selected in the European NESSIE project, and it has been recommended for Japanese e-Government ciphers by the CRYPTREC project. This paper reports a previously unknown higher order differential characteristic of 4-round MISTY1 with the FL functions. It also shows that a higher order differential attack that utilizes this newly discovered characteristic is successful against 6-round MISTY1 with the FL functions. This attack can recover a partial subkey with a data complexity of 253.7 and a computational complexity of 264.4, which is better than any previous cryptanalysis of MISTY1.

A Study on Higher Order Differential Attack of KASUMI

This paper proposes novel calculuses of linearizing attack that can be applied to higher order differential attack. Higher order differential attack is a powerful and versatile attack on block ciphers. It can be roughly summarized as follows: (1) Derive an attack equation to estimate the key by using the higher order differential properties of the target cipher, (2) Determine the key by solving an attack equation. Linearizing attack is an effective method of solving attack equations. It linearizes an attack equation and determines the key by solving a system of linearized equations using approaches such as the Gauss-Jordan method. We enhance the derivation algorithm of the coefficient matrix for linearizing attack to reduce computational cost (fast calculus 1). Furthermore, we eliminate most of the unknown variables in the linearized equations by making the coefficient column vectors 0 (fast calculus 2). We apply these algorithms to an attack of the five-round variant of KASUMI and show that the attack complexity is equivalent to 228.9 chosen plaintexts and 231.2 KASUMI encryptions.