Impossible Differential Attack Research Articles

Multiple impossible differential cryptanalysis of reduced-round NBC

NBC is a class of Type-II generalized Feistel structure algorithms with excellent software and hardware implementation performance. In this paper, we evaluate the security of NBC from the view point of multiple impossible differential. More precisely, using the idea of combining the matrix method and “meet-in-the-middle,” we first obtain 4 types of 11-round impossible differentials for NBC-128 and 32 types of 14-round impossible differentials for NBC-256, respectively. Then, according to the characteristics of Feistel structure and the distinguisher, we perform 17-round, 19-round, and 22-round multiple impossible differential cryptanalysis on NBC-128-128, NBC-128-256, and NBC-256-256, respectively. Results indicate that NBC has sufficient security to resist an impossible differential attack, and the data and time complexity of our attack has been significantly reduced compared to previous ones.

Improved Search for Integral, Impossible Differential and Zero-Correlation Attacks

Integral, impossible-differential (ID), and zero-correlation (ZC) attacks are three of the most important attacks on block ciphers. However, manually finding these attacks can be a daunting task, which is why automated methods are becoming increasingly important. Most automatic tools regarding integral, ZC, and ID attacks have focused only on finding distinguishers rather than complete attacks. At EUROCRYPT 2023, Hadipour et al. proposed a generic and efficient constraint programming (CP) model based on satisfiability for finding ID, ZC, and integral distinguishers. This new model can be extended to a unified CP model for finding full key recovery attacks. However, it has limitations, including determining the contradiction location beforehand and a cell-wise model unsuitable for weakly aligned ciphers like Ascon and PRESENT. They also deferred developing a CP model for the partial-sum technique in key recovery as future work.In this paper, we enhance Hadipour et al.’s method in several ways. First, we remove the limitation of determining the contradiction location in advance. Second, we show how to extend the distinguisher model to a bit-wise model, considering the internal structure of S-boxes and keeping the model based on satisfiability. Third, we introduce a CP model for the partial-sum technique for the first time. To show the usefulness and versatility of our approach, we apply it to various designs, from strongly aligned ones like ForkSKINNY and QARMAv2 to weakly aligned ones such as Ascon and PRESENT, yielding significantly improved results. To mention a few of our results, we improve the integral distinguisher of QARMAv2-128 (resp. QARMAv2-64) by 7 (resp. 5) rounds, and the integral distinguisher of ForkSKINNY by 1 round, only thanks to our cell-wise distinguisher modelings. By using our new bit-wise modeling, our tool can find a group of 2155 5-round ID and ZC distinguishers for Ascon in only one run, taking a few minutes on a regular laptop. The new CP model for the partial-sum technique enhances integral attacks on all SKINNY variants, notably improving the best attack on SKINNY-n-n in the single-key setting by 1 round. We also enhance ID attacks on ForkSKINNY and provide the first analysis of this cipher in a limited reduced-round setting. Our methods are generic and applicable to other block ciphers.

Square impossible differential attack and security of AES in known plaintext scenario

In this work, we examine the security of the 8-round AES, under the known plaintext attack scenario, a type of cryptographic attack in which an attacker has access to the plaintext and corresponding ciphertext pairs. We present an innovative impossible differential (ID) attack technique, which utilizes a specific ID characteristic, to perform the first known plaintext attack on the 8-round AES with a 256-bit key. Additionally, we propose a new attack methodology, known as the Square Impossible Differential (SID) attack, to enhance the effectiveness of the ID attacks on AES in chosen ciphertext or plaintext scenarios. The SID attack is a combination of a square attack and an ID attack. Our methodology introduces various new approaches, including the key indicator vectors, eliminating the key candidate through the Meet-in-The-Middle technique and mounting the guess and determine attack through the hash tables for the two-round decryption of one column of AES while determining the subkeys constituting the impossible differential characteristic for a given plaintext/ciphertext difference pair. Our approach demonstrates lower computational complexity compared to previous methods, and our analysis shows that the complexities of our known plaintext attack and SID attack are estimated to be 2220 and 2209, respectively.

RAZOR A Lightweight Block Cipher for Security in IoT

Rapid technological developments prompted a need to do everything from anywhere and that is growing due to modern lifestyle. The Internet of Things (IoT) technology is helping to provide the solutions by inter-connecting the smart devices. Lightweight block ciphers are deployed to enable the security in such devices. In this paper, a new lightweight block cipher RAZOR is proposed that is based on a hybrid design technique. The round function of RAZOR is designed by mixing the Feistel and substitution permutation network techniques. The rotation and XOR based diffusion function is applied on 32-bit input with 8 branches and branch number 7 to optimize the security. The strength of RAZOR is proved against differential, linear, and impossible differential attacks. The number of active S-boxes in any 5-round differential characteristic of RAZOR is 21 in comparison to the 10, 6, 4, 7, and 6 for PRESENT, Rectangle, LBlock, GIFT, and SCENERY respectively. RAZOR provides better security than the existing lightweight designs. The average throughput of 1.47 mega bytes per second to encrypt the large files makes it a better choice for software oriented IoT applications.

Full-round impossible differential attack on shadow block cipher

Lightweight block ciphers are the essential encryption algorithm for devices with limited resources. Its goal is to ensure the security of data transmission through resource-constrained devices. Impossible differential cryptanalysis is one of the most effective cryptanalysis on block ciphers, and assessing the ability of resisting this attack is a basic design criterion. Shadow is a lightweight block cipher proposed by Guo et al. (IEEE Internet Things J 8(16):13014–13023, 2021). It utilizes a combination of ARX operations and generalized Feistel structure to overcome the weakness of the traditional Feistel structure that only diffuses half in one round. In this paper, we focus on the differential property of Shadow and its security against impossible differential cryptanalysis. First, we use the SAT method to automatically search for a full-round impossible differential distinguisher of Shadow-32. Then, based on the experimental results, we prove that Shadow has a differential property with probability 1 based on the propagation of the state. Further, we can obtain an impossible differential distinguisher for an arbitrary number of rounds of Shadow. Finally, we perform a full key recovery attack on the full-round Shadow-32 and Shadow-64. Both experimentally and theoretically, our results indicate that Shadow is critically flawed, and regardless of the security strength of the internal components and the number of rounds applied, the overall cipher remains vulnerable to impossible differential cryptanalysis.

Exploring the optimality of byte-wise permutations of a piccolo-type block cipher

Piccolo is a lightweight block cipher based on a 16-bit word 4-line generalized Feistel structure. Piccolo adopts byte-wise round permutation (RP) instead of the typical word-based RP to improve diffusion. In this paper, we explore the optimality of byte-based RP from the viewpoint of security. We evaluate the security of differential, linear, impossible differential, and integral attacks for all byte-wise RPs using mixed integer linear programming (MILP). We show that the RP of Piccolo is optimal in terms of the number of rounds required to guarantee security against such attacks. In addition, we introduce new two classes of RPs that require 7 rounds for security against impossible differential attacks, which is one round less than required by Piccolo. These new classes require 7/9 and 8/8 rounds to guarantee security against differential/linear attacks, respectively, which is more rounds than required by Piccolo.

Quantum impossible differential attacks: applications to AES and SKINNY

Quantum impossible differential attacks: applications to AES and SKINNY

Bit‐level evaluation of piccolo block cipher by satisfiability problem solver

AbstractIn the field of symmetric key cryptography, the security against distinguishing attacks is one of the crucial security requirements. With advancements in computing capabilities and cryptanalysis techniques in recent years, more efficient methods have been proposed for exploring distinguishers using Mixed‐Integer Linear Programing (MILP) or satisfiability problem (SAT), thereby updating the security bounds of various ciphers. Piccolo is a lightweight block cipher proposed at CHES in 2011, with support 80‐bit and 128‐bit keys. Designers have undergone a rough security evaluation against differential, impossible differential, and related‐key differential attacks, based on nibble‐wise estimations due to the limitation of computational resource. Here, the authors perform bit‐level evaluations on Piccolo block cipher against differential, integral and impossible differential attacks by leveraging SAT‐based approaches. For the first time, the authors succeed in identifying optimal differential distinguisher on 6 rounds in the single key setting, and on 10/12 rounds in the related‐key setting for 80‐bit and 128‐bit keys, respectively. For integral attacks, the authors find integral distinguisher up to 7 rounds. Although the number of attacked rounds is the same as that of the previous attack, the authors find the 56th ordered integral distinguisher, which enable reducing the data complexity for attacks from 263 to 256. As a result, the authors find the 7‐round impossible differentials which is the same number of rounds as the previous nibble‐wise evaluation.

Explicit Upper Bound Of Impossible Differentials For AES-Like Ciphers: Application To uBlock And Midori

Abstract Whether a block cipher can resist impossible differential attack is an important basis to evaluate the security of a block cipher. However, the length of impossible differentials is important for the security evaluation of block ciphers. Most of the previous studies are based on structural cryptanalysis to find the impossible differential, and the structural cryptanalysis covers a lot of specific cryptanalytic vectors which are independent of the nonlinear S-boxes. In this paper, we study the maximum length of the impossible differential of an Advanced Encryption Standard-like cipher in the setting with the details of S-boxes. Inspired by the ‘Divide-and-Conquer’ technique, we propose a new technique called Reduced Block, which combines the details of the S-box. With this tool, the maximum length of impossible differentials can be proven under reasonable assumptions. As applications, we use this tool on uBlock and Midori. Consequently, we prove that for uBlock-128, uBlock-256 and Midori-64, there are no impossible five-round, six-round and seven-round differentials with one active input nibble and one active output nibble, even when considering the details of S-boxes. Furthermore, we reveal some properties of the uBlock S-box and linear layer and demonstrate theoretically that there are no impossible differentials longer than four rounds for uBlock-128 under the assumption that the round keys are independent and uniformly random. This study might provide some insight into the bounds of the length of impossible differentials.

Security Evaluation of Initialization Phases and Round Functions of Rocca and AEGIS

Authenticated-Encryption with Associated-Data (AEAD) plays an important role in guaranteeing confidentiality, integrity, and authenticity in network communications. To meet the requirements of high-performance applications, several AEADs make use of AES New Instructions (AES-NI), which can conduct operations of AES encryption and decryption dramatically fast by hardware accelerations. At SAC 2013, Wu and Preneel proposed an AES-based AEAD scheme called AEGIS-128/128L/256, to achieve high-speed software implementation. At FSE 2016, Jean and Nikolić generalized the construction of AEGIS and proposed more efficient round functions. At ToSC 2021, Sakamoto et al. further improved the constructions of Jean and Nikolić, and proposed an AEAD scheme called Rocca for beyond 5G. In this study, we first evaluate the security of the initialization phases of Rocca and AEGIS family against differential and integral attacks using MILP (Mixed Integer Linear Programming) tools. Specifically, according to the evaluation based on the lower bounds for the number of active S-boxes, the initialization phases of AEGIS-128/128L/256 are secure against differential attacks after 4/3/6 rounds, respectively. Regarding integral attacks, we present the integral distinguisher on 6 rounds and 6/5/7 rounds in the initialization phases of Rocca and AEGIS-128/128L/256, respectively. Besides, we evaluate the round function of Rocca and those of Jean and Nikolić as cryptographic permutations against differential, impossible differential, and integral attacks. Our results indicate that, for differential attacks, the growth rate of increasing the number of active S-boxes in Rocca is faster than those of Jean and Nikolić. For impossible differential and integral attacks, we show that the round function of Rocca achieves the sufficient level of the security against these attacks in smaller number of rounds than those of Jean and Nikolić.

Cryptanalysis on Reduced-Round 3D and Saturnin

Abstract 3D is an Advanced Encryption Standard (AES)-like cipher employed 3D structure proposed in 2008. The main innovation of 3D is the multi-dimensional state, generalizing the design of Rijndael and allowing block sizes beyond the 256-bit boundary. Saturnin, a lightweight block cipher has been selected as a second-round candidate in the National Institute of Standards and Technology standardization for lightweight cryptography. It also employs a 3D structure and provides high security against quantum and classic attacks. The exchange-equivalence attacks proposed by Bardeh and Rønjom consider how quadruples of plaintexts confirm distinguishable properties for AES. It is similar to the principle of yoyo attack, but it can find a longer number of rounds of distinguisher. In this paper, we investigate the exchange-equivalence attack on 3D and yoyo attack on Saturnin. Our new results turn out to be the first secret-key chosen plaintext distinguisher for 10-round 3D. The complexity of the distinguisher is about $2^{364.2}$ in terms of data, memory and computational complexity. For Saturnin, we propose the first six-super-round impossible differential yoyo attack, which is suitable for the two-S-layer version. Compared with the previous impossible differential attacks in the design report of Saturnin, the attacks presented here are the best in terms of the complexity under the chosen-plaintext scenario.

New Search Method for Sbox-Related Impossible Differentials

The impossible differential attack is one of the most fundamental tools of cryptanalysis and has been successfully applied to a large variety of block ciphers. In a typical impossible differential attack, the foundation and first step is to construct an impossible differential. Nowadays, two kinds of most commonly used approaches in impossible differential construction are the matrix-based and tool-aided automatic search methods. In this paper, we proposed a new search method combining an early-abort strategy with the guess-and-determine technique to find longer impossible differentials. Compared with the previous matrix-based search methods, ours has taken the details of Sbox into consideration, while compared with the tool-aided methods, ours is independent of a third-party solver and is applicable to ciphers with large (≥8 bits) Sboxes, which could be tough work for tool-aided methods to cover. Therefore, more accurate results could be obtained. To prove the effectiveness of our method, it is applied to CSA and FOX64. For CSA, 23/24/25-round impossible differentials were found for CSA-BC. This improved the longest impossible differential distinguisher so far by 1/2/3 rounds. And 25-round key recovery attacks are performed against CSA-BC and CSA, which are the longest impossible differential attack by now. For FOX64, we proved that an impossible differential for its round function always implies an impossible differential for 4-round FOX64, and new types of impossible differentials were able to be found. Our method has its own advantage in dealing with large Sboxes, and it may be a possible direction to search for Sbox-related impossible differentials.

Impossible differential cryptanalysis of FBC-128

To promote the theory and application of cryptology, the design and implementation of cryptographic algorithms, in 2018, the Chinese Association for Cryptologic Research held the National Cryptographic Algorithm Design Competition. After the first round evaluation of security and implementation, FBC is selected one of the 10 block ciphers for the second round. FBC adopts 4-branch Extended Generalized Feistel Networks (EGFN) and it is designed with efficient implementation and good resistance against side-channel attacks. In this paper, we focus on the impossible differential attack, which is one of the most basic cryptanalytical methods, against FBC with 128-bit block size and key size (FBC-128). First, an equivalent expression with improved clarity of the round functions was derived. Then a structural property concerning the relationship among branches was explored. Combining those properties of its round function and structure, 9-round truncated impossible differentials were constructed for FBC-128, which is 2 rounds longer than previous works. Using this distinguisher, 13-round key recovery attack was mounted. The data and time complexity is 2126 chosen-plaintexts and 2122.96 encryptions respectively. To our knowledge, this is the best attack so far in terms of attacked rounds. Our attack exploited the properties of both structure and round function of FBC, and those observation and analysis would be beneficial to the understanding of FBC. Moreover, our results demonstrate when constructing impossible differentials, differentials with low hamming weight input and output difference may not always be optimal, which calls for more comprehensive analysis of the differential pattern.

Rectangle Attack Against Type‐I Generalized Feistel Structures

Type-I generalized Feistel networks (GFN) are widely used frameworks in symmetric-key primitive designs such as CAST-256 and Lesamnta. Different from the extensive studies focusing on specific block cipher instances, the analysis against Type-I GFN structures gives generic security evaluation of the basic frameworks and concentrates more on the effect of linear transformation. Currently, works in this field mainly evaluate the security against impossible differential attack, zero-correlation linear attack, meet-in-the-middle attack and yoyo game attack, while its security evaluation against rectangle attack is still missing. In this paper, we filled this gap and gave the first structural analytical results of Type-I GFN against rectangle attack. By exploiting its structural properties, we proved there exists a boomerang switch for Type-I GFN for the first time, which is independent of the round functions. Then we turned the boomerang switch into chosen plaintext setting and proposed a new rectangle attack model. By appending 1 more round in the beginning of the boomerang switch, we constructed a rectangle distinguisher and a key recovery attack could be performed.

Multiple Impossible Differential Attacks for ForkAES

To yield a highly efficient authentication encryption design for very short messages, the tweakable forkcipher is proposed, which is a tweakable block cipher that uses forking construction to produce two output blocks. The designers also presented ForkAES, a forkcipher that is based on the round function of AES and the tweakable variant of KIASU. Therefore, the security of ForkAES is found on the block ciphers AES and KIASU. However, from the perspective of new forking construction, attackers may obtain some unique properties. Impossible differential attacks are widely used on block ciphers. This paper studies the security of ForkAES against multiple impossible differential cryptanalysis. Based on the property of the forking construction, two types of impossible differential distinguishers have been constructed. We first use the tweak with different truncated differences to build more attack trails. Then, we first propose the multiple impossible differential attack for ForkAES- <math xmlns="http://www.w3.org/1998/Math/MathML" id="M1"> <mi>∗</mi> </math> -5-4. Thus, only a single round would remain as a security margin. Utilizing multiple attack trails, our attack scenario obtains more subkey bytes and enhances the subkey’s sieving efficiency without increasing complexity. Furthermore, we carefully consider the process of recovering the master key, which can efficiently reject wrong candidate keys. In reconstruction queries, our attack reaches the longest number of rounds for ForkAES in impossible differential analysis, with <math xmlns="http://www.w3.org/1998/Math/MathML" id="M2"> <msup> <mrow> <mn>2</mn> </mrow> <mrow> <mn>100.8</mn> </mrow> </msup> </math> lookups, <math xmlns="http://www.w3.org/1998/Math/MathML" id="M3"> <msup> <mrow> <mn>2</mn> </mrow> <mrow> <mn>85.8</mn> </mrow> </msup> </math> chosen ciphertexts, and <math xmlns="http://www.w3.org/1998/Math/MathML" id="M4"> <msup> <mrow> <mn>2</mn> </mrow> <mrow> <mn>92.7</mn> </mrow> </msup> </math> memory blocks to store AES states. In encryption queries, we improve the previous attacks on ForkAES by attacking one more round (i.e., ForkAES- <math xmlns="http://www.w3.org/1998/Math/MathML" id="M5"> <mi>∗</mi> </math> -5-4), with <math xmlns="http://www.w3.org/1998/Math/MathML" id="M6"> <msup> <mrow> <mn>2</mn> </mrow> <mrow> <mn>118.2</mn> </mrow> </msup> </math> lookups, <math xmlns="http://www.w3.org/1998/Math/MathML" id="M7"> <msup> <mrow> <mn>2</mn> </mrow> <mrow> <mn>111.4</mn> </mrow> </msup> </math> plaintexts, and <math xmlns="http://www.w3.org/1998/Math/MathML" id="M8"> <msup> <mrow> <mn>2</mn> </mrow> <mrow> <mn>92.7</mn> </mrow> </msup> </math> memory blocks to store AES states.

Security evaluation on type‐1 and type‐1‐like 4‐branch generalized Feistel structures and application to reduced‐round Lesamnta‐LW‐BC

Generalized Feistel structures (called GFSs for short) are one of the most popular block cipher structures. They are mainly divided into type-1, type-2 and type-3 GFS. Among them, type-1 and type-1-like ones attracted much attention during the past decades because of the simple design and high implementation efficiency. In this paper, the security of the type-1 and type-1-like 4-branch GFS with substitution permutation round functions against the impossible differential attack are evaluated. For these two structures, 21-round impossible differential distinguishers are constructed when the linear layers P satisfy γ(P) ≥ 2, where γ(P) denotes the primitive index of P. Especially, when γ(P) = 2, the 21-round distinguisher of the type-1 structure is one round longer than before. Furthermore, for a specific block cipher Lesamnta-LW-BC, which takes the type-1-like structure, by exploiting the details of the linear layer, a better 21-round impossible differential distinguisher is constructed, which contains more impossible differentials than before. With this distinguisher, a 27-round impossible differential attack on Lesamnta-LW-BC is performed. The length of this attack is 8 rounds longer than the previous best one. Our results can provide guidance for designing and analysing the type-1 and type-1-like GFS as well as the specific block ciphers which take the structures.

On Data Complexities of Reciprocal Impossible Differential Attacks

On Data Complexities of Reciprocal Impossible Differential Attacks

The 7-Round Subspace Trail-Based Impossible Differential Distinguisher of Midori-64

This paper analyzes the subspace trail of Midori-64 and uses the propagation law and mutual relationship of the subspaces of Midori-64 to provide a 6-round Midori-64 subspace trail-based impossible differential key recovery attack. The data complexity of the attack is 2 54.6 chosen plaintexts, and the computational complexity is 2 58.2 lookup operations. Its overall complexity is less than that of the known 6-round truncated impossible differential distinguisher. This distinguisher is also applicable to Midori-128 with a secret S -box. Additionally, utilizing the properties of subspaces, we prove that a subspace trail-based impossible differential distinguisher of Midori-64 contains at most 7 rounds. This is 1 more than the upper bound of Midori-64’s truncated impossible differential distinguisher which is 6. According to the Hamming weights of the starting and ending subspaces, we classify all 7-round Midori-64 subspace trail-based impossible differential distinguishers into two types and they need 2 59.6 and 2 51.4 chosen plaintexts, respectively.

Improved Impossible Differentials and Zero-Correlation Linear Hulls of New Structure III

Impossible differential cryptanalysis and zero-correlation linear cryptanalysis are two kinds of most effective tools for evaluating the security of block ciphers. In those attacks, the core step is to construct a distinguisher as long as possible. In this paper, we focus on the security of New Structure III, which is a kind of block cipher structure with excellent resistance against differential and linear attacks. While the best previous result can only exploit one-round linear layer P to construct impossible differential and zero-correlation linear distinguishers, we try to exploit more rounds to find longer distinguishers. Combining the Miss-in-the-Middle strategy and the characteristic matrix method proposed at EUROCRYPT 2016, we could construct 23-round impossible differentials and zero-correlation linear hulls when the linear layer P satisfies some restricted conditions. To our knowledge, both of them are 1 round longer than the best previous works concerning the two cryptanalytical methods. Furthermore, to show the effectiveness of our distinguishers, the linear layer of the round function is specified to the permutation matrix of block cipher SKINNY which was proposed at CRYPTO 2016. Our results indicate that New Structure III has weaker resistance against impossible differential and zero-correlation linear attacks, though it possesses good differential and linear properties.

Integral and impossible‐differential attacks on the reduced‐round Lesamnta‐LW‐BC

Lesamnta-LW-BC is the internal block cipher of the Lesamnta-LW lightweight hash function, specified in ISO/IEC 29192-5:2016. It is based on the unbalanced Feistel network and Advanced Encryption Standard round function. In this study, the security of Lesamnta-LW-BC against integral and impossible-differential attacks is evaluated. Specifically, the authors searched for the integral distinguishers and impossible differentials with Mixed-Integer Linear Programming-based methods. As a result, the discovered impossible differential can reach up to 21 rounds, while three integral distinguishers reaching 18, 19 and 25 rounds are obtained, respectively. Moreover, it is also feasible to construct a 47-round integral distinguisher in the known-key setting. Finally, a 20-round key-recovery attack is proposed based on the discovered 18-round integral distinguisher and a 19-round key-recovery attack using a 17-round impossible differential. To the best of the authors' knowledge, this is the first third-party cryptanalysis of Lesamnta-LW-BC.