Impossible Differential Characteristics Research Articles

Improved differential attacks on the reduced-round SNOW-V and SNOW-Vi stream cipher

The SNOW-V stream cipher is a candidate cipher for 5G mobile communication system, and the SNOW-Vi stream cipher is a faster variant of SNOW-V. In this paper, we analyze the resistance of the reduced-round SNOW-V and SNOW-Vi against the chosen IV differential distinguishing attacks in the initialization phase. Firstly, we use the divide-and-conquer strategy to give a Mixed-integer Linear Programming (MILP) model to describe the probabilities within the Differential Distribution Table (DDT) of large S-boxes, which can more accurately search the best differential characteristics of SNOW-V and SNOW-Vi than using the probability lower bound of the DDT in the original MILP model. Secondly, we point out that the registers R1,R2,R3 of SNOW-Vi filled with 0 were not considered in the original MILP model, resulting in the MILP model may return impossible differential characteristics. Then, we give the splicing search technology of C program and MILP model to solve this problem. Thirdly, based on these two studies, we present a more efficient and accurate MILP model for searching the best differential characteristics of the reduced-round SNOW-V and SNOW-Vi. The improved MILP model reduces the complexity of the distinguishing attacks. Finally, we give two multiple differential attack techniques on SNOW-V/SNOW-Vi structure, and apply them to the reduced-round SNOW-V and SNOW-Vi, respectively. While improving the results of single differential attacks, we also reduce the complexity of differential attack on the 4-round SNOW-V from 297 to 259.985, which can give the effective attack under the data limitation 264 for the single key. In addition, we give the first differential attack on 5-round SNOW-Vi, and the time complexity and data complexity is 296.84. The success rate is 0.97725. Although this has exceeded the data complexity limitation of the single key attack, it is meaningful for us to analyze the security of SNOW-Vi.

Searching for impossible subspace trails and improved impossible differential characteristics for SIMON-like block ciphers

In this paper, we greatly increase the number of impossible differentials for SIMON and SIMECK by eliminating the 1-bit constraint in input/output difference, which is the precondition to ameliorate the complexity of attacks. We propose an algorithm which can greatly reduce the searching complexity to find such trails efficiently since the search space exponentially expands to find impossible differentials with multiple active bits. There is another situation leading to the contradiction in impossible differentials except for miss-in-the-middle. We show how the contradiction happens and conclude the precondition of it defined as miss-from-the-middle. It makes our results more comprehensive by applying these two approach simultaneously. This paper gives for the first time impossible differential characteristics with multiple active bits for SIMON and SIMECK, leading to a great increase in the number. The results can be verified not only by covering the state-of-art, but also by the MILP model.

Cryptanalysis of Reduced round SKINNY Block Cipher

SKINNY is a family of lightweight tweakable block ciphers designed to have the smallest hardware footprint. In this paper, we present zero-correlation linear approximations and the related-tweakey impossible differential characteristics for different versions of SKINNY .We utilize Mixed Integer Linear Programming (MILP) to search all zero-correlation linear distinguishers for all variants of SKINNY, where the longest distinguisher found reaches 10 rounds. Using a 9-round characteristic, we present 14 and 18-round zero correlation attacks on SKINNY-64-64 and SKINNY- 64-128, respectively. Also, for SKINNY-n-n and SKINNY-n-2n, we construct 13 and 15-round related-tweakey impossible differential characteristics, respectively. Utilizing these characteristics, we propose 23-round related-tweakey impossible differential cryptanalysis by applying the key recovery attack for SKINNY-n-2n and 19-round attack for SKINNY-n-n. To the best of our knowledge, the presented zero-correlation characteristics in this paper are the first attempt to investigate the security of SKINNY against this attack and the results on the related-tweakey impossible differential attack are the best reported ones.

Cryptanalysis of Reduced round SKINNY Block Cipher

SKINNY is a family of lightweight tweakable block ciphers designed to have the smallest hardware footprint. In this paper, we present zero-correlation linear approximations and the related-tweakey impossible differential characteristics for different versions of SKINNY .We utilize Mixed Integer Linear Programming (MILP) to search all zero-correlation linear distinguishers for all variants of SKINNY, where the longest distinguisher found reaches 10 rounds. Using a 9-round characteristic, we present 14 and 18-round zero correlation attacks on SKINNY-64-64 and SKINNY- 64-128, respectively. Also, for SKINNY-n-n and SKINNY-n-2n, we construct 13 and 15-round related-tweakey impossible differential characteristics, respectively. Utilizing these characteristics, we propose 23-round related-tweakey impossible differential cryptanalysis by applying the key recovery attack for SKINNY-n-2n and 19-round attack for SKINNY-n-n. To the best of our knowledge, the presented zero-correlation characteristics in this paper are the first attempt to investigate the security of SKINNY against this attack and the results on the related-tweakey impossible differential attack are the best reported ones.

Improved zero‐correlation and impossible differential cryptanalysis of reduced‐round SIMECK block cipher

SIMECK is a family of three lightweight block ciphers designed by Yang et al., following the framework used by Beaulieu et al. from the United States National Security Agency to design SIMON and SPECK. In this study, the authors employ an improved miss-in-the-middle approach to find zero correlation linear distinguishers and impossible differentials on SIMECK48 and SIMECK64. Based on this novel technique, they will be able to present zero-correlation linear approximations for 15-round SIMECK48 and 17-round SIMECK64 and these zero-correlation linear approximations improve the previous best result by two rounds for SIMECK48 and SIMECK64. Moreover, they attack 27-round SIMECK48 and 31-round SIMECK64 based on these zero-correlation linear distinguishers. In addition, due to the duality of zero-correlation and impossible differential, they search for the impossible differential characteristics for SIMECK48 and SIMECK64 so that they will be able to present 15-round SIMECK48 and 17-round SIMECK64 while the best previously known results were 13-round impossible differentials for SIMECK48 and 15-round impossible differentials for SIMECK64. Moreover, they propose impossible differential attacks on 22-round SIMECK48 and 24-round SIMECK64 based on these impossible differential characteristics. The results significantly improve the previous zero correlation attack and impossible differential characteristic results for these variants of SIMECK to the best of the authors’ knowledge.

On the Design Rationale of SIMON Block Cipher: Integral Attacks and Impossible Differential Attacks against SIMON Variants

Simon is a lightweight block cipher designed by NSA in 2013. NSA presented the specification and the implementation efficiency, but they did not provide detailed security analysis nor the design rationale. The original Simon has rotation constants of (1,8,2), and Kölbl et al. regarded the constants as a parameter (a,b,c), and analyzed the security of Simon block cipher variants against differential and linear attacks for all the choices of (a,b,c). This paper complements the result of Kölbl et al. by considering integral and impossible differential attacks. First, we search the number of rounds of integral distinguishers by using a supercomputer. Our search algorithm follows the previous approach by Wang et al., however, we introduce a new choice of the set of plaintexts satisfying the integral property. We show that the new choice indeed extends the number of rounds for several parameters. We also search the number of rounds of impossible differential characteristics based on the miss-in-the-middle approach. Finally, we make a comparison of all parameters from our results and the observations by Kölbl et al. Interesting observations are obtained, for instance we find that the optimal parameters with respect to the resistance against differential attacks are not stronger than the original parameter with respect to integral and impossible differential attacks. Furthermore, we consider the security against differential attacks by considering differentials. From the result, we obtain a parameter that is potential to be better than the original parameter with respect to security against these four attacks.

Impossible differential cryptanalysis of MARS‐like structures

The MARS-like structure is a generalised Feistel structure. Unified impossible differential (UID) method is an effective method to discover impossible differential characteristics for block cipher structures. In this study, for a specific kind of MARS-like structure, the authors use UID to show that when n, the number of subblocks, is even, there always exist 3n − 1 rounds impossible differentials. Moreover, the authors prove that when n is odd, the MARS-like structure has impossible differentials for any number of rounds, which is a clear but interesting result.

Impossible differential cryptanalysis on cipher E2

SUMMARYE2, a block cipher, is an Advanced Encryption Standard candidate designed and submitted by Nippon Telegraph and Telephone Corporation. It employs a Feistel structure as global structure and two‐layer substitution–permutation network structure in round function. The conservative structure makes E2 immune to kinds of current cryptanalysis. Previously, there is no result of impossible differential attacks on E2 because it was once supposed to have no more than five‐round impossible differential characteristic. In this paper, we present a series of six‐round impossible differential characteristics of E2 with/without initial transformation (IT)/ final transformation (FT) functions. Based on these impossible differentials, the immunity of E2 against impossible differential cryptanalysis is evaluated. We perform a seven‐round attack on tweaked E2 (E2 without IT and FT ) with 128, 192, and 256 bits key and an eight‐round attack on tweaked E2 with 256 bits key. The seven‐round attack requires about 2120 chosen plaintexts and 2115.5 seven‐round encryptions; the eight‐round attack needs 2121 chosen plaintexts and less than 2214 eight‐round encryptions. We also discuss the seven‐round attack on E2 with IT or FT, and the result shows that the attack has the same complexities with the seven‐round attack on tweaked E2. Copyright © 2013 John Wiley & Sons, Ltd.

General Impossible Differential Attack on 7-Round AES

Impossible differential attack (IDA) uses impossible differential characteristics extracted from enough plaintext pairs to retrieve subkeys of the first and the last several rounds of AES. In this paper, a general IDA on 7-round AES is proposed. Such attack takes the number of all-zero columns of the 7th and the 6th round as parameters (α, β). And a trade-off relation between the number of plaintexts and times of encryptions in the process of the attack is derived, which makes only some values of (α, β) allowed in the attack for different key length.

An improved impossible differential cryptanalysis of Zodiac

In this paper, we introduce a new impossible differential cryptanalysis of Zodiac that is considerably more effective than the one in the previous work ( Hong et al., 2002). Using two new 13-round impossible differential characteristics and the early abort technique, this 3R-Attack breaks 128-bit key full-round Zodiac with complexity less than 2 71.3 encryptions, which is practical. This result is approximately 2 48 times better than what mentioned in the earlier work. Our result reveals depth of Zodiac’s weakness against impossible differential cryptanalysis due to its poor diffusion layer. We also obtain a tighter upper bound for time complexity.