Impossible Differential Cryptanalysis Research Articles

Multiple impossible differential cryptanalysis of reduced-round NBC

NBC is a class of Type-II generalized Feistel structure algorithms with excellent software and hardware implementation performance. In this paper, we evaluate the security of NBC from the view point of multiple impossible differential. More precisely, using the idea of combining the matrix method and “meet-in-the-middle,” we first obtain 4 types of 11-round impossible differentials for NBC-128 and 32 types of 14-round impossible differentials for NBC-256, respectively. Then, according to the characteristics of Feistel structure and the distinguisher, we perform 17-round, 19-round, and 22-round multiple impossible differential cryptanalysis on NBC-128-128, NBC-128-256, and NBC-256-256, respectively. Results indicate that NBC has sufficient security to resist an impossible differential attack, and the data and time complexity of our attack has been significantly reduced compared to previous ones.

Finding Impossible Differentials in ARX Ciphers under Weak Keys

Impossible differential cryptanalysis is very important in the field of symmetric ciphers. Currently, there are many automatic search approaches to find impossible differentials. However, these methods have two underlying assumptions: Markov cipher assumption and key independence assumption. Actually, these two assumptions are not true in ARX ciphers, especially lightweight ones. In this paper, we study the impossible differentials in ARX cipher under weak keys for the first time. Firstly, we propose several accurate difference propagation properties on consecutive two and three modular additions. Then, these properties are applied to four typical local constructions composed of two consecutive modular additions, two modular additions with a rotation operation, xoring secret key or constant in the middle, to find impossible differentials under weak keys or special constants. What’s more, we propose a more accurate difference propagation property on three consecutive modular additions. It can be used to find impossible differentials on more complex local constructions under weak keys or special constants. In practical ciphers, these impossible differentials on local constructions can be used to find contradictions. Lastly, combining our new findings with traditional automatic search methods for impossible differentials, we propose a framework to find impossible differentials in ARX ciphers under weak keys. As applications, we apply the framework to SPECK-32/64, LEA and CHAM-64/128. As a result, we find two 8-round impossible differentials for SPECK-32/64 under 260 weak keys, and one 11-round impossible differential for LEA under 2k−1 weak keys, where k is the key size. These impossible differentials can start from any round. Furthermore, we find two 22-round impossible differentials for CHAM-64/128 under 2127 weak keys starting from certain rounds. As far as we know, all these impossible differentials are longer than previous ones.

Impossible Differential Cryptanalysis and A Security Evaluation Framework for AND-RX Ciphers

Impossible Differential Cryptanalysis and A Security Evaluation Framework for AND-RX Ciphers

Full-round impossible differential attack on shadow block cipher

Lightweight block ciphers are the essential encryption algorithm for devices with limited resources. Its goal is to ensure the security of data transmission through resource-constrained devices. Impossible differential cryptanalysis is one of the most effective cryptanalysis on block ciphers, and assessing the ability of resisting this attack is a basic design criterion. Shadow is a lightweight block cipher proposed by Guo et al. (IEEE Internet Things J 8(16):13014–13023, 2021). It utilizes a combination of ARX operations and generalized Feistel structure to overcome the weakness of the traditional Feistel structure that only diffuses half in one round. In this paper, we focus on the differential property of Shadow and its security against impossible differential cryptanalysis. First, we use the SAT method to automatically search for a full-round impossible differential distinguisher of Shadow-32. Then, based on the experimental results, we prove that Shadow has a differential property with probability 1 based on the propagation of the state. Further, we can obtain an impossible differential distinguisher for an arbitrary number of rounds of Shadow. Finally, we perform a full key recovery attack on the full-round Shadow-32 and Shadow-64. Both experimentally and theoretically, our results indicate that Shadow is critically flawed, and regardless of the security strength of the internal components and the number of rounds applied, the overall cipher remains vulnerable to impossible differential cryptanalysis.

HDLBC: A lightweight block cipher with high diffusion

Both the diffusion property and the area consumption are two important evaluation criteria in the design and implementation of symmetric encryption algorithms. Many AND-Rotation-XOR (AND-RX) block ciphers are usually designed by reducing the diffusion property to minimize the area consumption. On the other hand, these AND-RX block ciphers use multiple round function operations to achieve the enough diffusion property, which always induce more area consumption in their hardware implementation. How to trade off the diffusion property and the area consumption appears to be an interesting task in the design of block cipher. In this paper, HDLBC as a new family of lightweight block cipher (with 64-bit plaintext and 64-bit/128-bit key) for the Internet of Things (IoT) is proposed. More specifically, the HDLBC is designed by using only two F-functions (RA1 and RA2), where the non-linear layer of the F-functions is constructed by the NAND operation that consumes the least area among the non-linear logic operations. To the best of our knowledge, HDLBC cipher requires the minimum number of F-functions to provide the diffusion property, where the F-functions require fewer implementation resources than the F-functions of existing similar encryption algorithms. It illustrates the hardware implementation of HDLBC cipher on SMIC 0.18μm requires only 1248 Gate Equivalents (GEs), its throughput rate is 256 Kbps at 100 KHz. Compared with other encryption algorithms, the implementation performance of HDLBC cipher achieves well-balanced in both the area consumption and diffusion property. Moreover, the security analysis shows that HDLBC cipher has enough security margin against various known attacks, such as differential cryptanalysis, linear cryptanalysis, impossible differential cryptanalysis, zero correlation cryptanalysis, etc.

Selecting Rotation Constants on SIMON-Type Ciphers

In 2013, a lightweight block cipher SIMON is proposed by NSA. This paper tries to investigate this design criterion in terms of resisting against impossible differential cryptanalysis. On one hand, starting from all the possible rotation constants, this paper sieves those “bad parameters” step by step, for each step, the regular patterns for those “bad parameters” are deduced. Accordingly, basic rules for selecting rotation constants on SIMON-type ciphers to construct shorter longest impossible differentials are proposed. On the other hand, the authors categorize the optimal parameters proposed in CRYPTO 2015, according to these results, some “good parameters” in terms of differential cryptanalysis may be rather “bad parameters” while considering impossible differential cryptanalysis. Finally, a concrete attack on 26-round SIMON(13,0,10) is proposed, which is a suggested SIMON variant in CRYPTO 2015 against differential cryptanalysis and linear cryptanalysis. The result in this paper indicates that it is very important to choose appropriate rotation constants when designing a new block cipher.

A revisited security evaluation of Simeck family ciphers against impossible differential cryptanalysis

A revisited security evaluation of Simeck family ciphers against impossible differential cryptanalysis

Differential analysis of the NBC algorithm based on mixed integer linear programming model

AbstractThis paper mainly studies mixed integer linear programming (MILP)‐based cryptanalysis on round‐reduced NBC algorithm with generalized Feistel structure. First, each component of the algorithm is equivalently described by linear inequality equations, and the propagation rules of differential characteristics and linear approximation are described, and an automatic search algorithm model of differential mode and linear mask mode based on MILP is established, and the minimum number of active S‐boxes and the corresponding differential mode and linear mask mode paths are obtained. Second, according to the NBC algorithm's 16‐bit block pull‐wire position permutation characteristics, the optimal full diffusion rounds of NBC‐128 algorithm and NBC‐256 algorithm are obtained by using approximate matrix multiplication theory to be six and eight respectively. Finally, based on the optimal number of full diffusion rounds of the algorithm, an automatic search algorithm model of impossible differential cryptanalysis is established, and the set of input differential patterns is traversed to obtain 11‐round impossible differential distinguishers of NBC‐128 algorithm and 14‐round impossible differential distinguishers of NBC‐256 algorithm respectively.

A cluster-based practical key recovery attack on reduced-round AES using impossible-differential cryptanalysis

A cluster-based practical key recovery attack on reduced-round AES using impossible-differential cryptanalysis

Impossible differential cryptanalysis of FBC-128

To promote the theory and application of cryptology, the design and implementation of cryptographic algorithms, in 2018, the Chinese Association for Cryptologic Research held the National Cryptographic Algorithm Design Competition. After the first round evaluation of security and implementation, FBC is selected one of the 10 block ciphers for the second round. FBC adopts 4-branch Extended Generalized Feistel Networks (EGFN) and it is designed with efficient implementation and good resistance against side-channel attacks. In this paper, we focus on the impossible differential attack, which is one of the most basic cryptanalytical methods, against FBC with 128-bit block size and key size (FBC-128). First, an equivalent expression with improved clarity of the round functions was derived. Then a structural property concerning the relationship among branches was explored. Combining those properties of its round function and structure, 9-round truncated impossible differentials were constructed for FBC-128, which is 2 rounds longer than previous works. Using this distinguisher, 13-round key recovery attack was mounted. The data and time complexity is 2126 chosen-plaintexts and 2122.96 encryptions respectively. To our knowledge, this is the best attack so far in terms of attacked rounds. Our attack exploited the properties of both structure and round function of FBC, and those observation and analysis would be beneficial to the understanding of FBC. Moreover, our results demonstrate when constructing impossible differentials, differentials with low hamming weight input and output difference may not always be optimal, which calls for more comprehensive analysis of the differential pattern.

A bit-vector differential model for the modular addition by a constant and its applications to differential and impossible-differential cryptanalysis.

ARX algorithms are a class of symmetric-key algorithms constructed by Addition, Rotation, and XOR. To evaluate the resistance of an ARX cipher against differential and impossible-differential cryptanalysis, the recent automated methods employ constraint satisfaction solvers to search for optimal characteristics or impossible differentials. The main difficulty in formulating this search is finding the differential models of the non-linear operations. While an efficient bit-vector differential model was obtained for the modular addition with two variable inputs, no differential model for the modular addition by a constant has been proposed so far, preventing ARX ciphers including this operation from being evaluated with automated methods. In this paper, we present the first bit-vector differential model for the n-bit modular addition by a constant input. Our model contains O(log _2(n)) basic bit-vector constraints and describes the binary logarithm of the differential probability. We describe an SMT-based automated method that includes our model to search for differential characteristics of ARX ciphers including constant additions. We also introduce a new automated method for obtaining impossible differentials where we do not search over a small pre-defined set of differences, such as low-weight differences, but let the SMT solver search through the space of differences. Moreover, we implement both methods in our open-source tool ArxPy to find characteristics and impossible differentials of ARX ciphers with constant additions in a fully automated way. As some examples, we provide related-key impossible differentials and differential characteristics of TEA, XTEA, HIGHT, LEA, SHACAL-1, and SHACAL-2, which achieve better results compared to previous works.

Multiple Impossible Differential Attacks for ForkAES

To yield a highly efficient authentication encryption design for very short messages, the tweakable forkcipher is proposed, which is a tweakable block cipher that uses forking construction to produce two output blocks. The designers also presented ForkAES, a forkcipher that is based on the round function of AES and the tweakable variant of KIASU. Therefore, the security of ForkAES is found on the block ciphers AES and KIASU. However, from the perspective of new forking construction, attackers may obtain some unique properties. Impossible differential attacks are widely used on block ciphers. This paper studies the security of ForkAES against multiple impossible differential cryptanalysis. Based on the property of the forking construction, two types of impossible differential distinguishers have been constructed. We first use the tweak with different truncated differences to build more attack trails. Then, we first propose the multiple impossible differential attack for ForkAES- <math xmlns="http://www.w3.org/1998/Math/MathML" id="M1"> <mi>∗</mi> </math> -5-4. Thus, only a single round would remain as a security margin. Utilizing multiple attack trails, our attack scenario obtains more subkey bytes and enhances the subkey’s sieving efficiency without increasing complexity. Furthermore, we carefully consider the process of recovering the master key, which can efficiently reject wrong candidate keys. In reconstruction queries, our attack reaches the longest number of rounds for ForkAES in impossible differential analysis, with <math xmlns="http://www.w3.org/1998/Math/MathML" id="M2"> <msup> <mrow> <mn>2</mn> </mrow> <mrow> <mn>100.8</mn> </mrow> </msup> </math> lookups, <math xmlns="http://www.w3.org/1998/Math/MathML" id="M3"> <msup> <mrow> <mn>2</mn> </mrow> <mrow> <mn>85.8</mn> </mrow> </msup> </math> chosen ciphertexts, and <math xmlns="http://www.w3.org/1998/Math/MathML" id="M4"> <msup> <mrow> <mn>2</mn> </mrow> <mrow> <mn>92.7</mn> </mrow> </msup> </math> memory blocks to store AES states. In encryption queries, we improve the previous attacks on ForkAES by attacking one more round (i.e., ForkAES- <math xmlns="http://www.w3.org/1998/Math/MathML" id="M5"> <mi>∗</mi> </math> -5-4), with <math xmlns="http://www.w3.org/1998/Math/MathML" id="M6"> <msup> <mrow> <mn>2</mn> </mrow> <mrow> <mn>118.2</mn> </mrow> </msup> </math> lookups, <math xmlns="http://www.w3.org/1998/Math/MathML" id="M7"> <msup> <mrow> <mn>2</mn> </mrow> <mrow> <mn>111.4</mn> </mrow> </msup> </math> plaintexts, and <math xmlns="http://www.w3.org/1998/Math/MathML" id="M8"> <msup> <mrow> <mn>2</mn> </mrow> <mrow> <mn>92.7</mn> </mrow> </msup> </math> memory blocks to store AES states.

Related-Key Multiple Impossible Differential Cryptanalysis on Full-Round LiCi-2 Designed for IoT

LiCi-2 is an ultralightweight block cipher designed for constrained IoT devices. It is a successor of LiCi and has even better performance in both software and hardware implementation. In this paper, based on the idea of related-key multiple impossible differential cryptanalysis, a key recovery attack on full-round LiCi-2 is proposed. First, an interesting property is revealed that, with a single bit difference in the related key, a 10-round differential character with probability of 1 exists on LiCi-2. With an automatic approach, the boundaries of impossible differential distinguishers in terms of single-key setting and related-key setting are explored. Under our construction method, the longest length is 8 rounds for single-key setting and 18 rounds for related-key setting. Finally, based on these 18-round distinguishers, a 25-round key recovery attack is proposed with adding 3 rounds before and 4 rounds after the distinguisher. Our attack needs one related key. The time complexity for our attack is O(2123.44), the memory complexity is O(294), and the data complexity is O(260.68). As far as we know, no full-round attack has previously been reported on LiCi-2.

Research on the Security Level of μ2 against Impossible Differential cryptanalysis

Research on the Security Level of μ2 against Impossible Differential cryptanalysis

Impossible Differential Cryptanalysis on ESF Algorithm with Simplified MILP Model

Impossible Differential Cryptanalysis on ESF Algorithm with Simplified MILP Model

Improved Impossible Differentials and Zero-Correlation Linear Hulls of New Structure III

Impossible differential cryptanalysis and zero-correlation linear cryptanalysis are two kinds of most effective tools for evaluating the security of block ciphers. In those attacks, the core step is to construct a distinguisher as long as possible. In this paper, we focus on the security of New Structure III, which is a kind of block cipher structure with excellent resistance against differential and linear attacks. While the best previous result can only exploit one-round linear layer P to construct impossible differential and zero-correlation linear distinguishers, we try to exploit more rounds to find longer distinguishers. Combining the Miss-in-the-Middle strategy and the characteristic matrix method proposed at EUROCRYPT 2016, we could construct 23-round impossible differentials and zero-correlation linear hulls when the linear layer P satisfies some restricted conditions. To our knowledge, both of them are 1 round longer than the best previous works concerning the two cryptanalytical methods. Furthermore, to show the effectiveness of our distinguishers, the linear layer of the round function is specified to the permutation matrix of block cipher SKINNY which was proposed at CRYPTO 2016. Our results indicate that New Structure III has weaker resistance against impossible differential and zero-correlation linear attacks, though it possesses good differential and linear properties.

A New Automatic Tool Searching for Impossible Differential of NIST Candidate ACE

The ACE algorithm is a candidate of the Lightweight Cryptography standardization process started by the National Institute of Standards and Technology (NIST) of the USA that passed the first round and successfully entered the second round. It is designed to achieve a balance between hardware cost and software efficiency for both authenticated encryption with associated data (AEAD) and hashing functionalities. This paper focuses on the impossible differential attack against the ACE permutation, which is the core component of the ACE algorithm. Based on the method of characteristic matrix, we build an automatic searching algorithm that can be used to search for structural impossible differentials and give the optimal permutation for ACE permutation and other SPN ciphers. We prove that there is no impossible differential of ACE permutation longer than 9 steps and construct two 8-step impossible differentials. In the end, we give the optimal word permutation against impossible differential cryptanalysis, which is π′=(2,4,1,0,3), and a safer word XOR structure of ACE permutation.

New Results in Reduced Round AES - 256 Impossible Differential Cryptanalysis

New Results in Reduced Round AES - 256 Impossible Differential Cryptanalysis

Impossible Differential Cryptanalysis of Surge

In 2018, Li Lang et al. proposed a new lightweight block cipher which is called Surge. Its block size is 64-bit, and the length of key size is 64/80/128-bit, respectively. They also proved that the cipher has good performance on security and effectively resists on differential attack, linear attack and algebraic attack. In this paper, some 4-round impossible differentials are constructed with the miss-in-the-middle method. Furthermore, 6-round impossible differential attacks are proposed on Surge- 64/Surge-80/Surge-128 algorithms based on the 4-round impossible differentials. The data complexity of the attack is 238/239/239.5 chosen plaintexts, the time complexity is 251.4/251.7/260.9 6-round encryptions, and the storage complexity is 240/240.1/249 storage units. This is the first time to make the impossible differential cryptanalysis for Surge.

More accurate results on the provable security of AES against impossible differential cryptanalysis

Whether there exist longer impossible differentials than existing ones for a block cipher, is an important problem in the provable security evaluation of a block cipher against impossible differential cryptanalysis. In this paper, we give more accurate results for this problem for the AES. After investigating the differential properties of both the S-box and the linear layer of AES, we theoretically prove that there do not exist impossible concrete differentials longer than 4 rounds for AES by proving that any concrete differential is possible for the 5-round AES, under the only assumption that the round keys are independent and uniformly random. We use a tool, called “(w, d)-Dependent Tree (DT)”, to show how any concrete differential $$\varDelta X \rightarrow \varDelta Z$$ can be connected in the middle of the 5-round AES by some DTs. Our method might shed some light on bounding the length of impossible differentials with the differential properties of the S-boxes considered for some SPN block ciphers.