Integral Attack Research Articles

Cryptanalysis of QARMAv2

QARMAv2 is a general-purpose and hardware-oriented family of lightweight tweakable block ciphers (TBCs) introduced in ToSC 2023. QARMAv2, as a redesign of QARMAv1 with a longer tweak and tighter security margins, is also designed to be suitable for cryptographic memory protection and control flow integrity. The designers of QARMAv2 provided a relatively comprehensive security analysis in the design specification, e.g., some bounds for the number of attacked rounds in differential and boomerang analysis, together with some concrete impossible differential, zerocorrelation, and integral distinguishers. As one of the first third-party cryptanalysis of QARMAv2, Hadipour et al., [HGSE24] significantly improved the integral distinguishers of QARMAv2, and provided the longest concrete distinguishers of QARMAv2 up to now. However, they provided no key recovery attack based on their distinguishers. This paper delves into the cryptanalysis of QARMAv2 to enhance our understanding of its security. Given that the integral distinguishers of QARMAv2 are the longest concrete distinguishers for this cipher so far, we focus on integral attack. To this end, we first further improve the automatic tool introduced by Hadipour et al. [HSE23,HGSE24] for finding integral distinguishers of TBCs following the TWEAKEY framework. This new tool exploits the MixColumns property of QARMAv2 to find integral distinguishers more suitable for key recovery attacks. Then, we combine several techniques for integral key recovery attacks, e.g., Meet-in-the-middle and partial-sum techniques to build a fine-grained integral key recovery attack on QARMAv2. Notably, we demonstrate how to leverage the low data complexity of the integral distinguishers of QARMAv2 to reduce the memory complexity of the meet-in-the-middle technique. As a result, we successfully present the first concrete key recovery attacks on reduced-round versions of QARMAv2. This includes attacking 13 rounds of QARMAv2-64-128 with a single tweak block (T = 1), 14 rounds of QARMAv2-64-128 with two independent tweak blocks (T = 2), and 16 rounds of QARMAv2-128-256 with two independent tweak blocks (T = 2), all in an unbalanced setting. Our attacks do not compromise the claimed security of QARMAv2, but they shed more light on the cryptanalysis of this cipher.

Integral attack on the full FUTURE block cipher

Integral attack on the full FUTURE block cipher

IVLBC: An Involutive Lightweight Block Cipher for Internet of Things

Nowadays, the use of the Internet of Things has reached a commanding height in a new round of economic and technological upsurge. Its data transmission security has attracted much attention. It is well known that substitution permutation networks (SPNs) ciphers with high diffusion are not advantageous in unified encryption and decryption circuits with extremely resources constrained. Although some research has been carried out to address this issue, there are still insufficiencies. In this article, we propose a new 64-bit lightweight block cipher based on SPN named IVLBC, whose key allows 80 and 128 bits. The components of IVLBC are involutions. In particular, we propose a Feistel with tree structure to obtain a compact and involutive S-box. Also, the nibble-based involutive permutation is proposed to obtain the involutive permutation. Decryption can reuse encrypted code and circuitry in both software and hardware implementations. We prove that the costs of IVLBC are less than PRESENT, PRINCE, Midori, I-PRESENTTM, CRAFT, etc., in unified encryption and decryption circuits. In addition, we conduct other performance tests on IVLBC such as the differential attack, linear attack, integral attack, algebraic attack, invariant attacks, etc.

Analysis of ARX encryption schemes resistance to the integral attack and impracticable differentials attack

Common ARX (Addition-Rotation-XOR) encryption algorithms are analyzed. These algorithms are Chacha, Speckey, Simon, Chaskey, Sparkle. These algorithms use three basic operations: modular addition, XOR addition, and rotation. 16-bit reduced models of these algorithms are developed, methods of analysis are selected and developed, and the analysis of the resistance of these algorithms to the most effective attacks (integral attack and attack of impossible differentials) for this class of algorithms is performed. According to the selected indicator – the number of elementary operations that is necessary to obtain parameters of random substitution and the absence of impossible differentials and integrals – the most effective ARX algorithms are determined. These are Speckey, which operates on two 8-bit subblocks and requires 36 elementary operations, and Chaskey, which operates on four 4-bit subblocks and requires 72 elementary operations. If we assume that one 8-bit operation is equivalent to two 4-bit operations, then these schemes are equal in terms of the chosen indicator. The worst performers were the 8-bit Simon scheme and the 4-bit ChaCha scheme, which require almost twice as many operations as the best schemes. A conclusion was also made about the importance of using not one, but several XOR operations of key addition for the overall cryptographic strength of ARX algorithms.

Quantum Algorithm to Identify Division Property of a Multiset

Division property-based integral attack is the generalization of integral property developed by blending saturation attack and higher-order differential attack. This attack is considered as a chosen-plaintext attack because the cryptanalyst generates a multiset of plaintext which possesses a certain division property. However, in real-world applications, it is required to find the division property of a given multiset which turns the attack into a known-plaintext attack. The problem, finding the division property of a given multiset $$\mathbb {X}$$ of size $$|\mathbb {X}|$$ with each element of n-bit, when solved on a classical computer has the time complexity of $$O(n2^n|\mathbb {X}|)$$ (fixed in both average and worst cases). In this paper, a better and comparable algorithm using quantum computing is presented along with its quantum oracle designs that can find the correct division property of a multiset in the average case time complexity of $$O \left( \log (n)2^n\sqrt{|\mathbb {X}|} \right) $$ and worst case time complexity of $$O\left( \log (n) 2^n|\mathbb {X}| \right) $$ using $$\left( n + \lceil \log |\mathbb {X}|\rceil + p \right) $$ -qubits, where p are the precision qubits required by the quantum counting subroutine.

New Division Property Propagation Table: Applications to Block Ciphers with Large S-boxes

Abstract The division property method is a technique for automatic searching integral distinguishers on block ciphers. Previous methods only use word-based division property to search integral distinguishers for block ciphers with large S-boxes. Since using bit-based division property may find longer integral distinguishers than word-based division property, we propose a method to automatically search the integral distinguishers based on bit-based division property for block ciphers with large S-boxes. To achieve this goal, we propose a new division property propagation table for S-boxes. Theoretically, we prove that using both the new table and the traditional method to describe the bit-based division property propagation rule of S-box will lead to the same integral distinguishers. Technically, we design a mixed-integer linear programming-based tool to search the integral distinguisher based on the new table, which helps to search new integral distinguishers for block ciphers with large S-boxes efficiently. As a result, we apply our tool to derive new integral distinguishers and get the tight bound on the rounds that no integral distinguishers exist for ICEBERG, KHAZAD, Camellia, CS-Cipher, ITUbee and SMS4. Besides, to show the availability of our integral distinguishers, we form the present best five-round and the first six-round integral attack for ICEBERG as an example.

Research on the Security Criterion of S‐Boxes Against Division Property

As a generalized integral property, division property was proposed by Todo at EUROCRYPT 2015. We propose a new security criterion of S-boxes against division property and prove that it is invariant under permutation-xor equivalence. Based on the criterion, the division properties of some important 4-bit S-boxes are showed. Then, we apply it to improve the resistance of ciphers against division-property-based integral attacks while keeping the same security level against other attacks. Specifically, the resistance of the cipher PRESENT against division-property-based integral attack is improved by 2 rounds, and the resistance of the cipher LBlock against division-property-based integral attack is improved by 1 round.

Improved integral attacks on 24‐round LBlock and LBlock‐s

LBlock is a lightweight block cipher with Feistel-SP structure proposed by Wu and Zhang in Applied Cryptography and Network Security 2011, and a modified version LBlock-s is used later in the design of the lightweight authenticated encryption cipher LAC, one of the CAESAR candidates. The best known integral attack on LBlock is presented by Zhang and Wu which can attack 23-round LBlock based on a 16-round integral distinguisher found with division property. In Selected Areas in Cryptography 2018, Eskandari et al. further presented a 17-round integral distinguisher of LBlock with bit-based division property using SAT solver. Using their method, the authors further find some new 17-round integral distinguishers of LBlock and use one of them to present a 24-round integral attack on LBlock. Similarly, they also find some 17-round integral distinguishers of LBlock-s and select one to present a 24-round integral attack on LBlock-s. In this way, they have improved known single-key attacks on LBlock and LBlock-s by one round.

Integral Attack on Reduced-Round BORON Based on Bit-Based Division Property

BORON is a 64-bit block cipher with 80 and 128-bit key length proposed by Bansod et al (Frontiers of Information Technology & Electronic Engineering). Integral attack is one of the typical cryptographic analysis methods of block cipher. In this paper, we establish a MILP (mixed integer linear programming) model of BORON based on bit-based division. We get a 6-round integral distinguisher, which is the longest integral distinguisher of BORON. Based on 6-round distinguisher, we can attack 7-round BORON with time complex 254.19 and data complex 254, 8-round BORON with time complex 258.34 and data complex 256.32, and 9-round BORON with time complex 294.06 and data complex 257.90. This is the first security assessment of BORON in integral nature.

Cryptanalysis of PRIMATEs

PRIMATEs is a family of authenticated encryption design submitted to competition for authenticated encryption: security, applicability, and robustness. The three modes of operation in PRIMATEs family are: APE, HANUMAN, GIBBON with security levels: 80, 120 bits. APE is robust despite the nonce misusing. In this study, we revise the algebraic model and find new integral distinguishers for both PRIMATE permutation and its inverse permutation. Moreover, we construct a zero-sum distinguisher for full 12-round PRIMATE-80/120 permutation with the $2^{100}/2^{105}$ complexity, improving over previous work. We also perform an integral attack on 8-round finalization of APE-80/120 with $2^{30}$ chosen messages. The key recovery process is optimized using the FFT technique presented by Todo and Aoki. Our work is the best attack against APE, demonstrating the practical attack on 8-round finalization of APE-80. The new integral distinguishers apply to create forgeries on 5/6-round finalization of APE and HANUMAN that require $2^{15}/2^{30}$ chosen messages, which is the first forgery attack against APE and HANUMAN.

Improved Integral Attack on Reduced-Round Simeck

Simeck, a family of lightweight block ciphers utilizing Simon-like structure, is widely used under resource constrained environment. So far, many cryptanalysis methods have been used to attack Simeck. In this paper, we give the new results of integral cryptanalysis on reduced-round Simeck. First, the exact algebraic degree of Simeck32 is given by parallel computing, and then the 13-round theoretical integral distinguisher is proposed to attack 20-round Simeck32(64). Besides, by using the equivalent-subkey and partial-sum technology, combined with the meet-in-the-middle strategy and subkey relationship, the 22-round Simeck32(64) integral attack is first proposed based on the 15-round integral distinguisher. Furthermore, based on 18-round and 21-round integral distinguishers, the new integral attacks on 26-round Simeck48(96) and 30-round Simeck64(128) are proposed, respectively. These new attacks greatly improve the results of the previous integral attacks for Simeck.

Cryptanalysis of Reduced-Round SPECK

SPECK, a family of lightweight block ciphers proposed by the National Security Agency (NSA), is widely used under resource constrained environment. There are many cryptanalytic results on SPECK concentrated on differential and linear attacks. However, the security evaluation against other popular cryptanalysis methods seems to lag behind. In this paper, we investigate both the security of SPECK against impossible differential, zero-correlation linear, and integral attacks as well as the design choice of NSA. First, we construct the satisfiability (SAT)-based model to automatically search impossible differentials and zero-correlation linear hulls and then obtain several integral distinguishers based on the links between the zero-correlation linear hull and integral distinguisher. Second, based on the new distinguishers, we propose the first zero-correlation attack on 11-round SPECK64 and integral attack on 11-round SPECK32, SPECK48, and SPECK64 by exploring the iterated expression of the modulo subtraction operation and utilizing the partial-sum technique. Finally, we study the design principle of the rotation parameters selection of SPECK32. We show that SPECK32 with parameters (8, 3) is better than SPECK32 with the original parameters (7, 2) with respect to security against impossible differential, zero-correlation linear and integral cryptanalysis.

Improved integral attacks without full codebook

The integral attack, exploits the balanced property of the output in the distinguisher. Usually, adversaries append some rounds after the distinguisher, guess the corresponding key bits and check whether the target bits are balanced. Few works add rounds before the distinguisher to make the key recovery attack. In the first full-round attack on MISTY1, Todo adds one FL layer (key-dependent linear function) before the distinguisher. In this study, the authors extend his method and give a general method, which they can use to extend some rounds (non-linear) before the distinguisher to attack more rounds with data complexity smaller than the whole space and little extra time consumption. The basic idea is that for different subkeys guessed in the forward rounds, they set different constant values for the input of the distinguisher. Finally, the selected data space is not full. For substitution permutation network (SPN) (Feistel with SPN round function) structures with 4 bit S-box and bit permutation, they estimate the data complexity when adding one round before the distinguishers for all 4 bit S-boxes. Using the method, they improve the integral attacks on PRESENT, RECTANGLE, TWINE and LBlock, and their results could cover one more round.

Statistical integral distinguisher with multi-structure and its application on AES-like ciphers

Integral attack is one of the most powerful tools in the field of symmetric ciphers. In order to reduce the time complexity of original integral one, Wang et al. firstly proposed a statistical integral distinguisher at FSE’16. However, they don’t consider the cases that there are several integral properties on output and multiple structures of data should be used at the same time. In terms of such cases, we put forward a new statistical integral distinguisher, which enables us to reduce the data complexity comparing to the traditional integral ones under multiple structures. As illustrations, we use it into the known-key distinguishers on AES-like ciphers including AES and the permutations of Whirlpool, PHOTON and Grostl-256 hash functions based on the Gilbert’s work at ASIACRYPT’14. These new distinguishers are the best ones comparing with previous ones under known-key setting. Moreover, we propose a secret-key distinguisher on 5-round AES under chosen-ciphertext mode. Its data, time and memory complexities are 2114.32 chosen ciphertexts, 2110 encryptions and 233.32 blocks. This is the best integral distinguisher on AES with secret S-box under secret-key setting so far.

Structural Attack on Reduced-Round Skipjack

In this paper, we present a new structure-recovery cryptanalysis against 16-round Skipjack-like structure in which all the inner transformations are unknown. Our attack is divided into three phases. In the first phase, we use yoyo game to recover the outermost round functions. In the second phase, we use integral attack to achieve the round functions in round 2/3/4/13/14/15. A series of equations based on integral distinguishers is established to recover these inner transformations. However, effective integral distinguishers cannot be constructed for shorter rounds. For this reason, we propose a guess and determine attack to recover the residue round functions in the third phase. For $n$ -bit Skipjack-like cipher, our attack can be executed within time complexity $O(2^{2.81\times n/4})$ and data complexity $O(2^{n/2})$ , and thus can lead to a practical attack against 16-round Skipjack cipher.

New integral attacks on SIMON

SIMON is a family of lightweight block ciphers publicly released by National Security Agency (NSA). Up to now, there have been many cryptanalytic results on it by means of impossible differential, integral, zero-correlation linear cryptanalysis and so forth. In this study, the authors analyse the characteristic of the Boolean functions of SIMON32 and find that the presentation of zero-sum property is influenced by the degree of the corresponding Boolean function. As a result, the zero-sum integral distinguisher for 14-round SIMON32 is identified which is same to the one given by Wang et.al. Inspired by this finding, they also experimentally find the zero-sum integral distinguisher for 16-round SIMON48. Then, the integral attacks on 22-round SIMON32, 22-round SIMON48/72 and 23-round SIMON48/96 are given. They improve the previous integral attack on SIMON32 from 21-round to 22-round, and the first integral attack on SIMON48 is proposed.

Statistical integral attack on CAST-256 and IDEA

Integral attack, as a powerful technique in the cryptanalysis field, has been widely utilized to evaluate the security of block ciphers. Integral distinguisher is based on balanced property on output with probability one. To obtain a distinguisher covering more rounds, an attacker will usually increase the data complexity by iterating through all values of more bits of plaintexts under the firm limitation that the data complexity should be less than the whole plaintext space. In order to release the limitation and reduce the data complexity, Wang et al. proposed a statistical integral distinguisher at FSE’16. In this paper, we exploit the statistical integral distinguisher to attack the IDEA and CAST-256 block ciphers. As a result, we manage to mount a key recovery attack on 29-round CAST-256 with 296.8 chosen plaintexts, 2219.4 encryptions and 273 bytes of memory. By making a trade-off between the time complexity and data complexity, the attack can be achieved by 283.9 chosen plaintexts, 2244.4 encryptions and 266 bytes of memory. As far as we know, these are the best attacks on CAST-256 in the single-key model without weak-key assumption so far. What’s more, we find an integral distinguisher of IDEA block cipher, which is the longest integral distinguisher known to now. By taking advantage of this distinguisher, we achieve a key recovery attack on 4.5-round IDEA with 258.5 known plaintexts, 2120.9 encryptions and 246.6 bytes of memory respectively. It is the best integral attack with respect to the number of rounds.

Diffusion and Security Evaluation of Feistel‐PG

Feistel-PG structure is a new specific Generalized Feistel structure (GFS) adopted in DBlock and LHash. Its main feature is adding a sbox-size permutation before the round function. Different choices of the permutation may affect the security property of ciphers with Feistel-PG structure but how it effects is not clear. We evaluate the values of diffusion round for all possible parameters and summarize the characteristics of optimum shuffles. The results show that one special kind of Feistel-PG achieves full diffusion in less cost than the improved GFS. This advantage may attract the designers' interests and this kind of Feistel-PG ciphers are suggested to designers. We also evaluate the security of suggested ciphers against various byte-oriented attacks, including differential cryptanalysis, linear cryptanalysis, impossible differential attack and integral attack. Some permutations with optimum diffusion but relatively weaker security are filtered out and these permutations should be avoided by designers.

Security Analysis of Cipher ICEBERG against Bit-pattern Based Integral Attack

Significant progress in the development of lightweight symmetric cryptographic primitives has been made in recent years. Security of ciphers against current cryptanalysis methods should be carefully evaluated. Integral attack is one of the most effective attacks against block ciphers. However, traditional integral attack based on byte or word is not available for a bit-oriented cipher. Bit-pattern based integral attack technique, introduced by Z'aba et al. addresses this issue to some extent. In this paper, bit-pattern based integral attack is applied to ICEBERG—a lightweight block cipher efficient in reconfigurable hard-ware. By tracing the propagation of the plaintext structure at bit-level, the balance property is obtained and then key guesses are verified. The result shows that 3, 4 and 5 rounds ICEBERG are not immune to this attack. All attacks presented in this paper manage to recover the full subkeys of the final round.

Fast Fourier Transform Key Recovery for Integral Attacks

An integral attack is one of the most powerful attacks against block ciphers. We propose a new technique for the integral attack called the Fast Fourier Transform (FFT) key recovery. When N chosen plaintexts are required for the integral characteristic and the guessed key is k bits, a straightforward key recovery requires the time complexity of O(N2k). However, the FFT key recovery only requires the time complexity of O(N+k2k). As a previous result using FFT, at ICISC 2007, Collard etal proposed that FFT can reduce the time complexity of a linear attack. We show that FFT can also reduce the complexity of the integral attack. Moreover, the estimation of the complexity is very simple. We first show the complexity of the FFT key recovery against three structures, the Even-Mansour scheme, a key-alternating cipher, and the Feistel structure. As examples of these structures, we show integral attacks against Prøst, AES, PRESENT, and CLEFIA. As a result, an 8-round Prøst P128,K can be attacked with about an approximate time complexity of 279.6. For the key-alternating cipher, a 6-round AES and a 10-round PRESENT can be attacked with approximate time complexities of 251.7 and 297.4, respectively. For the Feistel structure, a 12-round CLEFIA can be attacked with approximate time complexities of 287.5.