Linear Cryptanalysis Research Articles

Almost pairwise independence and resilience to deep learning attacks

Almost pairwise independence (API) is a quantitative property of a class of functions that is desirable in many cryptographic applications. This property is satisfied by Learning with errors (LWE)-mappings and by special Substitution-Permutation Networks (SPN). API block ciphers are known to be resilient to differential and linear cryptanalysis attacks. Recently, security of protocols against neural network-based attacks became a major trend in cryptographic studies. Therefore, it is relevant to study the hardness of learning a target function from an API class of functions by gradient-based methods. We propose a theoretical analysis based on the study of the variance of the gradient of a general machine learning objective with respect to a random choice of target function from a class. We prove an upper bound and verify that, indeed, such a variance is extremely small for API classes of functions. This implies the resilience of actual LWE-based primitives against deep learning attacks, and to some extent, the security of SPNs. The hardness of learning reveals itself in the form of the barren plateau phenomenon during the training process, or in other words, in a low information content of the gradient about the target function. Yet, we emphasize that our bounds hold for the case of a regular parameterization of a neural network and the gradient may become informative if a class is mildly pairwise independent and a parameterization is non-regular. We demonstrate our theory in experiments on the learnability of LWE mappings.

Multidimensional zero-correlation linear cryptanalysis on uBlock and RAIN

uBlock and RAIN are both SPN structure lightweight block ciphers with sufficient security against traditional attacks. This article mainly focuses on the zero-correlation linear cryptanalysis of uBlock-128/128 and RAIN-64 without considering the whitening key for the first time. On the one hand, combining the linear mask propagation rules of S-box with matrix method, a large number of 4-round zero-correlation linear approximations for uBlock-128/128 are obtained. Therefore, a 6-round key recovery attack is carried out with partial-compression technique, which can recover 48-bit subkeys with data complexity 2 126.41 known plaintexts, time complexity 2 122.82 times of 6-round of algorithm encryptions, and memory complexity 2 48 nibbles. On the other hand, a similar method is used on RAIN-64, thus a 10-round attack is performed, which recovers 64-bit subkeys with data complexity 2 61.95 known plaintexts, time complexity 2 74.26 times of 10-round algorithm encryptions, and memory complexity 2 64 nibbles. The results show that both uBlock and RAIN are safe enough to resist zero-correlation linear cryptanalysis.

Utilizing FWT in linear cryptanalysis of block ciphers with various structures

Utilizing FWT in linear cryptanalysis of block ciphers with various structures

Theoretical Linear Cryptanalysis of the 5G Standard Candidate SNOW 5G

In this paper, we perform linear cryptanalysis of the stream cipher SNOW 5G, which is recommended by the international standardization group (SAGE) as one standard algorithm for 5G confidentiality and integrity protection over the wireless channel. SNOW 5G can be regarded as one member of the SNOW-V family, as it is modified from SNOW-Vi by SAGE with a slight improvement. As an overall contribution, we provide a comprehensive and elaborate theoretical analysis of linear approximations of SNOW 5G and provide the best public cryptanalysis result by far. Specifically, we first theoretically analyze the formats of linear masks of SNOW5G that can introduce high correlations, and then search for high-quality linear masks using a divide-and-conquer method based on the different cases of a critical intermediate linear mask. We find a linear approximation of SNOW 5G with correlation −2−67.67 and further launch a correlation attack against it with complexity 2279.8, improving the existing best correlation attack by a factor of 232.4. Our results are mainly from theoretical analysis, which involve little computation overhead and help to better understand the security of SNOW 5G.

Automated Differential-Linear Cryptanalysis for AND-RX Ciphers

Differential and linear cryptanalysis are two important methods to evaluate the security of block ciphers. Building on these two methods, differential-linear (DL) cryptanalysis was introduced by Langford and Hellman in 1994. This cryptanalytic method has been not only extensively researched but also proven to be effective. In this paper, a security evaluation framework for AND-RX ciphers against DL cryptanalysis is proposed, which is denoted as K6. In addition to modeling the structure of all the possible differential trails and linear trails at the bit level, we introduce a method to calculate this structure round by round. Based on this approach, an automatic algorithm is proposed to construct the DL distinguisher. Unlike previous methods, K6 uses a truncated differential and a linear hull instead of a differential characteristic and a linear approximation, which brings the bias of the DL distinguisher close to the experimental value. To validate the effectiveness of the framework, K6 is applied to Simon and Simeck, which are two typical AND-RX ciphers. With the automatic algorithm, we discover an 11-round DL distinguisher of Simon32 with bias 2−14.89 and a 12-round DL distinguisher of Simeck32 with bias 2−14.89. Moreover, the 14-round DL distinguisher of Simon48 with bias 2−22.30 is longer than the longest DL distinguisher currently known. In addition, the framework K6 shows advantages when analyzing ciphers with large block sizes. As far as we know, for Simon64/96/128 and Simeck48/64, the first DL distinguishers are obtained with our framework. The DL distinguishers are 16, 23, 32, 17, and 22 rounds of Simon64/96/128 and Simeck48/64 with bias 2−24.31, 2−47.57, 2−60.75, 2−22.54, and 2−31.41, respectively. To prove the correctness of distinguishers, experiments on Simon32 and Simeck32 have been performed. The experimental bias are 2−13.76 and 2−14.82, respectively. Comparisons of the theoretical and experimental results show good agreement.

Semi-Permanent Stuck-At Fault injection attacks on Elephant and GIFT lightweight ciphers

Fault attacks pose a potent threat to modern cryptographic implementations, particularly those used in physically approachable embedded devices in IoT environments. Information security in such resource-constrained devices is ensured using lightweight ciphers, where combinational circuit implementations of SBox are preferable over look-up tables (LUT) as they are more efficient regarding area, power, and memory requirements. Most existing fault analysis techniques focus on fault injection in memory cells and registers. Recently, a novel fault model and analysis technique, namely Semi-Permanent Stuck-At (SPSA) fault analysis, has been proposed to evaluate the security of ciphers with combinational circuit implementation of Substitution layer elements, SBox. In this work, we propose optimized techniques to recover the key in a minimum number of ciphertexts in such implementations of lightweight ciphers. Based on the proposed techniques, a key recovery attack on the NIST lightweight cryptography (NIST-LWC) standardization process finalist, Elephant AEAD, has been proposed. The proposed key recovery attack is validated on two versions of Elephant cipher. The proposed fault analysis approach recovered the secret key within 85 − 240 ciphertexts, calculated over 1000 attack instances. To the best of our knowledge, this is the first work on fault analysis attacks on the Elephant scheme. Furthermore, an optimized combinational circuit implementation of Spongent SBox (SBox used in Elephant cipher) is proposed, having a smaller gate count than the optimized implementation reported in the literature. The proposed fault analysis techniques are validated on primary and optimized versions of Spongent SBox through Verilog simulations. Further, we pinpoint SPSA hotspots in the lightweight GIFT cipher SBox architecture. We observe that GIFT SBox exhibits resilience towards the proposed SPSA fault analysis technique under the single fault adversarial model. However, eight SPSA fault patterns reduce the nonlinearity of the SBox to zero, rendering it vulnerable to linear cryptanalysis. Conclusively, SPSA faults may adversely affect the cryptographic properties of an SBox, thereby leading to trivial key recovery. The GIFT cipher is used as an example to focus on two aspects: i) its SBox construction is resilient to the proposed SPSA analysis and therefore characterizing such constructions for SPSA resilience and, ii) an SBox even though resilient to the proposed SPSA analysis, may exhibit vulnerabilities towards other classical analysis techniques when subjected to SPSA faults. Our work reports new vulnerabilities in fault analysis in the combinational circuit implementations of cryptographic protocols.

DRcipher: A pseudo-random dynamic round lightweight block cipher

The Internet of Things (IoT) has gained popularity in various fields, including components such as embedded devices and wireless sensors. However, ensuring the security of data transmission from these devices is of critical importance. In light of these challenges, a novel lightweight encryption method called DRcipher is proposed in this paper for resource-constrained IoT devices. DRcipher has a 64-bit block size and supports either 96-bit or 128-bit key sizes. In order to improve the security, DRcipher employs a pseudo-random number of encryption rounds determined by the primary key. DRcipher adopts the structure of Generalized Feistel Network (GFN) with 4 branches, and its round functions consist of F-function, FF-function and RP permutation components. In particular, there is a negative feedback mechanism between the FF-function and the overall round of encryption functions. In addition, DRcipher is synthesised using Synopsys Design Compiler version A-2007.12-SP1 and the UMCL18G212T3 standard cell library. DRcipher-96 has an area footprint of 1546 Gate Equivalents (GE), while DRcipher-128 has a slightly larger area footprint of 1646 GE. Moreover, a comprehensive security analysis shows that the proposed DRcipher ensures high-level security redundancy against differential cryptanalysis, linear cryptanalysis, and so on.

Algebraic Attacks on RAIN and AIM Using Equivalent Representations

Designing novel symmetric-key primitives for advanced protocols like secure multiparty computation (MPC), fully homomorphic encryption (FHE) and zero-knowledge proof systems (ZK), has been an important research topic in recent years. Many such existing primitives adopt quite different design strategies from conventional block ciphers. Notable features include that many of these ciphers are defined over a large finite field, and that a power map is commonly used to construct the nonlinear component due to its efficiency in these applications as well as its strong resistance against the differential and linear cryptanalysis. In this paper, we target the MPC-friendly ciphers AIM and RAIN used for the post-quantum signature schemes AIMer (CCS 2023 and NIST PQC Round 1 Additional Signatures) and Rainier (CCS 2022), respectively. Specifically, we can find equivalent representations of 2-round RAIN and full-round AIM, respectively, which make them vulnerable to either the polynomial method, or the crossbred algorithm, or the fast exhaustive search attack. Consequently, we can break 2-round RAIN with the 128/192/256-bit key in only 2111/2170/2225 bit operations. For full-round AIM with the 128/192/256-bit key, we could break them in 2136.2/2200.7/2265 bit operations, which are equivalent to about 2115/2178/2241 calls of the underlying primitives. In particular, our analysis indicates that AIM does not reach the required security levels by the NIST competition.

Multidimensional Linear Cryptanalysis of Feistel Ciphers

This paper presents new generic attacks on Feistel ciphers that incorporate the key addition at the input of the non-invertible round function only. This feature leads to a specific vulnerability that can be exploited using multidimensional linear cryptanalysis. More specifically, our approach involves using key-independent linear trails so that the distribution of a combination of the plaintext and ciphertext can be computed. This makes it possible to use the likelihood-ratio test as opposed to the χ2 test. We provide theoretical estimates of the cost of our generic attacks and verify these experimentally by applying the attacks to CAST-128 and LOKI91. The theoretical and experimental findings demonstrate that the proposed attacks lead to significant reductions in data-complexity in several interesting cases.

SAT-Based Security Evaluation for WARP against Linear Cryptanalysis

SAT-Based Security Evaluation for WARP against Linear Cryptanalysis

Blocking Linear Cryptanalysis Attacks Found on Cryptographic Algorithms Used on Internet of Thing Based on the Novel Approaches of Using Galois Field (GF (232)) and High Irreducible Polynomials

Attacks on the Internet of Things (IoT) are not highly considered during the design and implementation. The prioritization is making profits and supplying services to clients. Most cryptographic algorithms that are commonly used on the IoT are vulnerable to attacks such as linear, differential, differential–linear cryptanalysis attacks, and many more. In this study, we focus only on linear cryptanalysis attacks. Little has been achieved (by other researchers) to prevent or block linear cryptanalysis attacks on cryptographic algorithms used on the IoT. In this study, we managed to block the linear cryptanalysis attack using a mathematically novel approach called Galois Field of the order (232), denoted by GF (232), and high irreducible polynomials were used to re-construct weak substitution boxes (S-Box) of mostly cryptographic algorithms used on IoT. It is a novel approach because no one has ever used GF (232) and highly irreducible polynomials to block linear cryptanalysis attacks on the most commonly used cryptographic algorithms. The most commonly used cryptographic algorithms on the IoT are Advanced Encryption Standard (AES), BLOWFISH, CAMELLIA, CAST, CLEFIA, Data Encryption Standard (DES), Modular Multiplication-based Block (MMB), RC5, SERPENT, and SKIPJACK. We assume that the reader of this paper has basic knowledge of the above algorithms.

An innovative approach for dynamic key dependent S-Box to enhance security of IoT systems

The Internet of Things (IoT) foresees pervasive and connected smart nodes that interact independently while offering varied services. Today, IoT nodes are a treasure house of data and hence security has become a major concern in IoT networks. Conventional cryptography faces many challenges during implementation in IoT devices. These challenges can be tackled by lightweight cryptography which is highly secure with less resource requirements. The vital characteristic of security is fulfilled by one out of 6 inner structures such as Substitution-Permutation Network, Feistel Network, General Feistel Network, Add-Rotate-XOR, Non Linear-Feedback Shift Register and Hybrid. PRESENT, which is a NIST approved lightweight cryptographic algorithm with SPN structure uses fixed or static S-Box. This permits attackers to explore S-Box and identify weaknesses of the algorithm. Key dependent approaches are better because it impedes an attacker from any offline analyses of attacks on the S-Box. Additionally, this is susceptible to linear and differential attacks. The static S Box does not possess superior diffusion and does not have a good rate of avalanche effect. So, the solution is to create a robust dynamic key dependent algorithm with nonlinear S-Boxes to secure the communication between IoT devices and platform. Security analysis is done on Non-linearity, Differential and Linear Cryptanalysis and Avalanche characteristics, besides, encryption of IoT data to demonstrate its aptness for cold chain security applications.© 2017 Elsevier Inc. All rights reserved.

HDLBC: A lightweight block cipher with high diffusion

Both the diffusion property and the area consumption are two important evaluation criteria in the design and implementation of symmetric encryption algorithms. Many AND-Rotation-XOR (AND-RX) block ciphers are usually designed by reducing the diffusion property to minimize the area consumption. On the other hand, these AND-RX block ciphers use multiple round function operations to achieve the enough diffusion property, which always induce more area consumption in their hardware implementation. How to trade off the diffusion property and the area consumption appears to be an interesting task in the design of block cipher. In this paper, HDLBC as a new family of lightweight block cipher (with 64-bit plaintext and 64-bit/128-bit key) for the Internet of Things (IoT) is proposed. More specifically, the HDLBC is designed by using only two F-functions (RA1 and RA2), where the non-linear layer of the F-functions is constructed by the NAND operation that consumes the least area among the non-linear logic operations. To the best of our knowledge, HDLBC cipher requires the minimum number of F-functions to provide the diffusion property, where the F-functions require fewer implementation resources than the F-functions of existing similar encryption algorithms. It illustrates the hardware implementation of HDLBC cipher on SMIC 0.18μm requires only 1248 Gate Equivalents (GEs), its throughput rate is 256 Kbps at 100 KHz. Compared with other encryption algorithms, the implementation performance of HDLBC cipher achieves well-balanced in both the area consumption and diffusion property. Moreover, the security analysis shows that HDLBC cipher has enough security margin against various known attacks, such as differential cryptanalysis, linear cryptanalysis, impossible differential cryptanalysis, zero correlation cryptanalysis, etc.

An effective cryptanalysis of DES for secure communication using hybrid cryptanalysis and deep neural network

SummaryIn today's world, information security plays a key role in data storage and communication owing to the modern evolution of digitized data interchange in electronic mode. Cryptography is a widely preferred technique for securing transmitted information by transforming the original text into cipher text. A few cryptographic techniques have the inability to protect the data which are vulnerable to a distinct class of attacks. Therefore, a reliable cryptographic technique is necessitated for enlarging information security. In this paper, a new hybrid cryptanalysis (HCA) model has been proposed to acquire optimal cryptanalysis of data encryption standard (DES). It combines linear cryptanalysis (LCA) and neural cryptanalysis (NCA) for enhancing the performance of the cryptographic system with minimal time complexity. Primarily, the HCA model employs LCA to break cryptographic codes by analyzing linear approximations of the cryptographic algorithm. NCA is then applied with the aid of a deep neural network for identifying patterns in larger datasets. These patterns can be further utilized to break encryption. The efficacy of the proposed HCA model will be assessed through the assessment of three different datasets. The results manifest that the accuracy of the proposed model is increased up to 97.66% and the time needed to break encryption can be reduced.

Differential and Linear properties of vectorial boolean functions based on chi

To evaluate the security of a cryptographic primitive, investigating its resistance against differential and linear cryptanalysis is required. Many modern cryptographic primitives repeatedly apply similar round functions alternated with the addition of round keys or constants. A round function usually consists of a non-linear mapping and a number of linear mappings. The non-linear mapping χ\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\chi$$\\end{document} is used in different cryptographic primitives such as Keccak and Subterranean. An alternative version of χ\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\chi$$\\end{document} is used in Ascon and the non-linear layer of Simon has the same differential and linear properties of χ\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\chi$$\\end{document}. The mapping χ\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\chi$$\\end{document} can be applied to strings with different lengths. For instance, it can be parallelly applied to small-length strings as in Keccak, where it works on 5-bit strings, or it can be applied to big-length strings as in Subterranean, where it works on a string of length 257. Investigating the differential and linear properties of χ\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\chi$$\\end{document} working on alternative lengths of strings, provides useful information to designers to make a better choice for the non-linear layer. Some differential properties of χ\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\chi$$\\end{document} have been analyzed in [8] and in this work we provide a revised presentation of them. We then extend this study and we analyze linear propagation properties of χ\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\chi$$\\end{document}. Thanks to these additional results, we extend the comparison between the application of parallel instances of χ\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\chi$$\\end{document} on small-length strings and the application of a single instance of χ\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\chi$$\\end{document} on a big-length string. We show how we can apply the results of this study also to the non-linear layers of Ascon and Simon thanks to their affine-equivalence with χ\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\chi$$\\end{document}.

Generation of Nonlinear Substitutions by Simulated Annealing Algorithm

The problem of nonlinear substitution generation (S-boxes) is investigated in many related works in symmetric key cryptography. In particular, the strength of symmetric ciphers to linear cryptanalysis is directly related to the nonlinearity of substitution. In addition to being highly nonlinear, S-boxes must be random, i.e., must not contain hidden mathematical constructs that facilitate algebraic cryptanalysis. The generation of such substitutions is a complex combinatorial optimization problem. Probabilistic algorithms are used to solve it, for instance the simulated annealing algorithm, which is well-fitted to a discrete search space. We propose a new cost function based on Walsh–Hadamard spectrum computation, and investigate the search efficiency of S-boxes using a simulated annealing algorithm. For this purpose, we conduct numerous experiments with different input parameters: initial temperature, cooling coefficient, number of internal and external loops. As the results of the research show, applying the new cost function allows for the rapid generation of nonlinear substitutions. To find 8-bit bijective S-boxes with nonlinearity 104, we need about 83,000 iterations. At the same time, the probability of finding the target result is 100%.

An Efficient Substitution Box design with a chaotic logistic map and Linear Congruential Generator for secure communication in Smart cities

The study provides a unique method for creating an efficient substitution box (S-box) for advanced encryption standards using a Chaotic Logistic Map (CLM) and a Linear Congruential Generator (LCG) (AES) for secure communications in a smart city. The Pseudo-Random Number Generator (PRNG), which is further examined, is constructed using an extensive search of reasonable possibilities for the initial seed and set parameters. Using statistical testing, the performance analysis of the new S-box is assessed. Additionally, the resilience of differential, as well as linear cryptanalysis, is shown. It is derived using other features, including nonlinearity, the Bit Independence Criterion (BIC), and the Strict Avalanche Criterion (SAC). The suggested S-box has good potential and is usable for symmetric key cryptography, according to the features of the new S-cryptographic box.

A Substitution Box for Lightweight Ciphers to Secure Internet of Things

The Internet of Things is a resource-constrained device that demands lightweight cryptographic solutions to achieve high performance and optimal security. In lightweight ciphers Substitution Box (S-box) plays an important role as it enables confusion property. However, it is one of the costlier operations. The design and construction of such S-boxes for Internet of Things (IoT) devices are crucial..Hence, we propose a 4-bit, highly Nonlinear, Bijective, Balanced S-box called Feather S-box to enable confusion in lightweight ciphers. The hardware performance of Feather S-Box is analysed in terms of Area and Critical Path-Delay cost. While examining the Area Delay-Product and Power-Delay Product, it shows 23% and 19% lower than PRESENT cipher and 12% lesser than GIFT and KATAN ciphers. The security analysis of the proposed S-Box is also done in terms of Nonlinearity, Bijective, Balanced, Global Avalanche characteristics, resistance to Algebraic attack, Side-channel attacks, Differential and Linear Cryptanalysis. The Feather S-box also exhibts good cryptographic properties such as Nonlinearity and immunity against Algebraic attacks. Moreover, it offers good resistance against Side-channel attack, Differential and Linear Cryptanalysis. We also observed that the Feather S-box has the highest immunity against Differential and Linear Cryptanalysis except for the SKINNY cipher.

Demonstration and Implementation of Quantum Computing in Cryptanalysis

Quantum computing has long been a hot topic in both fields of physics and computer science. As a matter of fact, most of the earliest quantum algorithms are related to cryptology on account of its potential advantage over conventional computers. In this paper, Bernstein-Vazirani algorithm, a linear cryptanalysis method performing on quantum computers, is selected as a typical algorithm to demonstration and implementation of the quantum computing in cryptanalysis. To be specific, this study analyzes the method itself, and realizes the method with Qiskit so as to compare it with conventional methods. With the comparison, the superiority of quantum computing in certain fields as well as some current disadvantages to be dealt with are clarified. Thus, it is hoped to present the huge potential of quantum computing in its processing ability and its property of superposition beginning with the field of cryptanalysis. Besides, a direction of future improvement of the technology is also proposed. Overall, these results shed light on guiding further exploration of quantum computing.

New Wine Old Bottles: Feistel Structure Revised

This paper mainly investigates the iterative structures whose decryption is similar to the encryption. Firstly, we unify many well-known structures which share similar procedures between the decryption and the encryption, and give a sufficient and necessary condition for this structure to be bijective, which reveals many new insights into the Feistel structure as well as the Lai-Massey structure. Secondly, we analyze the security of the unified structure against the known cryptanalysis. By extending the dual structure from a Feistel structure to the unified structure, we prove that a differential of the unified structure is impossible if and only if it is a zero-correlation linear hull of its dual structure, which presents a generalized link between the impossible differential and zero-correlation linear cryptanalysis shown in CRYPTO 2015. Significantly, several constraints on the linear components of the cipher and the permutation on the branches of the cipher are specified to make the structure resilient to differential and linear cryptanalysis. Furthermore, in the case that the order of the permutation equals the number of the branches <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$n$ </tex-math></inline-formula> , we prove that there always exist a <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$(3n-1)$ </tex-math></inline-formula> -round impossible differential and a <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$(3n-1)$ </tex-math></inline-formula> -round zero-correlation linear hull of the structure, and also present an algorithm to construct these distinguishers. Finally, we propose some novel structures which might be used in future block cipher designs.