Linear Cryptanalysis Research Articles

Analysis of differential distribution of lightweight block cipher based on parallel processing on GPU

As the fast development of IoT technology, various security solutions have to be considered when the corresponding solutions are being deployed. Due to the lightweight nature of the IoT devices such as the RFID tags and so on, traditional encryption schemes such as AES which are relatively heavy in the sense of operations cannot be applied here. Lightweight block ciphers have since become a default standard when considering security protections on such lightweight IoT devices. Compared with the security analysis approaches by taking advantage of the differential or linear cryptanalysis, the security margin of lightweight block ciphers can be further derived more accurately due to the small internal state. In this paper, we investigate the security margin of the lightweight block cipher structure especially the SPN design by taking advantage of the parallel computing power of modern GPU architecture. We show how to accelerate the computing of the statistical distinguisher, which is the crucial point for analyzing the security of the cipher design. Our proposed methods gain notable advantage against traditional CPU architecture in terms of time complexity and possess extensibility for other block ciphers.

Improving Matsui’s Search Algorithm For The Best Differential/Linear Trails And Its Applications For DES, DESL And GIFT

Abstract Automatic search methods have been widely used for cryptanalysis of block ciphers, especially for the most classic cryptanalysis methods—differential and linear cryptanalysis. However, the automatic search methods, no matter based on MILP, SMT/SAT or CP techniques, can be inefficient when the search space is too large. In this paper, we propose three new methods to improve Matsui’s branch-and-bound search algorithm, which is known as the first generic algorithm for finding the best differential and linear trails. The three methods, named reconstructing DDT and LAT according to weight, executing linear layer operations in minimal cost and merging two 4-bit S-boxes into one 8-bit S-box, respectively, can efficiently speed up the search process by reducing the search space as much as possible and reducing the cost of executing linear layer operations. We apply our improved algorithm to DESL and GIFT, which are still the hard instances for the automatic search methods. As a result, we find the best differential trails for DESL (up to 14-round) and GIFT-128 (up to 19-round). The best linear trails for DESL (up to 16-round), GIFT-128 (up to 10-round) and GIFT-64 (up to 15-round) are also found. To the best of our knowledge, these security bounds for DESL and GIFT under single-key scenario are given for the first time. Meanwhile, it is the longest exploitable (differential or linear) trails for DESL and GIFT. Furthermore, benefiting from the efficiency of the improved algorithm, we do experiments to demonstrate that the clustering effect of differential trails for 13-round DES and DESL are both weak.

STUDIES ON PRACTICAL CRYPTOGRAPHIC SECURITY ANALYSIS FOR BLOCK CIPHERS WITH RANDOM SUBSTITUTIONS

In up-to-date information and communication systems (ICS) cryptography is used for ensuring data confidentiality. The symmetric block ciphers (BC) are implemented in different ICS including critical applications. Today theory of analysis and security verification of BC with fixed substitution nodes against linear and differential cryptanalysis (LDC) is developed. There are also BC with substitution nodes defined by round keys. Random substitution nodes improve security of ciphers and complicate its cryptanalysis. But through it all, quantitative assessment is an actual and not simple task as well as the derivation of formulas for practical security verification for BC with random substitution nodes against LDC. In this paper analytical upper bounds of parameters characterized practical security of BC with random substitution nodes against LDC were given. These assessments generalize known analogs on BC with random substitution nodes and give a possibility to verify security improving against LDC. By using the example of BC Kalyna-128, it was shown that the use of random substitution nodes allows improving upper bounds of linear and differential parameters average probabilities in 246 and 290 times respectively. The study is novel as it is one of the few in the cryptology field to calculate analytical upper bounds of BC practical security against LDC methods as well as to show and prove that using random substitutions allows improving upper bounds of linear and differential parameters. The security analysis using quantitative parameters gives possibility to evaluate various BCs or other cryptographic algorithms and their ability to provide necessary and sufficient security level in ICS. A future research study can be directed on improving analytical upper bounds for analyzed LDC in context to practical security against LDC, as well as practical cryptographic security assessment for other BC with random substitutions against LDC and other cryptanalysis methods including quantum cryptanalysis (Shor, Grover, Deutsch-Jozsa algorithms).

Linear Cryptanalysis of Reduced-Round Simon Using Super Rounds

We present attacks on 21-rounds of Simon 32/64, 21-rounds of Simon 48/96, 25-rounds of Simon 64/128, 35-rounds of Simon 96/144 and 43-rounds of Simon 128/256, often with direct recovery of the full master key without repeating the attack over multiple rounds. These attacks result from the observation that, after four rounds of encryption, one bit of the left half of the state of 32/64 Simon depends on only 17 key bits (19 key bits for the other variants of Simon). Further, linear cryptanalysis requires the guessing of only 16 bits, the size of a single round key of Simon 32/64. We partition the key into smaller strings by focusing on one bit of state at a time, decreasing the cost of the exhaustive search of linear cryptanalysis to 16 bits at a time for Simon 32/64. We also present other example linear cryptanalysis, experimentally verified on 8, 10 and 12 rounds for Simon 32/64.

Construction of a polynomial invariant annihilation attack of degree 7 for T-310

Cryptographic attacks are typically constructed by black-box methods and combinations of simpler properties, for example in [Generalised] Linear Cryptanalysis. In this article, we work with a more recent white-box algebraic-constructive methodology. Polynomial invariant attacks on a block cipher are constructed explicitly through the study of the space of Boolean polynomials which does not have a unique factorisation and solving the so-called Fundamental Equation (FE). Some recent invariant attacks are quite symmetric and exhibit some sort of clear structure, or work only when the Boolean function is degenerate. As a proof of concept, we construct an attack where a highly irregular product of seven polynomials is an invariant for any number of rounds for T-310 under certain conditions on the long term key and for any key and any IV. A key feature of our attack is that it works for any Boolean function which satisfies a specific annihilation property. We evaluate very precisely the probability that our attack works when the Boolean function is chosen uniformly at random.

Enhancing the security of AES through small scale confusion operations for data communication

With the advent of computers, networks, distributed systems and wireless data transfer technologies, data communication is subjected to potential threats and hence needs to be protected. Advanced Encryption Standard (AES) is an efficient encryption algorithm used for secure wireless communication, but its security is under threat due to different forms of theoretical and practical attacks such as linear cryptanalysis, differential cryptanalysis, boomerang attack, truncated differentials, hybrid attacks, related-key distinguishing attack, and side channel attacks. This work is focused on reducing the attacks by increasing the complexity of cryptanalysis through small scale variations in the shift row transformation and key expansion unit of the AES algorithm. The proposed small scale variations in the linear layer of the cipher unit and in the word column of key expansion unit enhances confusion during encryption. The inherent diffusion property of the algorithm along with the proposed confusion characteristics allows us to increase the overall security of the algorithm. The confusion and diffusion characteristics of the modified algorithm are found to be higher in terms of balance, Strict Avalanche Criterion and bit independence criteria. The AES variants are also tested using NIST-800-22 statistical test suite for random number generators, the small scale variations made in the architecture provides a higher degree of randomness in the ciphertext thus increasing cryptanalysis complexity. This paper also proposes an obfuscation control unit that allows on-demand selection of the three AES variants resulting in a variable encrypting pattern for a plaintext-key pair thus adding more bottlenecks to the adversaries.

Revisiting the Wrong-Key-Randomization Hypothesis

Linear cryptanalysis is considered to be one of the strongest techniques in the cryptanalyst’s arsenal. In most cases, Matsui’s Algorithm 2 is used for the key recovery part of the attack. The success rate analysis of this algorithm is based on an assumption regarding the bias of a linear approximation for a wrong key, known as the wrong-key-randomization hypothesis. This hypothesis was refined by Bogdanov and Tischhauser to take into account the stochastic nature of the bias for a wrong key. We provide further refinements to the analysis of Matsui’s Algorithm 2 by considering sampling without replacement. This paper derives the distribution of the observed bias for wrong keys when sampling is done without replacement and shows that less data are required in this scenario. It also develops formulas for the success probability and the required data complexity when this approach is taken. The formulas predict that the success probability may reach a peak and then decrease as more pairs are considered. We provide a new explanation for this behavior and derive the conditions for encountering it. We empirically verify our results and compare them to previous work.

Improving the MILP-based Security Evaluation Algorithm against Differential/Linear Cryptanalysis Using A Divide-and-Conquer Approach

In recent years, Mixed Integer Linear Programming (MILP) has been widely used in cryptanalysis of symmetric-key primitives. For differential and linear cryptanalysis, MILP can be used to solve two kinds of problems: calculation of the minimum number of differentially/linearly active S-boxes, and search for the best differential/linear characteristics. There are already numerous papers published in this area. However, the efficiency is not satisfactory enough for many symmetric-key primitives. In this paper, we greatly improve the efficiency of the MILP-based search algorithm for both problems. Each of the two problems for an r-round cipher can be converted to an MILP model whose feasible region is the set of all possible r-round differential/linear characteristics. Generally, high-probability differential/linear characteristics are likely to have a low number of active S-boxes at a certain round. Inspired by the idea of a divide-and-conquer approach, we divide the set of all possible differential/linear characteristics into several smaller subsets, then separately search them. That is to say, the search of the whole set is split into easier searches of smaller subsets, and optimal solutions within the smaller subsets are combined to give the optimal solution within the whole set. In addition, we use several techniques to further improve the efficiency of the search algorithm. As applications, we apply our search algorithm to five lightweight block ciphers: PRESENT, GIFT-64, RECTANGLE, LBLOCK and TWINE. For each cipher, we obtain better results than the best-known ones obtained from the MILP method. For the minimum number of differentially/linearly active S-boxes, we reach 31/31, 16/15, 16/16, 20/20 and 20/20 rounds for the five ciphers respectively. For the best differential/linear characteristics, we reach 18/18, 15/13, 15/14, 16/15 and 15/16 rounds for the five ciphers respectively.

Comprehensive security analysis of CRAFT

CRAFT is a lightweight block cipher, designed to provide efficient protection against differential fault attacks. It is a tweakable cipher that includes 32 rounds to produce a ciphertext from a 64-bit plaintext using a 128-bit key and 64-bit public tweak. In this paper, compared to the designers’ analysis, we provide a more detailed analysis of CRAFT against differential and zero-correlation cryptanalysis, aiming to provide better distinguishers for the reduced rounds of the cipher. Our distinguishers for reduced-round CRAFT cover a higher number of rounds compared to the designers’ analysis. In our analysis, we observed that, for any number of rounds, the differential effect of CRAFT has an extremely higher probability compared to any differential trail. As an example, while the best trail for 11 rounds of the cipher has a probability of at least 2−80, we present a differential with probability 2−49.79, containing 229.66 optimal trails, all with the same optimum probability of 2−80. Next, we use a partitioning technique, based on optimal expandable truncated trails to provide a better estimation of the differential effect on CRAFT. Thanks to this technique, we are able to find differential distinguishers for 9, 10, 11, 12, 13, and 14 rounds of the cipher in single tweak model with the probabilities of at least 2−40.20, 2−45.12, 2−49.79, 2−54.49, 2−59.13, and 2−63.80, respectively. These probabilities should be compared with the best distinguishers provided by the designers in the same model for 9 and 10 rounds of the cipher with the probabilities of at least 2−54.67 and 2−62.61, respectively. In addition, we consider the security of CRAFT against the new concept of related tweak zero-correlation (ZC) linear cryptanalysis and present a new distinguisher which covers 14 rounds of the cipher, while the best previous ZC distinguisher covered 13 rounds. Thanks to the related tweak ZC distinguisher for 14 rounds of the cipher, we also present 14 rounds integral distinguishers in related tweak mode of the cipher. Although the provided analysis does not compromise the cipher, we think it provides a better insight into the designing of CRAFT.

Multiple Linear Cryptanalysis Using Linear Statistics

We propose an improved and extended approach of the multiple linear cryptanalysis presented by A. Biryukov et al. at CRYPTO 2004 that exploits dominant and statistically independent linear trails. While they presented only rank based attacks with success probability 1, we present threshold based attacks as well as rank based ones using newly introduced statistic that is a linear combination of the component statistics for the trails and is an approximation of the LLR statistic. The rank based Algorithm 1 style attack yields the same estimate for the gain with Biryukov et al.’s Algorithm 1 style attack. For each of the threshold based Algorithm 1 style and Algorithm 2 style attacks, we provide a formula for its advantage in terms of the correlations of the trails, the data complexity, and the success probability in case the aimed success probability is not 1. Combining the threshold based attacks with the rank based ones, we get attacks each of which has better estimates for the advantage compared to the threshold based one in case the aimed success probability is close to 1. We then extend the methods to get a new framework of multiple linear attacks exploiting close-to-dominant linear trails that may not be statistically independent. We apply the methods to full DES and get linear attacks using 4 linear trails with about the same or better complexity compared to those presented at ASIACRYPT 2017 that use 4 additional trails. With data complexity less than 241, the attack has better complexity than existing attacks on DES.

Automatic Search for the Linear (Hull) Characteristics of ARX Ciphers: Applied to SPECK, SPARX, Chaskey, and CHAM-64

Linear cryptanalysis is an important evaluation method for cryptographic primitives against key recovery attack. In this paper, we revisit the Walsh transformation for linear correlation calculation of modular addition, and an efficient algorithm is proposed to construct the input-output mask space of specified correlation weight. By filtering out the impossible large correlation weights in the first round, the search space of the first round can be substantially reduced. We introduce a concept of combinational linear approximation table (cLAT) for modular addition with two inputs. When one input mask is fixed, another input mask and the output mask can be obtained by the Splitting-Lookup-Recombination approach. We first split the n-bit fixed input mask into several subvectors and then find the corresponding bits of other masks, and in the recombination phase, pruning conditions can be used. By this approach, a large number of search branches in the middle rounds can be pruned. With the combination of the optimization strategies and the branch-and-bound search algorithm, we can improve the search efficiency for linear characteristics on ARX ciphers. The linear hulls for SPECK32/48/64 with a higher average linear potential (ALP) than existing results have been obtained. For SPARX variants, an 11-round linear trail and a 10-round linear hull have been found for SPARX-64 and a 10-round linear trail and a 9-round linear hull are obtained for SPARX-128. For Chaskey, a 5-round linear trail with a correlation of 2−61 has been obtained. For CHAM-64, 34/35-round optimal linear characteristics with a correlation of 2−31/2−33 are found.

A Method of Evaluating the Security of Snow 2.0-Like Ciphers Against Correlation Attacks Over the Finite Extensions of Two Element Field

A method is proposed for evaluation of the security of SNOW 2.0-like ciphers against correlation attacks that are generated by analogy with the well-known attacks on the SNOW 2.0 cipher. Unlike the available methods, the proposed one focuses on proving the security and allows obtaining lower bounds of effectiveness of attacks of the considered class directly by the parameters of stream ciphers components in the same way as it proves the security of block ciphers against linear cryptanalysis. Application of the method to SNOW 2.0 and Strumok ciphers shows that any of the considered correlation attacks on them over the field of order 256 has an average time complexity no less than 2146 . 20 and 2249. 40 , respectively, and requires no less than 2142.77 and 2249. 38 keystream symbols, respectively.

Classification of 4-bit S-Boxes for BOGI Permutation

Bad Output must go to Good Input (BOGI) is the primary design strategy of GIFT , a lightweight block cipher that was presented at CHES 2017. Because this strategy obviates the need to adhere to the required conditions of S-boxes when adopting bit-permutation, cryptographic designers have more S-box choices. In this paper, we classify all 4-bit S-boxes that support BOGI, called “BOGI-applicable S-boxes,” and evaluate them in terms of the cryptographic strength and efficiency. First, we exhaustively show that only 2413 Permutation- XOR-Equivalence (PXE) classes over 4-bit S-boxes are BOGI-applicable. After refining the PXE classes with respect to the differential uniformity ( $\mathcal {U}$ ) and linearity ( $\mathcal {L}$ ), we suggest 20 “Optimal BOGI-applicable” PXE classes that provide the best ( $\mathcal {U}$ , $\mathcal {L}$ ). Our security evaluations revealed that all optimal BOGI-applicable S-boxes fulfill the security properties considered by the designers of GIFT and that the differences between them exist in the other properties. Moreover, we explore the resistance of GIFT variants against differential and linear cryptanalysis by replacing the existing S-box with other optimal BOGI-applicable S-boxes. Based on the results, we identify the best attainable resistance with the bit-permutation of GIFT-64 . Lastly, we suggest notable S-boxes that support competitive performance, jointly considering the cryptographic strength and efficiency for GIFT-64 and GIFT-128 structures, respectively.

On the Design of Chaos-Based S-Boxes

Substitution boxes (S-boxes) are critical nonlinear elements to achieve cryptanalytic resistance of modern block and stream ciphers. Given their importance, a rich variety of S-box construction strategies exists. In this paper, S-boxes generated by using chaotic functions (CF) are analyzed to measure their actual resistance to linear cryptanalysis. The aforementioned papers emphasize on the average nonlinearity of the S-box coordinates only, ignoring the rest of the S-box components in the process. Thus, the majority of those studies should be re-evaluated. Integrating such S-boxes in a given cryptosystem should be done with a considerable caution. Furthermore, we show that in the context of nonlinearity optimization problem the profit of using chaos structures is negligible. By using two heuristic methods and starting from pseudo-random S-boxes, we repeatedly reached S-boxes, which significantly outperform all previously published CF-based S-boxes, in those cryptographic terms, which the aforementioned papers utilize for comparison. Moreover, we have linked the multi-armed bandit problem to the problem of maximizing an S-box average coordinate nonlinearity value, which further allowed us to reach near-optimal average coordinate nonlinearity values significantly greater than those known in literature.

A Novel Optimization Method for Constructing Cryptographically Strong Dynamic S-Boxes

The resistance of S-box-based cryptosystems to linear cryptanalysis is often determined by the nonlinearity (NL) and the linear approximation probability (LAP) of the underlying S-box. Constructing dynamic bijective S-boxes with high nonlinearity is a challenging problem. In this paper, we propose a novel S-box construction method based on the concept of constrained optimization. The proposed method uses a random-restart hill-climbing algorithm to construct randomized S-boxes and maximize the nonlinearity of each Boolean function under bijectivity constraints. The proposed algorithm dramatically reduced the S-box construction time. Compared to recent S-box construction methods, the proposed method strikes a better balance among the three design objectives of dynamic S-boxes, namely, cryptographic strength, dynamicity, and speed of construction. On the average, the proposed method constructs a new dynamic $8\times 8$ S-box with NL=112 every 118 ms, whereas a NL=110 S-box can be generated in 5.3 ms, which makes it suitable for real time applications. The proposed method also constructs $8\times 8$ S-boxes with NL=114, which is among the highest reported in literature. Moreover, we demonstrate the extensibility of the proposed constrained optimization formulation to improve other S-box design criteria. Namely, we propose an algorithm to optimize the LAP of an S-box while preserving its NL and bijectivity.

New insights on linear cryptanalysis

Linear cryptanalysis is one of the most important cryptanalytic tools against block ciphers, thus modern block ciphers are always deliberately devised to avoid good long linear characteristics so as to resist linear cryptanalysis and its extensions. Differential-linear cryptanalysis, a powerful extension of linear cryptanalysis, has drawn much attention due to its applicability even in certain case that there is no good long linear characteristic of block ciphers. To further refine differential-linear cryptanalysis, we investigate the correlation distribution of differential-linear hull over random permutation and derive a concrete and concise correlation distribution accordingly. Theoretically, this could make differential-linear cryptanalysis more reasonable and precise. Moreover, the newly-proposed correlation distribution could lead to an interesting potential for improving the effectiveness of differential-linear cryptanalysis.

Cryptanalysis of the Lightweight Block Cipher BORON

This paper provides security evaluations of a lightweight block cipher called BORON proposed by Bansod et al. There is no third-party cryptanalysis towards BORON. Designers only provided coarse and simple security analysis. To fill this gap, security bounds of BORON against differential and linear cryptanalysis are presented in this paper. By automatic models based on the SMT solver STP, we search for differential and linear trails with the minimal number of active S-boxes and trails with optimal probability and bias. Then, we present key-recovery attacks towards round-reduced BORON. This paper is the first third-party cryptanalysis towards BORON.

Immunity of Lightweight DES Algorithm (DESL) Against Linear Cryptanalysis Attack

Lightweight DES Algorithm (DESL) was introduced by Axel Poschmann et.al as a strong, compact and efficient encryption algorithm suitable for constraint resource like WSNs, RFID and IOT devices. This paper discusses the security of the DESL against Linear Cryptanalysis which is a known plaintext attack in which a large number of plaintext-ciphertext pairs are used to determine the value of key bits. Linear cryptanalysis works on the principle of finding “high probability occurrences of linear expressions involving plaintext bits, ciphertext bits, and subkey bits”. Furthermore, we show that DESL is more resistant against the linear cryptanalysis attack than classical DES.

Design and Analysis of Substitution Boxes in GOST Lightweight Security Algorithm

Recently, lightweight symmetric cryptography became one of the most vital topics for researchers in cryptology. It is introduced as a smart solution to protect the data communication in constraint resources environments. S-boxes play a very vital role in the security of the modern block ciphers. They form the only non-linear element of a block cipher. ‎Therefore, S-boxes have to be chosen carefully to make the ‎cipher rigid against all kinds of attacks. Specially, the compact S-boxes that have been selected to be used in limited resources devices. ‎So, it is essential to understand some of the design criteria that the S-box must satisfy. In lightweight designs, 4-bit S-boxes are preferred to save the area (Gate Equivalents). In this paper, we in our primary analysis, we consider two versions of the GOST algorithm S-Boxes to be tested and evaluated. The Central Bank of the Russian ‎Federation Version and the Most Recent Version are ‎introduced. ‎GOST is one of the most famous modern symmetric ‎block ciphers. The paper looks into the design details of both GOST versions and considers different analysis criteria to their S-Boxes. Our design guarantees that the resulting S-boxes will be ‎bijective and nonlinear and will exhibit the strict avalanche ‎criterion and the output bit independence criterion. ‎In addition, the paper evaluates GOST high resistivity against both linear and differential cryptanalysis.

Quantum Algorithm to Construct Linear Approximation of an S-Box

Linear cryptanalysis, a Known-Plaintext Attack, for symmetric block cipher works by constructing linear approximations of the non-linear components of the cipher. The only component which introduces non-linearity in the symmetric block cipher is an S-box. Using classical computing algorithms, the best known solution to find a linear approximation of a non-linear function, in this case an S-box, requires queries to the S-box and time-complexity, where is the input size of the S-box and is the output size. In this paper, a quantum algorithm is presented which can produce best linear approximations of a non-linear S-box using only queries to S-box with time-complexity. The proposed algorithm shows a significant improvement over the classical algorithm. Correctness proof of the proposed quantum algorithm is presented along with an example.