Impossible Differential Cryptanalysis of LiCi Block Cipher

Impossible differential attack is a well-known mean to examine robustness of block ciphers. Using impossible differential cryptanalysis, we analyze security of a family of lightweight block ciphers, named Midori, that are designed considering low energy consumption. Midori state size can be either 64 bits for Midori64 or 128 bits for Midori128; however, both versions have key size equal to 128 bits. In this paper, we mainly study security of Midori64. To this end, we use various techniques such as early-abort, memory reallocation, miss-in-the-middle and turning to account the inadequate key schedule algorithm of Midori64. We first show two new 7round impossible differential characteristics which are, to the best of our knowledge, the longest impossible differential characteristics found for Midori64. Based on the new characteristics, we mount three impossible differential attacks for 10, 11, and 12 rounds on Midori64 with 2 87.7 , 2 90.63 , and 2 90.51 time complexity, respectively, to retrieve the master-key.

Today's headlines abound with the promised explosion of the Internet of things. Studies claim that there will be the existence of billions of internet connected devices in coming years. The small size and limited processing power of many connected devices could inhibit encryption and other robust security measure. Here cryptography plays a pivotal role. Also most of the devices available in the market today are resource constrained. Hence cryptographic solutions must be easy to implement and have high performance on a wide range of severely constrained devices. The relatively new field of lightweight cryptography provides significant advantages over existing algorithms when addressing security issues for highly constrained devices. In this project a detailed study of LBlock block cipher is done which is a lightweight cipher in both hardware and 8-bit platforms and an IP core is developed. The block size of LBlock is 64-bit and the key size is 80-bit and it can achieve competitive hardware and software performances when compared with other known lightweight block ciphers. The security evaluation shows that LBlock can achieve enough security margin against known attacks such as differential cryptanalysis, linear cryptanalysis, impossible differential cryptanalysis and related-key attacks etc. LBlock cryptocore is designed, build and characterized for the efficient implementation in low resource devices. It can serve as a benchmark for the hardware design engineers to model devices that utilizes lightweight characteristics. LBlock cipher is implemented on Xilinx Spartan-6 FPGA (XC6LX16-CS324) and its performance metrics were obtained.

The guess‐and‐determine technique find wide applications in the recovery of unknown variables within given system of relations. The fundamental concept behind this technique involves guessing certain unknown variables and deducing the remaining ones based on the relational system. In the context of symmetric cryptography analysis, the guess‐and‐determine technique is employed to deduce partial subkey information to recover the master key. The set of variables that need to be guessed is called the guess basis.The crux of the guess‐and‐determine technique lies in identifying the minimal guess basis. By introducing new equal relations and initial constraints, this paper enhances the minimal guess basis mixed integer linear programming (MILP) model. The new model offers a more comprehensive depiction of key schedule, thereby enabling a more accurate and efficient derivation of the minimal guess basis.The novel model is applied to the eight‐sided fortress (ESF) block cipher algorithm. By extending forward by three rounds and backward by three rounds based on a nine‐round impossible differential distinguisher, a 15‐round impossible differential attack is conducted. Utilizing the new model, the minimal guess basis required for key recovery is determined to be 54 bits. This represents a significant improvement compared to the existing result of 58 bits.The results indicate that for a 15‐round impossible differential attack on the ESF algorithm, the data complexity is 2 31.18 CP, the time complexity involves 2 61.67 iterations of 15‐round encryption, and the memory complexity is 2 66.18 bytes. Furthermore, this paper introduces, for the first time, a principle for designing key scheduling algorithms based on the guessing basis. This principle is applied to the ESF algorithm, where the minimal guess basis is employed to determine the positions of S ‐boxes and the parameters for cyclic shifts within the key scheduling algorithm. Without altering the consumption of software or hardware resources, a global optimal search is conducted among various key scheduling candidate approaches. By employing an equivalence class partitioning approach derived from 2108 instances of nine‐round impossible differential distinguishers, the search space is reduced. Eventually, a selection process identifies a set of eight novel key schedule algorithms that achieve the maximum value of 77 bits for the minimal guess basis. These new key scheduling algorithms exhibit enhanced resistance against impossible differential attacks.

摘要: ARIA密码是2003年由韩国学者提出的新的分组密码算法，该密码与AES的设计原理相类似，并在2004年被选为韩国的分组密码标准。该文根据ARIA密码的结构特征，提出ARIA密码的一种新的7轮不可能差分攻击路径，首次实现了对ARIA-192的不可能差分攻击，攻击的时间复杂度为2176.2。同时，利用扩散层的相关性质降低攻击ARIA-256的时间复杂度为2192.2。 关键词: 分组密码 / 不可能差分攻击 / 预计算 / ARIA密码

This paper analyzes the security of the RC5 encryption algorithm against differential and linear cryptanalysis. RC5 is a new block cipher recently designed by Ron Rivest. It has a variable word size, a variable number of rounds, and a variable-length secret key. In RC5, the secret key is used to fill an expanded key table which is then used in encryption. Both our differential and linear attacks on RC5 recover every bit of the expanded key table without any exhaustive search. However, the plaintext requirement is strongly dependent on the number of rounds. For 64-bit block size, our differential attack on nine-round RC5 uses 245 chosen plaintext pairs (about the same as DES), while 262 pairs are needed for 12-round RC5. Similarly, our linear attack on live-round RC5 uses 247 known plaintexts (about the same as DES), and the plaintext requirement is impractical for more than six rounds. We conjecture that the linear approximations used in our linear cryptanalysis are optimal. Thus, we conclude that Rivest's suggested use of 12 rounds is sufficient to make differential and linear cryptanalysis of RC5 impractical.

Several recently proposed ciphers, for example Rijndael and Serpent, are built with layers of small S-boxes interconnected by linear key-dependent layers. Their security relies on the fact, that the classical methods of cryptanalysis (e.g. linear or differential attacks) are based on probabilistic characteristics, which makes their security grow exponentially with the number of rounds N r r. In this paper we study the security of such ciphers under an additional hypothesis: the S-box can be described by an overdefined system of algebraic equations (true with probability 1). We show that this is true for both Serpent (due to a small size of S-boxes) and Rijndael (due to unexpected algebraic properties). We study general methods known for solving overdefined systems of equations, such as XL from Eurocrypt’00, and show their inefficiency. Then we introduce a new method called XSL that uses the sparsity of the equations and their specific structure. The XSL attack uses only relations true with probability 1, and thus the security does not have to grow exponentially in the number of rounds. XSL has a parameter P, and from our estimations is seems that P should be a constant or grow very slowly with the number of rounds. The XSL attack would then be polynomial (or subexponential) in N r> , with a huge constant that is double-exponential in the size of the S-box. The exact complexity of such attacks is not known due to the redundant equations. Though the presented version of the XSL attack always gives always more than the exhaustive search for Rijndael, it seems to (marginally) break 256-bit Serpent. We suggest a new criterion for design of S-boxes in block ciphers: they should not be describable by a system of polynomial equations that is too small or too overdefined.

PRESENT and MIBS are two lightweight block ciphers that are suitable for low resource devices such as radio‐frequency identification tags. In this paper, we present the first biclique cryptanalysis of MIBS block cipher and a new biclique cryptanalysis of PRESENT block cipher. These attacks are performed on full‐round MIBS‐80 and full‐round PRESENT‐80. Using matching without matrix technique in the attack on MIBS and choosing a sub‐key space of an internal round for key division eventuate to reduce the security of this cipher by 1bit, while the data complexity of attack is 252 chosen plaintext. The attack on PRESENT‐80 has a data complexity of at most 222 chosen plaintext and computational complexity of 279.34 encryption that both complexities are lower than of other cryptanalyses of full‐round PRESENT‐80 so far. Also, in this paper, we use early abort technique to efficiently filter out wrong keys in matching phase of biclique attack of PRESENT‐80. Copyright © 2015 John Wiley & Sons, Ltd.

Statistical attacks on block ciphers make use of a property of the cipher so that an event occurs with different probabilities depending on whether or not the correct key is used. For instance, differential cryptanalysis [3] and truncated differential cryptanalysis [5] consider characteristics or differentials which show that a particular output difference should be obtained with a relatively high probability when a particular input difference is used. Hence, when the correct key is used, the predicted differences occur more frequently.

Differential cryptanalysis is one of the fundamental cryptanalysis techniques to evaluate the security of the block cipher. In many cases, resistance to differential cryptanalysis is proven through the upper bound of the differential characteristic probability, not the differential probability. Since the attacker uses a differential rather than a differential characteristic, resistance based on a differential characteristic tends to overestimate the security level of the block cipher. Such an overestimation is notably observed in lightweight block ciphers SKINNY, Midori, and CRAFT. In this paper, we examine the gap between the differential characteristics and the differential probability of lightweight block ciphers. We present practical methods for computing differential probability using a multistage graph. Using these methods, we count the exact number of maximum differential characteristics with fixed plaintext/ciphertext difference and activity pattern. By the exact number of maximum differential characteristics, we can calculate the probability that is closer to the real differential probability. In addition, by modifying the method, we compute a more accurate differential probability by considering the characteristics of the lower probability. We find differential distinguishers of 9-round Midori64 with probability 2−61.58, 9-round SKINNY64 with 2−58.67 and 14-round CRAFT with 2−60.32. Furthermore, we find a related-tweakey differential distinguisher of 11-round SKINNY64-64 with 2−55.93 and a related-tweak differential distinguisher of 17-round CRAFT with probability 2−63.37. Finally, we explain why these gaps are notable in Midori64, SKINNY64 and CRAFT by relating the S-box differential distribution table.

The block cipher Camellia has now been adopted as an international standard by ISO/IEC, and it has also been selected to be Japanese CRYPTREC e-government recommended cipher and in the NESSIE block cipher portfolio. Most recently, Wu et al constructed some 8-round impossible differentials of Camellia, and presented an attack on 12-round Camellia-192/256 in [5]. Later in [6], Lu et al improved the above attack by using the same 8-round impossible differential and some new observations on the diffusion transformation of Camellia. Considering that all these previously known impossible differential attacks on Camellia have not taken the key scheduling algorithm into account, in this paper we exploit the relations between the round subkeys of Camellia, together with some novel techniques in the key recovery process to improve the impossible differential attack on Camellia up to 12-round Camellia-128 and 16-round Camellia-256. The data complexities of the two attacks are 265 and 289 respectively, and the time complexities of the two attacks are less than 2111.5 and 2222.1 respectively. The presented results are better than any previously published cryptanalytic results on Camellia without the FL/FL − 1 functions and whitening layers.KeywordsBlock cipherCamelliaImpossible differentialCryptanalysisRound subkey

In this paper we apply impossible differential attacks to reduced round AES. Using various techniques, including the early abort approach and key schedule considerations, we significantly improve previously known attacks due to Bahrak-Aref and Phan. The improvement of these attacks leads to better impossible differential attacks on 7-round AES-128 and AES-192, as well as to better impossible differential attacks on 8-round AES-256.

Low differentially uniform permutations from the Dobbertin APN function over [formula omitted

In order to adopt the restricted environment, such as radio frequency identification technology or sensor networking, which are the important components of the Internet of Things, lightweight block ciphers are designed. NUX is a 31-round iterative ultralightweight cipher proposed by Bansod et al. In this paper, we examine the resistance of NUX to differential and linear analysis and search for 1~31-round differential characteristics and linear approximations. In design specification, authors claimed that 25-round NUX is resistant to differential and linear attack. However, we can successfully perform 29-round differential attack on NUX with the 22-round differential characteristic found in this paper, which is 4 rounds more than the limitation given by authors. Furthermore, we present the key recovery attack on 22-round NUX using a 19-round linear approximation determined in this paper. Besides, distinguishing attack, whose distinguisher is built utilizing the property of differential propagation through NUX, is implemented on full NUX with data complexity 8.

In the last few years, a large amount of private and sensitive data generated by Internet of Things (IoT) devices need to be transmitted, stored, and processed in security, which become a serve challenge because these resource-constrained IoT devices cannot satisfy the requirements of conventional encryption ciphers. In this article, we propose the extended Type-1 generalized Feistel networks (Type-1 EGFNs) to improve the diffusion speed of Type-1 generalized Feistel networks (Type-1 GFNs). We instantiate Type-1 EGFNs into a lightweight block cipher that is named ALLPC, and analyze the performance of the cipher in terms of software implementation, hardware implementation, and security. The Type-1 EGFNs overcome the shortcoming of slow diffusion of Type-1 GFNs, and the ALLPC cipher is quite suitable for the resource-constrained IoT environment. Compared with other existing lightweight block ciphers, the ALLPC cipher can achieve compact hardware and low-cost software (e.g., low memory) while having low execution time, high throughput, and low energy consumption on the 32-bit ARM-Cortex M3 STM32F103 platform. In our security analysis, the ALLPC cipher can attain sufficient security degree against differential cryptanalysis, zero-correlation attack, and linear cryptanalysis, and owns a meaningful avalanche effect. Experimental results shows that our ALLPC cipher outperforms other existing lightweight ciphers in throughput, execution time and energy consumption.

This paper presents an evaluation of the practical strength of the lightweight block cipher “Cypress” to the differential cryptanalysis, which is determined by the probability of the best found differential characteristic. The paper proposes a mathematical model for evaluating the block cipher “Cypress” to differential cryptanalysis and methods for searching for multi-round differential characteristics. The first method is based on the combination of highly probable one-round differential characteristics into multi-round ones, while the second method is based on the extension of one-round characteristics for several rounds. As a result of the application of the second search method to the block cipher Cypress-256, a 6-round differential characteristic was found. Since it was not found a differential characteristics for more than six rounds with a probability which is higher than the probability of a brute-force attack, the block cipher Cypress-256 is practically resistant to differential cryptanalysis.