Multiple Linear Cryptanalysis of a Reduced Round RC6

Differential cryptanalysis and linear cryptanalysis are two classic analytical methods for block ciphers, and they are of great significance for evaluating the security of block ciphers. In practical security evaluations, a commonly used approach is to study lower bounds on the number of active F-functions in multi-round differential characteristics and linear approximations of the cipher structure, thereby establishing upper bounds on the maximum differential characteristic probability and the maximum linear approximation probability. If these upper bounds are sufficiently small, the cipher structure is considered to have resistance against differential and linear cryptanalysis. Based on this, this paper conducts a detailed study on the resistance of a class of four-branch extended generalized Feistel networks against differential and linear cryptanalysis. Under the condition that the F-function is bijective, it is proven that the lower bound on the number of active F-functions in \(k\)-round (\(k \ge 1\)) differential characteristics or linear approximations is \(k - 1\). Thus, if the maximum differential probability and the maximum linear approximation probability of the F-function are denoted as \(p\) and \(q\), respectively, the upper bounds on the \(k\)-round differential characteristic probability and linear approximation probability are \({p}^{k - 1}\) and \({q}^{k - 1}\), respectively.

Differential and linear cryptanalysis are two of the most effective attacks on block ciphers. Searching for (near) optimal differential or linear trails is not only useful for the security evaluation of block ciphers against these attacks, but also indispensable to the cryptanalysts who want to attack a cipher with these techniques. In recent years, searching for trails automatically with Mixed-Integer Linear Programming (MILP) gets a lot of attention. At first, Mouha et al. translated the problem of counting the minimum number of differentially active S-boxes into an MILP problem for word-oriented block ciphers. Subsequently, in Asiacrypt 2014, Sun et al. extended Mouha et al.’s method, and presented a technique which can find actual differential or linear characteristics of a block cipher in both the single-key and related-key models. In this paper, we refine the constraints of the 2-XOR operation in order to reduce the overall number of variables and constraints. Experimental results show that MILP models with the refined constraints can be solved more efficiently. We apply our method to HIGHT (an ISO standard), and we find differential (covering 11 rounds) or linear trails (covering 10 rounds) with higher probability or correlation. Moreover, we find so far the longest differential and linear distinguishers of HIGHT.

Secure lightweight block ciphers have become an important aspect due to the fact that they are a popular choice for providing security in ubiquitous devices. Two of the most important attacks on block ciphers are differential cryptanalysis [1] and linear cryptanalysis [2]. Calculating the number of active S-boxes is one of the method to examine the security of block ciphers against differential attack. In this paper, we count the minimum number of active S-boxes for several rounds of the lightweight ciphers namely KLEIN, LED and AES. We utilized the method proposed in [9], where calculation of the minimum number of active S-boxes is formulated as a Mixed Integer Linear Programming (MILP) problem. The objective function is to minimize the number of active S-boxes, subject to the constraints imposed by the differential propagation of the cipher. The experimental results are presented in this paper and found to be encouraging.

Vaudenay[12] proposed a new way of protecting block ciphers against classes of attacks, which was based on the notion of decorrelation. He also suggested two block cipher families COCONUT and PEANUT. Wagner[14] suggested a new differential-style attack called boomerang attack and cryptanalyzed COCONUT’98. Cheon[5] suggested a new block cipher DONUT which was made by two pairwise perfect decorrelation modules and is secure against boomerang attack. In this paper we suggest an attack called difference distribution attack on DONUT. We also suggest an improved DONUT which is secure against difference distribution attack.KeywordsDecorrelationDONUTDifferential Cryptanalysis(DC)LinearCryptanalysis(LC)Difference Distribution Attack(DDA)

Today wireless communication is the fastest growing sector for transmission of digitally stored data. In wireless communication certain security protocols are used. The security layers of these protocols requires encryption algorithm to provide transmission security. In this paper, FPGA Design and implementation of optimized RC5 block cipher has been proposed considering the various aspect such as speed, area and power. RC5 block cipher is based on RC5 encryption algorithm. The parameter of RC5 encryption algorithm taken are word (w) = 32, round(r) = 4 and key (k) = 128. The simulation is done on Aldec Active HDL. For FPGA Design various results are obtained using Xilinx ISE Design Suite 14.1. The target board is vertex-6 and FPGA device Chosen is 6vlx75tff484-3. The proposed design ensures high throughput with 6-stage pipelined architecture for r = 4.

Linear cryptanalysis (LC) is an important codebreaking method that became popular in the 1990s and has roots in the earlier research of Shamir in the 1980s. In this article we show evidence that linear cryptanalysis is even older. According to documents from the former East Germany cipher authority ZCO, the systematic study of linear characteristics for nonlinear Boolean functions was routinely performed in the 1970s. At the same time East German cryptologists produced an excessively complex set of requirements known as KT1, which requirements were in particular satisfied by known historical used in the 1980s. An interesting line of inquiry, then, is to see if KT1 keys offer some level of protection against linear cryptanalysis. In this article we demonstrate that, strangely, this is not really the case. This is demonstrated by constructing specific counterexamples of pathologically weak keys that satisfy all the requirements of KT1. However, because we use T-310 in a stream cipher mode that uses only a tiny part of the internal state for actual encryption, it remains unclear whether this type of weak key could lead to key recovery attacks on T-310.

Today's headlines abound with the promised explosion of the Internet of things. Studies claim that there will be the existence of billions of internet connected devices in coming years. The small size and limited processing power of many connected devices could inhibit encryption and other robust security measure. Here cryptography plays a pivotal role. Also most of the devices available in the market today are resource constrained. Hence cryptographic solutions must be easy to implement and have high performance on a wide range of severely constrained devices. The relatively new field of lightweight cryptography provides significant advantages over existing algorithms when addressing security issues for highly constrained devices. In this project a detailed study of LBlock block cipher is done which is a lightweight cipher in both hardware and 8-bit platforms and an IP core is developed. The block size of LBlock is 64-bit and the key size is 80-bit and it can achieve competitive hardware and software performances when compared with other known lightweight block ciphers. The security evaluation shows that LBlock can achieve enough security margin against known attacks such as differential cryptanalysis, linear cryptanalysis, impossible differential cryptanalysis and related-key attacks etc. LBlock cryptocore is designed, build and characterized for the efficient implementation in low resource devices. It can serve as a benchmark for the hardware design engineers to model devices that utilizes lightweight characteristics. LBlock cipher is implemented on Xilinx Spartan-6 FPGA (XC6LX16-CS324) and its performance metrics were obtained.

Differential cryptanalysis and linear cryptanalysis are the most widely used techniques for block ciphers cryptanalysis. Several attacks combine these cryptanalytic techniques to obtain new attacks, e.g., differential-linear attacks, miss-in-the-middle attacks, and boomerang attacks. In this paper we present several new combinations: we combine differentials with bilinear approximations, higher-order differentials with linear approximations, and the boomerang attack with linear, with differential-linear, with bilinear, and with differential-bilinear attacks. We analyze these combinations and present examples of their usefulness. For example, we present a 6-round differential-bilinear approximation of s5DES with a bias of 1/8, and use it to attack 8-round s5DES using only 384 chosen plaintexts. We also enlarge a weak key class of IDEA by a factor of 512 using the higher-order differential-linear technique. We expect that these attacks will be useful against larger classes of ciphers.

The Demirci-Selçuk's meet-in-the-middle attack is one of the most important methods among all the cryptanalytic vectors, which gives the best result against the round-reduced AES with respect to the rounds, and tradeoffs between data, time and memory. While we have already built provable security models against the differential cryptanalysis, linear cryptanalysis cryptanalysis, impossible differential and zero-correlation linear cryptanalysis, the provable security against the meet-in-the-middle attack is missing. In this paper, we propose the subset representation of function based on which we could give an algorithm to compute the exact number of parameters of the Demirci-Selçuk's distinguisher given the input and output, respectively. Experiments show that this algorithm can be more efficient than the automatical tool presented by Shi et al. at Asiacrypt 2018. We further extract a formula based on this algorithm and show an upper bound for the length of the Demirci-Selçuk's distinguisher of an iterative SPN cipher. We prove that for an SPN block cipher whose block size equals the key size, an effective Demirci-Selçuk-type meet-in-the-middle distinguisher covers at most twice the maximum of the primitive indexes of the linear layer and its inverse. As a result, we show that the known length of the Demirci-Selçuk's distinguisher of the AES-128 cannot be improved unless the details of the S-boxes are exploited, which demonstrates that the AES has a provable security against the Demirci-Selçuk's meet-in-the-middle attack.

During the last years a new approach to construct safe block and stream ciphers has been developed using the theory of dynamical systems. Since a block cryptosystem is generally, from the mathematical point of view, a family (parametrized by the keys) of permutations of n-bit numbers, one of the main problems of this approach is to adapt the dynamics defined by a map f to the block structure of the cryptosystem. In this paper we propose a method based on the approximation of f by periodic maps Tn(v.g. some interval exchange transformations). The approximation of automorphisms of measure spaces by periodic automorphisms was introduced by Halmos and Rohlin. One important aspect studied in our paper is the relation between the dynamical properties of the map f (say, ergodicity or mixing) and the immunity of the resulting cipher to cryptolinear attacks, which is currently one of the standard benchmarks for cryptosystems to be considered secure. Linear cryptanalysis, first proposed by M. Matsui, exploits some statistical inhomogeneities of expressions called linear approximations for a given cipher. Our paper quantifies immunity to cryptolinear attacks in terms of the approximation speed of the map f by the periodic Tn. We show that the most resistant block ciphers are expected when the approximated dynamical system is mixing.

From the Publisher: In October 2000, the US National Institute of Standards and Technology selected the block cipher Rijndael as the Advanced Encryption Standard (AES). AES is expected to gradually replace the present Data Encryption Standard (DES) as the most widely applied data encryption technology.|This book by the designers of the block cipher presents Rijndael from scratch. The underlying mathematics and the wide trail strategy as the basic design idea are explained in detail and the basics of differential and linear cryptanalysis are reworked. Subsequent chapters review all known attacks against the Rijndael structure and deal with implementation and optimization issues. Finally, other ciphers related to Rijndael are presented.|This volume is THE authoritative guide to the Rijndael algorithm and AES. Professionals, researchers, and students active or interested in data encryption will find it a valuable source of information and reference.

This paper reports on the improved and multiple linear cryptanalysis of reduced round Serpent by mean of a branch-and-bound characteristic search within the algorithm. We first present a 9-round linear characteristic with probability $\frac{1}{2}+2^{-50}$ that involves a reduction of the estimated data complexity of the best reported attack by a factor of 16. Then, we investigate the possibility to take advantage of multiple linear approximations for improving the linear cryptanalysis of Serpent. According to the framework of Biryukov et al.from Crypto 2004, we provide estimations of the improved data complexity of such attacks and derive practical cryptanalysis scenarios. For computational reasons, the branch-and-bound search is not guaranteed to be optimal. However, these are the best reported complexities of a linear attack against Serpent.

It is a common belief that the presence of linear relations in the S-boxes of some block cipher algorithm facilitates its linear cryptanalysis and related attacks towards. In the present work, we clarify that claim in respect to a linear cryptanalysis (in the very spirit of Matsui’s classic one) applied to modified DES algorithm with S-boxes having parity check bits. The results of our investigations show that embedding parity checks in the outputs of these S-boxes does not generally guarantee more suitable for that kind of cryptanalysis best multi-round linear characteristics. Their structure, the corresponding bias and the number of effective bits depend crucially on the parity position chosen, and may lead not only to reduction but as well to growth in complexity of successful linear cryptanalysis compared to that towards the original DES.

Quantum-inspired design of resilient substitution boxes: From coding to hardware implementation

This paper analyzes the security of the RC5 encryption algorithm against differential and linear cryptanalysis. RC5 is a new block cipher recently designed by Ron Rivest. It has a variable word size, a variable number of rounds, and a variable-length secret key. In RC5, the secret key is used to fill an expanded key table which is then used in encryption. Both our differential and linear attacks on RC5 recover every bit of the expanded key table without any exhaustive search. However, the plaintext requirement is strongly dependent on the number of rounds. For 64-bit block size, our differential attack on nine-round RC5 uses 245 chosen plaintext pairs (about the same as DES), while 262 pairs are needed for 12-round RC5. Similarly, our linear attack on live-round RC5 uses 247 known plaintexts (about the same as DES), and the plaintext requirement is impractical for more than six rounds. We conjecture that the linear approximations used in our linear cryptanalysis are optimal. Thus, we conclude that Rivest's suggested use of 12 rounds is sufficient to make differential and linear cryptanalysis of RC5 impractical.