Refined Probability of Differential Characteristics Including Dependency Between Multiple Rounds
The current paper studies the probability of differential characteristics for an unkeyed (or with a fixed key) construction. Most notably, it focuses on the gap between two probabilities of differential characteristics: probability with independent S-box assumption, pind, and exact probability, pexa...
| Main Authors: | , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Ruhr-Universität Bochum
2017-06-01
|
| Series: | IACR Transactions on Symmetric Cryptology |
| Subjects: | |
| Online Access: | https://tosc.iacr.org/index.php/ToSC/article/view/644 |
| _version_ | 1818613239282401280 |
|---|---|
| author | Anne Canteaut Eran Lambooij Samuel Neves Shahram Rasoolzadeh Yu Sasaki Marc Stevens |
| author_facet | Anne Canteaut Eran Lambooij Samuel Neves Shahram Rasoolzadeh Yu Sasaki Marc Stevens |
| author_sort | Anne Canteaut |
| collection | DOAJ |
| description | The current paper studies the probability of differential characteristics for an unkeyed (or with a fixed key) construction. Most notably, it focuses on the gap between two probabilities of differential characteristics: probability with independent S-box assumption, pind, and exact probability, pexact. It turns out that pexact is larger than pind in Feistel network with some S-box based inner function. The mechanism of this gap is then theoretically analyzed. The gap is derived from interaction of S-boxes in three rounds, and the gap depends on the size and choice of the S-box. In particular the gap can never be zero when the S-box is bigger than six bits. To demonstrate the power of this improvement, a related-key differential characteristic is proposed against a lightweight block cipher RoadRunneR. For the 128-bit key version, pind of 2−48 is improved to pexact of 2−43. For the 80-bit key version, pind of 2−68 is improved to pexact of 2−62. The analysis is further extended to SPN with an almost-MDS binary matrix in the core primitive of the authenticated encryption scheme Minalpher: pind of 2−128 is improved to pexact of 2−96, which allows to extend the attack by two rounds. |
| first_indexed | 2024-12-16T15:58:57Z |
| format | Article |
| id | doaj.art-3fba68786ae2465da8c1cd387cf82bf6 |
| institution | Directory Open Access Journal |
| issn | 2519-173X |
| language | English |
| last_indexed | 2024-12-16T15:58:57Z |
| publishDate | 2017-06-01 |
| publisher | Ruhr-Universität Bochum |
| record_format | Article |
| series | IACR Transactions on Symmetric Cryptology |
| spelling | doaj.art-3fba68786ae2465da8c1cd387cf82bf62022-12-21T22:25:30ZengRuhr-Universität BochumIACR Transactions on Symmetric Cryptology2519-173X2017-06-0120322710.13154/tosc.v2017.i2.203-227644Refined Probability of Differential Characteristics Including Dependency Between Multiple RoundsAnne Canteaut0Eran Lambooij1Samuel Neves2Shahram Rasoolzadeh3Yu Sasaki4Marc Stevens5InriaTechnische Universiteit EindhovenCISUC, Dept. of Informatics Engineering, University of CoimbraRuhr-Universität BochumNTT Secure Platform LaboratoriesCWI AmsterdamThe current paper studies the probability of differential characteristics for an unkeyed (or with a fixed key) construction. Most notably, it focuses on the gap between two probabilities of differential characteristics: probability with independent S-box assumption, pind, and exact probability, pexact. It turns out that pexact is larger than pind in Feistel network with some S-box based inner function. The mechanism of this gap is then theoretically analyzed. The gap is derived from interaction of S-boxes in three rounds, and the gap depends on the size and choice of the S-box. In particular the gap can never be zero when the S-box is bigger than six bits. To demonstrate the power of this improvement, a related-key differential characteristic is proposed against a lightweight block cipher RoadRunneR. For the 128-bit key version, pind of 2−48 is improved to pexact of 2−43. For the 80-bit key version, pind of 2−68 is improved to pexact of 2−62. The analysis is further extended to SPN with an almost-MDS binary matrix in the core primitive of the authenticated encryption scheme Minalpher: pind of 2−128 is improved to pexact of 2−96, which allows to extend the attack by two rounds.https://tosc.iacr.org/index.php/ToSC/article/view/644differential cryptanalysisindependent S-boxfixed keyunkeyed constructionexact probabilityRoadRunneRMinalpher |
| spellingShingle | Anne Canteaut Eran Lambooij Samuel Neves Shahram Rasoolzadeh Yu Sasaki Marc Stevens Refined Probability of Differential Characteristics Including Dependency Between Multiple Rounds IACR Transactions on Symmetric Cryptology differential cryptanalysis independent S-box fixed key unkeyed construction exact probability RoadRunneR Minalpher |
| title | Refined Probability of Differential Characteristics Including Dependency Between Multiple Rounds |
| title_full | Refined Probability of Differential Characteristics Including Dependency Between Multiple Rounds |
| title_fullStr | Refined Probability of Differential Characteristics Including Dependency Between Multiple Rounds |
| title_full_unstemmed | Refined Probability of Differential Characteristics Including Dependency Between Multiple Rounds |
| title_short | Refined Probability of Differential Characteristics Including Dependency Between Multiple Rounds |
| title_sort | refined probability of differential characteristics including dependency between multiple rounds |
| topic | differential cryptanalysis independent S-box fixed key unkeyed construction exact probability RoadRunneR Minalpher |
| url | https://tosc.iacr.org/index.php/ToSC/article/view/644 |
| work_keys_str_mv | AT annecanteaut refinedprobabilityofdifferentialcharacteristicsincludingdependencybetweenmultiplerounds AT eranlambooij refinedprobabilityofdifferentialcharacteristicsincludingdependencybetweenmultiplerounds AT samuelneves refinedprobabilityofdifferentialcharacteristicsincludingdependencybetweenmultiplerounds AT shahramrasoolzadeh refinedprobabilityofdifferentialcharacteristicsincludingdependencybetweenmultiplerounds AT yusasaki refinedprobabilityofdifferentialcharacteristicsincludingdependencybetweenmultiplerounds AT marcstevens refinedprobabilityofdifferentialcharacteristicsincludingdependencybetweenmultiplerounds |