Algebraic Techniques in Differential Cryptanalysis Revisited

Abstract

At FSE 2009, Albrecht et al. proposed a new cryptanalytic method that combines algebraic and differential cryptanalysis. They introduced three new attacks, namely Attack A, Attack B and Attack C. For Attack A, they explain that the time complexity is difficult to determine. The goal of Attacks B and C is to filter out wrong pairs and then recover the key. In this paper, we show that Attack C does not provide an advantage over differential cryptanalysis for typical block ciphers, because it cannot be used to filter out any wrong pairs that satisfy the ciphertext differences. Furthermore, we explain why Attack B provides no advantage over differential cryptanalysis for PRESENT. We verify our results for PRESENT experimentally, using both PolyBoRi and Min-iSat. Our work helps to understand which equations are important in the differential-algebraic attack. Based on our findings, we present two new differential-algebraic attacks. Using the first method, our attack on 15-round PRESENT-80 requires 2 59 chosen plaintexts and has a worstcase time complexity of 2 73.79 equivalent encryptions. Our new attack on 14-round PRESENT-128 requires 2 55 chosen plaintexts and has a worstcase time complexity of 2 112.83 equivalent encryptions. Although these attacks have a higher time complexity than the differential attacks, their data complexity is lower.

Human Psychological Disorder towards Cryptography: True Random Number Generator from EEG of Schizophrenics and Its Application in Block Encryption’s Substitution Box

“…In this section, sample confusion components of Section 4 are evaluated through the standard confusion component evaluation criteria [32][33][34][35][36][37][38][39][40][41][42][43][44], which includes bit independence criterion(BIC), linear approximation probability (LP), strict avalanche criterion (SAC), nonlinearity score, and differential approximation probability (DP).…”

“…As mentioned earlier, chaos-and algebraic-based techniques are extensively used to design the confusion component. Chaos-and algebraic-based techniques provide favorable features for the design of confusion components; however, researchers have also identified various cryptanalysis on these techniques including interpolation attacks [9][10][11][12], Gröbner basis attack [13][14][15][16][17][18][19], SAT solver [20][21][22][23][24][25][26][27], linear and differential attacks [28][29][30][31][32][33][34][35][36][37][38][39][40][41][42], XL attacks [43][44][45], and XSL attack [9,[46][47][48][49][50][51][52][53][54][55]. Similarly, ...…”

A new representation of S-boxes for algebraic differential cryptanalysis

“…In our experiments we use a 4-round SPN with n B = 16, m = 4 with variable S-boxes, and a fixed permutation layer given by bit permutation (1,5,9,13,2,6,10,14,3,7,11,15,4,8,12,16). As a key schedule, we use either repetition of a 16-bit key (for n K = 16), 5 independent 16-bit subkeys (for n K = 80), or a sequence of low 16-bits from a shifted 32-bit key (for n K = 32).…”

“…If we have access to a large number of P-C pairs, algebraic cryptanalysis can be combined with differential techniques [1,5,10]. The attack is based on a selected differential characteristic, which holds with high probability.…”

Improved Differential Cryptanalysis of Round-Reduced Speck

“…This generic key recovery framework for differential cryptanalysis was first proposed by Albrecht and Cid in [2], where it was applied to the block cipher PRESENT (and was further used in followup publications such as [3,22]). Albrecht and Cid used algebraic techniques to enhance differential cryptanalysis, and specifically, devised Attack-C which formulates the sub-cipher as a system of non-linear equations, and solves it using algebraic tools (e.g., SAGE [20]).…”