An Algebraic Formulation of the Division Property: Revisiting Degree Evaluations, Cube Attacks, and Key-Independent Sums

Hu, Kai; Sun, Siwei; Wang, Meiqin; Wang, Qingju

doi:10.1007/978-3-030-64837-4_15

Cited by 40 publications

(59 citation statements)

References 31 publications

(69 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The monomial prediction is another language for the division property from the polynomial viewpoint. The paper [15] has shown the equivalence between 3SDPwoU and the monomial prediction. In theory, they are perfectly accurate in detecting the integral distinguishers by counting the number of monomial trails.…”

Section: Monomial Predictionmentioning

confidence: 92%

“…The monomial prediction is a new technique proposed by Hu et al in [15] to determine whether a monomial appears in any product of the coordinate functions of a vectorial boolean function f . It provides a new perspective from the polynomial for the division properties [26,13].…”

Section: Monomial Predictionmentioning

confidence: 99%

“…To represent the monomial trails through the linear layer, we introduce a set of auxiliary binary variables t i,j (0 ≤ i, j ≤ n−1) to decompose the binary matrix into XOR and COPY operations. Denote (x 0 , x 1 , ..., x n−1 ) → (y 0 , y 1 , ..., y n−1 ) as a monomial trail of M , then we can construct linear inequal- The works in [13,15] have implied that the 3SDPwoU and the monomial prediction can be used to detect the integral properties for ciphers considering the key schedule. In this paper, we regard all the round keys are independent input variables, and the whole model we consider is illustrated in Figure 2.…”

Section: Milp Modeling For the Monomial Predictionmentioning

confidence: 99%

“…By counting the so-called monomial trails, they are able to determine if a monomial of the plaintext or IV appears in the polynomial of the cipher output. Indeed, the monomial prediction and the 3SDPwoU were proved to be equivalent [15].…”

Section: Introductionmentioning

confidence: 97%

“…Recently, Hebborn et al pointed out that the idea behind the 3SDPwoU from the perspective of the parity set [5] is that the 3SDPwoU actually determined the existence or absence of a certain monomial in the polynomial of the cipher output. At ASIACRYPT 2020, Hu et al [15] proposed the concept of the monomial prediction, which is another language for the division properties from the viewpoint of the polynomial directly. By counting the so-called monomial trails, they are able to determine if a monomial of the plaintext or IV appears in the polynomial of the cipher output.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Integral Attacks on Pyjamask-96 and Round-Reduced Pyjamask-128

Cui

Wang

et al. 2022

Topics in Cryptology – CT-RSA 2022

Self Cite

View full text Add to dashboard Cite

In order to provide benefits in the areas of fully homomorphic encryption (FHE), multi-party computation (MPC), post-quantum signature schemes, or efficient masked implementations for side-channel resistance, reducing the number of multiplications has become a quite popular trend for the symmetric cryptographic primitive designs. With an aggressive design strategy exploiting the extremely simple and lowdegree S-box and low number of rounds, Pyjamask, the fundamental block cipher of the AEAD with the same name, has the smallest number of AND gates per bit among all the existing block ciphers (except LowMC or Rasta which work on unconventional plaintext/key sizes). Thus, although the AEAD Pyjamask stuck at the second round of the NIST lightweight cryptography standardization process, the block cipher Pyjamask itself still attracts a lot of attention. Not very unexpectedly, the low degree and the low number of rounds are the biggest weakness of Pyjamask. At FSE 2020, Dobraunig et al. successfully mounted an algebraic and higher-order differential attack on full Pyjamask-96, one member of the Pyjamask block cipher family. However, the drawback of this attack is that it has to use the full codebook, which makes the attack less appealing. In this paper, we take integral attacks as our weapon, which are also sensitive to the low degree. Based on a new 11-round integral distinguisher found by state-of-the-art detection techniques, and combined with the relationship between round keys that reduces the involved keys , we give the key recovery attack on the full Pyjamask-96 without the full codebook for the first time. Further, the algebraic and higher-order differential technique does not work for Pyjamask-128, the other member of the Pyjamask block cipher family. To better understand the security margin of Pyjamask-128, we present the first third-party cryptanalysis on Pyjamask-128 up to 11 out of 14 rounds.

show abstract

Section: Monomial Predictionmentioning

confidence: 92%

Section: Monomial Predictionmentioning

confidence: 99%

Section: Milp Modeling For the Monomial Predictionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 97%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations