Another View of the Division Property

Abstract

A new distinguishing property against block ciphers, called the division property, was introduced by Todo at Eurocrypt 2015. Our work gives a new approach to it by the introduction of the notion of parity sets. First of all, this new notion permits us to formulate and characterize in a simple way the division property of any order. At a second step, we are interested in the way of building distinguishers on a block cipher by considering some further properties of parity sets, generalising the division property. We detail in particular this approach for substitutionpermutation networks. To illustrate our method, we provide low-data distinguishers against reduced-round Present. These distinguishers reach a much higher number of rounds than generic distinguishers based on the division property and demonstrate, amongst others, how the distinguishers can be improved when the properties of the linear and the Sbox layer are taken into account. At last, this work provides an analysis of the resistance of Sboxes against this type of attacks, demonstrates links with the algebraic normal form of an Sbox as well as its inverse Sbox and exhibit design criteria for Sboxes to resist such attacks.

Division cryptanalysis of block ciphers with a binary diffusion layer

“…Definition 1 (Division property [12,4]). A set X ⊆ F n 2 has the division property D n k for some 1 ≤ k ≤ n, if the sum over all vectors x in X of the product x u equals 0, for all vectors u that have a hamming weight less than k, i.e.…”

“…"=⇒" By [4,Proposition 7], if (x, y) is one of the division trails of an order n linear transformation, then the monomial ∏ i∈Ix x i appears in the expansion of ∏ j∈Iy y j = (a j1,1 x 1 + · · · + a j1,n x n ) · · · (a j wt(x) ,1 x 1 + · · · + a j wt(x) ,n x n ).…”

Tuple Cryptanalysis: Slicing and Fusing Multisets

“…More recently, Todo [34,35] generalized the integral cryptanalysis approach by taking the integral sum on the low-order polynomial subsets of all the elements in the output multisets, such that due to the higher-order dierential type property linked to the algebraic normal form (ANF) representation of the cipher component, a zero sum is obtained; so-called the division property. The approach was then formalised by Boura and Canteaut [46] in relation to Reed-Muller codes, based on parity computation across dierent multiple bits of each multiset element, which is related to the ANF representation of functions and the algebraic degree. In contrast, our proposed approach considers each bitslice channel independently and the focus is on the internal ordering of such bitslice elements rather than on their integral sum.…”

Paradigms in Cryptology – Mycrypt 2016. Malicious and Exploratory Cryptology

“…More recently, Todo [34,35] generalized the integral cryptanalysis approach by taking the integral sum on the low-order polynomial subsets of all the elements in the output multisets, such that due to the higher-order dierential type property linked to the algebraic normal form (ANF) representation of the cipher component, a zero sum is obtained; so-called the division property. The approach was then formalised by Boura and Canteaut [46] in relation to Reed-Muller codes, based on parity computation across dierent multiple bits of each multiset element, which is related to the ANF representation of functions and the algebraic degree. In contrast, our proposed approach considers each bitslice channel independently and the focus is on the internal ordering of such bitslice elements rather than on their integral sum.…”