Automatic Search for Bit-Based Division Property

Ghosh, Shibam; Dunkelman, Orr

doi:10.1007/978-3-030-88238-9_13

Cited by 6 publications

(2 citation statements)

References 32 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Automated tools were also used for additional properties, including CP for the bit-based division property [GD21] and MILP for the 3-subset bit-based division property [RHSS21].…”

Section: Previous Bounds For the Ascon Permutationmentioning

confidence: 99%

Bounds for the Security of Ascon against Differential and Linear Cryptanalysis

Erlacher

Mendel

Eichlseder

2022

ToSC

View full text Add to dashboard Cite

The NIST Lightweight Cryptography project aims to standardize symmetric cryptographic designs, including authenticated encryption and hashing, suitable for constrained devices. One essential criterion for the evaluation of the 10 finalists is the evidence for their security against attacks like linear and differential cryptanalysis. For Ascon, one of the finalists and previous winner of the CAESAR competition in the ‘lightweight’ category, there is a large gap between the proven bounds and the best known characteristics found with heuristic tools: The bounds only cover up to 3 rounds with 15 differentially and 13 linearly active S-boxes, insufficient for proving a level of security for the full constructions.In this paper, we propose a new modeling strategy for SAT solvers and derive strong bounds for the round-reduced Ascon permutation. We prove that 4 rounds already ensure that any single characteristic has a differential probability or squared correlation of at most 2−72, and 6 rounds at most 2−108. This is significantly below the bound that could be exploited within the query limit for keyed Ascon modes. These bounds are probably not tight. To achieve this result, we propose a new search strategy of dividing the search space into a large number of subproblems based on ‘girdle patterns’, and show how to exploit the rotational symmetry of Ascon using necklace theory. Additionally, we evaluate and optimize several aspects of the pure SAT model, including the counter implementation and parallelizability, which we expect to be useful for future applications to other models.

show abstract

“…Automated tools were also used for additional properties, including CP for the bit-based division property [GD21] and MILP for the 3-subset bit-based division property [RHSS21].…”

Section: Previous Bounds For the Ascon Permutationmentioning

confidence: 99%

Bounds for the Security of Ascon against Differential and Linear Cryptanalysis

Erlacher

Mendel

Eichlseder

2022

ToSC

View full text Add to dashboard Cite

show abstract

“…We also like to note that there are several important topics that we did not cover. Those topics are mainly concerned with an efficient computation of the division property using either dedicated algorithms [4,7,26,36] or general tools, in particular mixed integer linear programming tools [8,10,17,[37][38][39][40][41][42], SAT/SMT solvers [19,22,[43][44][45][46][47]. It is actually this practical computational aspect that is of great importance for all variants of the division property.…”

Section: Discussionmentioning

confidence: 99%

Mathematical aspects of division property

2023

View full text Add to dashboard Cite

This work surveys mathematical aspects of division property, which is a state of the art technique in cryptanalysis of symmetric-key algorithms, such as authenticated encryption, block ciphers and stream ciphers. It aims to find integral distinguishers and cube attacks, which exploit weakness in the algebraic normal forms of the output coordinates of the involved vectorial Boolean functions. Division property can also be used to provide arguments for security of primitives against these attacks. The focus of this work is a formal presentation of the theory behind the division property, including rigorous proofs, which were often omitted in the existing literature. This survey covers the two major variants of division property, namely conventional and perfect division property. In addition, we explore relationships of the technique with classic degree bounds.

show abstract