Automatic Security Evaluation of Block Ciphers with S-bP Structures Against Related-Key Differential Attacks

Abstract

Abstract. Counting the number of active S-boxes is a common way to evaluate the security of symmetric key cryptographic schemes against differential attack. Based on Mixed Integer Linear Programming (MILP), Mouha et al proposed a method to accomplish this task automatically for word-oriented symmetric-key ciphers with SPN structures. However, this method can not be applied directly to block ciphers of SPN structures with bitwise permutation diffusion layers (S-bP structures), due to its ignorance of the diffusion effect derived collaboratively by nonlinear substitution layers and bitwise permutation layers. Moreover, the MILP constrains presented in Mouha et al's method are not enough to describe the differential propagation behaviour of a linear diffusion layer constructed from a non-MDS code, even an almost MDS code. In this paper we extend Mouha et al's method for S-bP structures by introducing new representations for exclusive-or (XOR) differences to describe bit/word level differences simultaneously and by taking the collaborative diffusion effect of S-boxes and bitwise permutations into account. Our method is applied to the block cipher PRESENT-80, an international standard for lightweight symmetric key cryptography, to automatically evaluate its security against differential attacks. We obtain lower bounds on the numbers of active S-boxes in the single-key model for full 31-round PRESENT-80 and in related-key model for round-reduced PRESENT-80 up to 12 rounds, and therefore automatically prove that the full-round PRESENT-80 is secure against single-key differential attack, and the cost of related-key differential attack on the full-round PRESENT-80 is close to that of an exhaustive search: the best related-key differential characteristic for full PRESENT-80 is upper bounded by 2 −72 .

Related-tweakey impossible differential attack on reduced-round Deoxys-BC-256

“…The goal is to find the optimal value that minimizes/maximizes the objective function satisfying all of the inequality constraints. This was introduced in [13,14] and improved in [15][16][17][18].…”

Security of LBlock-s against related-key differential attack

“…In this section, we introduce the MILP based methods proposed by Mouha et al [12] and Sun et al [13,14,17]. The mixed integer linear programming (MILP) problem is an optimization problem derived from linear programming with some or all variables restricted over integers.…”

“…Further, by the method proposed in [14,17], the solution of an MILP instance must correspond to a specific related-key differential characteristic and is the exact lower bound of the number of active S-boxes. We refer the readers to [12,13,14,17] for more information on an MILP problem and linear constraints describing several operations over finite fields with characteristic 2.…”

“…Two word-oriented symmetric ciphers, AES and Enocoro-128v2, were then considered along this line, and they proved that Enocoro-128v2 is secure enough to resist against differential and linear cryptanalysis. Subsequently, Sun et al extended the method to apply to bit-oriented symmetric ciphers and obtained a series of inequalities over integers for describing an S-box and generalized Mouha et al's method [13,14]. In [14], it was proved that the cipher PRESENT-80 is secure enough to resist against standard related-key differential attack and the lower bound of probabilities of related-key differential characteristics of the full-round LBlock is upper bounded by 56 2 .…”

“…However, whether LBlock-s can resist against the related-key differential attack is unclear. In this paper, we will examine the security of LBlock-s against related-key differential attacks by using the methods proposed by Mouha et al [12] and Sun et al [13,14,17]. To this end, we will firstly introduce the MILP based methods in the next section.…”