Catching the Fastest Boomerangs

Delaune, Stéphanie; Derbez, Patrick; Vavrille, Mathieu

doi:10.46586/tosc.v2020.i4.104-129

Cited by 30 publications

(65 citation statements)

References 13 publications

(25 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The probabilities denoted by §, correspond to the distinguishers that can be obtained by extending the distinguishers proposed in [SQH19]. The probabilities displayed with a † sign correspond to the distinguishers from [DDV20] that are exactly the same as our distinguishers and the probabilities represented with a ‡ sign are associated to the distinguishers from [DDV20] having the same activeness pattern as our distinguisher. proved that the probability of four boomerang distinguishers proposed in [LGS17] are much higher than previously evaluated.…”

Section: A Brief Description Of Skinnymentioning

confidence: 99%

“…We also improve the boomerang distinguishers of SKINNY-64-128 and SKINNY-64-192 by one round. Authors of [DDV20] have also independently improved the boomerang distinguishers of SKINNY about which we will discuss in detail in Section 8. To the best of our knowledge, our boomerang distinguishers for SKINNY-n-2n and SKINNY-n-3n when n ∈ {64, 128}, are the best related-tweakey distinguishers so far for these variants of SKINNY in terms of probability and the number of rounds.…”

Section: Our Contributionmentioning

confidence: 99%

“…Building upon the improved boomerang distinguishers, we mount key recovery attacks against reduced CRAFT and SKINNY in Section 7. Lastly, we provide a comparison between the methods developed in [DDV20] and this paper in Section 8 and conclude the paper in Section 9.…”

Section: Our Contributionmentioning

confidence: 99%

“…For complete details of the round function, and tweakey scheduling algorithm, one can refer to [BJK + 16]. [DDV20] for boomerang distinguishers of SKINNY. The probabilities highlighted in red have been verified experimentally.…”

Section: A Brief Description Of Skinnymentioning

confidence: 99%

See 3 more Smart Citations

Improved Rectangle Attacks on SKINNY and CRAFT

Hadipour

Bagheri

Song

2021

ToSC

View full text Add to dashboard Cite

The boomerang and rectangle attacks are adaptions of differential cryptanalysis that regard the target cipher E as a composition of two sub-ciphers, i.e., E = E1 ∘ E0, to construct a distinguisher for E with probability p2q2 by concatenating two short differential trails for E0 and E1 with probability p and q respectively. According to the previous research, the dependency between these two differential characteristics has a great impact on the probability of boomerang and rectangle distinguishers. Dunkelman et al. proposed the sandwich attack to formalise such dependency that regards E as three parts, i.e., E = E1 ∘ Em ∘ E0, where Em contains the dependency between two differential trails, satisfying some differential propagation with probability r. Accordingly, the entire probability is p2q2r. Recently, Song et al. have proposed a general framework to identify the actual boundaries of Em and systematically evaluate the probability of Em with any number of rounds, and applied their method to accurately evaluate the probabilities of the best SKINNY’s boomerang distinguishers. In this paper, using a more advanced method to search for boomerang distinguishers, we show that the best previous boomerang distinguishers for SKINNY can be significantly improved in terms of probability and number of rounds. More precisely, we propose related-tweakey boomerang distinguishers for up to 19, 21, 23, and 25 rounds of SKINNY-64-128, SKINNY-128-256, SKINNY-64-192 and SKINNY-128-384 respectively, which improve the previous boomerang distinguishers of these variants of SKINNY by 1, 2, 1, and 1 round respectively. Based on the improved boomerang distinguishers for SKINNY, we provide related-tweakey rectangle attacks on 23 rounds of SKINNY-64-128, 24 rounds of SKINNY-128-256, 29 rounds of SKINNY-64-192, and 30 rounds of SKINNY-128-384. It is worth noting that our improved related-tweakey rectangle attacks on SKINNY-64-192, SKINNY-128-256 and SKINNY-128-384 can be directly applied for the same number of rounds of ForkSkinny-64-192, ForkSkinny-128-256 and ForkSkinny-128-384 respectively. CRAFT is another SKINNY-like tweakable block cipher for which we provide the security analysis against rectangle attack for the first time. As a result, we provide a 14-round boomerang distinguisher for CRAFT in the single-tweak model based on which we propose a single-tweak rectangle attack on 18 rounds of this cipher. Moreover, following the previous research regarding the evaluation of switching in multiple rounds of boomerang distinguishers, we also introduce new tools called Double Boomerang Connectivity Table (DBCT), LBCT⫤, and UBCT⊨ to evaluate the boomerang switch through the multiple rounds more accurately.

show abstract

Section: A Brief Description Of Skinnymentioning

confidence: 99%

Section: Our Contributionmentioning

confidence: 99%

Section: Our Contributionmentioning

confidence: 99%

Section: A Brief Description Of Skinnymentioning

confidence: 99%

See 2 more Smart Citations

Improved Rectangle Attacks on SKINNY and CRAFT

Hadipour

Bagheri

Song

2021

ToSC

View full text Add to dashboard Cite

show abstract

“…They introduced some new tables for S-boxes to model the dependence between the upper and lower differentials in boomerang distinguishers. We briefly introduce their searching approach by following steps: Almost at the same time, [DDV20] proposed a new automatic tool to search boomerang distinguishers and provided their source code to facilitate follow-up works. Similar with [HBS20], they also introduced a set of tables which help to calculate the probability of the boomerang distinguisher.…”

Section: The Tradeoff In Rectangle Attack On Ciphers With Linear Key-schedulementioning

confidence: 99%

Automated Search Oriented to Key Recovery on Ciphers with Linear Key Schedule

Qin

Dong

Wang

et al. 2021

ToSC

View full text Add to dashboard Cite

Automatic modelling to search distinguishers with high probability covering as many rounds as possible, such as MILP, SAT/SMT, CP models, has become a very popular cryptanalysis topic today. In those models, the optimizing objective is usually the probability or the number of rounds of the distinguishers. If we want to recover the secret key for a round-reduced block cipher, there are usually two phases, i.e., finding an efficient distinguisher and performing key-recovery attack by extending several rounds before and after the distinguisher. The total number of attacked rounds is not only related to the chosen distinguisher, but also to the extended rounds before and after the distinguisher. In this paper, we try to combine the two phases in a uniform automatic model.Concretely, we apply this idea to automate the related-key rectangle attacks on SKINNY and ForkSkinny. We propose some new distinguishers with advantage to perform key-recovery attacks. Our key-recovery attacks on a few versions of round-reduced SKINNY and ForkSkinny cover 1 to 2 more rounds than the best previous attacks.

show abstract

A Simpler Model for Recovering Superpoly on Trivium

Delaune

Derbez

Gontier

et al. 2022

Selected Areas in Cryptography

Self Cite

View full text Add to dashboard Cite

The cube attack is a powerful cryptanalysis technique against symmetric primitives, especially for stream ciphers. One of the key step in a cube attack is recovering the superpoly. The division property has been introduced to cube attacks with the aim first to identify variables/monomials that are not involved in the superpoly. Recently, some improved versions of this technique allowing the recovery of the exact superpoly have been developed and applied on various stream ciphers [13,15]. In this paper, we propose a new model to recover the exact superpoly of a stream cipher given a cube. We model the polynomials involved in the stream cipher as a directed graph. It happens that this structure handles some of the monomial cancellations more easily than those based on division property, and this leads to better timing results. We propose two implementations of our model, one in MILP and one in CP, which are up to 10 times faster than the original division property-based model from Hao et al. [13], and consistently 30 to 60 times faster than the monomial prediction-based model from Hu et al. [15].

show abstract

Catching the Fastest Boomerangs

Cited by 30 publications

References 13 publications

Improved Rectangle Attacks on SKINNY and CRAFT

Improved Rectangle Attacks on SKINNY and CRAFT

Automated Search Oriented to Key Recovery on Ciphers with Linear Key Schedule

A Simpler Model for Recovering Superpoly on Trivium

Contact Info

Product

Resources

About