Cryptanalysis of Skipjack Reduced to 31 Rounds Using Impossible Differentials

Abstract

In this paper we present a new cryptanalytic technique, based on impossible differentials, and use it to show that Skipjack reduced from 32 to 31 rounds can be broken by an attack which is faster than exhaustive search.

Miss in the Middle Attacks on IDEA and Khufu

“…5 2 53 4 * * impossible-differential 2 37 2 70 4.5 * * * impossible-differential 2 64 2 112 * From the second to the middle of the fifth round. * * From the second to the end of the fifth round.…”

“…Depending on the starting round and on the differential being used ((a, 0, a, 0) or (0, a, 0, a)), there is a varying amount of overlap between the subkey bits. In the case of our choice (from second to the fifth round, with the first differential), we will work with subkeys: 5 5 , Z 5 6 : a) Decrypt the last half round of all the structures, using the guessed subkeys. b) For each structure find all pairs with zero differences in the third and fourth words, leaving about 2 31 pairs per structure.…”

“…In [5,17] a new cryptanalytic technique based on impossible differentials was proposed, and its application to Skipjack [28] and DEAL [17] was described. In this paper we apply this technique to the IDEA and Khufu cryptosystems.…”

Propagation Characteristics and Correlation-Immunity of Highly Nonlinear Boolean Functions

“…It is also recommended that the output distribution of all derivatives be close to the uniform distribution: the existence of a derivative whose output takes a constant value with a high probability leads to differential attacks [3,2]. This means that |F(D α f)| should be small for all nonzero α ∈ F n 2 .…”

HIGHT: A New Block Cipher Suitable for Low-Resource Device

“…We call it an impossible differential characteristic [2]. Such differential characteristic can be used for attacks on block ciphers.…”