Fast Ciphers for Cheap Hardware: Differential Analysis of SPECTR-H64

Cryptanalysis on Block Ciphers

“…The first related-key differential making up the 24-round distinguisher is the following related-key differential ∆α → ∆β with probability 2 −32.49 for E 0 : (e 22,27,31 , e 27 ) → (e 12,17,21 , e 7,25,27 ), where the relationship between the four cipher keys is…”

“…Guess a value for the most significant 6 bits K 45, [27,32] of the 32-bit value K 45 , and perform Steps (a) and (b) below.…”

“…, partially decrypt R l 1 and R l 2 with K 45, [27,32] and K 45, [27,32] ⊕ ρ 6 6 , respectively, under the two possibilities 0 and 1 of the carry bit occurred in bit (26) of the left add modulo operation to get the corresponding values for the most significant 6 bits of the left and right halves just before Round 45; we denote them by U s,l 1 and U s,l 2 , respectively, and partially decrypt R * l 1 and R * l 2 with K 45, [27,32] and K 45, [27,32] ⊕ ρ 6 6 , respectively, under the two possibilities 0 and 1 of the carry bit occurred in bit (26) …”

Controlled elements for designing ciphers suitable to efficient VLSI implementation

“…3b), or as a set of four 2 × 2 substitutions (Fig. 3c) called modifications F 2/2 (00) , F 2/2 (01) , F 2/2 (10) and F 2/2 (11) . The VLSI implementation of CE F 2/2 consumes also two 4-bit memory cells.…”

“…The DDPs have been used as main design primitive in a number of fast block ciphers CIKS-1 [10], Spectr-H64 [11], Cobra-H64 [12], and Cobra-H128 [13] suitable to cheap hardware implementation). Security analysis of these ciphers has shown that efficiency of the DDPs as cryptographic primitive is caused by the variability of this operation while ciphering different data blocks.…”