Generalized Boomerang Connectivity Table and Improved Cryptanalysis of GIFT

Li, Chenmeng; Wu, Bing-Fei; Lin, Dongdai

doi:10.1007/978-3-031-26553-2_11

Cited by 4 publications

(2 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The BCT can also be extended to the GBF, which was first proposed in [LWL22] and named the Generalized Boomerang Connectivity Table (GBCT).…”

Section: Generalized Boomerang Frameworkmentioning

confidence: 99%

Impossible Boomerang Attacks Revisited

Zhang,

Wang,

Tang

2024

ToSC

View full text Add to dashboard Cite

The impossible boomerang (IB) attack was first introduced by Lu in his doctoral thesis and subsequently published at DCC in 2011. The IB attack is a variant of the impossible differential (ID) attack by incorporating the idea of the boomerang attack. In this paper, we revisit the IB attack, and introduce the incompatibility of two characteristics in boomerang to the construction of an IB distinguisher. With our methodology, all the constructions of IB distinguisher are represented in a unified manner. Moreover, we show that the related-(twea)key IB distinguishers possess more freedom than the ones of ID so that it can cover more rounds.We also propose a new tool based on Mixed-Integer Quadratically-Constrained Programming (MIQCP) to search for IB attacks. To illustrate the power of the IB attack, we mount attacks against three tweakable block ciphers: Deoxys-BC, Joltik-BC and SKINNY. For Deoxys-BC, we propose a related-tweakey IB attack on 14-round Deoxys-BC-384, which improves the best previous related-tweakey ID attack by 2 rounds, and we improve the data complexity of the best previous related-tweakey ID attack on 10-round Deoxys-BC-256. For Joltik-BC, we propose the best attacks against 10-round Joltik-BC-128 and 14-round Joltik-BC-192 with related-tweakey B attack. For SKINNY-n-3n, we propose a 27-round related-tweakey IB attack, which improves both the time and the memory complexities of the best previous ID attack. We also propose the first related-tweakey IB attack on 28-round SKINNY-n-3n, which improves the previous best ID attack by one round.

show abstract

“…The BCT can also be extended to the GBF, which was first proposed in [LWL22] and named the Generalized Boomerang Connectivity Table (GBCT).…”

Section: Generalized Boomerang Frameworkmentioning

confidence: 99%

Impossible Boomerang Attacks Revisited

Zhang,

Wang,

Tang

2024

ToSC

View full text Add to dashboard Cite

show abstract

“…A first example could be to obtain a one-round contradiction corresponding to a null BCT coefficient (for an SPN cipher) or to a null FBCT coefficient (for a Feistel cipher using Sboxes). The GBCT and FGBCT [LWL22] (which are generalization of these tables in which differences on the facing sides are not equal) could also be used. In the case of a two-round contradiction and as discussed above in Section 3.1, the correct tool to catch a contradiction is the DBCT*.…”

Section: Extending the Impossible Boomerang Distinguisher Notion By U...mentioning

confidence: 99%

On Impossible Boomerang Attacks

Bonnetain,

Cordero,

Lallemand

et al. 2024

ToSC

View full text Add to dashboard Cite

The impossible boomerang attack, introduced in 2008 by Jiqiang Lu, is an extension of the impossible differential attack that relies on a boomerang distinguisher of probability 0 for discarding incorrect key guesses. In Lu’s work, the considered impossible boomerang distinguishers were built from 4 (different) probability-1 differentials that lead to 4 differences that do not sum to 0 in the middle, in a miss-in-the-middle way.In this article, we study the possibility of extending this notion by looking at finerlevel contradictions that derive from boomerang switch constraints. We start by discussing the case of quadratic Feistel ciphers and in particular of the Simon ciphers. We exploit their very specific boomerang constraints to enforce a contradiction that creates a new type of impossible boomerang distinguisher that we search with an SMT solver. We next switch to word-oriented ciphers and study how to leverage the Boomerang Connectivity Table contradictions. We apply this idea to SKINNYee, a recent tweakable block cipher proposed at Crypto 2022 and obtain a 21-round distinguisher.After detailing the process and the complexities of an impossible boomerang attack in the single (twea)key and related (twea)key model, we extend our distinguishers into attacks and present a 23-round impossible boomerang attack on Simon-32/64 (out of 32 rounds) and a 29-round impossible boomerang attack on SKINNYee (out of 56 rounds). To the best of our knowledge our analysis covers two more rounds than the (so far, only) other third-party analysis of SKINNYee that has been published to date.

show abstract