Improved Conditional Differential Analysis on NLFSR Based Block Cipher KATAN32 with MILP

Abstract

In this paper, a new method for constructing a Mixed Integer Linear Programming (MILP) model on conditional differential cryptanalysis of the nonlinear feedback shift register-(NLFSR-) based block ciphers is proposed, and an approach to detecting the bit with a strongly biased difference is provided. The model is successfully applied to the block cipher KATAN32 in the single-key scenario, resulting in practical key-recovery attacks covering more rounds than the previous. In particular, we present two distinguishers for 79 and 81 out of 254 rounds of KATAN32. Based on the 81-round distinguisher, we recover 11 equivalent key bits of 98-round KATAN32 and 13 equivalent key bits of 99-round KATAN32. The time complexity is less than 2 31 encryptions of 98-round KATAN32 and less than 2 33 encryptions of 99-round KATAN32, respectively. Thus far, our results are the best known practical key-recovery attacks for the round-reduced variants of KATAN32 regarding the number of rounds and the time complexity. All the results are verified experimentally.

Conditional differential analysis on the KATAN ciphers based on deep learning

“…The conditional differential analysis results of KATAN ciphers are improved in the single-key setting. In Table12, we summarise the results of practical key recovery attacks on KATAN ciphers in the singlekey setting.Compared with the results in Ref [12][13][14],. our attacks improve the number of recoverable key bits and have advantages in time complexity and data complexity for KATAN32.As shown inTable 12, our work is the best result in the practical key recovery attack for KATAN48 and KATAN64.…”

“…Conditions only involve key bits k i . This paper uses the Mixed-Integer Linear Programming (MILP) model [14] to search the conditions of the KATAN ciphers, which also can be found in a manual operation. The input difference has an impact on the accuracy of the neural distinguishers.…”

“…Plaintext structures are generated by weak neutral bit sets, which pass the initial 26-round differential characteristic together with probability 1. For KATAN32, five bits [30,29,26,14,12] are only shown in the last condition. Hence, {30, 13}, {29, 13}, {26, 13}, {14, 13}, {12, 13} (p 13 is changed in the last conditions) are five weak neutral bit sets of KATAN32.…”

“…Cube and algebraic attacks are also presented as practical attacks of KATAN ciphers [13]. Xing et al [14] improved the conditional differential analysis of KATAN32. Additionally, there are some theoretical attack results of KATAN family [15][16][17].…”

“…Xing et al. [14] improved the conditional differential analysis of KATAN32. Additionally, there are some theoretical attack results of KATAN family [15–17].…”