Links Among Impossible Differential, Integral and Zero Correlation Linear Cryptanalysis

Abstract

Abstract. As two important cryptanalytic methods, impossible differential cryptanalysis and integral cryptanalysis have attracted much attention in recent years. Although relations among other important cryptanalytic approaches have been investigated, the link between these two methods has been missing. The motivation in this paper is to fix this gap and establish links between impossible differential cryptanalysis and integral cryptanalysis.Firstly, by introducing the concept of structure and dual structure, we prove that a → b is an impossible differential of a structure E if and only if it is a zero correlation linear hull of the dual structure E ⊥ . More specifically, constructing a zero correlation linear hull of a Feistel structure with SP -type round function where P is invertible, is equivalent to constructing an impossible differential of the same structure with P T instead of P . Constructing a zero correlation linear hull of an SPN structure is equivalent to constructing an impossible differential of the same structure with (P −1 ) T instead of P . Meanwhile, our proof shows that the automatic search tool presented by Wu and Wang could find all impossible differentials of both Feistel structures with SP -type round functions and SPN structures, which is useful in provable security of block ciphers against impossible differential cryptanalysis.Secondly, by establishing some boolean equations, we show that a zero correlation linear hull always indicates the existence of an integral distinguisher while a special integral implies the existence of a zero correlation linear hull. With this observation we improve the integral distinguishers of Feistel structures by 1 round, build a 24-round integral distinguisher of CAST-256 based on which we propose the best known key recovery attack on reduced round CAST-256 in the non-weak key model, present a 12-round integral distinguisher of SMS4 and an 8-round integral distinguisher of Camellia without F L/F L −1 . Moreover, this result provides a novel way for establishing integral distinguishers and converting known plaintext attacks to chosen plaintext attacks.Finally, we conclude that an r-round impossible differential of E always leads to an r-round integral distinguisher of the dual structure E ⊥ . In the case that E and E ⊥ are linearly equivalent, we derive a direct link between impossible differentials and integral distinguishers of E . Specifically, we obtain that an r-round impossible differential of an SPN structure, which adopts a bit permutation as its linear layer, always indicates the existence of an r-round integral distinguisher. Based on this newly established link, we deduce that impossible differentials of SNAKE(2), PRESENT, PRINCE and ARIA, which are independent of the choices of the S-boxes, always imply the existence of integral distinguishers.Our results could help to classify different cryptanalytic tools. Furthermore, when designing a block cipher, the designers need to demonstrate that the cipher has sufficient security margins against impo...

A New Structural-Differential Property of 5-Round AES

“…exploited, one cannot find any impossible differential or zero-correlation linear hull of the AES that covers 5 or more rounds. Moreover, due to the link among impossible differential, integral and zero correlation linear cryptanalysis [24], an analogous result holds also for the integral case. On the other hand, our new property presented in this paper holds up to 5-round of AES independently of the key and of the details of the S-Box (and of the MixColumns operation), and allows to answer an almost 20-year old problem: given a set of chosen plaintexts similar to the one used by the integral and impossible differential distinguishers just recalled, is there any property which is independent of the secret key after 5-round AES?…”

Improvements for Finding Impossible Differentials of Block Cipher Structures

“…We apply this method to many block cipher structures. The experiment results show that this improvement can largely reduce the search time for the impossible differentials of a block cipher, since there are known relationships between impossible differential and integral and zero correlation linear cryptanalysis [22,36,37]. This method can be used as a cryptanalytic tool to evaluate the security of a block cipher against these kinds of cryptanalysis.…”

“…MIBS is a 16-subblock Feistel structure with substitution and permutation input: A differential pair (Δin, Δout) and the system S output: A boolean flag indicates if (Δin, Δout) is an impossible differential (1) is the × augmented matrix of S; (2) is the − 1 dimension variable vector; (3) N is the map of constraints of S; (4) flag←false; (5) index←true; (6) Initialize every variable in according to (Δin, Δout) and the constraints in N; (7) while index do (8) UpdateMatrix ( , ) // Update according to ; / * Transform into the reduced-row-echelon form by Gauss-Jordan Elimination * / (9) ReducedRowEchelon ( ); (10) if has no solution then (11) flag←true; (12) break; (13) else (14) index ← false; (15) count← 0; (16) for ← to 1 do (17) → V ← Row of ; (18) if the sum of the first − 1 elements of → V is 1 then (19) ← the index of the element 1 in → V ; (20) ← the last element of → V ; // the solution of the th variable in (21) / * update the variable vector with ( , ) and return true if there is no contradiction and return false otherwise. * / (22) ←UpdateVector ( , N, , ); (23) if is false then (24) flag ← true; (25) return flag; (26) else (27) index ← true; (28) end (29) end (30) end ( …”

“…In [22], Sun et al show that Wu and Wang's automatic search method can find all impossible differentials of a cipher that are independent of the choices of the inner primitives. However, Wu and Wang's method can only find all truncated impossible differentials since the choice of truncated difference may result in missing some impossible differentials.…”

On the Complexity of Impossible Differential Cryptanalysis

“…Impossible differential attack, introduced by Knudsen [1] and Biham et al [2] independently, is one of the most well-known cryptanalytic techniques for symmetric-key cryptanalysts [3][4][5][6][7][8][9]. Generally, in impossible differential cryptanalysis, we guess some key bits involved in the outer rounds of the target cipher.…”