Markov Ciphers and Alternating Groups

Abstract

This paper includes some relalions between differential cryptanalysis and group theory. The main result is the following: If the one-round functions of :UI r-round iterated, cipher generate the rdternating or the symmetric group, then for all corresponding Markov ciphers the chains of differences are irreducible and aperiodic. As an application it will be shown that if the hypothesis of stochastic equivalence holds for any of these corresponding Uvkov ciphers, then the DES and the IDEA(32) 'we secure against a differential cryptanalysis attack after sufficiently m,my rounds for these Mmkov ciphers. The section about IDEA(32) includes the result that the one-round functions of this algorithm generate the altemqting group.The theoretic foundations in group theory and Markov chains are described for instance in [Wie 641 and [Fel 581. Properties of Markov Chains and Markov CiphersLet us recall some definitions and properties of Markov chains. The definitions follow the notations of [LMM 911. In this section we will briefly review parts of this paper.A sequence of discrete random variables vo,vl ,. .., v, is a Markov chain if for 0 I i < r (where r = -is allowed):A Markov chain is called homogeneous if P ( V~+~ = PI vi = a) is independent of i for all pairs (a$).Let I 7 = ipu[ denote the transition probability matrix of a finite homogeneous Markov chain with M states and p;i the transition probabilities.

Imprimitive Permutation Groups and Trapdoors in Iterated Block Ciphers

“…Unfortunately this property seems to be hard to verify in practice. We note that DES and IDEA (probably, see [12]) do satisfy this property.…”

Group theoretic properties of Rijndael-like ciphers

“…Small cardinality. If the cardinality of the group G R,n were small, then this property may be related to regularities of Markov chains that are considered in the context of differential and linear cryptanalysis (see [25] and [12]). If these chains are not irreducible or not aperiodic, then differential and/or linear attacks may be derived.…”

“…A further motivation to study the group theoretic properties of a block cipher stems from a connection to the Markov cipher approach to classical differential cryptanalysis [16,25]. If it can be shown that the round functions of a block cipher generate the alternating group on the message space, then for all corresponding Markov ciphers the chain of differences is irreducible and aperiodic, which means that after sufficiently many rounds of the cipher all differences become equally probable [12]. As the AES round functions generate the alternating group on the state space [32], after sufficiently many AES rounds all differences will roughly be equally probable with respect to the Markov cipher theory approach (see also [1,Section 3.2]).…”

The round functions of KASUMI generate the alternating group

“…The group * is primitive by Proposition 6.1 and contains only even permutations by [ Proof. The group generated by the KASUMI encryption functions with independent round keys is a normal subgroup of * (see [10]). Since the alternating group on {0, 1} 64 is simple, the result follows from Theorem 6.6.…”

“…A further purpose for the analysis of group theoretic properties of a block cipher stems from the fact that, if the round functions of the cipher generate the alternating group on the message space, then general security proofs for the cipher are possible with respect to the Markov cipher approach to classical di erential cryptanalysis (cf. [2,10,16]). For the DES [4], AES [22], and other ciphers, several results on the cyclic and group theoretic structure of their components have already been found (see [3,5,8,13,21,23,24]).…”