MILP Modeling for (Large) S-boxes to Optimize Probability of Differential Characteristics

Abstract

Current Mixed Integer Linear Programming (MILP)-based search against symmetric-key primitives with 8-bit S-boxes can only build word-wise model to search for truncated differential characteristics. In such a model, the properties of the Differential Distribution Table (DDT) are not considered. To take these properties into account, a bit-wise model is necessary, which can be generated by the H-representation of the convex hull or the logical condition modeling. However, the complexity of both approaches becomes impractical when the size of the S-box exceeds 5 bits. In this paper, we propose a new modeling for large (8-bit or more) S-boxes. In particular, we first propose an algorithm to generate a bit-wise model of the DDT for large S-boxes. We observe that the problem of generating constraints in logical condition modeling can be converted into the problem of minimizing the product-of-sum of Boolean functions, which is a well-studied problem. Hence, classical off-the-shelf solutions such as the Quine-McCluskey algorithm or the Espresso algorithm can be utilized, which makes building a bit-wise model, for 8-bit or larger S-boxes, practical. Then this model is further extended to search for the best differential characteristic by considering the probabilities of each propagation in the DDT, which is a much harder problem than searching for the lower bound on the number of active S-boxes. Our idea is to separate the DDT into multiple tables for each probability and add conditional constraints to control the behavior of these multiple tables. The proposed modeling is first applied to SKINNY-128 to find that there is no differential characteristic having probability higher than 2−128 for 14 rounds, while the designers originally expected that 15 rounds were required. We also applied the proposed modeling to two, arbitrarily selected, constructions of the seven AES round function based constructions proposed in FSE 2016 and managed to improve the lower bound on the number of the active S-boxes in one construction and the upper bound on the differential characteristic for the other.

New method to describe the differential distribution table for large S‐boxes in MILP and its application

“…Moreover, to search the best probability of the truncated differential characteristic, we use the idea of [19] to separate the DDT to pd‐ DDT according to the probability. We use the new method to obtain the inequalities for each pd‐ DDT.…”

“…Abdelkhalek et al . [19] first proposed a method to generate the inequalities of the DDT for the large S‐boxes. They converted the problem of generating constraints in logic condition modelling into the problem of minimising the product‐of‐sum of Boolean functions which is a well‐studied problem.…”

New Results on Gimli: Full-Permutation Distinguishers and Improved Collisions

“…This section aims to provide the first analysis of the linear properties of the Gimli permutation and its components. We use a Mixed Integer Linear Programming (MILP) modelization of the operations constructed according to [1], and then solve it with the SCIP software [17,18] to search for linear trails with optimal correlation. Linear trails of the (double) SP-box We begin by studying the linear trails of the SP-Box.…”

“…The 23-round distinguisher could be extended by 1 round for free if the rounds were shifted. 1 Using similar guess-and-determine ideas, we increase to 12 the number of rounds susceptible to collision attacks on Gimli-Hash. A reduced-round version of this attack has been implemented.…”

Linearly equivalent S-boxes and the division property

“…8-bit S-boxes) as the complexity of generating the initial set of inequalities is too high. However, Abdelkhalek et al showed a new method in [1] to tackle this problem, and thus proposed a way to modelize 8-bit S-boxes in MILP. Note that while this allows us to modelize 8-bit S-boxes, it often leads to a lot of inequalities, thus the resulting model can be quite huge and this can result in a high solving time.…”