Multiple Differential Cryptanalysis Using LLR and χ 2 Statistics

Abstract

Abstract. Recent block ciphers have been designed to be resistant against differential cryptanalysis. Nevertheless it has been shown that such resistance claims may not be as accurate as wished due to recent advances in this field. One of the main improvements to differential cryptanalysis is the use of many differentials to reduce the data complexity. In this paper we propose a general model for understanding multiple differential cryptanalysis and propose new attacks based on tools used in multidimensional linear cryptanalysis (namely LLR and χ 2 statistical tests). Practical cases to evaluate different approaches for selecting and combining differentials are considered on a reduced version of the cipher PRESENT. We also consider the accuracy of the theoretical estimates corresponding to these attacks.

New Links between Differential and Linear Cryptanalysis

“…For differential cryptanalysis, such multidimensional extensions appeared not until 2012 [2,9]. In [2], a framework for such attacks was presented and tested for small block cipher.…”

“…Cryptanalysis using multiple differentials on real ciphers, however, requires selection of suitable subsets of output differences, or grouping them in an appropriate way. In an attack model called "unbalanced partitioning" [9], a subspace of output differences is taken into consideration. In this model, the probability distributions involved ordinary differential probabilities, while the "balanced partitioning" model involves probability distributions of truncated differentials.…”

“…The latter approach allows considering information from the whole output space. Advantages and disadvantages of both partitioning functions are discussed in [9]. In this article, we focus on MDC using balanced partitioning and probability distributions of truncated differentials, for the simple reason that those can be efficiently computed using the method of squared correlations.…”

“…Recently, an attack called multiple differential cryptanalysis (MDC) was proposed as an "all-in-one" generalisation of differential cryptanalysis [2,9]. In these papers, distributions of differences for small block ciphers were evaluated to provide attacks using LLR and χ 2 scoring functions.…”

“…This model, which improves and generalises differential, truncated differential, and impossible differential cryptanalysis methods remained, however, to be completed. To apply the LLR statistical test to actual block ciphers, cryptanalysts must be able to provide an upstream evaluation of the differential probabilities [9]. Up to now, computation of differential probabilities has been challenging for many ciphers.…”