On Multiple Linear Approximations

Abstract

Abstract. In this paper we study the long standing problem of information extraction from multiple linear approximations. We develop a formal statistical framework for block cipher attacks based on this technique and derive explicit and compact gain formulas for generalized versions of Matsui's Algorithm 1 and Algorithm 2. The theoretical framework allows both approaches to be treated in a unified way, and predicts significantly improved attack complexities compared to current linear attacks using a single approximation. In order to substantiate the theoretical claims, we benchmarked the attacks against reduced-round versions of DES and observed a clear reduction of the data and time complexities, in almost perfect correspondence with the predictions. The complexities are reduced by several orders of magnitude for Algorithm 1, and the significant improvement in the case of Algorithm 2 suggests that this approach may outperform the currently best attacks on the full DES algorithm.

Multiple Differential Cryptanalysis Using LLR and χ 2 Statistics

“…Premise of this approach have already been proposed in some papers by independently considering different differentials [4] (different analysis phases for different characterics) or by summing the information coming from the different characterics to perform all in one step. In the context of linear cryptanalysis, the method known as multiple linear cryptanalysis [18,5,13] considers each characteristic independently and proposes to analyze the vectors of information for each key candidate. While the question of characteristics combination have been deeply studied for linear cryptanalysis [18,5,[13][14][15], the lack of a comprehensive study on this topic in the context of differential cryptanalysis motivates the present work.…”

“…In the context of linear cryptanalysis, the method known as multiple linear cryptanalysis [18,5,13] considers each characteristic independently and proposes to analyze the vectors of information for each key candidate. While the question of characteristics combination have been deeply studied for linear cryptanalysis [18,5,[13][14][15], the lack of a comprehensive study on this topic in the context of differential cryptanalysis motivates the present work. In the following, and after presenting the required background, we propose a general framework and instantiate it with statistical tools already shown to be useful for linear cryptanalysis.…”

“…As shown in the case of linear cryptanalysis, different approaches may be used depending on the context. In 2004, Biryukov et al proposed a multiple linear cryptanalysis under the assumption that linear approximations are statistically independent 4 [5]. Later Hermelin et al introduced the multidimensional linear cryptanalysis [14,15].…”

The Hummingbird-2 Lightweight Authenticated Encryption Algorithm

“…Our findings give significant confidence to assert that Hummingbird-2 is resistant to linear cryptanalysis up to twelve rounds of f . We have also experimented with multiple linear approximations in our analysis [2].…”

The Cryptanalysis of Reduced-Round SMS4

“…Multiple linear approximations were first proposed in [6,7] and they have been the subject of much recent analysis [3,5]. Here we take m different linear approximations, where we use κ j to denote a single bit of key information, The purpose is to use several approximations to reduce the number of plaintexts when keeping the same probability of sucess.…”