Provable Security against Differential and Linear Cryptanalysis for the SPN Structure

New Method for Upper Bounding the Maximum Average Linear Hull Probability for SPNs

“…Moreover, the new upper bound is a function of the number of rounds (other upper bounds known to the authors are not). When B = M , our upper bound is consistently superior to [9]. When B = (M + 1), our upper bound does not appear to improve on [9].…”

“…When B = M , our upper bound is consistently superior to [9]. When B = (M + 1), our upper bound does not appear to improve on [9]. On application to Rijndael (128-bit block size, 10 rounds), we obtain the upper bound UB = 2 −75 , corresponding to a lower bound on the data complexity of 8 UB = 2 78 (for 96.7% success rate).…”

“…Moreover, the upper bound we compute is a function of the number of rounds of the SPN; all other upper bounds known to the authors do not depend on the number of rounds. When the diffusiveness of the LT is one less than maximum (the relevant definition is given in Section 5.3), our upper bound is consistently superior to that of [9]. For LTs with maximum diffusiveness, our upper bound does not appear to improve on [9].…”

“…When the diffusiveness of the LT is one less than maximum (the relevant definition is given in Section 5.3), our upper bound is consistently superior to that of [9]. For LTs with maximum diffusiveness, our upper bound does not appear to improve on [9].…”

“…The best previous result is that of Hong et al [9], which applies only to SPNs with highly diffusive LTs. In contrast, our method can be applied to an SPN with any LT (computation time may vary).…”