Proving Resistance Against Infinitely Long Subspace Trails: How to Choose the Linear Layer

Abstract

Designing cryptographic permutations and block ciphers using a substitutionpermutation network (SPN) approach where the nonlinear part does not cover the entire state has recently gained attention due to favorable implementation characteristics in various scenarios.For word-oriented partial SPN (P-SPN) schemes with a fixed linear layer, our goal is to better understand how the details of the linear layer affect the security of the construction. In this paper, we derive conditions that allow us to either set up or prevent attacks based on infinitely long truncated differentials with probability 1. Our analysis is rather broad compared to earlier independent work on this problem since we consider (1) both invariant and non-invariant/iterative trails, and (2) trails with and without active S-boxes.For these cases, we provide rigorous sufficient and necessary conditions for the matrix that defines the linear layer to prevent the analyzed attacks. On the practical side, we present a tool that can determine whether a given linear layer is vulnerable based on these results. Furthermore, we propose a sufficient condition for the linear layer that, if satisfied, ensures that no infinitely long truncated differential exists. This condition is related to the degree and the irreducibility of the minimal polynomial of the matrix that defines the linear layer. Besides P-SPN schemes, our observations may also have a crucial impact on the Hades design strategy, which mixes rounds with full S-box layers and rounds with partial S-box layers.

Bounded Surjective Quadratic Functions over Fnp for MPC-/ZK-/FHE-Friendly Symmetric Primitives

“…is a MDS matrix that prevents the existence of invariant subspace trails for the internal rounds -we refer to [GRS21] for a detailed description on how to choose such matrices;…”

“…is an invertible matrix that aims for destroying the invariant subspace trails of the Lai-Massey construction -we refer to [GRS21,GØSW23] for all details regarding how to construct/choose the matrix M I ;…”

Invertible Quadratic Non-Linear Layers for MPC-/FHE-/ZK-Friendly Schemes over Fnp

“…In the same paper, authors also set up preimage attacks on the sponge hash function instantiated with the full-round permutation P π in the case of a weak MDS matrix M such that M 2 is a multiple of the identity, and so, for which an invariant subspace trail that covers all the internal rounds with probability 1 exists (see also [KR21]). In [GRS21], Grassi et al showed how to properly choose the MDS matrix M in order to prevent this (and similar) attack(s).…”

“…where d ≥ 3 is the smallest integer such that gcd(d, p − 1) = 1. The linear layer is defined via an invertible matrix M (I) ∈ F t×t p that must prevent arbitrary-long subspace trails for the Partial-SPN scheme I (R I −1) • • • • • I (0) , as explained in [GRS21].…”

“…As shown in [GRS21, GSW + 21], the matrix M (I) must be chosen in order to guarantee that no subspace X i is invariant for an arbitrary number of internal rounds, and more generally, that no subspace trail can cover any arbitrary number of internal rounds. We suggest to make used the tool presented in [GRS21] in order to properly choose the matrix M (I) for this goal. This implies that no more than t − 1 internal rounds can be covered without activating any S-Box x → x d .…”