Revisiting the Wrong-Key-Randomization Hypothesis

Abstract

Linear cryptanalysis is considered to be one of the strongest techniques in the cryptanalyst's arsenal. In most cases, Matsui's Algorithm 2 is used for the key recovery part of the attack. The success rate analysis of this algorithm is based on an assumption regarding the bias of a linear approximation for a wrong key, known as the wrong-keyrandomization hypothesis. This hypothesis was refined by Bogdanov and Tischhauser to take into account the stochastic nature of the bias for a wrong key. We provide further refinements to the analysis of Matsui's algorithm 2 by considering sampling without replacement. This paper derives the distribution of the observed bias for wrong keys when sampling is done without replacement and shows that less data is required in this scenario. It also develops formulas for the success probability and the required data complexity when this approach is taken. The formulas predict that the success probability may reach a peak, then decrease as more pairs are considered. We provide a new explanation for this behavior and derive the conditions for encountering it. We empirically verify our results and compare them to previous work.

Another look at success probability of linear cryptanalysis

“…These derivations cannot be made formal unless the assumption of normality on p κ * and p κ,κ * are dropped. We note that none of the previous works [12,1,7,8] discuss or even identify this issue. In obtaining the distributions of the test statistic we separately consider the cases where the plaintexts are sampled with and without replacements.…”

“…Based on a previous work by Daemen and Rijmen [15], it was hypothesised that p κ,κ * itself is a random variable following the normal distribution N (1/2, 2 −n−2 ). A later work by Ashur, Beyne and Rijmen [1] also used the adjusted wrong key randomisation hypothesis. The difference in [12] and [1] is in the manner in which the plaintexts P 1 , .…”

“…A later work by Ashur, Beyne and Rijmen [1] also used the adjusted wrong key randomisation hypothesis. The difference in [12] and [1] is in the manner in which the plaintexts P 1 , . .…”

“…, P N were assumed to be chosen -sampling with replacement was considered in [12] while sampling without replacement was considered in [1]. Both the works [12,1] observed a non-monotonic dependence of the success probability on N and provided possible explanations for this phenomenon. The statistical methodology used in [12,1] is based on an earlier work by Selçuk [33] using order statistics.…”

“…There is, however, a fundamental difficulty. Following previous works [12,1,8,7], the quantities p κ * and p κ,κ * are modelled using normal distributions. As a result, it is possible that these quantities take values outside the range [0, 1].…”