Substitution-permutation networks resistant to differential and linear cryptanalysis

Heys, Howard M.; Tavares, Stafford E.

doi:10.1007/bf02254789

Cited by 72 publications

(52 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The approximation in (8) has been widely used to evaluate the security of block ciphers against LC [8]. Knudsen calls a block cipher practically secure if the data complexity determined by this method is prohibitive [10].…”

Section: Provable Security Against Linear Cryptanalysismentioning

confidence: 99%

New Method for Upper Bounding the Maximum Average Linear Hull Probability for SPNs

Keliher

Meijer

Tavares

2001

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. We present a new algorithm for upper bounding the maximum average linear hull probability for SPNs, a value required to determine provable security against linear cryptanalysis. The best previous result (Hong et al. [9]) applies only when the linear transformation branch number (B) is M or (M + 1) (maximal case), where M is the number of s-boxes per round. In contrast, our upper bound can be computed for any value of B. Moreover, the new upper bound is a function of the number of rounds (other upper bounds known to the authors are not). When B = M , our upper bound is consistently superior to [9]. When B = (M + 1), our upper bound does not appear to improve on [9]. On application to Rijndael (128-bit block size, 10 rounds), we obtain the upper bound UB = 2 −75 , corresponding to a lower bound on the data complexity of 8 UB = 2 78 (for 96.7% success rate). Note that this does not demonstrate the existence of a such an attack, but is, to our knowledge, the first such lower bound.

show abstract

Section: Provable Security Against Linear Cryptanalysismentioning

confidence: 99%

New Method for Upper Bounding the Maximum Average Linear Hull Probability for SPNs

Keliher

Meijer

Tavares

2001

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…The approximation in (4) has been widely used to evaluate the security of block ciphers against LC [12,14]. Knudsen calls a block cipher practically secure if the data complexity determined by this method is prohibitive [16].…”

Section: Choosing the Best Characteristicmentioning

confidence: 99%

“…The substitution-permutation network (SPN) [9,1,12] is a fundamental block cipher architecture based on Shannon's principles of confusion and diffusion [22]. These principles are implemented through substitution and linear transformation (LT), respectively.…”

Section: Introductionmentioning

confidence: 99%

Improving the Upper Bound on the Maximum Average Linear Hull Probability for Rijndael

Keliher

Meijer

Tavares

2001

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. In [15], Keliher et al. present a new method for upper bounding the maximum average linear hull probability (MALHP) for SPNs, a value which is required to make claims about provable security against linear cryptanalysis. Application of this method to Rijndael (AES) yields an upper bound of UB = 2 −75 when 7 or more rounds are approximated, corresponding to a lower bound on the data complexity of 32 UB = 2 80 (for a 96.7% success rate). In the current paper, we improve this upper bound for Rijndael by taking into consideration the distribution of linear probability values for the (unique) Rijndael 8 × 8 s-box. Our new upper bound on the MALHP when 9 rounds are approximated is 2 −92 , corresponding to a lower bound on the data complexity of 2 97 (again for a 96.7% success rate). [This is after completing 43% of the computation; however, we believe that values have stabilized-see Section 7.]

show abstract

“…The result is better for a cryptanalysts if the numbers of 8s in the table are less. If numbers of 8s are much more than the other numbers in the table then the 4-bit Crypto S-box is said to be more linear cryptanalysis immune [HH96] [HH02].…”

mentioning

confidence: 99%

A review of existing 4-bit crypto S-box cryptanalysis techniques and two new techniques with 4-bit Boolean functions for cryptanalysis of 4-bit crypto S-boxes

Dey

Ghosh

2017

Preprint

View full text Add to dashboard Cite

Abstract. 4-bit Linear Relations play an important role in Cryptanalysis of 4-bit Bijective Crypto S-boxes. 4-bit finite differences also a major part of cryptanalysis of 4-bit substitution boxes. Count of existence of all 4-bit linear relations, for all of 16 input and 16 output 4-bit bit patterns of 4-bit bijective crypto S-boxes said as S-boxes has been reported in Linear Cryptanalysis of 4-bit S-boxes. Count of existing finite differences from each element of output S-boxes to distant output S-boxes have been noted in Differential Cryptanalysis of S-boxes. In this paper a brief review of these cryptanalytic methods for 4-bit SBoxes has been introduced in a very lucid and conceptual manner. Two new Analysis Techniques, one to search for the existing Linear Approximations among the input Boolean Functions (BFs) and output BFs of a particular 4-bit S-Box has also been introduced in this paper. The search is limited to find the existing linear relations or approximations in the contrary to count the number existent linear relations among all 16 4-bit input and output bit patterns within all possible linear approximations. Another is to find number of balanced 4-bit BFs in difference output S-boxes. Better the number of Balanced BFs, Better the security.Keywords. Linear Cryptanalysis, Differential Cryptanalysis, Substitution Boxes, S-boxes, Cryptography, Cryptanalysis. In Linear Cryptanalysis of 4-bit S-Boxes, every 4-bit linear relations are tested for a particular 4-bit Crypto S-box. The presence of each 4-bit unique linear relation is checked by satisfaction of each of them for all 16, 4-bit unique input bit patterns and corresponding 4-bit output bit patterns, generated from the index of each element and each element respectively of that particular Crypto S-box. If they are satisfied 8 times out of 16 operations for all 4-bit unique input bit patterns and corresponding 4-bit output bit patterns, then the existence of the 4-bit linear equation is at a stake, since the probability of presence and absence of a 4-bit linear relation both are (= 8/16) ½. If a 4-bit linear equation is satisfied 0 times then it can be concluded that the given 4-bit linear relation is absent for that particular 4-bit bijective S-Box. If a 4-bit linear equation is satisfied 16 times then it can also be concluded that the given 4-bit linear relation is present for that particular 4-bit S-Box. In both the cases full information is adverted to the cryptanalysts. The concept of Probability Bias was introduced to predict the randomization ability of that 4-bit SBox from the probability of presence or absence of unique 4-bit linear relations. The result is better for cryptanalysts if the probability of presence or absences of unique 4-bit linear equations are far away from ½ or near to 0 or 1. If the probabilities of presence or absence, of all unique 4-bit linear relations are ½ or close to ½, then the 4-bit Crypto S-box is said to be linear cryptanalysis immune, since the existence of maximum 4-bit linear relations for that 4-bit Crypto S...

show abstract

Substitution-permutation networks resistant to differential and linear cryptanalysis

Cited by 72 publications

References 20 publications

New Method for Upper Bounding the Maximum Average Linear Hull Probability for SPNs

New Method for Upper Bounding the Maximum Average Linear Hull Probability for SPNs

Improving the Upper Bound on the Maximum Average Linear Hull Probability for Rijndael

A review of existing 4-bit crypto S-box cryptanalysis techniques and two new techniques with 4-bit Boolean functions for cryptanalysis of 4-bit crypto S-boxes

Contact Info

Product

Resources

About