WARP : Revisiting GFN for Lightweight 128-Bit Block Cipher

Banik, Subhadeep; Bao, Zhenzhen; Isobe, Takanori; Kubo, Hidenori; Liu, Fukang; Minematsu, Kazuhiko; Sakamoto, Kosei; Shibata, Nao; Shigeri, Maki

doi:10.1007/978-3-030-81652-0_21

Cited by 27 publications

(18 citation statements)

References 54 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For the AES structure, we considered the approaches proposed in the literature to construct the chaosbased S-boxes with different sizes, namely, the 4×4 [18]- [22], 8×8 [23]- [27] and 16×16 [28]- [32] S-boxes, as shown in Tables 2 to 10. According to reference [18]- [27], [28]- [32] the small pathway delay with a small gate region can be implemented given its low energy.…”

Section: Results and Analysesmentioning

confidence: 99%

Best S-box amongst differently sized S-boxes based on the avalanche effect in ‎the advance encryption standard algorithm

Taher

Al-Rahman

Shawkat‎‎

2022

IJECE

View full text Add to dashboard Cite

<span lang="EN-US">Substitution boxes are essential nonlinear modules that are popular in block ‎cipher algorithms. They ‎also play a significant role in the security area because of ‎their robustness to different linear ‎cryptanalysis. Each element of the state in a S-‎box is nonlinearly replaced using a lookup table. This ‎research presents the S-‎box, one of the fundamental parts of the advanced encryption standard ‎‎(AES) ‎algorithm. The S-box represents the confusion part in the AES. However, when ‎information ‎is shared between different devices in an authorized manner, the ‎algorithm should be able to ‎combine a sufficient number of confusion layers to ‎guarantee the avalanche effect (AE). ‎Subsequently, this research selects the best ‎S-box by comparing different sizes (4×4, 8×8, and ‎‎16×16) and measuring them ‎on the basis of the million-bit encryption. The AE is the main criterion ‎used in ‎choosing the best S-box. A robust and strong cryptography algorithm should be ‎able to ‎confirm the AEs. Results indicate that the 16×16 S-box with a 52% AE ‎ratio is the superior S-box</span>

show abstract

Section: Results and Analysesmentioning

confidence: 99%

Best S-box amongst differently sized S-boxes based on the avalanche effect in ‎the advance encryption standard algorithm

Taher

Al-Rahman

Shawkat‎‎

2022

IJECE

View full text Add to dashboard Cite

show abstract

“…𝑆 [1] = 𝐶 𝑏 , 𝑆 [2] = 𝐶 𝑎 , 𝑆 [3] = 𝐶 𝑏 , 𝑆 [4] = 𝐾 128𝐿 ⊕ 𝐼𝑉 128𝐿 , 𝑆 [5] = 𝐾 128𝐿 ⊕ 𝐶 𝑎 , 𝑆 [6] = 𝐾 128𝐿 ⊕ 𝐶 𝑏 , 𝑆 [7] = 𝐾 128𝐿 ⊕ 𝐶 𝑎 .…”

Section: Our Targetsmentioning

confidence: 99%

“…𝑆 [1] = 𝑁 𝑅 , 𝑆 [2] = 𝐶 0 , 𝑆 [3] = 𝐶 1 , 𝑆 [4] = 𝑁 𝑅 ⊕ 𝐾 𝑅,𝑏 , 𝑆 [5] = 0, 𝑆 [6] = 𝐾 𝑅,𝑎 , 𝑆 [7] = 0.…”

Section: Roccamentioning

confidence: 99%

“…This is a common method to find the longest impossible differences as it generally takes the most number of rounds to achieve full diffusion when the output or input has only one active bit/word. Some block cipher designers have used this method to evaluate their designs [2][3][4]. Under this condition, we search for the longest impossible differential distinguisher for each construction.…”

Section: ) Differential Attacksmentioning

confidence: 99%

See 1 more Smart Citation

Security Evaluation of Initialization Phases and Round Functions of Rocca and AEGIS

TAKEUCHI

Sakamoto

Isobe

2023

IEICE Trans. Fundamentals

View full text Add to dashboard Cite

Authenticated-Encryption with Associated-Data (AEAD) plays an important role in guaranteeing confidentiality, integrity, and authenticity in network communications. To meet the requirements of high-performance applications, several AEADs make use of AES New Instructions (AES-NI), which can conduct operations of AES encryption and decryption dramatically fast by hardware accelerations. At SAC 2013, Wu and Preneel proposed an AES-based AEAD scheme called AEGIS-128/128L/256, to achieve high-speed software implementation. At FSE 2016, Jean and Nikolić generalized the construction of AEGIS and proposed more efficient round functions. At ToSC 2021, Sakamoto et al. further improved the constructions of Jean and Nikolić, and proposed an AEAD scheme called Rocca for beyond 5G.In this study, we first evaluate the security of the initialization phases of Rocca and AEGIS family against differential and integral attacks using MILP (Mixed Integer Linear Programming) tools. Specifically, according to the evaluation based on the lower bounds for the number of active S-boxes, the initialization phases of AEGIS-128/128L/256 are secure against differential attacks after 4/3/6 rounds, respectively. Regarding integral attacks, we present the integral distinguisher on 6 rounds and 6/5/7 rounds in the initialization phases of Rocca and AEGIS-128/128L/256, respectively. Besides, we evaluate the round function of Rocca and those of Jean and Nikolić as cryptographic permutations against differential, impossible differential, and integral attacks. Our results indicate that, for differential attacks, the growth rate of increasing the number of active S-boxes in Rocca is faster than those of Jean and Nikolić. For impossible differential and integral attacks, we show that the round function of Rocca achieves the sufficient level of the security against these attacks in smaller number of rounds than those of Jean and Nikolić.

show abstract

“…However, permutations with optimal diffusion round can also be weak against other cryptanalysis techniques. For instance, the designers of WARP [1] selected a permutation achieving full diffusion in 10 rounds while permutations with a diffusion round of 9 actually exist. The main reason is that all optimal permutations for the diffusion round are much weaker regarding truncated differential cryptanalysis than the one they selected.…”

Section: Even-odd Case: Search For New Propertiesmentioning

confidence: 99%

New Algorithm for Exhausting Optimal Permutations for Generalized Feistel Networks

Delaune

Derbez

Gontier

et al. 2022

Lecture Notes in Computer Science

View full text Add to dashboard Cite

The Feistel construction is one of the most studied ways of building block ciphers. Several generalizations were proposed in the literature, leading to the Generalized Feistel Network (GFN) construction, in which the round function operates on each pair of blocks in parallel until all branches are permuted. At FSE'10, Suzaki and Minematsu studied the diffusion of such construction, raising the question of how many rounds are required so that each block of the ciphertext depends on all blocks of the plaintext. Exhausting all possible permutations up to 16 blocks, they observed that there were always optimal permutations mapping even-number input blocks to odd-number output blocks and vice versa. Recently, both Cauchois et al. and Derbez et al. proposed new algorithms to build optimal even-odd permutations for up to 36 blocks. In this paper, we present a new algorithm based on iterative path building to search for optimal Feistel permutation. This algorithm is much faster in exhausting optimal non-even-odd permutations than all the previous approaches. Our first result is a computational proof that no non-even-odd permutation reaches a better diffusion round than optimal even-odd permutations up to 32 blocks. Furthermore, it is well known that permutations with an optimal diffusion round do not always lead to optimal permutations against differential cryptanalysis. We investigate several new criteria to build permutations leading to more secure GFN.

show abstract

WARP : Revisiting GFN for Lightweight 128-Bit Block Cipher

Cited by 27 publications

References 54 publications

Best S-box amongst differently sized S-boxes based on the avalanche effect in ‎the advance encryption standard algorithm

Best S-box amongst differently sized S-boxes based on the avalanche effect in ‎the advance encryption standard algorithm

Security Evaluation of Initialization Phases and Round Functions of Rocca and AEGIS

New Algorithm for Exhausting Optimal Permutations for Generalized Feistel Networks

Contact Info

Product

Resources

About