Abstract
Recent constructions of (tweakable) block ciphers with an embedded cryptographic backdoor relied on the existence of probability-one differentials or perfect (non-)linear approximations over a reduced-round version of the primitive. In this work, we study how the existence of probability-one differentials or perfect linear approximations over two rounds of a substitution-permutation network can be avoided by design. More precisely, we develop criteria on the s-box and the linear layer that guarantee the absence of probability-one differentials for all keys. We further present an algorithm that allows to efficiently exclude the existence of keys for which there exists a perfect linear approximation.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Notes
- 1.
For simplicity, we omit whitening keys and the linear layer in the final round. Adding those have no effect on the (non-)existence of perfect linear approximations.
- 2.
- 3.
Notice that for our analysis Midori64 and MANTIS are equivalent because their s-boxes and linear layers are identical.
- 4.
An implementation of this example is also provided together with the source code.
- 5.
More precisely, we allow the subspaces to be equal to \(\mathbb {F}_2^{n}\) but not to be \(\{0\}\).
- 6.
For convenience of the reader, we slightly reformulate them by making use of the fact that \({{\,\textrm{Im}\,}}(\pi _i^U \circ \pi _j^W) \cap {{\,\textrm{Im}\,}}(\pi _i^U \circ \pi _{k \ne j}^W) = {{\,\textrm{Im}\,}}(\pi _i^U \circ \pi _j^W \circ \pi _{l \ne i}^U)\) (see [20, Corollary 8]).
- 7.
Intuitively, a maximal decomposition means that no s-box can be seen as the composition of two s-boxes. For a precise definition of a maximal decomposition, we refer the interested reader to [20].
- 8.
As long as \(\dim (U_i) \ne 1\) of course, which would already mean that \(F_i\) would be affine.
- 9.
This algorithmic version of Theorem 2 is also part of the provided source code.
References
Albrecht, M.R., Driessen, B., Kavun, E.B., Leander, G., Paar, C., Yalçın, T.: Block ciphers – focus on the linear layer (feat. PRIDE). In: Garay, J.A., Gennaro, R. (eds.) CRYPTO 2014, Part I. LNCS, vol. 8616, pp. 57–76. Springer, Heidelberg (2014). https://doi.org/10.1007/978-3-662-44371-2_4
Beierle, C., Beyne, T., Felke, P., Leander, G.: Constructing and deconstructing intentional weaknesses in symmetric ciphers. In: Dodis, Y., Shrimpton, T. (eds.) Proceedings of the 42nd Annual International Cryptology Conference on Advances in Cryptology, CRYPTO 2022, Part III. LNCS, Santa Barbara, CA, USA, 15–18 August 2022, vol. 13509, pp. 748–778. Springer, Heidelberg (2022). https://doi.org/10.1007/978-3-031-15982-4_25
Beierle, C., Felke, P., Leander, G., Neumann, P., Stennes, L.: On perfect linear approximations and differentials over two-round SPNs. Cryptology ePrint Archive, Paper 2023/725 (2023). https://eprint.iacr.org/2023/725
Beierle, C., et al.: The SKINNY family of block ciphers and its low-latency variant MANTIS. In: Robshaw, M., Katz, J. (eds.) CRYPTO 2016, Part II. LNCS, vol. 9815, pp. 123–153. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-53008-5_5
Beierle, C., Leander, G., Moradi, A., Rasoolzadeh, S.: CRAFT: lightweight tweakable block cipher with efficient protection against DFA attacks. IACR Trans. Symmetric Cryptol. 2019(1), 5–45 (2019). https://doi.org/10.13154/tosc.v2019.i1.5-45
Bellini, E., Makarim, R.H.: Functional cryptanalysis: application to reduced-round Xoodoo. IACR Cryptol. ePrint Arch., p. 134 (2022). https://eprint.iacr.org/2022/134
Beyne, T.: Block cipher invariants as eigenvectors of correlation matrices. J. Cryptol. 33(3), 1156–1183 (2020). https://doi.org/10.1007/s00145-020-09344-1
Beyne, T., Rijmen, V.: Differential cryptanalysis in the fixed-key model. In: Dodis, Y., Shrimpton, T. (eds.) Proceedings of the42nd Annual International Cryptology Conference Advances in Cryptology, CRYPTO 2022, Part III. LNCS, Santa Barbara, CA, USA, 15–18 August 2022, vol. 13509, pp. 687–716. Springer, Heidelberg (2022). https://doi.org/10.1007/978-3-031-15982-4_23
Biham, E., Shamir, A.: Differential cryptanalysis of DES-like cryptosystems. In: Menezes, A.J., Vanstone, S.A. (eds.) CRYPTO 1990. LNCS, vol. 537, pp. 2–21. Springer, Heidelberg (1991). https://doi.org/10.1007/3-540-38424-3_1
Carlet, C. (ed.): Boolean Functions for Cryptography and Coding Theory. Cambridge University Press (2020). https://doi.org/10.1017/9781108606806
Cid, C., Huang, T., Peyrin, T., Sasaki, Yu., Song, L.: Boomerang connectivity table: a new cryptanalysis tool. In: Nielsen, J.B., Rijmen, V. (eds.) EUROCRYPT 2018. LNCS, vol. 10821, pp. 683–714. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-78375-8_22
Daemen, J.: Cipher and hash function design, strategies based on linear and differential cryptanalysis, Ph.D. Thesis. K.U. Leuven (1995). http://jda.noekeon.org/
Daemen, J., Rijmen, V.: The wide trail design strategy. In: Honary, B. (ed.) Cryptography and Coding 2001. LNCS, vol. 2260, pp. 222–238. Springer, Heidelberg (2001). https://doi.org/10.1007/3-540-45325-3_20
Daemen, J., Rijmen, V.: Plateau characteristics. IET Inf. Secur. 1(1), 11–17 (2007). https://doi.org/10.1049/iet-ifs:20060099, https://doi.org/10.1049/iet-ifs:20060099
Dinur, I., Dunkelman, O., Keller, N., Ronen, E., Shamir, A.: Efficient detection of high probability statistical properties of cryptosystems via surrogate differentiation. In: Advances in Cryptology, EUROCRYPT 2023. LNCS, Lyon, France, 23–27 April 2023, vol. 14007. Springer, Heidelberg (2023). https://doi.org/10.1007/978-3-031-30634-1_4
Dobraunig, C., Eichlseder, M., Mendel, F., Schläffer, M.: Ascon v1.2: lightweight authenticated encryption and hashing. J. Cryptol. 34(3), 33 (2021). https://doi.org/10.1007/s00145-021-09398-9
Fourquet, R., Loidreau, P., Tavernier, C.: Finding good linear approximations of block ciphers and its application to cryptanalysis of reduced round DES. In: Workshop on Coding and Cryptography, WCC 2009 (2009). https://perso.univ-rennes1.fr/pierre.loidreau/articles/wcc_2009/wcc_2009.pdf
Guo, H., et al.: Differential attacks on CRAFT exploiting the involutory s-boxes and tweak additions. IACR Trans. Symmetric Cryptol. 2020(3), 119–151 (2020). https://doi.org/10.13154/tosc.v2020.i3.119-151
Kuijsters, D., Verbakel, D., Daemen, J.: Weak subtweakeys in SKINNY. IACR Cryptol. ePrint Arch., p. 1042 (2022). https://eprint.iacr.org/2022/1042
Lambin, B., Leander, G., Neumann, P.: Pitfalls and shortcomings for decompositions and alignment. In: Hazay, C., Stam, M. (eds.) Advances in Cryptology, EUROCRYPT 2023. LNCS, vol. 14007. Springer, Cham (2023). https://doi.org/10.1007/978-3-031-30634-1_11
Leander, G., Rasoolzadeh, S.: Weak tweak-keys for the CRAFT block cipher. IACR Trans. Symmetric Cryptol. 2022(1), 38–63 (2022). https://doi.org/10.46586/tosc.v2022.i1.38-63
Matsui, M.: Linear cryptanalysis method for DES cipher. In: Helleseth, T. (ed.) EUROCRYPT 1993. LNCS, vol. 765, pp. 386–397. Springer, Heidelberg (1994). https://doi.org/10.1007/3-540-48285-7_33
Nyberg, K., Knudsen, L.R.: Provable security against a differential attack. J. Cryptol. 8(1), 27–37 (1995). https://doi.org/10.1007/BF00204800
Peyrin, T., Wang, H.: The MALICIOUS framework: embedding backdoors into tweakable block ciphers. In: Micciancio, D., Ristenpart, T. (eds.) CRYPTO 2020, Part III. LNCS, vol. 12172, pp. 249–278. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-56877-1_9
Vaudenay, S.: Provable security for block ciphers by decorrelation. In: Morvan, M., Meinel, C., Krob, D. (eds.) STACS 1998. LNCS, vol. 1373, pp. 249–275. Springer, Heidelberg (1998). https://doi.org/10.1007/BFb0028566
Acknowledgments
This work was funded by the by the projects Analysis and Protection of Lightweight Cryptographic Algorithms (432878529), Symmetric Cipher Design with Inherent Physical Security (406956718) and by the Deutsche Forschungsgemeinschaft (DFG, German Research Foundation) under Germany’s Excellence Strategy - EXC 2092 CASA - 390781972.
Author information
Authors and Affiliations
Corresponding authors
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2023 International Association for Cryptologic Research
About this paper
Cite this paper
Beierle, C., Felke, P., Leander, G., Neumann, P., Stennes, L. (2023). On Perfect Linear Approximations and Differentials over Two-Round SPNs. In: Handschuh, H., Lysyanskaya, A. (eds) Advances in Cryptology – CRYPTO 2023. CRYPTO 2023. Lecture Notes in Computer Science, vol 14083. Springer, Cham. https://doi.org/10.1007/978-3-031-38548-3_8
Download citation
DOI: https://doi.org/10.1007/978-3-031-38548-3_8
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-38547-6
Online ISBN: 978-3-031-38548-3
eBook Packages: Computer ScienceComputer Science (R0)
