In this paper, we propose a new method based on Mixed-Integer Linear Programming (MILP) to search for differential-linear (DL) distinguishers targeting word-oriented block ciphers. To be specific, we present a new structure of DL distinguishers based on the works of Biham et al. and Bar-On et al., and divide the process of finding an R-round DL distinguisher into two stages. In the first stage, we aim to prepare some special ( \(R-1\) )-round truncated differentials with high probabilities using MILP, which is adapted to our new DL structure. To achieve this goal, we simplify the types of previous truncated differential (TD) patterns and optimize the propagation rules of TDs. In the second stage, we concatenate the prepared TDs with the introduced concept of the differential-linear connectivity layer (DLCL), whose bias can be calculated by differential-linear connectivity tables (DLCTs) of S-boxes, to efficiently determine the optimal output linear mask for deriving an R-round DL distinguisher. We apply the proposed method to Midori64, CRAFT, and Skinny64. As a result, the longest DL distinguishers obtained in this paper for Midori64, CRAFT, and Skinny64 are 6, 11, and 10 rounds with the estimated biases of \(2^{-14.43}\) , \(2^{-16.04}\) , and \(2^{-22.73}\) , respectively. To the best of our knowledge, this is the first study to explore the DL distinguishers of Midori64 and CRAFT against DL cryptanalysis. In addition, we also conduct experiments to verify the validity of these distinguishers. Consequently, our estimated biases are very close to the experimental ones, which indicates that these DL distinguishers are indeed valid and also provides a strong support for the effectiveness of our method. By the way, our results cannot threaten the security of the three ciphers, but provide a better understanding on the strength against DL cryptanalysis, especially for Midori64 and CRAFT.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

A Novel Method for Finding Differential-Linear Distinguishers: Application to  \(\textsf{Midori64}\) , \(\textsf{CRAFT}\) , and  \(\textsf{Skinny64}\)

  • Mei Yan,
  • Siwei Chen,
  • Zejun Xiang,
  • Shasha Zhang,
  • Xiangyong Zeng

摘要

In this paper, we propose a new method based on Mixed-Integer Linear Programming (MILP) to search for differential-linear (DL) distinguishers targeting word-oriented block ciphers. To be specific, we present a new structure of DL distinguishers based on the works of Biham et al. and Bar-On et al., and divide the process of finding an R-round DL distinguisher into two stages. In the first stage, we aim to prepare some special ( \(R-1\) )-round truncated differentials with high probabilities using MILP, which is adapted to our new DL structure. To achieve this goal, we simplify the types of previous truncated differential (TD) patterns and optimize the propagation rules of TDs. In the second stage, we concatenate the prepared TDs with the introduced concept of the differential-linear connectivity layer (DLCL), whose bias can be calculated by differential-linear connectivity tables (DLCTs) of S-boxes, to efficiently determine the optimal output linear mask for deriving an R-round DL distinguisher. We apply the proposed method to Midori64, CRAFT, and Skinny64. As a result, the longest DL distinguishers obtained in this paper for Midori64, CRAFT, and Skinny64 are 6, 11, and 10 rounds with the estimated biases of \(2^{-14.43}\) , \(2^{-16.04}\) , and \(2^{-22.73}\) , respectively. To the best of our knowledge, this is the first study to explore the DL distinguishers of Midori64 and CRAFT against DL cryptanalysis. In addition, we also conduct experiments to verify the validity of these distinguishers. Consequently, our estimated biases are very close to the experimental ones, which indicates that these DL distinguishers are indeed valid and also provides a strong support for the effectiveness of our method. By the way, our results cannot threaten the security of the three ciphers, but provide a better understanding on the strength against DL cryptanalysis, especially for Midori64 and CRAFT.