Efficient Algorithms for Modeling SBoxes Using MILP

Debranjan Pal,Vishal Pankaj Chandratreya,Dipanwita Roy Chowdhury

2023-06-05

Abstract:Mixed Integer Linear Programming (MILP) is a well-known approach for the cryptanalysis of a symmetric cipher. A number of MILP-based security analyses have been reported for non-linear (SBoxes) and linear layers. Researchers proposed word- and bit-wise SBox modeling techniques using a set of inequalities which helps in searching differential trails for a cipher. In this paper, we propose two new techniques to reduce the number of inequalities to represent the valid differential transitions for SBoxes. Our first technique chooses the best greedy solution with a random tiebreaker and achieves improved results for the 4-bit SBoxes of MIBS, LBlock, and Serpent over the existing results of Sun et al. [25]. Subset addition, our second approach, is an improvement over the algorithm proposed by Boura and Coggia. Subset addition technique is faster than Boura and Coggia [10] and also improves the count of inequalities. Our algorithm emulates the existing results for the 4-bit SBoxes of Minalpher, LBlock, Serpent, Prince, and Rectangle. The subset addition method also works for 5-bit and 6-bit SBoxes. We improve the boundary of minimum number inequalities from the existing results for 5-bit SBoxes of ASCON and SC2000. Application of subset addition technique for 6-bit SBoxes of APN, FIDES, and SC2000 enhances the existing results. By applying multithreading, we reduced the execution time needed to find the minimum inequality set over the existing techniques.

Cryptography and Security

What problem does this paper attempt to address?

The paper attempts to address the problem of efficiently modeling S-boxes (SBoxes) in symmetric cryptography using Mixed Integer Linear Programming (MILP) methods for effective differential path propagation. Specifically, the authors propose two new techniques to reduce the number of inequalities required to represent the effective differential transitions of S-boxes, thereby improving the efficiency and accuracy of the MILP model. These two techniques are:

1. **Greedy Random Tie-Breaking Algorithm**: This algorithm reduces the number of inequalities required to represent 4-bit S-boxes by randomly selecting one among multiple inequalities with the same rank. This method shows improvements over existing greedy algorithms when handling 4-bit S-boxes of MIBS, LBlock, and Serpent.

2. **Subset Addition Method**: By generating new inequalities from the H-representation of the convex hull, this method further reduces the number of inequalities. The subset addition method is applicable not only to 4-bit S-boxes but also to 5-bit and 6-bit S-boxes. For 5-bit S-boxes (such as ASCON and SC2000) and 6-bit S-boxes (such as APN and SC2000), this method significantly reduces the number of inequalities as well.

Through these techniques, the authors aim to provide cryptographers with a more efficient method to determine the minimum number of active S-boxes, thereby ensuring the resistance of cryptographic systems against differential cryptanalysis attacks. Additionally, the authors also reduce the time required to find the minimum set of inequalities by using multi-threading techniques.