Abstract:A division property is a generic tool to search for integral distinguishers, and automatic tools such as MILP or SAT/SMT allow us to evaluate the propagation efficiently. In the application to stream ciphers, it enables us to estimate the security of cube attacks theoretically, and it leads to the best key-recovery attacks against well-known stream ciphers. However, it was reported that some of the key-recovery attacks based on the division property degenerate to distinguishing attacks due to the inaccuracy of the division property. Three-subset division property (without unknown subset) is a promising method to solve this inaccuracy problem, and a new algorithm using automatic tools for the three-subset division property was recently proposed at Asiacrypt2019. In this paper, we first show that this state-of-the-art algorithm is not always efficient and we cannot improve the existing key-recovery attacks. Then, we focus on the three-subset division property without unknown subset and propose another new efficient algorithm using automatic tools. Our algorithm is more efficient than existing algorithms, and it can improve existing key-recovery attacks. In the application to Trivium, we show a 842-round key-recovery attack. We also show that a 855-round key-recovery attack, which was proposed at CRYPTO2018, has a critical flaw and does not work. As a result, our 842-round attack becomes the best key-recovery attack. In the application to Grain-128AEAD, we show that the known 184-round key-recovery attack degenerates to a distinguishing attack. Then, the distinguishing attacks are improved up to 189 rounds, and we also show the best key-recovery attack against 190 rounds. In the application to ACORN, we prove that the 772-round key-recovery attack at ISC2019 is in fact a constant-sum distinguisher. We then give new key-recovery attacks mounting to 773-, 774- and 775-round ACORN. We verify the current best key-recovery attack on 892-round Kreyvium and recover the exact superpoly. We further propose a new attack mounting to 893 rounds.

Six Ways to Implement Divisibility by Three in miniKanren

Recursively divisible numbers

Relations in the Set of Divisors of an Integer $n$

Two New Kinds of Numbers and Related Divisibility Results

Divisibility Tests Unified: Stacking the Trimmings for Sums

Improving stableKanren's Backward Compatibility

Generalized divisor functions in arithmetic progressions: I

Three simple reduction formulas for the denumerant functions

Arithmetic Properties modulo powers of $2$ and $3$ for Overpartition $k$-Tuples with Odd Parts

Fractal patterns related to dividing coins

An infinite family of internal congruences modulo powers of 2 for partitions into odd parts with designated summands

Divisors in Residue Classes Revisited

Parity results concerning the generalized divisor function involving small prime factors of integers

Support Sizes of Threefold Resolvable Triple Systems

Variations of Kurepa's left factorial hypothesis

Representations of integers as quotients of sums of distinct powers of three

Modeling for Three-Subset Division Property Without Unknown Subset

Intersections of multiplicative translates of $3$-adic Cantor sets II: two infinite families

Certified Semantics for Relational Programming

Proceedings of the 2024 miniKanren and Relational Programming Workshop