Abstract:In this paper, a security evaluation framework for AND-RX ciphers against impossible differential cryptanalysis is proposed. This framework is constructed based on three different methods towards finding the theoretical upper boundary, theoretical lower boundary, and practical boundary of impossible differential distinguishers (short for ID) respectively. The provable security boundary (upper boundary) can be calculated with two round-function-related matrices through a few matrix multiplications, this calculation is beyond actual input and output differences. For searching longer IDs (lower boundary), an automatic method is proposed. With this method, given the input and output difference, all the possible direct and indirect contradictions are detected. For the practical boundary, a method of approximating all the potential longest IDs with concrete differential trails is introduced. The three boundaries validate the correctness from each other. According to our result, on the one hand, the boundaries derived with well-designed ID-construction methods can already reach the practical boundary for some block ciphers and it is unlikely to be improved based on known construction methods or future unknown construction methods. On the other hand, for those ciphers whose current best result does not reach our boundary, longer IDs can be discovered with this framework. The correctness is validated by a series of applications. For the provable security boundary, four family ciphers-SIMON, Simeck, Friet-PC and SAND are investigated. For SIMON and Simeck, the lengths of current longest IDs have reached their provable security boundaries. For Friet-PC and SAND, there is a gap between the provable security boundary and current best results. With the automatic searching method, some longer IDs on Friet-PC and SAND are discovered. For Friet-PC, 128 11-round IDs are discovered, while the previous best differential distinguisher is 9-round. For SAND64, 256 11-round IDs are proposed. For SAND128, 456 14-round IDs are presented. Both results extend previous longest IDs by one round and all these newly proposed distinguishers reached corresponding provable security boundaries. For Simeck, the length of longest IDs has not been improved. However, more distinguishers of the same length are discovered. For Simeck64, the increased ratio for the quantity can reach 300%. Besides, the practical boundary of SIMON is investigated, the results indicate that for SIMON, the practical boundary is identical with the provable security boundary or the boundary derived with the automatic searching method.

Improvements for Finding Impossible Differentials of Block Cipher Structures

Unified Impossible Differential Cryptanalysis on Block Cipher Structures

Explicit Upper Bound Of Impossible Differentials For AES-Like Ciphers: Application To uBlock And Midori

Impossible Differential Cryptanalysis of MARS-like Structures.

Revised Unified Impossible Differential Cryptanalysis of Aria

Impossible Differential Cryptanalysis and A Security Evaluation Framework for AND-RX Ciphers

New Automatic Tool for Finding Impossible Differentials and Zero-Correlation Linear Approximations

Improved Impossible Differential Cryptanalysis of Large-Block Rijndael

Impossible differential cryptanalysis of FBC-128

Improved Impossible Differential Attacks on Large-Block Rijndael

A Quantum Automatic Tool for Finding Impossible Differentials

Quantum Automated Tools for Finding Impossible Differentials

Impossible Differential Cryptanalysis of 14-Round Camellia-192.

Improved Results on Impossible Differential Cryptanalysis of Reduced-Round Camellia-192/256

New Impossible Differential Cryptanalysis of Reduced-Round Camellia

Research on the Security Level of Μ2 Against Impossible Differential Cryptanalysis.

New Improved Impossible Differential Attack on Reduced-Round AES-128

Impossible Differential Cryptanalysis of CLEFIA-128/192/256

A Novel Automatic Technique Based on MILP to Search for Impossible Differentials

Cryptanalysis Of Midori128 Using Impossible Differential Techniques

New Impossible Differential Attacks Of Reduced-Round Camellia-192 And Camellia-256