Abstract:A boomerang attack is a cryptanalysis framework that regards a block cipher E as the composition of two sub-ciphers E1∘E0$$E_1\circ E_0$$ and builds a particular characteristic for E with probability p2q2$$p^2q^2$$ by combining differential characteristics for E0$$E_0$$ and E1$$E_1$$ with probability p and q, respectively. Crucially the validity of this figure is under the assumption that the characteristics for E0$$E_0$$ and E1$$E_1$$ can be chosen independently. Indeed, Murphy has shown that independently chosen characteristics may turn out to be incompatible. On the other hand, several researchers observed that the probability can be improved to p or q around the boundary between E0$$E_0$$ and E1$$E_1$$ by considering a positive dependency of the two characteristics, e.g. the ladder switch and S-box switch by Biryukov and Khovratovich. This phenomenon was later formalised by Dunkelman et al. as a sandwich attack that regards E as E1∘Em∘E0$$E_1\circ E_m \circ E_0$$, where Em$$E_m$$ satisfies some differential propagation among four texts with probability r, and the entire probability is p2q2r$$p^2q^2r$$. In this paper, we revisit the issue of dependency of two characteristics in Em$$E_m$$, and propose a new tool called Boomerang Connectivity Table (BCT), which evaluates r in a systematic and easy-to-understand way when Em$$E_m$$ is composed of a single S-box layer. With the BCT, previous observations on the S-box including the incompatibility, the ladder switch and the S-box switch are represented in a unified manner. Moreover, the BCT can detect a new switching effect, which shows that the probability around the boundary may be even higher than p or q. To illustrate the power of the BCT-based analysis, we improve boomerang attacks against Deoxys-BC, and disclose the mechanism behind an unsolved probability amplification for generating a quartet in SKINNY. Lastly, we discuss the issue of searching for S-boxes having good BCT and extending the analysis to modular addition.

The Boomerang Attacks on Round-Reduced Skein-1024

The Boomerang Attacks on the Round-Reduced Skein-512.

Partial-Collision Attack on the Round-Reduced Compression Function of Skein-256.

Improved related-key boomerang attacks on round-reduced threefish-512

Improved Boomerang Attacks on Round-Reduced SM3 and Keyed Permutation of BLAKE-256

Evaluate the Security Margins of SHA-512, SHA-256and DHA-256 Against the Boomerang Attack

Improved Boomerang Attacks on SM3.

Automated Search Oriented To Key Recovery On Ciphers With Linear Key Schedule Applications To Boomerangs In Skinny And Forkskinny

Boomerang Attack On Step-Reduced Sha-512

New results on quantum boomerang attacks

Key Guessing Strategies for Linear Key-Schedule Algorithms in Rectangle Attacks

Boomerang Connectivity Table: A New Cryptanalysis Tool

Boomeyong: Embedding Yoyo within Boomerang and its Applications to Key Recovery Attacks on AES and Pholkos

Optimizing Rectangle and Boomerang Attacks: A Unified and Generic Framework for Key Recovery

Practical Key-Recovery Attacks on Round-Reduced Ketje Jr, Xoodoo-AE and Xoodyak

Automated Search Oriented to Key Recovery on Ciphers with Linear Key Schedule

Improved Cryptanalysis of Step-Reduced SM3

New Related-Tweakey Boomerang and Rectangle Attacks on Deoxys-BC Including BDT Effect

Snowball: Another View on Side-Channel Key Recovery Tools.

Security Analysis and Comparison of the SHA-3 Finalists BLAKE, Grøstl, JH, Keccak, and Skein

Improved Single-Key Attacks on 9-Round AES-192/256.