Abstract:A boomerang attack is a cryptanalysis framework that regards a block cipher E as the composition of two sub-ciphers E1∘E0$$E_1\circ E_0$$ and builds a particular characteristic for E with probability p2q2$$p^2q^2$$ by combining differential characteristics for E0$$E_0$$ and E1$$E_1$$ with probability p and q, respectively. Crucially the validity of this figure is under the assumption that the characteristics for E0$$E_0$$ and E1$$E_1$$ can be chosen independently. Indeed, Murphy has shown that independently chosen characteristics may turn out to be incompatible. On the other hand, several researchers observed that the probability can be improved to p or q around the boundary between E0$$E_0$$ and E1$$E_1$$ by considering a positive dependency of the two characteristics, e.g. the ladder switch and S-box switch by Biryukov and Khovratovich. This phenomenon was later formalised by Dunkelman et al. as a sandwich attack that regards E as E1∘Em∘E0$$E_1\circ E_m \circ E_0$$, where Em$$E_m$$ satisfies some differential propagation among four texts with probability r, and the entire probability is p2q2r$$p^2q^2r$$. In this paper, we revisit the issue of dependency of two characteristics in Em$$E_m$$, and propose a new tool called Boomerang Connectivity Table (BCT), which evaluates r in a systematic and easy-to-understand way when Em$$E_m$$ is composed of a single S-box layer. With the BCT, previous observations on the S-box including the incompatibility, the ladder switch and the S-box switch are represented in a unified manner. Moreover, the BCT can detect a new switching effect, which shows that the probability around the boundary may be even higher than p or q. To illustrate the power of the BCT-based analysis, we improve boomerang attacks against Deoxys-BC, and disclose the mechanism behind an unsolved probability amplification for generating a quartet in SKINNY. Lastly, we discuss the issue of searching for S-boxes having good BCT and extending the analysis to modular addition.

Generalized Boomerang Connectivity Table and Improved Cryptanalysis of GIFT.

Improved Related-Key Rectangle Attacks on GIFT

Improved Differential Attacks On Gift-64

Boomerang Connectivity Table: A New Cryptanalysis Tool

Differential-Linear Cryptanalysis of GIFT Family and GIFT-based Ciphers

Towards Key-recovery-attack Friendly Distinguishers: Application to GIFT-128

New Properties of the Double Boomerang Connectivity Table

A new class of S-boxes with optimal Feistel boomerang uniformity

The revised boomerang connectivity tables and their connection to the Difference Distribution Table

MILP-Based Differential Attack on Round-Reduced GIFT

New Results about the Boomerang Uniformity of Permutation Polynomials

MILP-based Related-Key Rectangle Attack and Its Application to GIFT, Khudra, MIBS

On the boomerang uniformity of (quadratic) permutations over $F_{2^n}$

Optimizing Rectangle and Boomerang Attacks: A Unified and Generic Framework for Key Recovery

The Explicit values of the UBCT, the LBCT and the DBCT of the inverse function

Generalized Related-Key Rectangle Attacks on Block Ciphers with Linear Key Schedule: Applications to SKINNY and GIFT.

Theoretical Round Modification Fault Analysis on AEGIS-128 with Algebraic Techniques

Constructing the Impossible Differential of Type-II GFN with Boolean Function and Its Application to WARP

In-depth analysis of S-boxes over binary finite fields concerning their differential and Feistel boomerang differential uniformities

The c-boomerang uniformity of two classes of permutation polynomials over finite fields

Further explorations in the second-order zero differential spectra of power functions over finite fields