Abstract:This paper considers the security of iterated block ciphers against the differential cryptanalysis introduced by Biham and Shamir. Differential cryptanalysis is a chosen-plaintext attack on secret-key block ciphers that are based on iterating a cryptographically weak function r times (e.g., the 16-round Data Encryption Standard (DES)). It is shown that the success of such attacks on an r-round cipher depends on the existence of (r-1)-round differentials that have high probabilities, where an i-round differential is defined as a couple (α, β) such that a pair of distinct plaintexts with difference α can result in a pair of i-th round outputs that have difference β, for an appropriate notion of "difference". The probabilities of such differentials can be used to determine a lower bound on the complexity of a differential cryptanalysis attack and to show when an r-round cipher is not vulnerable to such attacks. The concept of "Markov ciphers" is introduced for iterated ciphers because of its significance in differential cryptanalysis. If an iterated cipher is Markov and its round subkeys are independent, then the sequence of differences at each round output forms a Markov chain. It follows from a result of Biham and Shamir that DES is a Markov cipher. It is shown that, for the appropriate notion of "difference", the Proposed Encryption Standard (PES) of Lai and Massey, which is an 8-round iterated cipher, is a Markov cipher, as are also the mini-version of PES with block length 8, 16 and 32 bits. It is shown that PES(8) and PES(16) are immune to differential cryptanalysis after sufficiently many rounds. A detailed cryptanalysis of the full-size PES is given and shows that the very plausibly most probable 7-round differential has a probability about 2-58. A differential cryptanalysis attack of PES(64) based on this differential is shown to require all 264 possible encryptions. This cryptanalysis of PES suggested a new design principle for Markov ciphers, viz., that their transition probability matrices should not be symmetric. A minor modification of PES, consistent with all the original design principles, is proposed that satisfies this new design criterion. This modified cipher, called Improved PES (IPES), is described and shown to be highly resistant to differential cryptanalysis.

Differential Invariant Subspace Cryptanalysis – A Realtime Attack against IoT-friendly Word-based Block Ciphers

Adaptive Side-Channel Analysis Model and Its Applications to White-Box Block Cipher Implementations.

Integral Cryptanalysis of Reduced-Round IIoTBC-A andFull IIoTBC-B

Real-Time Related-Key Attack on Full-Round Shadow Designed for IoT Nodes

Cryptanalysis Of Midori128 Using Impossible Differential Techniques

Differential and Linear Cryptanalysis Using Mixed-Integer Linear Programming

Related-Key Multiple Impossible Differential Cryptanalysis on Full-Round LiCi-2 Designed for IoT

Explicit Upper Bound Of Impossible Differentials For AES-Like Ciphers: Application To uBlock And Midori

Deep Learning based Differential Distinguisher for Lightweight Block Ciphers

Differential experiments using parallel alternative operations

Cryptanalysis of Reduced-Round Midori64 Block Cipher.

New Automatic Tool for Finding Impossible Differentials and Zero-Correlation Linear Approximations

An Effective Differential Fault Analysis on the Serpent Cryptosystem in the Internet of Things

EasyBC: A Cryptography-Specific Language for Security Analysis of Block Ciphers against Differential Cryptanalysis

Security Analysis of the Lightweight Cryptosystem TWINE in the Internet of Things.

Truncated Differential Attacks on Symmetric Primitives with Linear Key Schedule: WARP and Orthros

Markov Ciphers and Differentail Cryptanalysis

Differential cryptanalysis of full-round ANU-II ultra-lightweight block cipher

Differential-Multiple Linear Cryptanalysis

Bit‐Based Evaluation of Lightweight Block Ciphers SLIM, LBC‐IoT, and SLA by Mixed Integer Linear Programming

MILP-based differential cryptanalysis on full-round shadow