Zero-correlation cryptanalysis uses linear approximations holding with probability exactly 1/2. In this paper, we reveal fundamental links of zero-correlation distinguishers to integral distinguishers and multidimensional linear distinguishers. We show that an integral implies zero-correlation linear approximations and that a zero-correlation linear distinguisher is actually a special case of multidimensional linear distinguishers. These observations provide new insight into zero-correlation cryptanalysis which is illustrated by attacking a Skipjack variant and round-reduced CAST-256 without weak key assumptions.

/pdf/integral-and-multidimensional-linear-distinguishers-with-a888vyxg4q.pdf

Integral and multidimensional linear distinguishers with correlation zero

Integral and Multidimensional Linear Distinguishers with Correlation Zero

We revisit meet-in-the-middle (MITM) attacks on block ciphers Despite recent significant improvements of the MITM attack, its application is still restrictive In other words, most of the recent MITM attacks work only on block ciphers consisting of a bit permutation based key schedule such as KTANTAN, GOST, IDEA, XTEA, LED and Piccolo In this paper, we extend the MITM attack so that it can be applied to a wider class of block ciphers In our approach, MITM attacks on block ciphers consisting of a complex key schedule can be constructed We regard all subkeys as independent variables, then transform the game that finds the user-provided key to the game that finds all independent subkeys We apply our approach called all subkeys recovery (ASR) attack to block ciphers employing a complex key schedule such as CAST-128, SHACAL-2, KATAN, FOX128 and Blowfish, and present the best attacks on them with respect to the number of attacked rounds in literature Moreover, since our attack is simple and generic, it is applied to the block ciphers consisting of any key schedule functions even if the key schedule is an ideal function

https://link.springer.com/content/pdf/10.1007%2F978-3-642-35999-6_14.pdf

All Subkeys Recovery Attack on Block Ciphers: Extending Meet-in-the-Middle Approach

Generalized Feistel Schemes (GFSs) are important components of symmetric ciphers, which have been extensively studied in the classical setting. However, detailed security evaluations of GFS in the quantum setting still remain to be explored.

Quantum Attacks Against Type-1 Generalized Feistel Ciphers and Applications to CAST-256

8-bit microcontrollers can be used in a wide range of applications, such as the smart cards, telemedicine, cars and automation systems. In these application areas, security is one of the most important issues. The block ciphers, which can provide high-performance and reasonable security level, are meant to meet the security requirements of the 8-bit microcontrollers. In this paper, we realized the performance evaluation of the popular block cipher algorithms such as AES (Advanced Encryption Standard) (Daemen and Rijmen, 2002), Serpent (Anderson et al., 1998), Camellia (Aoki et al., 2001), CAST5 (Carlisle, 1997), and MARS (Burwick et al., 1998) on 8-bit Atmel microcontroller. The performance of the chosen block ciphers were evaluated in terms of the code/data memory requirement, execution time, and throughput criteria. According to the results obtained from target device, AES has better performance than other block ciphers in respect to throughput and code memory requirement. CAST5 and Camellia can be considered as a good alternative to AES. Serpent has a very bad performance in terms of throughput and Mars has a very bad performance in terms of memory requirement. 

	 

	Key words: Block cipher, low-cost, 8-bit microcontroller, algorithm, implementation.

Software implementation and performance comparison of popular block ciphers on 8-bit low-cost microcontroller

This paper presents a linear cryptanalysis for reduced round variants of CAST-128 and CAST-256 block ciphers. Compared with the linear relation of round function with the bias 2? 17 by J. Nakahara et al., we found the more heavily biased linear approximations for 3 round functions and the highest one is 2? 12.91. We can mount the known-plaintext attack on 6-round CAST-128 and the ciphertext-only attack on 4-round CAST-128. Moreover the known-plaintext attack on 24-round CAST-256 with key size 192 and 256 bits has been given, and the ciphertext-only attack on 21-round CAST-256 with key size 192 and 256 bits can be performed. At the same time, we also present the attack on 18-round CAST-256 with key size 128 bits.

/pdf/new-linear-cryptanalytic-results-of-reduced-round-of-cast-3tt93561gb.pdf

Changhui Hu

Papers

New Linear Cryptanalytic Results of Reduced-Round of CAST-128 and CAST-256