While Generalized Feistel Networks (GFNs) have been widely studied in the literature as a building block of a block cipher, we recall in this paper the results of [1] where a unified vision to easily represent them through a matrix representation is proposed. We also introduce a new class of such schemes called Extended Generalized Feistel Networks well suited for cryptographic applications. We instantiate this particular construction into a lightweight block cipher called Lilliput analyzing its security and its hardware performances.

Extended Generalized Feistel Networks Using Matrix Representation to Propose a New Lightweight Block Cipher: Lilliput

In this paper, a new tool searching for impossible differentials is presented. Our tool can detect any contradiction between input and output differences. It can also take into account the property inside the S-box when its size is small e.g. 4 bits. This is natural for ciphers with bit-wise diffusion like PRESENT, while finding such impossible differentials for ciphers with word-wise diffusion is novel. In addition, several techniques are proposed to evaluate 8-bit S-box. The tool improves the number of rounds of impossible differentials from the previous best results for Midori128, Lilliput, and Minalpher. The tool also finds new impossible differentials for ARIA and MIBS. We manually verify the impossibility of the searched results, which reveals new structural properties of those designs. The tool can be implemented by slightly modifying the previous differential search tool using Mixed Integer Linear Programming (MILP). This motivates us to discuss the usage of our tool particular for the design process. With this tool, the maximum number of rounds of impossible differentials can be proven under reasonable assumptions and the tool is applied to various concrete designs.

New Impossible Differential Search Tool from Design and Cryptanalysis Aspects

The mere number of various apparently different statistical attacks on block ciphers has raised the question about their relationships which would allow to classify them and determine those that give essentially complementary information about the security of block ciphers. While mathematical links between some statistical attacks have been derived in the last couple of years, the important link between general truncated differential and multidimensional linear attacks has been missing. In this work we close this gap. The new link is then exploited to relate the complexities of chosen-plaintext and known-plaintext distinguishing attacks of differential and linear types, and further, to explore the relations between the key-recovery attacks. Our analysis shows that a statistical saturation attack is the same as a truncated differential attack, which allows us, for the first time, to provide a justifiable analysis of the complexity of the statistical saturation attack and discuss its validity on 24 rounds of the PRESENT block cipher. By studying the data, time and memory complexities of a multidimensional linear key-recovery attack and its relation with a truncated differential one, we also show that in most cases a known-plaintext attack can be transformed into a less costly chosen-plaintext attack. In particular, we show that there is a differential attack in the chosen-plaintext model on 26 rounds of PRESENT with less memory complexity than the best previous attack, which assumes known plaintext. The links between the statistical attacks discussed in this paper give further examples of attacks where the method used to sample the data required by the statistical test is more differentiating than the method used for finding the distinguishing property.

/pdf/links-between-truncated-differential-and-multidimensional-2402c5jckk.pdf

Links between Truncated Differential and Multidimensional Linear Properties of Block Ciphers and Underlying Attack Complexities

As two important cryptanalytic methods, impossible differential and integral cryptanalysis have attracted much attention in recent years Although relations among other cryptanalytic approaches have been investigated, the link between these two methods has been missing The motivation in this paper is to fix this gap and establish links between impossible differential cryptanalysis and integral cryptanalysis

/pdf/links-among-impossible-differential-integral-and-zero-43ep4nbjss.pdf

Links Among Impossible Differential, Integral and Zero Correlation Linear Cryptanalysis

Impossible differential cryptanalysis is a powerful technique to recover the secret key of block ciphers by exploiting the fact that in block ciphers specific input and output differences are not compatible. This paper introduces a novel tool to search truncated impossible differentials for word-oriented block ciphers with bijective Sboxes. Our tool generalizes the earlier \(\mathcal{U}\)-method and the UID-method. It allows to reduce the gap between the best impossible differentials found by these methods and the best known differentials found by ad hoc methods that rely on cryptanalytic insights. The time and space complexities of our tool in judging an r-round truncated impossible differential are about O(c·l 4·r 4) and O(c′·l 2·r 2) respectively, where l is the number of words in the plaintext and c, c′ are constants depending on the machine and the block cipher. In order to demonstrate the strength of our tool, we show that it does not only allow to automatically rediscover the longest truncated impossible differentials of many word-oriented block ciphers, but also finds new results. It independently rediscovers all 72 known truncated impossible differentials on 9-round CLEFIA. In addition, it finds new truncated impossible differentials for AES, ARIA, Camellia without FL and FL− 1 layers, E2, LBlock, MIBS and Piccolo. Although our tool does not improve the lengths of impossible differentials for existing block ciphers, it helps to close the gap between the best known results of previous tools and those of manual cryptanalysis.

Automatic Search of Truncated Impossible Differentials for Word-Oriented Block Ciphers

A unified method for finding impossible differentials of block cipher structures

In this paper, we analyze the pseudorandomness of the high level structure of FOX64, and describe a 2-round pseudorandomness distinguisher and a 3-round strong pseudorandomness distinguisher, and thus prove that 3-round and 4-round are necessary to achieve the pseudorandomness and strong pseudorandomness respectively We also find a 4-round impossible difference characteristic By using it, an adversary can attack 5, 6 and 7-round FOX64 with 269, 2133 and 2197 encryptions respectively which improves the best known attack by a factor of 2404 This attack can be extended to 5-round FOX128 with 2133 encryptions

Improved cryptanalysis of the FOX block cipher

In this paper, we propose a systematic method for finding impossible differentials for block cipher structures, better than the Umethod introduced by Kim et al [4]. It is referred as a unified impossible differential finding method (UID-method). We apply the UID-method to some popular block ciphers such as Gen-Skipjack, Gen-CAST256, GenMARS, Gen-RC6, Four-Cell, SMS4 and give the detailed impossible differentials. By the UID-method, we find a 16-round impossible differential on Gen-Skipjack and a 19-round impossible differential on Gen-CAST256. Thus we disprove the Conjecture 2 proposed in Asiacrypt’00 [9] and the theorem in FSE’09 rump session presentation [8]. On Gen-MARS and SMS4, the impossible differentials find by the UID-method are much longer than that found by the U-method. On the Four-Cell block cipher, our result is the same as the best result previously obtained by case-bycase treatment.

/pdf/a-unified-method-for-finding-impossible-differentials-of-18paadzy0u.pdf

A Unified Method for Finding Impossible Differentials of Block Cipher Structures.

Impossible Differential Cryptanalysis of FOX.

At Asiacrypt’99, Vaudenay modified the structure in the IDEA cipher to a new scheme, which they called as the Lai-Massey scheme It is proved that 3-round Lai-Massey scheme is sufficient for pseudorandomness and 4-round Lai-Massey scheme is sufficient for strong pseudorandomness But the author didn’t point out whether three rounds and four rounds are necessary for the pseudorandomness and strong pseudorandomness of the Lai-Massey Scheme In this paper we find a tworound pseudorandomness distinguisher and a three-round strong pseudorandomness distinguisher, thus prove that three rounds is necessary for the pseudorandomness and four rounds is necessary for the strong pseudorandomness

/pdf/pseudorandomness-analysis-of-the-lai-massey-scheme-3upb8p4we9.pdf

Zhongming Wu

Papers

A unified method for finding impossible differentials of block cipher structures

Improved cryptanalysis of the FOX block cipher

A Unified Method for Finding Impossible Differentials of Block Cipher Structures.

Impossible Differential Cryptanalysis of FOX.

Pseudorandomness Analysis of the Lai-Massey Scheme.