On the Complexity of Impossible Differential Cryptanalysis

While impossible differential attack is one of the most well-known and familiar techniques for symmetric-key cryptanalysts, its subtlety and complicacy make the construction and verification of such attacks difficult and error-prone. We introduce a new set of notations for impossible differential analysis. These notations lead to unified formulas for estimation of data complexities of ordinary impossible differential attacks and attacks employing multiple impossible differentials. We also identify an interesting point from the new formulas: in most cases, the data complexity is only related to the form of the underlying distinguisher and has nothing to do with how the differences at the beginning and the end of the distinguisher propagate in the outer rounds. We check the formulas with some examples, and the results are all matching. Since the estimation of the time complexity is flawed in some situations, in this work, we show under which condition the formula is valid and give a simple time complexity estimation for impossible differential attack which is always achievable.

Download Full-text

Accurate Estimate of the Advantage of Impossible Differential Attacks

IACR Transactions on Symmetric Cryptology ◽

10.46586/tosc.v2017.i3.169-191 ◽

2017 ◽

pp. 169-191 ◽

Cited By ~ 1

Author(s):

Céline Blondeau

Keyword(s):

Time Complexity ◽

Block Cipher ◽

Poisson Approximation ◽

Accurate Estimate ◽

Random Permutations ◽

Differential Attack ◽

Impossible Differential ◽

Impossible Differential Attack ◽

Differential Attacks ◽

Multivariate Hypergeometric Distribution

Impossible differential attacks, which are taking advantage of differentials that cannot occur, are powerful attacks for block cipher primitives. The power of such attacks is often measured in terms of the advantage — number of key-bits found during the key sieving phase — which determines the time complexity of the exhaustive key search phase. The statistical model used to compute this advantage has been introduced in the seminal work about the resistance of the DEAL cipher to impossible differential attacks. This model, which has not been modified since the end of the 1990s, is implicitly based on the Poisson approximation of the binomial distribution. In this paper, we investigate this commonly used model and experimentally illustrate that random permutations do not follow it. Based on this observation, we propose more accurate estimates of the advantage of an impossible differential attack. The experiments illustrate the accuracy of the estimate derived from the multivariate hypergeometric distribution. The maximal advantage –using the full codebook– of an impossible differential attack is also derived.

Download Full-text

A New Automatic Tool Searching for Impossible Differential of NIST Candidate ACE

Mathematics ◽

10.3390/math8091576 ◽

2020 ◽

Vol 8 (9) ◽

pp. 1576

Author(s):

Jingyi Liu ◽

Guoqiang Liu ◽

Longjiang Qu

Keyword(s):

Characteristic Matrix ◽

Differential Attack ◽

Optimal Permutation ◽

The Usa ◽

Standardization Process ◽

Impossible Differential ◽

Automatic Tool ◽

Ace Algorithm ◽

Impossible Differentials ◽

Impossible Differential Cryptanalysis

The ACE algorithm is a candidate of the Lightweight Cryptography standardization process started by the National Institute of Standards and Technology (NIST) of the USA that passed the first round and successfully entered the second round. It is designed to achieve a balance between hardware cost and software efficiency for both authenticated encryption with associated data (AEAD) and hashing functionalities. This paper focuses on the impossible differential attack against the ACE permutation, which is the core component of the ACE algorithm. Based on the method of characteristic matrix, we build an automatic searching algorithm that can be used to search for structural impossible differentials and give the optimal permutation for ACE permutation and other SPN ciphers. We prove that there is no impossible differential of ACE permutation longer than 9 steps and construct two 8-step impossible differentials. In the end, we give the optimal word permutation against impossible differential cryptanalysis, which is π′=(2,4,1,0,3), and a safer word XOR structure of ACE permutation.

Download Full-text