Provable Security of SP Networks with Partial Non-Linear Layers

Motivated by the recent trend towards low multiplicative complexity blockciphers (e.g., Zorro, CHES 2013; LowMC, EUROCRYPT 2015; HADES, EUROCRYPT 2020; MALICIOUS, CRYPTO 2020), we study their underlying structure partial SPNs, i.e., Substitution-Permutation Networks (SPNs) with parts of the substitution layer replaced by an identity mapping, and put forward the first provable security analysis for such partial SPNs built upon dedicated linear layers. For different instances of partial SPNs using MDS linear layers, we establish strong pseudorandom security as well as practical provable security against impossible differential attacks. By extending the well-established MDS code-based idea, we also propose the first principled design of linear layers that ensures optimal differential propagation. Our results formally confirm the conjecture that partial SPNs achieve the same security as normal SPNs while consuming less non-linearity, in a well-established framework.

Download Full-text

Security Analysis of 7-Round MISTY1 against Higher Order Differential Attacks

IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences ◽

10.1587/transfun.e93.a.144 ◽

2010 ◽

Vol E93-A (1) ◽

pp. 144-152 ◽

Cited By ~ 3

Author(s):

Yukiyasu TSUNOO ◽

Teruo SAITO ◽

Maki SHIGERI ◽

Takeshi KAWABATA

Keyword(s):

Security Analysis ◽

Higher Order ◽

Differential Attacks

Download Full-text

A secure and highly efficient first-order masking scheme for AES linear operations

Cybersecurity ◽

10.1186/s42400-021-00082-w ◽

2021 ◽

Vol 4 (1) ◽

Author(s):

Jingdian Ming ◽

Yongbin Zhou ◽

Huizhong Li ◽

Qian Zhang

Keyword(s):

Cost Reduction ◽

Provable Security ◽

State Of The Art ◽

Side Channel ◽

First Order ◽

Highly Efficient ◽

Non Linear ◽

Device Independence ◽

Practical Implications ◽

Provably Secure

AbstractDue to its provable security and remarkable device-independence, masking has been widely accepted as a noteworthy algorithmic-level countermeasure against side-channel attacks. However, relatively high cost of masking severely limits its applicability. Considering the high tackling complexity of non-linear operations, most masked AES implementations focus on the security and cost reduction of masked S-boxes. In this paper, we focus on linear operations, which seems to be underestimated, on the contrary. Specifically, we discover some security flaws and redundant processes in popular first-order masked AES linear operations, and pinpoint the underlying root causes. Then we propose a provably secure and highly efficient masking scheme for AES linear operations. In order to show its practical implications, we replace the linear operations of state-of-the-art first-order AES masking schemes with our proposal, while keeping their original non-linear operations unchanged. We implement four newly combined masking schemes on an Intel Core i7-4790 CPU, and the results show they are roughly 20% faster than those original ones. Then we select one masked implementation named RSMv2 due to its popularity, and investigate its security and efficiency on an AVR ATMega163 processor and four different FPGA devices. The results show that no exploitable first-order side-channel leakages are detected. Moreover, compared with original masked AES implementations, our combined approach is nearly 25% faster on the AVR processor, and at least 70% more efficient on four FPGA devices.

Download Full-text