Appendix A: A simplified proof for the generalization of observation 4
We denote the input and output of the 3-bit APN S-box by \((x_0,x_1,x_2)\) and \((y_0, y_1, y_2)\), respectively.
For a 3-bit APN S-box, its algebraic degree must be 2. Thus, it can be defined in the following way:
$$\begin{aligned} y_0&=\phi _0(x_0, x_1, x_2)\oplus a_0x_0x_1\oplus a_1x_0x_2\oplus a_2x_1x_2\oplus c_0,\nonumber \\ y_1&=\phi _1(x_0, x_1, x_2)\oplus a_3x_0x_1\oplus a_4x_0x_2\oplus a_5x_1x_2\oplus c_1,\nonumber \\ y_2&=\phi _2(x_0, x_1, x_2)\oplus a_6x_0x_1\oplus a_7x_0x_2\oplus a_8x_1x_2\oplus c_2, \end{aligned}$$
where
\(\phi _i(x_0, x_1, x_2) (0\le i\le 2)\) are linear boolean functions and
\(a_j\in {\mathrm{F_2}}(0\le j\le 8)\),
\(c_j\in {\mathrm{F_2}}(0\le j\le 2)\).
Since Observation
2 holds for all 3-bit APN S-box [
19], the generalization holds for the case when
\((\Delta x_0^1, \Delta x_1^1, \Delta x_2^1)=(\Delta x_0^2, \Delta x_1^2, \Delta x_2^2),\) or
\((\Delta x_0^1, \Delta x_1^1, \Delta x_2^1)=(0,0,0)\), or
\((\Delta x_0^2, \Delta x_1^2, \Delta x_2^2)=(0,0,0)\).
For the other case, we can write the accurate 8 valid output 2-differences, and it can be found that the 8 valid output 2-differences form an affine space of dimension 3.
For example, when input 2-difference is (0, 0, 1, 1, 0, 1), the possible output 2-differences are listed below:
$$\begin{aligned} (x_0,x_1,x_2)\rightarrow&(\Delta y_0^1,\Delta y_1^1, \Delta y_2^1,\Delta y_0^2, \Delta y_1^2, \Delta y_2^2)\nonumber \\ (0,0,0)\rightarrow&(\Delta \phi _0, \Delta \phi _1, \Delta \phi _2, \widetilde{\Delta \phi _0}\oplus a_1, \widetilde{\Delta \phi _1}\oplus a_4, \widetilde{\Delta \phi _2}\oplus a_7),\nonumber \\ (0,0,1)\rightarrow&(\Delta \phi _0, \Delta \phi _1, \Delta \phi _2, \widetilde{\Delta \phi _0}, \widetilde{\Delta \phi _1}, \widetilde{\Delta \phi _2}),\nonumber \\ (0,1,0)\rightarrow&(\Delta \phi _0\oplus a_2, \Delta \phi _1\oplus a_5, \Delta \phi _2\oplus a_8, \widetilde{\Delta \phi _0}\oplus a_0\oplus a_1\oplus a_2, \widetilde{\Delta \phi _1}\oplus a_3\oplus \nonumber \\&a_4\oplus a_5, \widetilde{\Delta \phi _2}\oplus a_6\oplus a_7\oplus a_8),\nonumber \\ (1,0,0)\rightarrow&(\Delta \phi _0\oplus a_1, \Delta \phi _1\oplus a_4, \Delta \phi _2\oplus a_7, \widetilde{\Delta \phi _0}, \widetilde{\Delta \phi _1}, \widetilde{\Delta \phi _2}),\nonumber \\ (0,1,1)\rightarrow&(\Delta \phi _0\oplus a_2, \Delta \phi _1\oplus a_5, \Delta \phi _2\oplus a_8, \widetilde{\Delta \phi _0}\oplus a_0\oplus a_2, \widetilde{\Delta \phi _1}\oplus a_3\oplus a_5,\nonumber \\&\widetilde{\Delta \phi _2}\oplus a_6\oplus a_8),\nonumber \\ (1,0,1)\rightarrow&(\Delta \phi _0\oplus a_1, \Delta \phi _1\oplus a_4, \Delta \phi _2\oplus a_7, \widetilde{\Delta \phi _0}\oplus a_1, \widetilde{\Delta \phi _1}\oplus a_4, \widetilde{\Delta \phi _2}\oplus a_7),\nonumber \\ (1,1,0)\rightarrow&(\Delta \phi _0\oplus a_1\oplus a_2, \Delta \phi _1\oplus a_4\oplus a_5, \Delta \phi _2\oplus a_7\oplus a_8, \widetilde{\Delta \phi _0}\oplus a_0\oplus a_2,\nonumber \\&\widetilde{\Delta \phi _1}\oplus a_3\oplus a_5, \widetilde{\Delta \phi _2}\oplus a_6\oplus a_8),\nonumber \\ (1,1,1)\rightarrow&(\Delta \phi _0\oplus a_1\oplus a_2, \Delta \phi _1\oplus a_4\oplus a_5, \Delta \phi _2\oplus a_7\oplus a_8, \widetilde{\Delta \phi _0}\oplus a_0\oplus a_1\oplus \nonumber \\&a_2, \widetilde{\Delta \phi _1}\oplus a_3\oplus a_4\oplus a_5, \widetilde{\Delta \phi _2}\oplus a_6\oplus a_7\oplus a_8). \end{aligned}$$
where we denote
\(\phi _i(0,0,1)\) by
\(\Delta \phi _i (0\le i\le 2)\) and
\(\phi _i(1,0,1)\) by
\(\widetilde{\Delta \phi _i} (0\le i\le 2).\)
As \(\{(0,0,0,0,0,0), (0,0,0,a_1,a_4,a_7), (a_2,a_5,a_8,a_0\oplus a_1\oplus a_2,a_3\oplus a_4\oplus a_5,a_6\oplus a_7\oplus a_8),\) \((a_1,a_4,a_7,0,0,0), (a_2,a_5,a_8,a_0\oplus a_2, a_3\oplus a_5, a_6\oplus a_8), (a_1,a_4,a_7,a_1,a_4,a_7),(a_1\oplus \) \(a_2, a_4\oplus a_5, a_7\oplus a_8, a_0\oplus a_2, a_3\oplus a_5, a_6\oplus a_8), (a_1\oplus a_2, a_4\oplus a_5, a_7\oplus a_8, a_0\oplus a_1\oplus a_2, a_3\oplus \) \(a_4\oplus a_5, a_6\oplus a_7\oplus a_8)\}\) is a linear subspace of dimension 3 of \(\mathrm{F_2^6}\), the 8 possible output 2-differences form an affine space of dimension 3.
Appendix B: A detailed explanation for the complexity \(T_3\)
In our attack using 3 chosen plaintexts, assume that there are
t inactive S-boxes and
j special-active S-boxes in the 3rd round. For each valid value of
\(\alpha _{0\_S}\) with
a inactive S-boxes and
b special-active S-boxes in the 1st round, the number of values of
\(\alpha _2\) such that the 2-difference transition
\(\alpha _{0\_S}\rightarrow \alpha _2\) is valid equals
$$\begin{aligned} M=4^b\times 8^{m-a-b}. \end{aligned}$$
When enumerating 2-differences backwards, the number of valid values of
\(\alpha _{2\_S}\) which satisfies there are
c inactive S-boxes and
d special-active S-boxes in the 2nd round is
$$\begin{aligned} N^0_{cd}&=4^j\times 8^{m-t-j}\times \left( {\begin{array}{c}m\\ c\end{array}}\right) \left( {\begin{array}{c}m-c\\ d\end{array}}\right) \left( \frac{1}{64}\right) ^c\times \left( \frac{21}{64}\right) ^d\nonumber \\&\quad \times \left( \frac{42}{64}\right) ^{m-c-d}. \end{aligned}$$
And for each valid
\(\alpha _{2\_S}\) which satisfies there are
c inactive S-boxes and
d special-active S-boxes in the 2nd round, the number of values of
\(\alpha _2\) such that the 2-difference transition
\(\alpha _2\leftarrow \alpha _{2\_S}\) is valid equals
$$\begin{aligned} N^1_{cd}=4^d\times 8^{m-c-d}. \end{aligned}$$
Thus, the number of valid 4-round compact 2-differential trail where there are
c inactive S-boxes and
d special-active S-boxes in the 2nd round is
$$\begin{aligned} N_{cd}&=M\times N^0_{cd}\times N^1_{cd}\times 2^{-2n}\nonumber \\&=4^b\times 8^{m-a-b}\times 4^j\times 8^{m-t-j}\times \left( {\begin{array}{c}m\\ c\end{array}}\right) \left( {\begin{array}{c}m-c\\ d\end{array}}\right) \left( \frac{1}{64}\right) ^c\times \left( \frac{21}{64}\right) ^d \nonumber \\&\quad \times \left( \frac{42}{64}\right) ^{m-c-d}\times 4^d\times 8^{m-c-d}\times 2^{-2n}. \end{aligned}$$
For each valid 4-round compact 2-differential trail where there are
c inactive S-boxes and
d special-active S-boxes in the 2nd round, we need to iterate
\(2^{2c}\) times to guess 2 bits for each inactive S-box in the 2nd round. In each iteration, we construct
\(8m+3-3a-b-3t-j\) linear equations with
\(k+3t\) variables. If
\(k+3t\le 8m+3-3a-b-3t-j\), i.e.
\(6t+j\le 5m+3-3a-b\), then it can be expected that the equation system has at most 1 solution. The cost equals 1. If
\(k+3t>8m+3-3a-b-3t-j\), i.e.
\(6t+j>5m+3-3a-b\), then it can be expected that the equation system has
\(2^{6t+j-5m-3+3a+b}\) solutions. The cost equals
\(2^{6t+j-5m-3+3a+b}\).
Thus, if
\(k+3t\le 8m+3-3a-b-3t-j\), i.e.
\(6t+j\le 5m+3-3a-b\), the expected time complexity to retrieve the master key is
$$\begin{aligned} T_3&=\sum _{c=0}^m\sum _{d=0}^{m-c}N_{cd}\times 2^{2c}\nonumber \\&=\sum _{c=0}^m\sum _{d=0}^{m-c}4^b\times 8^{m-a-b}\times 4^j\times 8^{m-t-j}\times \left( {\begin{array}{c}m\\ c\end{array}}\right) \left( {\begin{array}{c}m-c\\ d\end{array}}\right) \left( \frac{1}{64}\right) ^c\times \left( \frac{21}{64}\right) ^d \nonumber \\&\quad \times \left( \frac{42}{64}\right) ^{m-c-d}\times 4^d\times 8^{m-c-d}\times 2^{-2n}\times 2^{2c}\nonumber \\&\le 2^{2.73m-3t-j-3a-b}. \end{aligned}$$
(B1)
If
\(k+3t>8m+3-3a-b-3t-j\), i.e.
\(6t+j>5m+3-3a-b\), the expected time complexity to retrieve the master key is
$$\begin{aligned} T_3&=\sum _{c=0}^m\sum _{d=0}^{m-c}N_{cd}\times 2^{2c}\times 2^{6t+j-5m-3+3a+b}\nonumber \\&=\sum _{c=0}^m\sum _{d=0}^{m-c}4^b\times 8^{m-a-b}\times 4^j\times 8^{m-t-j}\times \left( {\begin{array}{c}m\\ c\end{array}}\right) \left( {\begin{array}{c}m-c\\ d\end{array}}\right) \left( \frac{1}{64}\right) ^c\times \left( \frac{21}{64}\right) ^d\nonumber \\&\quad \times \left( \frac{42}{64}\right) ^{m-c-d}\times 4^d\times 8^{m-c-d}\times 2^{-2n}\times 2^{2c}\times 2^{6t+j-5m-3+3a+b}\nonumber \\&\le 2^{3t-2.27m-3}. \end{aligned}$$
(B2)