2015 | OriginalPaper | Chapter
Structural Evaluation by Generalized Integral Property
Author : Yosuke Todo
Published in: Advances in Cryptology -- EUROCRYPT 2015
Publisher: Springer Berlin Heidelberg
Activate our intelligent search to find suitable subject content or patents.
Select sections of text to find matching patents with Artificial Intelligence. powered by
Select sections of text to find additional relevant content using AI-assisted search. powered by
In this paper, we show structural cryptanalyses against two popular networks, i.e., the Feistel Network and the Substitute-Permutation Network (SPN). Our cryptanalyses are distinguishing attacks by an improved integral distinguisher. The integral distinguisher is one of the most powerful attacks against block ciphers, and it is usually constructed by evaluating the propagation characteristic of integral properties, e.g., the ALL or BALANCE property. However, the integral property does not derive useful distinguishers against block ciphers with non-bijective functions and bit-oriented structures. Moreover, since the integral property does not clearly exploit the algebraic degree of block ciphers, it tends not to construct useful distinguishers against block ciphers with low-degree functions. In this paper, we propose a new property called
the division property
, which is the generalization of the integral property. It can effectively construct the integral distinguisher even if the block cipher has non-bijective functions, bit-oriented structures, and low-degree functions. From viewpoints of the attackable number of rounds or chosen plaintexts, the division property can construct better distinguishers than previous methods. Although our attack is a generic attack, it can improve several integral distinguishers against specific cryptographic primitives. For instance, it can reduce the required number of chosen plaintexts for the
$$10$$
-round distinguisher on
Keccak
-
$$f$$
from
$$2^{1025}$$
to
$$2^{515}$$
. For the Feistel cipher, it theoretically proves that
Simon
32, 48, 64, 96, and 128 have
$$9$$
-,
$$11$$
-,
$$11$$
-,
$$13$$
-, and
$$13$$
-round integral distinguishers, respectively.