Abstract
In this paper, we revisit the relationship between the probability of differential trails and the input difference of each round for SIMON-like block ciphers. The key observation is that not only the Hamming weight but also the positions of active bits of the input difference have effect on the probability. Based on this, our contributions are mainly twofold. Firstly, we rebuild the MILP model for SIMON-like block ciphers without quadratic constraints. Accordingly, we give the accurate objective function and reduce its degree to one by adding auxiliary variants to make the model easy to solve. Secondly, we search for optimal differential trails for SIMON and SIMECK based on this model. To the best of our knowledge, this is the first time that related-key differential trails have been obtained. Besides, we not only recover the single-key results in [11], but also obtain impossible differentials through this method.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
Notes
- 1.
All experiments are performed on a PC with 2.5 GHz Intel Core i7 and 16GB 1600 MHz DDR3.
References
Abdelraheem, M.A., Alizadeh, J., Alkhzaimi, H.A., Aref, M.R., Bagheri, N., Gauravaram, P.: Improved linear cryptanalysis of reduced-round SIMON-32 and SIMON-48. In: Biryukov, A., Goyal, V. (eds.) INDOCRYPT 2015. LNCS, vol. 9462, pp. 153–179. Springer, Cham (2015). https://doi.org/10.1007/978-3-319-26617-6_9
Abed, F., List, E., Lucks, S., Wenzel, J.: Differential cryptanalysis of round-reduced Simon and Speck. In: Cid, C., Rechberger, C. (eds.) FSE 2014. LNCS, vol. 8540, pp. 525–545. Springer, Heidelberg (2015). https://doi.org/10.1007/978-3-662-46706-0_27
Alkhzaimi, H.A., Lauridsen, M.M.: Cryptanalysis of the SIMON Family of Block Ciphers. Cryptology ePrint Archive, Report 2013/543 (2013). https://eprint.iacr.org/2013/543
Beaulieu, R., Shors, D., Smith, J., Treatman-Clark, S., Weeks, B., Wingers, L.: The Simon and Speck Families of Lightweight Block Ciphers. Cryptology ePrint Archive, Report 2013/404 (2013). https://eprint.iacr.org/2013/404
Beaulieu, R., Shors, D., Smith, J., Treatman-Clark, S., Weeks, B., Wingers, L.: Notes on the design and analysis of SIMON and SPECK. Cryptology ePrint Archive, Report 2017/560 (2017). https://eprint.iacr.org/2017/560
Biryukov, A., Roy, A., Velichkov, V.: Differential analysis of block ciphers SIMON and SPECK. In: Cid, C., Rechberger, C. (eds.) FSE 2014. LNCS, vol. 8540, pp. 546–570. Springer, Heidelberg (2015). https://doi.org/10.1007/978-3-662-46706-0_28
Biryukov, A., Velichkov, V.: Automatic search for differential trails in ARX ciphers. In: Benaloh, J. (ed.) CT-RSA 2014. LNCS, vol. 8366, pp. 227–250. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-04852-9_12
Chen, Z., Wang, N., Wang, X.: Impossible Differential Cryptanalysis of Reduced Round SIMON. Cryptology ePrint Archive, Report 2015/286 (2015). https://eprint.iacr.org/2015/286
Kölbl, S., Leander, G., Tiessen, T.: Observations on the SIMON block cipher family. In: Gennaro, R., Robshaw, M. (eds.) CRYPTO 2015. LNCS, vol. 9215, pp. 161–185. Springer, Heidelberg (2015). https://doi.org/10.1007/978-3-662-47989-6_8
Kondo, K., Sasaki, Y., Iwata, T.: On the design rationale of Simon block cipher: integral attacks and impossible differential attacks against Simon variants. In: Manulis, M., Sadeghi, A.-R., Schneider, S. (eds.) ACNS 2016. LNCS, vol. 9696, pp. 518–536. Springer, Cham (2016). https://doi.org/10.1007/978-3-319-39555-5_28
Liu, Z., Li, Y., Wang, M.: Optimal differential trails in SIMON-like ciphers. IACR Trans. Symmetric Cryptol. 2017, 358–379 (2017). https://doi.org/10.13154/tosc.v2017.i1.358-379
Liu, Z., Li, Y., Wang, M.: The Security of SIMON-like Ciphers Against Linear Cryptanalysis. Cryptology ePrint Archive, Report 2017/576 (2017). https://eprint.iacr.org/2017/576
Matsui, M.: On correlation between the order of S-boxes and the strength of DES. In: De Santis, A. (ed.) EUROCRYPT 1994. LNCS, vol. 950, pp. 366–375. Springer, Heidelberg (1995). https://doi.org/10.1007/BFb0053451
Shi, D., Hu, L., Sun, S., Song, L., Qiao, K., Ma, X.: Improved linear (hull) cryptanalysis of round-reduced versions of SIMON. 60, 39101, May 2016.https://doi.org/10.1007/s11432-015-0007-1
Sun, S., et al.: Towards Finding the Best Characteristics of Some Bit-oriented Block Ciphers and Automatic Enumeration of (Related-key) Differential and Linear Characteristics with Predefined Properties. Cryptology ePrint Archive, Report 2014/747 (2014). https://eprint.iacr.org/2014/747
Sun, S., et al.: Constructing Mixed-integer Programming Models whose Feasible Region is Exactly the Set of All Valid Differential Characteristics of SIMON (2015). https://eprint.iacr.org/2015/122
Sun, S., Hu, L., Wang, P., Qiao, K., Ma, X., Song, L.: Automatic security evaluation and (related-key) differential characteristic search: application to SIMON, PRESENT, LBlock, DES(L) and other bit-oriented block ciphers. In: Sarkar, P., Iwata, T. (eds.) ASIACRYPT 2014. LNCS, vol. 8873, pp. 158–178. Springer, Heidelberg (2014). https://doi.org/10.1007/978-3-662-45611-8_9
Todo, Y.: Division property: efficient method to estimate upper bound of algebraic degree. In: Phan, R.C.-W., Yung, M. (eds.) Mycrypt 2016. LNCS, vol. 10311, pp. 553–571. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-61273-7_30
Todo, Y., Morii, M.: Bit-based division property and application to Simon family. In: Peyrin, T. (ed.) FSE 2016. LNCS, vol. 9783, pp. 357–377. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-52993-5_18
Wang, Q., Liu, Z., Varıcı, K., Sasaki, Y., Rijmen, V., Todo, Y.: Cryptanalysis of reduced-round SIMON32 and SIMON48. In: Meier, W., Mukhopadhyay, D. (eds.) INDOCRYPT 2014. LNCS, vol. 8885, pp. 143–160. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-13039-2_9
Xiang, Z., Zhang, W., Bao, Z., Lin, D.: Applying MILP method to searching integral distinguishers based on division property for 6 lightweight block ciphers. In: Cheon, J.H., Takagi, T. (eds.) ASIACRYPT 2016. LNCS, vol. 10031, pp. 648–678. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-53887-6_24
Yang, G., Zhu, B., Suder, V., Aagaard, M.D., Gong, G.: The Simeck family of lightweight block ciphers. In: Güneysu, T., Handschuh, H. (eds.) CHES 2015. LNCS, vol. 9293, pp. 307–329. Springer, Heidelberg (2015). https://doi.org/10.1007/978-3-662-48324-4_16
Acknowledgement
The authors thank the anonymous reviewers of ISC2018 for useful comments. This work was supported by the NSFC under grant \(\#\)61379139.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Appendices
A Proof of Lemma 1
Proof
Let x and \((x \oplus \varDelta x)\) be two inputs of the function f. We have
Then for any bit \(\varDelta d_{i}\) in \(\varDelta d\) (\(i=0,\cdots ,n-1\)), we have
Obviously, only two bits in \(\varDelta x\), namely \(\varDelta x_{i+a}\) and \(\varDelta x_{i+b}\) can affect the value of \(\varDelta d_{i}\).
Fix an arbitrary i, assume that \(\varDelta d_{k}\) is affected by \(\varDelta x_{i}\). First, we have
from Eq. (5). If \(\varDelta d_{k}\) is affected by \(\varDelta x_{i}\), then we have
or
Put it in another form, we have
or
So proved that an arbitrary bit \(\varDelta x_{i}\) can affect only two bits \(\varDelta d_{i-a}\) and \(\varDelta d_{i-b}\).
From Eq. (5), we have that
-
(1)
if \(\varDelta x_{i+a}=0, \varDelta x_{i+b}=0\), then \(\varDelta d_{i}=0\);
-
(2)
if \(\varDelta x_{i+a}=1, \varDelta x_{i+b}=1\), then \(\varDelta d_{i}\) = \((x_{i+a}\oplus x_{i+b})\odot 1 \oplus 1\);
-
(3)
if \(\varDelta x_{i+a} = 1\), \(\varDelta x_{i+b} = 0\), then \(\varDelta d_{i} = \varDelta x_{i+a} \odot x_{i+b} = x_{i+b}\);
-
(4)
if \(\varDelta x_{i+a} = 0\), \(\varDelta x_{i+b} = 1\), then \(\varDelta d_{i} = x_{i+a} \odot \varDelta x_{i+b} = x_{i+a}\).
Let \(x_i\) denote an arbitrary bit in x. \(\varDelta d_k\) is affected by \(x_i\), iff. \(k \equiv i-a \mod n\) and \(\varDelta x_{k+b}=\varDelta x_{i-a+b} = 1\), or \(k \equiv i-b \mod n\) and \(\varDelta x_{k+a}=\varDelta x_{i-b+a} = 1\). Â Â Â \(\square \)
B Proof of Theorem 1
Proof
Let \(R_{d}\) be the collection of bits in \(\varDelta d\) which are affected by bits in R. From Lemma 1,
There may be duplicate elements in the collection \(R_d\).
-
1.
Since \(a \ne b\), then \(i_\ell -a \not \equiv i_\ell -b \mod n\), for \(\ell = 0,\cdots ,m-1\);
-
2.
For \(0 \le j \ne k \le m-1\), \(i_j -a \not \equiv i_k - a \mod n\), since \(i_j \ne i_k\);
-
3.
For \(0 \le j \ne k \le m-1\), if \(i_j -a \equiv i_k - b \mod n\), then \(i_j - i_k \equiv a - b \mod n\);
-
4.
For \(0 \le j \ne k \le m-1\), if \(i_j -b \equiv i_k - a \mod n\), then \(i_j - i_k \equiv b - a \mod n\);
If there exist \(p_1\) pairs of \(\{i_j,i_k\}\) such that \(|i_j-i_k |\equiv |a-b |\mod n\), we have
or
we claim that Eqs. (11) and (12) cannot hold true simultaneously, otherwise it contradicts with \(gcd(n,a-b)=1\). Let \(R_d'\) denote the set obtained by removing duplicate elements from the collection \(R_d\). Then if there exist \(p_1\) pairs of \(\{i_j,i_k\}\) such that \(|i_j-i_k |\equiv |a-b |\mod n\), \(|R_d |- |R_d' |= p_1\).
Now we turn to discuss the relationships amongst bits in \(\varDelta d\). First, for \(\varDelta d_k \notin R_d'\), we have \(\varDelta x_{k+a}=0\) and \(\varDelta x_{k+b} = 0\) from Lemma 1; specifically, \(\varDelta d_{k}=0\) holds with probability 1, regardless of the values of \(x_{k+a}\) and \(x_{k+b}\). Thus, we need only to discuss the relationships amongst bits in \(R_d'\). For \(\varDelta d_k \in R_d'\), it has been proved by Lemma 1 that at least one of \(\varDelta x_{k+a}\) and \(\varDelta x_{k+b}\) is active. Specifically,
-
1.
\(\varDelta x_{k+a}=1\), \(\varDelta x_{k+b}=0\). In this case, \(\varDelta d_{k}=x_{k+b}\). If there exists some other bit \(\varDelta d_{k}' \in R_d'\) such that \(\varDelta d_{k}'\) is dependent of \(\varDelta d_{k}\), then \(k' \equiv k+b-a \mod n\), since \(\varDelta d_{k+b-a}\) is the only bit which may be affected by \(x_{k+b}\) except for \(\varDelta d_k\) from Lemma 1.
$$\begin{aligned} \begin{aligned} \varDelta d_{k+b-a}=&\varDelta x_{k+b}\odot x_{k+2b-a}\oplus x_{k+b}\odot \varDelta x_{k+2b-a}\\&\oplus \varDelta x_{k+b}\odot \varDelta x_{k+2b-a} \end{aligned}\end{aligned}$$(13)If \(\varDelta x_{k+2b-a}\in R\), then \(\varDelta d_{k+b-a}=x_{k+b}=\varDelta d_{k}\); otherwise, \(\varDelta d_{k+b-a}=0\) holds with probability 1 (independent of \(\varDelta d_{k}\)).
-
2.
\(\varDelta x_{k+a}=0\), \(\varDelta x_{k+b}=1\). In this case, \(\varDelta d_{k}=x_{k+a}\). If there exists some other bit \(\varDelta d_{k}' \in R_d'\) such that \(\varDelta d_{k}'\) is dependent of \(\varDelta d_{k}\), then \(k' \equiv k+a-b \mod n\), since \(\varDelta d_{k+a-b}\) is the only bit which may be affected by \(x_{k+a}\) except for \(\varDelta d_k\) from Lemma 1.
$$\begin{aligned} \begin{aligned} \varDelta d_{k+a-b}=&\varDelta x_{k+a}\odot x_{k+2a-b}\oplus x_{k+a}\odot \varDelta x_{k+2a-b}\\&\oplus \varDelta x_{k+a}\odot \varDelta x_{k+2a-b} \end{aligned}\end{aligned}$$(14)If \(\varDelta x_{k+2a-b}\in R\), then \(\varDelta d_{k+a-b}=x_{k+a}=\varDelta d_{k}\); otherwise, \(\varDelta d_{k+a-b}=0\) holds with probability 1 (independent of \(\varDelta d_{k}\)).
-
3.
\(\varDelta x_{k+a}=1\), \(\varDelta x_{k+b}=1\). In this case, \(\varDelta d_{k}=(x_{k+a}\oplus x_{k+b})\odot 1\oplus 1\). From Lemma 1, the only other bit which may be affected by \(x_{k+a}\) is \(\varDelta d_{k+a-b}\). Specifically, the following equation holds if \(\varDelta x_{k+2a-b} \in R\).
$$\begin{aligned} \varDelta d_{k+a-b}=(x_{k+2a-b}\oplus x_{k+a})\odot 1\oplus 1 \end{aligned}$$(15)From Lemma 1, the only other bit which may be affected by \(x_{k+b}\) is \(\varDelta d_{k+b-a}\). Specifically, the following equation holds if \(\varDelta x_{k+2b-a} \in R\).
$$\begin{aligned} \varDelta d_{k+b-a}=(x_{k+b}\oplus x_{k+2b-a})\odot 1\oplus 1 \end{aligned}$$(16)It is obvious that \(\varDelta d_k\) can be dependent of other bit(s) in \(R_d'\), only in the case that \(\varDelta x_{k+2a-b},\varDelta x_{k+2b-a} \in R\). However, since \(\varDelta d_{k+b-a}\) and \(\varDelta d_{k+a-b}\) introduce the new bits (variants) of \(x_{k+2a-b}\) and \(x_{k+2b-a}\) respectively, we should involve more elements in \(R_d'\) to reduce the effects of \(x_{k+2a-b}\) and \(x_{k+2b-a}\). Again from Lemma 1, the only other bit affected by \(x_{k+2a-b}\) (\(x_{k+2b-a}\)) is \(\varDelta d_{k+2a-2b} = (x_{k+3a-2b}\oplus x_{k+2a-b})\odot 1\oplus 1\) (\(\varDelta d_{k+2b-2a} =(x_{k+2b-a}\oplus x_{k+3b-2a})\odot 1\oplus 1\)) on condition that \(\varDelta x_{k+3a-2b} \in R\) (\(\varDelta x_{k+3b-2a} \in R\)).
Thus, in order to eliminate the effects of \(x_{k+2a-b}\) and \(x_{k+2b-a}\), the only choice (from Lemma 1) is involving the new bits of \(\varDelta d_{k+2a-2b}\) and \(\varDelta d_{k+2b-2a}\), which can indeed eliminate \(x_{k+2a-b}\) and \(x_{k+2b-a}\) however introduce two new variants of \(x_{k+3a-2b}\) and \(x_{k+3b-2a}\). Under the condition \(gcd(n,a-b)=1\), this eliminating-while-introducing process will succeed iff. \(|R |= n\), and the probability of each possible value of \(\varDelta d\) is \(2^{-(n-1)}\) which coincides with the result in [11]. On the other hand, \(\varDelta d_{k}=(x_{k+a}\oplus x_{k+b})\odot 1\oplus 1\) is independent of other bits in \(R_d'\) when \(|R |< n\).
   \(\square \)
For a better understanding, we give an example with (n, a, b)=(8, 0, 3) as shown in Fig. 3. Assume that \(\varDelta x_{0}=1\), \(\varDelta x_{3}=1\). Only in the case where all input difference bits are active, can \(\varDelta d_0\) be dependent of other bits in \(\varDelta d\), namely \(\varDelta d_0 = \varDelta d_1 \oplus \cdots \oplus \varDelta d_7\).
-
1.
\(\varDelta d_0 = (x_0 \oplus x_3) \odot 1 \oplus 1\)
-
2.
\(\varDelta d_5 = (x_0 \oplus x_5) \odot 1 \oplus 1\), when \(\varDelta x_5=1\); \(\varDelta d_3 = (x_6 \oplus x_3) \odot 1 \oplus 1\), when \(\varDelta x_6=1\)
-
3.
\(\varDelta d_2 = (x_2 \oplus x_5) \odot 1 \oplus 1\), when \(\varDelta x_2=1\); \(\varDelta d_6 = (x_6 \oplus x_1) \odot 1 \oplus 1\), when \(\varDelta x_1=1\)
-
4.
\(\varDelta d_7 = (x_2 \oplus x_7) \odot 1 \oplus 1\), when \(\varDelta x_7=1\); \(\varDelta d_1 = (x_1 \oplus x_4) \odot 1 \oplus 1\), when \(\varDelta x_4=1\)
-
5.
\(\varDelta d_4 = (x_4 \oplus x_7) \odot 1 \oplus 1\)
Essentially, given \(gcd(n,a-b)=1\), there is only one cycle (\( \left( \begin{array}{cccccccc} 3 &{} 6 &{} 1 &{} 4 &{} 7 &{} 2 &{} 5 &{} 0 \\ 6 &{} 1 &{} 4 &{} 7 &{} 2 &{} 5 &{} 0 &{} 3\\ \end{array} \right) \) in this example). More generally, when \(gcd(n, a-b) = t\), there will be t cycles, and this in some way explains the rationalities of such requirement \(gcd(n,a-b)=1\).
Rights and permissions
Copyright information
© 2018 Springer Nature Switzerland AG
About this paper
Cite this paper
Wang, X., Wu, B., Hou, L., Lin, D. (2018). Automatic Search for Related-Key Differential Trails in SIMON-like Block Ciphers Based on MILP. In: Chen, L., Manulis, M., Schneider, S. (eds) Information Security. ISC 2018. Lecture Notes in Computer Science(), vol 11060. Springer, Cham. https://doi.org/10.1007/978-3-319-99136-8_7
Download citation
DOI: https://doi.org/10.1007/978-3-319-99136-8_7
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-99135-1
Online ISBN: 978-3-319-99136-8
eBook Packages: Computer ScienceComputer Science (R0)