Impossible Differentials of SPN Ciphers

Abstract

An upper bound of the length of impossible differentials for an SPN structure was presented at EUROCRYPT 2016. This paper mainly focuses on the lengths of impossible differentials for two specific SPN structures. The details of the S-boxes could be exploited to construct longer impossible differentials for ciphers adopting these structures. For Kuznyechik and the internal permutation of PHOTON, we can construct 3-round and 5-round impossible differentials, respectively. The lengths of impossible differentials of these two ciphers are 1 more round compared with the lengths of impossible differentials of the structures deduced from the corresponding ciphers.

The work in this paper is supported by the National Natural Science Foundation of China (No: 61672530, 61402515), the Foundation of Science and Technology on Information Assurance laboratory (No: KJ-14-003), and the Research Fund for the doctoral program of Higher Education of China (RFDP No: 2012150112004).

Appendices

A The Linear Transformation Matrix P and the Inverse Transformation Matrix $P^{-1}$ of Kuznyechik

$$\begin{aligned} \small P= \left( \begin{array}{cccccccccccccccc} cf&{} 98&{} 74&{} bf&{} 93&{} 8e&{} f2&{} f3&{} 0a&{} bf&{} f6&{} a9&{} ea&{} 8e&{} 4d&{} 6e\\ 6e&{} 20&{} c6&{} da&{} 90&{} 48&{} 89&{} 9c&{} c1&{} 64&{} b8&{} 2d&{} 86&{} 44&{} d0&{} a2\\ a2&{} c8&{} 87&{} 70&{} 68&{} 43&{} 1c&{} 2b&{} a1&{} 63&{} 30&{} 6b&{} 9f&{} 30&{} e3&{} 76\\ 76&{} 33&{} 10&{} 0c&{} 1c&{} 11&{} d6&{} 6a&{} a6&{} d7&{} f6&{} 49&{} 07&{} 14&{} e8&{} 72\\ 72&{} f2&{} 6b&{} ca&{} 20&{} eb&{} 02&{} a4&{} 8d&{} d4&{} c4&{} 01&{} 65&{} dd&{} 4c&{} 6c\\ 6c&{} 76&{} ec&{} 0c&{} c5&{} bc&{} af&{} 6e&{} a3&{} e1&{} 90&{} 58&{} 0e&{} 02&{} c3&{} 48\\ 48&{} d5&{} 62&{} 17&{} 06&{} 2d&{} c4&{} e7&{} d5&{} eb&{} 99&{} 78&{} 52&{} f5&{} 16&{} 7a\\ 7a&{} e6&{} 4e&{} 1a&{} bb&{} 2e&{} f1&{} be&{} d4&{} af&{} 37&{} b1&{} d4&{} 2a&{} 6e&{} b8\\ b8&{} 49&{} 87&{} 14&{} cb&{} 8d&{} ab&{} 49&{} 09&{} 6c&{} 2a&{} 01&{} 60&{} 8e&{} 4b&{} 5d\\ 5d&{} d4&{} b8&{} 2f&{} 8d&{} 12&{} ee&{} f6&{} 08&{} 54&{} 0f&{} f3&{} 98&{} c8&{} 7f&{} 27\\ 27&{} 9f&{} be&{} 68&{} 1a&{} 7c&{} ad&{} c9&{} 84&{} 2f&{} eb&{} fe&{} c6&{} 48&{} a2&{} bd\\ bd&{} 95&{} 5e&{} 30&{} e9&{} 60&{} bf&{} 10&{} ef&{} 39&{} ec&{} 91&{} 7f&{} 48&{} 89&{} 10\\ 10&{} e9&{} d0&{} d9&{} f3&{} 94&{} 3d&{} af&{} 7b&{} ff&{} 64&{} 91&{} 52&{} f8&{} 0d&{} dd\\ dd&{} 99&{} 75&{} ca&{} 97&{} 44&{} 5a&{} e0&{} 30&{} a6&{} 31&{} d3&{} df&{} 48&{} 64&{} 84\\ 84&{} 2d&{} 74&{} 96&{} 5d&{} 77&{} 6f&{} de&{} 54&{} b4&{} 8d&{} d1&{} 44&{} 3c&{} a5&{} 94\\ 94&{} 20&{} 85&{} 10&{} c2&{} c0&{} 01&{} fb&{} 01&{} c0&{} c2&{} 10&{} 85&{} 20&{} 94&{} 01\\ \end{array} \right) \end{aligned}$$

$$\begin{aligned} \small P^{-1}= \left( \begin{array}{cccccccccccccccc} 01&{} 94&{} 20&{} 85&{} 10&{} c2&{} c0&{} 01&{} fb&{} 01&{} c0&{} c2&{} 10&{} 85&{} 20&{} 94\\ 94&{} a5&{} 3c&{} 44&{} d1&{} 8d&{} b4&{} 54&{} de&{} 6f&{} 77&{} 5d&{} 96&{} 74&{} 2d&{} 84\\ 84&{} 64&{} 48&{} df&{} d3&{} 31&{} a6&{} 30&{} e0&{} 5a&{} 44&{} 97&{} ca&{} 75&{} 99&{} dd\\ dd&{} 0d&{} f8&{} 52&{} 91&{} 64&{} ff&{} 7b&{} af&{} 3d&{} 94&{} f3&{} d9&{} d0&{} e9&{} 10\\ 10&{} 89&{} 48&{} 7f&{} 91&{} ec&{} 39&{} ef&{} 10&{} bf&{} 60&{} e9&{} 30&{} 5e&{} 95&{} bd\\ bd&{} a2&{} 48&{} c6&{} fe&{} eb&{} 2f&{} 84&{} c9&{} ad&{} 7c&{} 1a&{} 68&{} be&{} 9f&{} 27\\ 27&{} 7f&{} c8&{} 98&{} f3&{} 0f&{} 54&{} 08&{} f6&{} ee&{} 12&{} 8d&{} 2f&{} b8&{} d4&{} 5d\\ 5d&{} 4b&{} 8e&{} 60&{} 01&{} 2a&{} 6c&{} 09&{} 49&{} ab&{} 8d&{} cb&{} 14&{} 87&{} 49&{} b8\\ b8&{} 6e&{} 2a&{} d4&{} b1&{} 37&{} af&{} d4&{} be&{} f1&{} 2e&{} bb&{} 1a&{} 4e&{} e6&{} 7a\\ 7a&{} 16&{} f5&{} 52&{} 78&{} 99&{} eb&{} d5&{} e7&{} c4&{} 2d&{} 06&{} 17&{} 62&{} d5&{} 48\\ 48&{} c3&{} 02&{} 0e&{} 58&{} 90&{} e1&{} a3&{} 6e&{} af&{} bc&{} c5&{} 0c&{} ec&{} 76&{} 6c\\ 6c&{} 4c&{} dd&{} 65&{} 01&{} c4&{} d4&{} 8d&{} a4&{} 02&{} eb&{} 20&{} ca&{} 6b&{} f2&{} 72\\ 72&{} e8&{} 14&{} 07&{} 49&{} f6&{} d7&{} a6&{} 6a&{} d6&{} 11&{} 1c&{} 0c&{} 10&{} 33&{} 76\\ 76&{} e3&{} 30&{} 9f&{} 6b&{} 30&{} 63&{} a1&{} 2b&{} 1c&{} 43&{} 68&{} 70&{} 87&{} c8&{} a2\\ a2&{} d0&{} 44&{} 86&{} 2d&{} b8&{} 64&{} c1&{} 9c&{} 89&{} 48&{} 90&{} da&{} c6&{} 20&{} 6e\\ 6e&{} 4d&{} 8e&{} ea&{} a9&{} f6&{} bf&{} 0a&{} f3&{} f2&{} 8e&{} 93&{} bf&{} 74&{} 98&{} cf\\ \end{array} \right) \end{aligned}$$

B Proof of Theorem 2

To prove Theorem 2, we only need calculate $\gamma (P)$ and $\gamma (P^{-1})$. The linear transformation $P=MC\circ SR$, which is an $d^2\times d^2$ matrix. According to the definition of $\gamma (P)$, we have $P^*\ge 0, \gamma (P)>1$, where $P^*$ is the characteristic matrix of P. Thus we consider whether $(P^*)^2>0$.

We denote $(P^*)^2=(q_{ij})$, thus $q_{ij}=0$ means that the i-th output byte of the 2-round SPN cipher is independent of the j-th input byte. Furthermore, when $Y=(P\circ S)^2(X)$, we denote $X=(x_0, x_1, \cdots , x_{d^2-1}), Y=(y_0, y_1, \cdots , y_{d^2-1})$, where $x_i,y_i\in \mathbb {F}_{2^n}$. If we can prove that any $x_i$ is dependent on all $y_j$, then $(P^*)^2>0$.

Assume that $X_1=(\underbrace{0,0,\ldots ,0}_{i-1},x_i,0,\ldots ,0), x_i\in \mathbb {F}_{2^n}^{*}$, $Y_1=S(X_1)$, there is only one element of $Y_1$ related to $x_i$. We denote $Y_2=P(Y_1)=MC\circ SR(Y_1)$, since the MC matrix is a $d\times d$ MDS matrix, there is one column of $Y_2$ which is viewed as a $d\times d$ matrix related to $x_i$. We denote $Y=P\circ S(Y_2)$, since the index transformation of ShiftRows is a permutation and the MC matrix is a $d\times d$ MDS matrix, all elements of Y are dependent on $x_i$.

Therefore, $\gamma (P)=2$. Similarly, with the same method, we get $\gamma (P^{-1})=2$. Furthermore, $\gamma (P)+\gamma (P^{-1})=4$. Note that we can construct 4-round impossible differentials for $\varepsilon ^(2)(n,d)$ when the input difference $\alpha$ and the output difference $\beta$ such that $H(\alpha )=H(\beta )=1$.