# Revisiting Differential-Linear Attacks via a Boomerang Perspective with Application to AES, Ascon, CLEFIA, SKINNY, PRESENT, KNOT, TWINE, WARP, LBlock, Simeck, and SERPENT

Hosein Hadipour, Patrick Derbez, Maria Eichlseder

► To cite this version:

Hosein Hadipour, Patrick Derbez, Maria Eichlseder. Revisiting Differential-Linear Attacks via a Boomerang Perspective with Application to AES, Ascon, CLEFIA, SKINNY, PRESENT, KNOT, TWINE, WARP, LBlock, Simeck, and SERPENT. CRYPTO 2024 - 44th Annual International Cryptology Conference, Aug 2024, Santa Barbara, United States. pp.38-72, 10.1007/978-3-031-68385-5_2. hal-04827105

HAL Id: hal-04827105

https://inria.hal.science/hal-04827105v1

Submitted on 9 Dec 2024

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Revisiting Differential-Linear Attacks via a
Boomerang Perspective With Application to
AES, Ascon, CLEFIA, SKINNY, PRESENT,
KNOT, TWINE, WARP, LBlock, Simeck, and
SERPENT

Hosein Hadipour¹✉, Patrick Derbez²✉ and Maria Eichlseder¹✉

¹ Graz University of Technology, Graz, Austria
hossein.hadipour@iaik.tugraz.at, hsn.hadipour@gmail.com
² Univ Rennes, Inria, CNRS, IRISA, Rennes, France

**Abstract.** In 1994, Langford and Hellman introduced differential-linear (DL) cryptanalysis, with the idea of decomposing the block cipher *E* into two parts, *E*<sub>u</sub> and *E*<sub>l</sub>, such that *E*<sub>u</sub> exhibits a high-probability differential trail, while *E*<sub>l</sub> has a high-correlation linear trail. Combining these trails forms a distinguisher for *E*, assuming independence between *E*<sub>u</sub> and *E*<sub>l</sub>. The dependency between the two parts of DL distinguishers remained unaddressed until EUROCRYPT 2019, where Bar-On et al. [3] introduced the DLCT framework, resolving the issue up to one S-box layer. However, extending the DLCT framework to formalize the dependency between the two parts for multiple rounds remained an open problem. In this paper, we first tackle this problem from the perspective of boomerang analysis. By examining the relationships between DLCT, DDT, and LAT, we introduce a set of new tables facilitating the formulation of dependencies between the two parts of the DL distinguisher across multiple rounds. Then, we introduce a highly versatile and easy-to-use automatic tool for exploring DL distinguishers, inspired by automatic tools for boomerang distinguishers. This tool considers the dependency between differential and linear trails across multiple rounds. We apply our tool to various symmetric-key primitives, and in all applications, we either present the first DL distinguishers or enhance the best-known ones. We achieve successful results against Ascon, AES, SERPENT, PRESENT, SKINNY, TWINE, CLEFIA, WARP, LBlock, Simeck, and KNOT. Furthermore, we demonstrate that, in some cases, DL distinguishers outperform boomerang distinguishers significantly.

**Keywords:** Differential-linear analysis · DLCT · UDLCT · LDLCT · EDLCT · DDLCT · AES · Ascon · SKINNY · SERPENT · PRESENT · KNOT · WARP · LBlock · Simeck · TWINE

# 1 Introduction

The security assessment of a symmetric primitive typically involves subjecting
it to various cryptanalysis techniques to ascertain that none pose a significant
threat. This analysis also aims to gauge the security margins provided by the primitive, allowing designers to finely tune operational parameters (such as the number of rounds in block ciphers) to strike a balance between efficiency and security. Differential [12] and linear [43] attacks represent two fundamental crypt-analysis techniques. However, given the well-known nature of these cryptanalysis techniques, most new cryptographic primitives are designed to resist them, at least in terms of *basic* applications of the attacks. One way to resist these attacks is to prevent the existence of long, high-probability differential or linear trails.

Nevertheless, in 1994, Langford and Hellman [38] showed that the non-existence of such trails does not necessarily imply the security of the primitive against differential and linear attacks. They introduced the concept of a combined attack known as the *differential-linear* (DL) attack. This attack merges the principles of both differential and linear cryptanalysis, forming an effective distinguisher on more rounds than achievable using either technique alone. They showed that if we can decompose the block cipher *E* into two parts *E* = *E*<sub>*l*</sub> ◦ *E*<sub>*u*</sub> such that there is a high-probability differential trail for *E*<sub>*u*</sub> and a high-correlation linear trail for *E*<sub>*l*</sub>, then we can combine them to create a distinguisher for *E*. DL attacks have been successfully applied to many ciphers and led to a full-round attack on COCONUT98 [10] as well as the best known attacks for several ciphers such as SERPENT [26], ICEPOLE [36], and Chaskey [6, 39].

However, the complexity analysis of the DL distinguisher relies on two statistical assumptions: an independence assumption for the two parts $E_u$ and $E_\ell$ and certain randomness assumptions for the output difference of $E_u$. Thus, many of the follow-up works were dedicated to formalizing the complexity of the DL distinguisher, relaxing the underlying assumptions. In 2002, Biham et al. [10] showed that some of the assumptions made in [38] may fail in practice, and proposed an enhanced DL attack. In 2017, Blondeau et al. [13] provided an exact expression of the correlation for DL distinguishers in a closed form under the sole assumption that the two parts are independent. While the dependence between the two parts $E_u$ and $E_\ell$ remained unexplored for a considerable period, it was eventually investigated within the context of another differential-based combined attack, namely, the boomerang attack [55]. Dunkelman et al. [27] proposed the sandwich framework to consider the dependence between the two parts of the boomerang distinguisher. The core idea of the sandwich framework is to divide the block cipher *E* into three parts $E_u$, $E_m$, and $E_\ell$, where the middle part $E_m$ takes dependencies into account. A similar framework is also applicable for differential-linear distinguishers. In this case, $E_u$ is covered by an ordinary differential distinguisher and $E_\ell$ by a linear distinguisher, while $E_m$ is subject to a small combined distinguisher that connects the two parts, as illustrated in Figure 1b. The main role of the middle part $E_m$ is to take the dependency between $E_u$ and $E_\ell$ into account while computing the correlation of the DL distinguisher. One option is to estimate the correlation of differential-linear approximations over $E_m$ with an experimental approach using a sufficiently large set of random inputs. As a more formal alternative, at EUROCRYPT 2019, Bar-On et al. [3] introduced the Differential-Linear Connectivity Table (DLCT)
to derive the correlation of the middle part $E_m$ when it covers only one S-box layer. However, they left extending the DLCT framework to the case where the middle part includes multiple rounds as an open problem. At CRYPTO 2021, Liu et al. [41] proposed a pure algebraic method to estimate the correlation of DL distinguishers for multiple rounds, but this approach is quite different from the DLCT framework. This situation is different compared to boomerang attacks, where recent papers made significant progress in generalizing the BCT framework to multi-round middle parts for various design paradigms [15, 16, 30, 33]. Despite the similar structure of boomerang distinguishers and differential-linear distinguishers, the duality between these two has so far not been systematically explored, and it remains an open problem to leverage insights gained in one technique for the other.

An even more pressing open problem is that identifying the most effective DL distinguishers against a primitive is a non-trivial task, particularly when taking dependencies between the two parts into account. Bar-On et al. [3] demonstrated the importance of studying the junction between differential and linear trails carefully, as optimizing the two trails independently may not necessarily result in the distinguisher with the highest correlation. While recent years have seen the emergence of several automated tools focused on identifying optimal boomerang/rectangle distinguishers [15, 21, 30, 33] and even the most effective full boomerang/rectangle attacks [25, 48] across various classes of primitives, there is a noticeable gap in research dedicated to exploring differential-linear distinguishers and attacks. Only very recently, Bellini et al. [7] introduced an automated tool based on Mixed-Integer Linear Programming (MILP) and Mixed-Integer Quadratic Constraint Programming (MIQCP) for identifying DL distinguishers in ARX ciphers and applied it to Speck-32. However, the authors themselves acknowledge that their Constraint Programming (CP) model is resource-intensive, limiting its application to smaller variants of Speck like Speck-32. Furthermore, the tool's efficiency with respect to SPN ciphers remains an open question. In another recent work from ASIACRYPT 2023, Chen et al. [18] proposed an alternative method for searching for DL distinguishers. However, their approach is also tailored to ARX ciphers and does not leverage general-purpose CP/MILP solvers. Developing an efficient and generic approach to automatically search for good DL distinguishers of different classes of primitives, particularly SPN designs, remains an open problem (see Section A for a detailed comparison).

**Our contributions.** This work addresses two important research gaps in the context of DL cryptanalysis. First, we address an open problem proposed at EUROCRYPT 2019 [3], which involves generalizing the DLCT framework to formalize the correlation of the middle part in the DL distinguisher when composed of multiple rounds. To achieve this, we explore the relations between DLCT, DDT, and LAT and propose a set of new tables that enable us to formulate the correlation of the middle part of the DL distinguisher across multiple rounds. Our approach is inspired by the generalized BCT framework in boomerang analysis and reveals a certain duality between the two frameworks. The advantage of our approach is that it allows us to leverage the insights gained in one framework for
the other. To demonstrate the utility of our new tables, we apply them to the
DL distinguishers of various block ciphers to derive a formula for the correlation
of the multiple-round middle part of the DL distinguisher. Then, as another
contribution and inspired by advancements in boomerang analysis, we introduce
an automated search method for DL distinguishers based on CP/MILP. This
method is both generic and user-friendly, designed for searching good DL distin-
guishers across a broad spectrum of symmetric primitives. Our tool is applied
to various primitives, including weakly aligned permutations (Ascon, KNOT),
bit-sliced block ciphers (SERPENT, PRESENT), and AndRX designs (Simeck),
as well as strongly aligned SPN block ciphers (AES, SKINNY) and Feistel ciphers
(Clefia, TWINE, LBlock, WARP). In all applications, we are either the first to
propose DL distinguishers or improve the best-known ones (see Table 1):

- For AES, we propose single-key DL distinguishers for up to 5 rounds for the first time.

- For Ascon, we propose a deterministic DL distinguisher for 4 rounds of the permutation, though it was considered not to have any deterministic DL distinguisher. We also introduce a new 5-round DL distinguisher with a correlation improved from $2^{-9}$ to $2^{-4.33}$.

- For SERPENT, we provide a new 9-round DL distinguisher with correlation improved from $2^{-56.50}$ to $2^{-50.95}$.

- For TWINE, CLEFIA, LBlock, and WARP, we propose DL distinguishers for the first time and show that in some cases the DL distinguisher can perform much better than boomerang distinguishers. For instance, we found a 17-round DL distinguisher for TWINE, which is 1 round longer than all distinguishers proposed so far. We also found a 17-round DL distinguisher for LBlock and LBlock-s exceeding its boomerang distinguisher by 1 round.

- For KNOT-256, we provide new DL distinguishers reaching up to 23 rounds of the permutation, whereas the best previous DL distinguisher is a 15-round conditional DL distinguisher [56].

- For SKINNY, we found DL distinguishers in both single-tweakey and related-tweakey settings for the first time. We introduce 15-round (resp. 17-round) related-tweakey distinguishers for SKINNY-64-128 (resp. SKINNY-64-192) that are 1 round longer than the best related-tweakey distinguishers of SKINNY with only 2 related tweakeys. Note that boomerang distinguishers of SKINNY require at least 4 related tweakeys.

- For Simeck, we significantly improve the DL distinguishers of all variants. Notably, we improve the DL distinguishers of Simeck-64, and Simeck-48 by 1 and 2 rounds, respectively.

The tool's source code is available at https://github.com/hadipourh/DL.
Most of the distinguishers reported in this paper can be obtained within minutes,
or even seconds, on a standard laptop.

**Outline.** In Section 2, we revisit the basics of differential-linear cryptanalysis. In Section 3, we extend the DLCT framework and introduce new connectivity tables to formalize the correlation of a DL distinguisher. In Section 4, we first
<table><caption>Table 1: Summary of our DL distinguishers. #R: number of rounds, C: correlation, S/RTK: Single/Related-Tweakey. □: Experimental verification.</caption><thead><tr><th>Cipher</th><th>#R</th><th>C</th><th>□</th><th>Ref.</th><th>Cipher</th><th>#R</th><th>C</th><th>□</th><th>Ref.</th></tr></thead><tbody><tr><td rowspan="4">Ascon-p</td><td>4</td><td>2<sup>-1</sup></td><td></td><td>[22]</td><td rowspan="4">Simeck-32</td><td>7</td><td>1</td><td>✓</td><td>I.2</td></tr><tr><td>4</td><td>1</td><td>✓</td><td>D.2</td><td>14</td><td>2<sup>-16.63</sup></td><td></td><td>[61]</td></tr><tr><td>5</td><td>2<sup>-9</sup></td><td></td><td>[22]</td><td>14</td><td>2<sup>-13.92</sup></td><td>✓</td><td>I.2</td></tr><tr><td>5</td><td>2<sup>-4.33</sup></td><td>✓</td><td>D.2</td><td></td><td></td><td></td><td></td><td></td></tr><tr><td rowspan="4">AES</td><td>2</td><td>1</td><td>✓</td><td>C.2</td><td rowspan="4">Simeck-48</td><td>8</td><td>1</td><td>✓</td><td>I.2</td></tr><tr><td>3</td><td>2<sup>-7.66</sup></td><td>✓</td><td>C.2</td><td>17</td><td>2<sup>-22.37</sup></td><td></td><td>[61]</td></tr><tr><td>4</td><td>2<sup>-31.66</sup></td><td></td><td>C.2</td><td>17</td><td>2<sup>-13.89</sup></td><td>✓</td><td>I.2</td></tr><tr><td>5</td><td>2<sup>-55.66</sup></td><td></td><td>C.2</td><td></td><td></td><td></td><td></td></tr><tr><td rowspan="9">SERPENT</td><td>3</td><td>2<sup>-0.68</sup></td><td>✓</td><td>E.2</td><td rowspan="9">Simeck-64</td><td>18</td><td>2<sup>-24.75</sup></td><td></td><td>[61]</td></tr><tr><td>4</td><td>2<sup>-12.75</sup></td><td></td><td>[26]</td><td>18</td><td>2<sup>-15.89</sup></td><td></td><td>I.2</td></tr><tr><td>4</td><td>2<sup>-5.54</sup></td><td>✓</td><td>E.2</td><td>19</td><td>2<sup>-17.89</sup></td><td></td><td>I.2</td></tr><tr><td>5</td><td>2<sup>-16.75</sup></td><td></td><td>[26]</td><td>20</td><td>2<sup>-21.89</sup></td><td></td><td>I.2</td></tr><tr><td>5</td><td>2<sup>-11.10</sup></td><td>✓</td><td>E.2</td><td></td><td></td><td></td><td></td></tr><tr><td>8</td><td>2<sup>-39.18</sup></td><td></td><td>E.2</td><td>10</td><td>1</td><td>✓</td><td>I.2</td></tr><tr><td>9</td><td>2<sup>-56.50</sup></td><td></td><td>[26]</td><td>24</td><td>2<sup>-38.13</sup></td><td></td><td>[61]</td></tr><tr><td>9</td><td>2<sup>-50.95</sup></td><td></td><td>E.2</td><td>24</td><td>2<sup>-25.14</sup></td><td></td><td>I.2</td></tr><tr><td></td><td></td><td></td><td></td><td>25</td><td>2<sup>-41.04</sup></td><td></td><td>[61]</td></tr><tr><td></td><td></td><td></td><td></td><td>25</td><td>2<sup>-27.14</sup></td><td></td><td>I.2</td></tr><tr><td></td><td></td><td></td><td></td><td>26</td><td>2<sup>-30.35</sup></td><td></td><td>I.2</td></tr><tr><td rowspan="4">SKINNY<br>(STK)</td><td>6</td><td>1</td><td>✓</td><td>F.2</td><td rowspan="4">KNOT-256</td><td>8</td><td>1</td><td>✓</td><td>H.2</td></tr><tr><td>9</td><td>2<sup>-10.86</sup></td><td>✓</td><td>F.2</td><td>15</td><td>2<sup>-17.20</sup></td><td></td><td>H.2</td></tr><tr><td>10</td><td>2<sup>-19.72</sup></td><td></td><td>F.2</td><td>23</td><td>2<sup>-58.88</sup></td><td></td><td>H.2</td></tr><tr><td>11</td><td>2<sup>-26.36</sup></td><td></td><td>F.2</td><td></td><td></td><td></td><td></td></tr><tr><td rowspan="3">SKINNY-64-128<br>(RTK)</td><td>8</td><td>1</td><td>✓</td><td>F.2</td><td rowspan="3">PRESENT</td><td>3</td><td>1</td><td>✓</td><td>G.2</td></tr><tr><td>14</td><td>2<sup>-23.03</sup></td><td></td><td>F.2</td><td>9</td><td>2<sup>-9.23</sup></td><td>✓</td><td>G.2</td></tr><tr><td>15</td><td>2<sup>-28.72</sup></td><td></td><td>F.2</td><td>12</td><td>2<sup>-23.77</sup></td><td></td><td>G.2</td></tr><tr><td></td><td></td><td></td><td></td><td>13</td><td>2<sup>-27.01</sup></td><td></td><td>G.2</td></tr><tr><td rowspan="3">SKINNY-64-192<br>(RTK)</td><td>10</td><td>1</td><td>✓</td><td>F.2</td><td rowspan="3">TWINE</td><td>7</td><td>1</td><td>✓</td><td>M.2</td></tr><tr><td>16</td><td>2<sup>-20.57</sup></td><td></td><td>F.2</td><td>10</td><td>2<sup>-7.85</sup></td><td>✓</td><td>M.2</td></tr><tr><td>17</td><td>2<sup>-27.59</sup></td><td></td><td>F.2</td><td>12</td><td>2<sup>-11.49</sup></td><td>✓</td><td>M.2</td></tr><tr><td></td><td></td><td></td><td></td><td>16</td><td>2<sup>-23.64</sup></td><td></td><td>M.2</td></tr><tr><td></td><td></td><td></td><td></td><td>17</td><td>2<sup>-29.62</sup></td><td></td><td>M.2</td></tr><tr><td rowspan="6">WARP</td><td>11</td><td>1</td><td>✓</td><td>K.2</td><td rowspan="6">LBlock-s</td><td>7</td><td>1</td><td>✓</td><td>J.2</td></tr><tr><td>14</td><td>2<sup>-6</sup></td><td>✓</td><td>K.2</td><td>11</td><td>2<sup>-7.42</sup></td><td>✓</td><td>J.2</td></tr><tr><td>15</td><td>2<sup>-8</sup></td><td>✓</td><td>K.2</td><td>12</td><td>2<sup>-9.42</sup></td><td>✓</td><td>J.2</td></tr><tr><td>16</td><td>2<sup>-11</sup></td><td>✓</td><td>K.2</td><td>13</td><td>2<sup>-12.10</sup></td><td>✓</td><td>J.2</td></tr><tr><td>17</td><td>2<sup>-15</sup></td><td></td><td>K.2</td><td>16</td><td>2<sup>-22.80</sup></td><td></td><td>J.2</td></tr><tr><td>18</td><td>2<sup>-19</sup></td><td></td><td>K.2</td><td>17</td><td>2<sup>-28.80</sup></td><td></td><td>J.2</td></tr><tr><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td rowspan="4">CLEFIA</td><td>4</td><td>1</td><td>✓</td><td>L.2</td><td rowspan="4">LBlock</td><td>7</td><td>1</td><td>✓</td><td>J.2</td></tr><tr><td>6</td><td>2<sup>-7.07</sup></td><td>✓</td><td>L.2</td><td>11</td><td>2<sup>-8</sup></td><td>✓</td><td>J.2</td></tr><tr><td>7</td><td>2<sup>-11.75</sup></td><td>✓</td><td>L.2</td><td>12</td><td>2<sup>-10</sup></td><td>✓</td><td>J.2</td></tr><tr><td>8</td><td>2<sup>-33.43</sup></td><td></td><td>L.2</td><td>13</td><td>2<sup>-11.89</sup></td><td>✓</td><td>J.2</td></tr><tr><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr></tbody></table>
discuss in more detail the DLCT and switches connecting both trails to give an intuition about the effective parameters when searching for DL distinguishers. Finally, we present our CP/MILP model and its results on several primitives. For detailed results including detailed cipher specifications as well as an introduction to constraint satisfaction and constraint optimization problems (CSP and COP), we refer to the appendix.

## 2 Background

Here, we recall the basics of differential-linear analysis, and introduce the notations we use in the rest of this paper. For $\lambda, x \in \mathbb{F}_2^n$, we define the dot product of $\lambda, x$ as $\sum_{i=0}^{n-1} \lambda[i] \cdot x[i]$, where $x[i]$ (resp. $\lambda[i]$) represents the ith bit of $x$ (resp. $\lambda$). Given a set $S \subseteq \mathbb{F}_2^n$ and a Boolean function $f: \mathbb{F}_2^n \to \mathbb{F}_2$, the correlation of $f$ over the sample space $S$ is defined as

$$C_S(f) := \frac{1}{|S|} \sum_{X \in S} (-1)^{f(X)} = \mathbb{P}(f(X) = 0 | X \in S) - \mathbb{P}(f(X) = 1 | X \in S) \\ = 2 \cdot \mathbb{P}(f(X) = 0 | X \in S) - 1,$$

where $\mathbb{P}$ denotes the probability when $X$ is chosen uniformly at random from $S$.

*Differential Cryptanalysis.* Differential cryptanalysis, first introduced by Biham and Shamir [12], exploits the propagation of difference between two plaintexts through the encryption algorithm. We use $\Delta_i \xrightarrow{p} \Delta_o$ to denote a differential transition through the block cipher $E$ with probability $p = \mathbb{P}(C_1 \oplus C_2 = \Delta_o | P_1 \oplus P_2 = \Delta_i)$, where $C_i = E(P_i)$ for $i \in \{0, 1\}$. Sometimes, we use the compact notation $\mathbb{P}(\Delta_i, \Delta_o)$ to denote the probability. Differential cryptanalysis relies on the fact that $\Delta_i \xrightarrow{p} \Delta_o$ may have a non-negligible probability for some $\Delta_i, \Delta_o$.

*Linear Cryptanalysis.* Linear cryptanalysis, first introduced by Matsui [43], exploits biased linear approximations connecting a plaintext with its ciphertext. We use $\lambda_i \xrightarrow{q} \lambda_o$ to denote a linear approximation with correlation $q = \mathbb{C}(\lambda_i \cdot P \oplus \lambda_o \cdot C)$, where $C = E(P)$. Sometimes, we use the compact notation $\mathbb{C}(\lambda_i, \lambda_o)$ to denote the correlation. Linear cryptanalysis relies on the fact that $\lambda_i \xrightarrow{q} \lambda_o$ may have a non-negligible correlation for some $\lambda_i, \lambda_o$.

*Differential-Linear Cryptanalysis.* In 1994, Langford and Hellman [38] merged concepts from both differential and linear cryptanalysis, giving rise to differential-linear cryptanalysis. The main concept of DL analysis involves merging a high-probability short differential transition with a high-correlation short linear approximation, aiming to create a long distinguisher for the block cipher. Later, in 1999, Wagner proposed the boomerang attack [55] that combines two high-probability short differential transitions to build a longer distinguisher. Combined attacks, like DL and boomerang attacks, highlight that the absence of long, high-probability differentials or high-correlation linear approximations does not
guarantee the cipher's security against differential or linear cryptanalysis. The presence of short, high-probability differentials and highly correlated linear approximations can potentially make the cipher susceptible to DL or boomerang attacks, as exemplified by the full-round DL attack on COCONUT98 in [10].

<figure><img src="image_2.png" /><figcaption>Fig. 1: The structure of DL distinguishers.</figcaption></figure>

Assume that we decompose the block cipher $E$, which has a block size of $n$ bits, into two parts $E_u$ and $E_\ell$ according to Figure 1a. Additionally, assume that we have a differential transition $\Delta_i \xrightarrow{p} \Delta_m$ through $E_u$ and a linear approximation $\lambda_m \xrightarrow{q} \lambda_o$ through $E_\ell$. To distinguish $E$ from a random permutation, we encrypt a pair of plaintexts $(P_1, P_2)$ with difference $\Delta_i$ and for each pair, we check if the corresponding ciphertexts $(C_1, C_2)$ satisfy the linear approximation $\lambda_o \cdot C_1 = \lambda_o \cdot C_2$.

As can be seen in Figure 1a, the linear approximation $\lambda_o \cdot C_1 \oplus \lambda_o \cdot C_2$ can be rewritten as a combination of three linear approximations:

$$ \lambda_o \cdot C_1 \oplus \lambda_o \cdot C_2 = (\lambda_o \cdot C_1 \oplus \lambda_m \cdot X_1) \oplus (\lambda_m \cdot X_1 \oplus \lambda_m \cdot X_2) \oplus (\lambda_m \cdot X_2 \oplus \lambda_o \cdot C_2). $$

If we assume that the linear approximations are independent, then using Matsui's Piling-up lemma [43], the correlation of the linear approximation $\lambda_o \cdot C_1 \oplus \lambda_o \cdot C_2$ is the multiplication of the correlations of the three linear approximations, i.e., $\mathbb{C}(\lambda_m \cdot \Delta X) \cdot q^2$, where $\Delta X = X_1 \oplus X_2$. If we also assume that $\lambda_m \cdot \Delta X = 0$
holds in half of the cases when $\Delta X \neq \Delta_m$, then we have<fnref n="3" />:

$$ \mathbb{P}(\lambda_m \cdot \Delta X = 0) = \mathbb{P}(\lambda_m \cdot \Delta X = 0 | \Delta X = \Delta_m) \cdot p + \mathbb{P}(\lambda_m \cdot \Delta X = 0 | \Delta X \neq \Delta_m) \cdot (1-p) = \frac{1}{2} \pm \frac{p}{2}. $$

Hence, $\mathbb{C}(\lambda_m \cdot \Delta X) = (-1)^{\lambda_m \cdot \Delta_m} p = \pm p$, implying that the correlation of the linear approximation $\lambda_o \cdot C_1 \oplus \lambda_o \cdot C_2$ is $\pm pq^2$. Consequently, if $pq^2$ is large enough, we can distinguish $E$ from a random permutation with $\mathcal{O}(p^{-2}q^{-4})$ chosen plaintexts. Nevertheless, this computation relies on two key assumptions: (1) The subciphers $E_u$ and $E_\ell$ are statistically independent, and (2) $\lambda_m \cdot \Delta X = 0$ holds in half of the cases when $\Delta X \neq \Delta_m$.

However, subsequent works revealed that the above assumptions may not hold in practice. For instance, Biham et al. [10] demonstrated that the second assumption can fail in numerous cases and proposed experimental verification as a workaround. Later, Blondeau et al. [13] provided an exact expression of the correlation for DL distinguisher in a closed form without the second assumption. Based on Theorem 2 in [13], under the sole assumption that the two parts are independent, the correlation of the DL distinguisher is (see Figure 1a):

$$ \mathbb{C}(\lambda_o \cdot C_1 \oplus \lambda_o \cdot C_2) = \sum_{\Lambda X \in \mathbb{F}_2^n} \mathbb{C}(\Lambda X \cdot (E_u(P) \oplus E_u(P \oplus \Delta_i))) \cdot \mathbb{C}^2(\Lambda X, \lambda_o), \quad (1) $$

where $\mathbb{C}(\Lambda X, \lambda_o) = \mathbb{C}(\Lambda X \cdot X \oplus \lambda_o \cdot E_\ell(X))$, with $X$ chosen uniformly at random from $\mathbb{F}_2^n$.

While the dependency between the two parts (i.e., $E_u$ and $E_\ell$) was not addressed for a long time, it was studied in the context of another differential-based combined attack, i.e., boomerang attack. Dunkelman et al. [27] proposed the idea of the sandwich framework to consider the dependency between the two parts of the boomerang distinguisher. This framework is also applicable to DL attacks. In the sandwich framework, we divide the block cipher $E$ into three parts: $E_u$, $E_m$, and $E_\ell$ as illustrated in Figure 1b. While we handle $E_u$ and $E_\ell$ as standard differential and linear distinguishers, respectively, we treat $E_m$ as a compact combined distinguisher connecting the two segments (refer to Figure 1b).

Assume that $\mathbb{R}(\Delta X, \Lambda Y) = \mathbb{C}(\Lambda Y \cdot (E_m(X) \oplus E_m(X \oplus \Delta X)))$ in Figure 1b, where $X$ is chosen uniformly at random from $\mathbb{F}_2^n$. Then, the correlation of the DL distinguisher is given by [3]:

$$ \mathbb{C}(\lambda_o \cdot C_1 \oplus \lambda_o \cdot C_2) = \sum_{\Delta X, \Lambda Y} \mathbb{P}(\Delta_i, \Delta X) \cdot \mathbb{R}(\Delta X, \Lambda Y) \cdot \mathbb{C}^2(\Lambda Y, \lambda_o), \quad (2) $$

where $\mathbb{P}(\Delta_i, \Delta X) = \mathbb{P}(E_u(P) \oplus E_u(P \oplus \Delta_i)) = \Delta X$, with $P$ chosen uniformly at random from $\mathbb{F}_2^n$, and $\mathbb{C}(\Lambda Y, \lambda_o) = \mathbb{C}(\Lambda Y \cdot E_\ell(Y) \oplus \lambda_o \cdot E_\ell(Y))$, with $Y$ chosen uniformly at random from $\mathbb{F}_2^n$.

The fundamental formula for DL distinguishers in Equation 2 does not rely on the two assumptions we mentioned earlier, but computing $\mathbb{P}$, $\mathbb{R}$, and $\mathbb{C}$ still relies

<footnote n="3">³ For a fixed value of $\lambda_m$ and $\Delta_m$, $\mathbb{P}(\lambda_m \cdot \Delta X = 0 | \Delta X = \Delta_m)$ is either 1 or 0.</footnote>
on the round independence assumption within $E_u, E_m$, and $E_\ell$. Although the round independence assumption may not precisely hold in practice, it enables us to provide a good approximation for the probability (resp. correlation) of differential (resp. linear) transitions averaged over a large set of random keys.

Given the input difference $\Delta_i$, and the output mask $\lambda_o$ for a block cipher $E$, assume that for a fixed $\Delta X = \Delta_m$ and $\Delta Y = \lambda_m$, $p = \mathbb{P}(\Delta_i, \Delta_o)$, $r = \mathbb{R}(\Delta_m, \lambda_m)$, and $q = \mathbb{C}(\lambda_m, \lambda_o)$. If we decompose $E$ appropriately into three segments: $E_i, E_m$, and $E_o$, and if $\Delta_m$ and $\lambda_m$ are good choices, then $prq^2$ gives a good estimation for the actual correlation of the DL distinguisher with input difference $\Delta_i$, and output mask $\lambda_o$. We elaborate on the appropriate decomposition of $E$ and the good choices for $\Delta_m$ and $\lambda_m$ in Section 4.

While the probability of a differential (resp. correlation of a linear approximation) through $E_u$ (resp. $E_\ell$) is computed using the DDT (resp. LAT) framework, calculating the correlation of the combined distinguisher over $E_m$ is not a straightforward task. The middle term in Equation 2, namely $\mathbb{R}(\Delta_m, \lambda_m)$, is typically determined through experimental means, involving the encryption of a sufficiently large set of random plaintexts with $E_m$. More recently, Bar-On et al. [3] introduced the DLCT framework to formalize the correlation of the small combined distinguisher over $E_m$, when it is composed of only one S-box layer. However, they left extending the DLCT framework to cover more rounds at the boundary between $E_u$ and $E_\ell$ as an open problem. In Section 3, we show how to extend it for multiple rounds.

## 3 Generalizing the DLCT Framework

In this section, we extend the DLCT framework to handle multiple rounds in the middle part $E_m$. Recent advances in boomerang analysis [21,30] have enabled us to formulate the probability of boomerang distinguishers using a generalized BCT framework, providing some basic rules for modeling the involved S-boxes with different BCT tables. Inspired by boomerang analysis, we introduce the alternative of generalized BCT [19] tables to the DLCT framework. Our main motivation is to apply the same technique for DL distinguishers, especially providing a basic guideline for modeling involved S-boxes with certain tables. To this end, we first review the DDT, LAT, and DLCT definitions. Then, we introduce new tables akin to those in [21,30], and demonstrate their use in extending the DLCT framework. Finally, we provide examples to illustrate how these new tables can effectively formulate the correlation of DL distinguishers across multiple rounds.

**Definition 1 (Differential Distribution Table (DDT)).** For a vectorial Boolean function $S: \mathbb{F}_2^n \to \mathbb{F}_2^m$, the DDT is a $2^n \times 2^m$ table whose rows correspond to the input difference $\Delta_i$ to $S$ and whose columns correspond to the output difference $\Delta_o$ of $S$. The entry at index $(\Delta_i, \Delta_o)$ is

$$ \text{DDT}(\Delta_i, \Delta_o) := |\{x \in \mathbb{F}_2^n : S(x) \oplus S(x \oplus \Delta_i) = \Delta_o\}|. $$

**Definition 2 (Differential Uniformity [46]).** The differential uniformity of an S-box $S: \mathbb{F}_2^n \to \mathbb{F}_2^m$ is defined as $\mathcal{DU}(S) := \max_{\Delta_i \in \mathbb{F}_2^n \setminus \{0\}, \Delta_o \in \mathbb{F}_2^m} \text{DDT}(\Delta_i, \Delta_o)$.
**Definition 3 (Linear Approximation Table (LAT)).** For a vectorial Boolean function $S: \mathbb{F}_2^n \to \mathbb{F}_2^m$, the LAT of $S$ is a $2^n \times 2^m$ table whose rows correspond to the input mask $\lambda_i$ to $S$ and whose columns correspond to the output mask $\lambda_o$ of $S$. The entry at index $(\lambda_i, \lambda_o)$ is

$$ \mathrm{LAT}(\lambda_i, \lambda_o) := |\mathrm{LAT}_0(\lambda_i, \lambda_o)| - |\mathrm{LAT}_1(\lambda_i, \lambda_o)|, $$

$$ \text{where } \mathrm{LAT}_b(\lambda_i, \lambda_o) = \{x \in \mathbb{F}_2^n : \lambda_i \cdot x \oplus \lambda_o \cdot S(x) = b\}. $$

It can be seen that $C(\lambda_i \cdot x \oplus \lambda_o \cdot S(x)) = \mathrm{LAT}(\lambda_i, \lambda_o)/2^n$.

**Definition 4 (Linearity [46]).** The linearity of an S-box $S: \mathbb{F}_2^n \to \mathbb{F}_2^m$ is defined as $\mathcal{L}(S) := \max_{\lambda_i \in \mathbb{F}_2^n, \lambda_o \in \mathbb{F}_2^m \setminus \{0\}} |\mathrm{LAT}(\lambda_i, \lambda_o)|$.

**Definition 5 (Differential-Linear Connectivity Table (DLCT) [3]).** For a vectorial Boolean function $S: \mathbb{F}_2^n \to \mathbb{F}_2^m$, the DLCT of $S$ is a $2^n \times 2^m$ table whose rows correspond to the input difference $\Delta_i$ to $S$ and whose columns correspond to the output mask $\lambda_o$ of $S$. The entry at index $(\Delta_i, \lambda_o)$ is$^4$

$$ \mathrm{DLCT}(\Delta_i, \lambda_o) = |\mathrm{DLCT}_0(\Delta_i, \lambda_o)| - |\mathrm{DLCT}_1(\Delta_i, \lambda_o)|, $$

$$ \text{where } \mathrm{DLCT}_b(\Delta_i, \lambda_o) = \{x \in \mathbb{F}_2^n : \lambda_o \cdot S(x) \oplus \lambda_o \cdot S(x \oplus \Delta_i) = b\} \text{ (see Figure 2a).} $$

Sometimes we use the normalized DLCT, which is defined as $\overline{\mathrm{DLCT}}(\Delta_i, \lambda_o) := \mathrm{DLCT}(\Delta_i, \lambda_o)/2^n$, and is equal to $C(\lambda_o \cdot S(x) \oplus \lambda_o \cdot S(x \oplus \Delta_i))$.

**Definition 6 (Differential-Linear Uniformity).** The differential-linear uniformity of an S-box $S: \mathbb{F}_2^n \to \mathbb{F}_2^m$ is defined as $\mathcal{DLU}(S) := \max_{\Delta_i, \lambda_o \neq 0} |\mathrm{DLCT}(\Delta_i, \lambda_o)|$.

<figure><img src="image_3.png" /><figcaption>Fig. 2: Tables of the generalized DLCT framework.</figcaption></figure>

As in boomerang distinguishers, we can extend the definition of the DLCT to the cases where the output difference and/or the input mask are also specified. This leads to the following definitions:

<footnote>$^4$ Our definition is slightly different from [3], where DLCT is defined as $|\mathrm{DLCT}_0| - 2^{n-1}$.</footnote>
**Definition 7 (Upper Differential-Linear Connectivity Table (UDLCT)).**

For a vectorial Boolean function $S: \mathbb{F}_2^n \to \mathbb{F}_2^m$, the UDLCT of $S$ is a $2^n \times 2^m \times 2^m$ table. The entry at index $(\Delta_i, \Delta_o, \lambda_o)$ is (see Figure 2b)

$$ \mathrm{UDLCT}(\Delta_i, \Delta_o, \lambda_o) = |\mathrm{UDLCT}_0(\Delta_i, \Delta_o, \lambda_o)| - |\mathrm{UDLCT}_1(\Delta_i, \Delta_o, \lambda_o)|, $$

where $\mathrm{UDLCT}_b(\Delta_i, \Delta_o, \lambda_o) = \{x \in \mathbb{F}_2^n : S(x) \oplus S(x \oplus \Delta_i) = \Delta_o \text{ and } \lambda_o \cdot \Delta_o = b\}$.

**Definition 8 (Lower Differential-Linear Connectivity Table (LDLCT)).**

For a vectorial Boolean function $S: \mathbb{F}_2^n \to \mathbb{F}_2^m$, the LDLCT of $S$ is a $2^n \times 2^n \times 2^m$ table. The entry at index $(\Delta_i, \lambda_i, \lambda_o)$ is (see Figure 2c)

$$ \mathrm{LDLCT}(\Delta_i, \lambda_i, \lambda_o) = |\mathrm{LDLCT}_0(\Delta_i, \lambda_i, \lambda_o)| - |\mathrm{LDLCT}_1(\Delta_i, \lambda_i, \lambda_o)|, $$

where $\mathrm{LDLCT}_b(\Delta_i, \lambda_i, \lambda_o) = \{x \in \mathbb{F}_2^n : \lambda_i \cdot \Delta_i \oplus \lambda_o \cdot S(x) \oplus \lambda_o \cdot S(x \oplus \Delta_i) = b\}$.

Finally, we define the table corresponding to the case where all inputs and outputs are specified.

**Definition 9 (Extended Differential-Linear Connectivity Table (EDLCT)).**

For a vectorial Boolean function $S: \mathbb{F}_2^n \to \mathbb{F}_2^m$, the EDLCT of $S$ is a $2^n \times 2^n \times 2^m \times 2^m$ table. The entry at index $(\Delta_i, \Delta_o, \lambda_i, \lambda_o)$ is (see Figure 2d)

$$ \mathrm{EDLCT}(\Delta_i, \Delta_o, \lambda_i, \lambda_o) = |\mathrm{EDLCT}_0(\Delta_i, \Delta_o, \lambda_i, \lambda_o)| - |\mathrm{EDLCT}_1(\Delta_i, \Delta_o, \lambda_i, \lambda_o)|, $$

where $\mathrm{EDLCT}_b(\Delta_i, \Delta_o, \lambda_i, \lambda_o) = \{x \in \mathbb{F}_2^n : S(x) \oplus S(x \oplus \Delta_i) = \Delta_o \text{ and } \lambda_i \cdot \Delta_i \oplus \lambda_o \cdot \Delta_o = b\}$.

**3.1 Table Properties**

Here, we explore the relationship between the introduced tables, both among themselves and with the DDT and LAT tables.

**Proposition 1.** The generalized DLCT tables satisfy the following properties:

1. $\mathrm{DLCT}(0, \lambda_o) = \mathrm{DLCT}(\Delta_i, 0) = 2^n, \forall \Delta_i, \lambda_o$

2. $\mathrm{DLCT}(\Delta_i, \lambda_o) = \sum_{\Delta_o} \mathrm{UDLCT}(\Delta_i, \Delta_o, \lambda_o)$

3. $\mathrm{UDLCT}(\Delta_i, \Delta_o, \lambda_o) = (-1)^{\lambda_o \cdot \Delta_o} \mathrm{DDT}(\Delta_i, \Delta_o)$

4. $\mathrm{LDLCT}(\Delta_i, \lambda_i, \lambda_o) = (-1)^{\lambda_i \cdot \Delta_i} \mathrm{DLCT}(\Delta_i, \lambda_o)$

5. $\mathrm{EDLCT}(\Delta_i, \Delta_o, \lambda_i, \lambda_o) = (-1)^{\lambda_i \cdot \Delta_i \oplus \lambda_o \cdot \Delta_o} \mathrm{DDT}(\Delta_i, \Delta_o)$

6. $\mathrm{LDLCT}(\Delta_i, \lambda_i, \lambda_o) = \sum_{\Delta_o} \mathrm{EDLCT}(\Delta_i, \Delta_o, \lambda_i, \lambda_o)$

7. $\sum_{\Delta_i} \mathrm{LDLCT}(\Delta_i, \lambda_i, \lambda_o) = \mathrm{LAT}^2(\lambda_i, \lambda_o)$

*Proof.* The last property is the only non-trivial one to prove. Let $\lambda_i$ and $\lambda_o$ be two masks, and let $A_b^\Delta$ be the set $\{x \in \mathbb{F}_2^n : \lambda_i \cdot (x \oplus \Delta) \oplus \lambda_o \cdot S(x \oplus \Delta) = b\}$.
We then observe the following equalities:

$$
\begin{align*}
\sum_{\Delta_i} \mathrm{LDLCT}(\Delta_i, \lambda_i, \lambda_o) &= \sum_{\Delta_i} |A_0^0 \cap A_0^{\Delta_i}| + |A_1^0 \cap A_1^{\Delta_i}| - |A_0^0 \cap A_1^{\Delta_i}| - |A_1^0 \cap A_0^{\Delta_i}| \\
&= \sum_{\Delta_i} \sum_{x \in A_0^0} |\{x\} \cap A_0^{\Delta_i}| - |\{x\} \cap A_1^{\Delta_i}| \\
&\quad + \sum_{\Delta_i} \sum_{x \in A_1^0} |\{x\} \cap A_1^{\Delta_i}| - |\{x\} \cap A_0^{\Delta_i}| \\
&= \sum_{x \in A_0^0} \sum_{\Delta_i \oplus x} |\{x\} \cap A_0^{\Delta_i \oplus x}| - |\{x\} \cap A_1^{\Delta_i \oplus x}| \\
&\quad + \sum_{x \in A_1^0} \sum_{\Delta_i \oplus x} |\{x\} \cap A_1^{\Delta_i \oplus x}| - |\{x\} \cap A_0^{\Delta_i \oplus x}| \\
&= \sum_{x \in A_0^0} \left( \sum_{\Delta_i \in A_0^0} 1 - \sum_{\Delta_i \in A_1^0} 1 \right) + \sum_{x \in A_1^0} \left( \sum_{\Delta_i \in A_0^0} 1 - \sum_{\Delta_i \in A_0^0} 1 \right) \\
&= |A_0^0|^2 - 2|A_0^0||A_1^0| + |A_1^0| = (|A_0^0| - |A_1^0|)^2 = \mathrm{LAT}^2(\lambda_i, \lambda_o)
\end{align*}
$$

As observed, the new DLCT tables differ entirely from their counterparts in the BCT framework for boomerang analysis. In fact, each of them is equivalent, differing only in sign and a scalar factor, to either the DDT or the DLCT.

In many cases, there are two consecutive active S-boxes in the middle part of the DL distinguishers (also referred to as *DL switch*), potentially accompanied by key additions and linear layers in between. To efficiently address this scenario, we introduce the DDLCT table, favoring memory usage over time to effectively reduce the overall time complexity of evaluating DL distinguisher correlations.

**Definition 10 (Double Differential-Linear Connectivity Table (DDLCT)).**
For a vectorial Boolean function $S: \mathbb{F}_2^n \to \mathbb{F}_2^m$, the DDLCT of $S$ is a $2^n \times 2^m$ table such that the entry at index $(\Delta_i, \lambda_o)$ is (see Figure 2e)

$$ \mathrm{DDLCT}(\Delta_i, \lambda_o) = 2^{-n} \sum_{\Delta_m} \sum_{\lambda_m} \mathrm{UDLCT}(\Delta_i, \Delta_m, \lambda_m) \cdot \mathrm{LDLCT}(\Delta_m, \lambda_m, \lambda_o) \quad (3) $$

**Proposition 2.** The DDLCT table satisfies the following properties:

$$
\begin{align*}
\mathrm{DDLCT}(\Delta_i, \lambda_o) &= \sum_{\Delta_m} \mathrm{DDT}(\Delta_i, \Delta_m) \cdot \mathrm{DLCT}(\Delta_m, \lambda_o) \\
&= 2^{-n} \sum_{\lambda_m} \mathrm{DLCT}(\Delta_i, \lambda_m) \cdot \mathrm{LAT}^2(\lambda_m, \lambda_o).
\end{align*}
$$

*Proof.* The goal is to prove the equalities:

$$ \mathrm{DDLCT}(\Delta_i, \lambda_o) = 2^{-n} \sum_{\lambda_m} \mathrm{DLCT}(\Delta_i, \lambda_m) \cdot \mathrm{LAT}^2(\lambda_m, \lambda_o) = \sum_{\Delta_m} \mathrm{DDT}(\Delta_i, \Delta_m) \cdot \mathrm{DLCT}(\Delta_m, \lambda_o). $$
This is done by relying on the 7 equalities given in Proposition 1 and at each step we will indicate which equality is use. We first rewrite LAT² using the LDLCT (7) and we obtain:

$$ \sum_{\lambda_m} \mathrm{DLCT}(\Delta_i, \lambda_m) \cdot \mathrm{LAT}^2(\lambda_m, \lambda_o) = \sum_{\lambda_m, \Delta'_m} \mathrm{DLCT}(\Delta_i, \lambda_m) \cdot \mathrm{LDLCT}(\Delta'_m, \lambda_m, \lambda_o). $$

Now we rewrite the DLCT using the UDLCT (2) to get:

$$ \sum_{\lambda_m, \Delta'_m, \Delta_m} \mathrm{UDLCT}(\Delta_i, \Delta_m, \lambda_m) \cdot \mathrm{LDLCT}(\Delta'_m, \lambda_m, \lambda_o). $$

We then simplify both the UDLCT and the LDLCT by using equalities 3 and 4:

$$ \sum_{\lambda_m, \Delta'_m, \Delta_m} (-1)^{\lambda_m \cdot (\Delta_m \oplus \Delta'_m)} \mathrm{DDT}(\Delta_i, \Delta_m) \cdot \mathrm{DLCT}(\Delta'_m, \lambda_o). $$

This sum can be rewritten as:

$$ \sum_{\Delta'_m, \Delta_m} \mathrm{DDT}(\Delta_i, \Delta_m) \cdot \mathrm{DLCT}(\Delta'_m, \lambda_o) \sum_{\lambda_m} (-1)^{\lambda_m \cdot (\Delta_m \oplus \Delta'_m)}, $$

and thus, by evaluating the nested sum we finally reach:

$$ \sum_{\Delta'_m, \Delta_m} \mathrm{DDT}(\Delta_i, \Delta_m) \cdot \mathrm{DLCT}(\Delta'_m, \lambda_o) \cdot 2^n \cdot \mathbb{1}_{\Delta_m = \Delta'_m}. $$

At this point we have obtained that the sum over $\Delta_m$ and $\Delta'_m$ can be reduced to a sum over $\Delta_m = \Delta'_m$, achieving the proof.

It is worth noting that our formulation for DDLCT aligns with Theorem 2 in [13], which addresses computing the correlation of DL distinguishers.

We emphasize that the DDLCT relies on the assumptions of round independence and round-key independence. Nevertheless, it significantly reduces the time complexity in evaluating correlations. Additionally, it can be employed to analyze the behavior of S-boxes against DL attacks. One can extend this approach by defining the Triple DLCT or t-DLCT to precompute correlations for different portions of the distinguisher.

**Definition 11 (t-DLCT).** For a vectorial Boolean function $S: \mathbb{F}_2^n \to \mathbb{F}_2^m$, the t-DLCT of $S$ is a $2^n \times 2^m$ table such that the entry at index $(\Delta_i, \lambda_o)$ is

$$ t\text{-DLCT}(\Delta_i, \lambda_o) = \sum_{\Delta_m} \mathrm{DDT}(\Delta_i, \Delta_m) \cdot (t-1)\text{-DLCT}(\Delta_m, \lambda_o). \quad (4) $$

**Definition 12.** Let $\Delta_i, \Delta_o, \lambda_i, \lambda_o \in \mathbb{F}_2^n$. We define the following quantities:

$$ \mathbb{P}_{\mathrm{DDT}}(\Delta_i, \Delta_o) = \mathrm{DDT}(\Delta_i, \Delta_o)/2^n \qquad \mathbb{C}_{\mathrm{LAT}}(\lambda_i, \lambda_o) = \mathrm{LAT}(\lambda_i, \lambda_o)/2^n $$

$$ \mathbb{C}_{\mathrm{UDLCT}}(\Delta_i, \Delta_o, \lambda_o) = \mathrm{UDLCT}(\Delta_i, \Delta_o, \lambda_o)/2^n \qquad \mathbb{C}_{\mathrm{DLCT}}(\Delta_i, \lambda_o) = \mathrm{DLCT}(\Delta_i, \lambda_o)/2^n $$

$$ \mathbb{C}_{\mathrm{LDLCT}}(\Delta_i, \lambda_i, \lambda_o) = \mathrm{LDLCT}(\Delta_i, \lambda_i, \lambda_o)/2^{2n} \qquad \mathbb{C}_{\mathrm{DDLCT}}(\Delta_i, \lambda_o) = \mathrm{DDLCT}(\Delta_i, \lambda_o)/2^{2n} $$

$$ \mathbb{C}_{\mathrm{EDLCT}}(\Delta_i, \Delta_o, \lambda_i, \lambda_o) = \mathrm{EDLCT}(\Delta_i, \Delta_o, \lambda_i, \lambda_o)/2^{2n} \qquad \mathbb{C}_{t\text{-DLCT}}(\Delta_i, \lambda_o) = t\text{-DLCT}(\Delta_i, \lambda_o)/2^{t\cdot n} $$
## 3.2 Practical Examples with the Generalized DLCT Framework

Now that we have defined all the tables related to DL distinguishers, let us explore some practical examples demonstrating how we can use these tables to accurately formulate the correlation of a DL distinguisher.

*Example 1.* We start by studying a simple example on 3-round AES as shown in Figure 3. The internal differences/masks have been replaced by variables to be as precise as possible regarding potential clusters.

<figure><img src="image_4.png" /><figcaption>Fig. 3: DL distinguisher for 3-round AES in the single-key model. The upper trail represents the differential trail while the lower one represents the linear trail. White, blue/red, and gray colors indicate respectively that the difference/mask on the byte is null, fixed, and unknown.</figcaption></figure>

The correlation of this DL distinguisher can be computed as follows:

$$C(\Delta_i, \lambda_o) = \sum_{\alpha, \beta, \gamma, \delta} C_{UDLCT}(\Delta_i, \alpha, \delta) \cdot C_{EDLCT}(\alpha, \beta, \delta, \gamma) \cdot C_{LDLCT}(\beta, \gamma, \lambda_o)$$

The terms of this formula are obtained by looking at each S-box cell through the encryption, exactly as for boomerang distinguishers. For instance, the term $C_{UDLCT}(\Delta_i, \alpha, \delta)$ comes from the red cell in the first round since both the input and output of the differential transition and the output mask are set.

According to Proposition 1, all extended tables can be expressed using only DDT, LAT and DLCT. Thus the above formula can be rewritten as:

$$C(\Delta_i, \lambda_o) = 2^{-5n} \sum_{\alpha, \beta} \mathrm{DDT}(\Delta_i, \alpha) \cdot \mathrm{DDT}(\alpha, \beta) \cdot \mathrm{DLCT}(\beta, \lambda_o) \sum_{\gamma, \delta} (-1)^{\alpha \cdot \delta \oplus \alpha \cdot \delta \oplus \beta \cdot \gamma \oplus \beta \cdot \gamma}$$

The nested sum equals $2^{2n}$, so the formula for the correlation is reduced to

$$C(\Delta_i, \lambda_o) = 2^{-3n} \sum_{\alpha, \beta} \mathrm{DDT}(\Delta_i, \alpha) \cdot \mathrm{DDT}(\alpha, \beta) \cdot \mathrm{DLCT}(\beta, \lambda_o). \quad (5)$$

According to Equation 5, we observe the maximum (absolute) correlation of $2^{-7.66}$ when $(\Delta_i, \lambda_o) = (0xb4, 0x67)$. Table 2 compares the theoretical value
obtained from Equation 5 with the experimental results, confirming the high accuracy of the formula. Using Equation 5, we computed the correlation for all possible input/output differences/masks. Figure 8 visualizes the correlation matrix for our 3-round distinguisher for AES. An interesting observation is that for all $(\Delta_i, \lambda_o)$ where $\Delta_i$, and $\lambda_o$ are nonzero, we have $C(\Delta_i, \lambda_o) < 0$, indicating that the sign of the correlation remains unchanged.

<table><caption>Table 2: Theoretical vs. experimental results for the distinguisher in Figure 3.</caption><thead><tr><th>Input/Output Differences/Linear-mask</th><th>Equation 5</th><th>Exp. Correlation</th></tr></thead><tbody><tr><td>($\Delta_i, \lambda_o$) = (0xb4, 0x67)</td><td>$-2^{-7.66}$</td><td>$-2^{-7.64}$</td></tr><tr><td>($\Delta_i, \lambda_o$) = (0x02, 0x02)</td><td>$-2^{-7.92}$</td><td>$-2^{-7.93}$</td></tr><tr><td>($\Delta_i, \lambda_o$) = (0x55, 0x55)</td><td>$-2^{-7.99}$</td><td>$-2^{-7.98}$</td></tr><tr><td>($\Delta_i, \lambda_o$) = (0xbf, 0xef)</td><td>$-2^{-8.05}$</td><td>$-2^{-8.06}$</td></tr><tr><td>($\Delta_i, \lambda_o$) = (0xe6, 0x06)</td><td>$-2^{-8.26}$</td><td>$-2^{-8.25}$</td></tr><tr><td>($\Delta_i, \lambda_o$) = (0x4b, 0x1a)</td><td>$-2^{-8.43}$</td><td>$-2^{-8.44}$</td></tr></tbody></table>

*Example 2.* Figure 4 displays the 9-round middle part of a DL distinguisher for 13 rounds of TWINE, as depicted in Figure 64. In this distinguisher, we can divide the commonly active S-boxes into two groups of three consecutive S-boxes along with several key additions and linear layers in between. We highlight the two identified groups in ■ and ■ within Figure 4d. Each group of active S-boxes contributes a correlation value of $C$, as defined in Equation 6, to the total correlation:

$$C(\Delta_i, \lambda_o) = \sum_{\Delta_m} \mathbb{P}_{\text{DDT}}(\Delta_i, \Delta_m) \cdot C_{\text{DDLCT}}(\Delta_m, \lambda_o) = \sum_{\lambda_m} C_{\text{DDLCT}}(\Delta_i, \lambda_m) \cdot C_{\text{LAT}}^2(\lambda_m, \lambda_o). \quad (6)$$

The two groups of commonly activated S-boxes, highlighted in ■ and ■, are independent. Therefore, the total correlation is $C_t = C^2$.

Table 3 provides a comparison between experimental and theoretical results for the correlation of the DL distinguisher depicted in Figure 4d. As demonstrated in Table 3, the outcomes derived from Equation 6 closely align with the experimental findings. Expressing the correlation is simpler using just one 3-DLCT: $C_t(\Delta_i, \lambda_o) = C_{3-DLCT}^2(\Delta_i, \lambda_o)$. Table 39 represents the 3-DLCT of TWINE's S-box, demonstrating that $(\Delta_i, \lambda_o) \in \{(4, 5), (5, a)\}$ yields the maximum correlation for the DL distinguisher.

### 3.3 Cell-wise Switches and Bit-wise Switches

The examples in Section 3.2 convey some key points. If an S-box is active in both differential and linear trails, referred to as *common* active S-box, it contributes to the correlation by a specific generalized DLCT table. However, if an S-box is
<figure><img src="image_5.png" /><figcaption>Fig. 4: Application of *t*-DLCT to formulate the correlation of DL distinguishers.</figcaption></figure>

active in at most one of the differential or linear trails, it does not contribute to
the correlation of the distinguisher, allowing us to freely bypass it. We term
these activeness patterns *ladder switches* or *cell-wise switches*. The cell-wise
switches can also be explained by the maximal entries in the first row and the first
column of all generalized *DLCT* tables. Moreover, the *DLCT* of many S-boxes also
<table><caption>Table 3: Theoretical vs. experimental results for the distinguisher in Figure 4d.</caption><thead><tr><th>Input/Output Differences/Linear-mask</th><th>Equation 6</th><th>Exp. Correlation</th></tr></thead><tbody><tr><td>(Δ<sub>i</sub>, λ<sub>o</sub>) = (4, 5)</td><td>2<sup>-5.83</sup></td><td>2<sup>-5.80</sup></td></tr><tr><td>(Δ<sub>i</sub>, λ<sub>o</sub>) = (a, a)</td><td>2<sup>-6.39</sup></td><td>2<sup>-6.39</sup></td></tr><tr><td>(Δ<sub>i</sub>, λ<sub>o</sub>) = (f, c)</td><td>2<sup>-7.36</sup></td><td>2<sup>-7.31</sup></td></tr><tr><td>(Δ<sub>i</sub>, λ<sub>o</sub>) = (e, 9)</td><td>2<sup>-8.39</sup></td><td>2<sup>-8.39</sup></td></tr><tr><td>(Δ<sub>i</sub>, λ<sub>o</sub>) = (d, a)</td><td>2<sup>-10.00</sup></td><td>2<sup>-9.98</sup></td></tr><tr><td>(Δ<sub>i</sub>, λ<sub>o</sub>) = (f, 1)</td><td>0</td><td>0</td></tr></tbody></table>

have maximal entries ($2^n$) in the middle rows/columns. For example, referring to Table 30, we can see that if $(Δ_i, λ_o) = (2, 2)$, then $C_{DLCT}(Δ_i, λ_o) = 1$. We refer to these bit-wise differential-linear transitions with correlation 1 as *bit-wise switches*. It is worth noting that according to Proposition 16 in [17], any Boolean component of degree 2 leads to such bit-wise switches.

The correlation of a DL distinguisher depends on three main factors: the probability of the differential transition over $E_u$ (denoted by $p$), the correlation over the middle part $E_m$ (denoted by $r$), and the squared correlation of the linear approximation over $E_ℓ$ (denoted by $q^2$). We already know that $p$ and $q^2$ are determined by the number of differentially and linearly active S-boxes through $E_u$ and $E_ℓ$, respectively. Nevertheless, $r$ depends on the number of common active S-boxes between the differential and linear trails over $E_m$. As a result, minimizing the number of differentially (rep. linearly) active S-boxes through $E_u$ (resp. $E_ℓ$) while maximizing the cell-wise/bit-wise switches over $E_m$ can yield a better distinguisher. Therefore, finding a good DL distinguisher is a non-trivial combinatorial optimization problem. CP/MILP-based methods have been shown to effectively solve optimization problems stemming from symmetric-key crypt-analysis. With a systematic CP/MILP-based method, we can take advantage of cell-wise/bit-wise switches during the search for DL distinguishers. If the middle part ($E_m$) includes only one S-box layer, the DLCT captures all the switches, and one can model all valid transitions through DLCT by CP/MILP constraints as done in [40]. However, what if the middle part includes much more than one round, e.g., 10 rounds? Section 4 addresses this research gap.

## 4 CP/MILP Model to Search for DL Distinguishers

Here, we describe how to model the problem of finding differential-linear distinguishers as a CP/MILP problem. We present two approaches: the *cell-wise* and *bit-wise* models. Our cell-wise model treats the S-boxes as black-boxes and only takes advantage of cell-wise switches. The cell-wise model offers simplicity in creation as well as solving, and as we will show, it performs very well for strongly aligned ciphers such as AES, SKINNY, CLEFIA, WARP, and TWINE. On the other hand, our bit-wise model takes advantage of the internal structure
of S-boxes (generally non-linear operations) and is suitable for weakly aligned
primitives like Ascon, SERPENT, KNOT, and Simeck.

4.1 Decomposing the Distinguisher

Before proposing our CP/MILP-based methods for exploring DL distinguishers, we would like to discuss how to decompose the DL distinguishers. In Section 3, we demonstrated that the correlation $r$ of the middle part of a DL distinguisher is essentially the sum of products of fractional values proportional to the generalized DLCT tables of common active S-boxes. As a result, an increase in common active S-boxes (more generally, non-linear operations) in the middle part results in more tables in the formula, thereby complicating the correlation evaluation. The computational complexity of evaluating the correlation $r$ of the middle part is approximately $r^{-2}$, which is exponential in the number of common active S-boxes or generally common active non-linear operations. Therefore, regardless of the approach to computing the correlation of the middle part, the number of common active S-boxes exponentially increases the computational complexity of evaluating the correlation of the middle part, whether we use experimental or theoretical approaches for computation.

The number of common active S-boxes (bits) in the middle part depends on the diffusion effect of the linear layer (and also the diffusion effect of the S-box in the bit-level) and the density of the differential and linear trails within the boundaries of $E_m$. For example, the more differentially (resp. linearly) active bits at the input of $E_m$, the sooner the differences (resp. linear masks) propagate to the entire state. On the other hand, the accuracy of correlation estimation based on $prq^2$ highly depends on the length of the middle part of $r_m$ rounds. If we set $r_m$ to be too short, then we are considering the dependency in only a few rounds, ignoring many potential cell-wise switches, and also some harmful dependencies between the two parts that can spoil the distinguisher.

Therefore, when decomposing the DL distinguishers, we should make a trade-
off between the quality of the distinguisher and the computational complexity
of evaluating the correlation of the middle part. The middle part should be
long enough for the dependency between the two parts almost to disappear. On
the other hand, it should be short enough to evaluate the correlation of the
middle part efficiently. As a result, a reasonable starting point for the length
of the middle part is the length of full diffusion of the corresponding primitive
in terms of differential and linear trails. Then, we can prepend/append some
rounds before/after $E_m$ to obtain $E_u$ and $E_\ell$.

After deriving the distinguisher, we can also conduct experiments on a re-
duced number of rounds to enhance the confidence in the accuracy of correlation
estimation. To this end, we can extend $E_m$ by a few rounds before and after and
check if the $prq^2$ formula gives a reasonable estimate for the correlation of the
extended $E_m$. If we have chosen the length of the middle part properly, the cor-
relation of the extended $E_m$ derived by the $prq^2$ formula should be close to the
actual value derived by experiments; otherwise, we should increase the length of
the middle part and repeat the process.
## 4.2 Cell-Wise Modeling for Distinguishers

We first explain our cell-wise model because it is more straightforward and intuitive. In this model, we consider the S-boxes as black-boxes and set up the truncated differential and linear trails as constraints. We use the term cell-wise because we focus on how the differential and linear trails propagate at the cell level. A cell is active if its difference or linear mask is nonzero; otherwise, it is inactive. Our cell-wise model has three main parts:

- A truncated CP/MILP model for finding truncated differential-linear trails.

- A bit-wise CP/MILP model to instantiate the discovered truncated trail and compute $p$ and $q^2$.

- A module to compute $r$ using the DLCT framework or experimental approach. Lastly, we estimate the total correlation using the $prq^2$ formula.

We implement these three modules in a unified tool that receives three integer numbers $r_u, r_m, r_\ell$, as an input and outputs the distinguisher together with an estimated correlation. The round numbers $r_u, r_m$, and $r_\ell$ determine the decomposition of the distinguisher, i.e., the length of $E_u, E_m$, and $E_\ell$, respectively.

The most critical step is finding good truncated differential-linear trails (first part), as it determines the position of differentially/linearly active bits, and the second and third modules should align with the activation pattern of the first module's output. In addition, the CP/MILP models to find ordinary differential/linear trails have already been studied in the literature [1,35,53]. So, in what follows, we mainly focus on the first module.

First, we give an overall view of our approach. As illustrated in Figure 5, we decompose the distinguisher into three parts: $E_u, E_m$, and $E_\ell$, with the lengths of $r_u, r_m$, and $r_\ell$, respectively. Let $p$ be the probability of the differential transition over $E_u, r$ be the correlation of the middle part, and $q^2$ be the squared correlation of the linear approximation for $E_\ell$. Based on Section 4.1, as long as the length of $E_m$ is long enough and $\Delta_m, \lambda_m$ are well-chosen, $prq^2$ gives a reasonable estimate for the correlation of the distinguisher. Hence, we aim to create a CP/MILP model to find a truncated differential-linear trail that maximizes the value of $prq^2$. We know that $p$ and $q$ depend on the number of differentially/linearly active S-boxes in $E_u$ and $E_\ell$, respectively. The middle $r$ is the sum of products of fractional values, with each fractional value corresponding to a specific generalized DLCT table, associated with the involved S-boxes through $E_m$. Due to the cell-wise switches, we expect a higher value for $r$ if the number of common active S-boxes in $E_m$ is minimized. Consequently, we create a unified CP model to find a truncated differential-linear trail such that the total number of differentially (resp. linearly) active S-boxes in $E_u$ (resp. $E_\ell$) as well as common active S-boxes in $E_m$ is minimized. To count the number of common active S-boxes in $E_m$ (considering cell-wise switches), we employ the idea of cell-wise deterministic differential and linear propagation. More precisely, while we propagate truncated differential/linear trails through $E_u/E_\ell$ as usual, we switch to deterministic propagation of differential/linear trails in the level of
<figure><img src="image_6.png" /><figcaption>Fig. 5: Overall view of our CP/MILP model for finding DL distinguishers.</figcaption></figure>

cells through $E_m$ and identify which cells are only active in at most one of the
trails.

Now, we explain the details of our cell-wise model. As discussed in Section 4.1,
we typically set the length of the middle part to the size of the full diffusion of the
primitive. Next, as Figure 5 visualizes, we model the propagation of the truncated
differential (resp. linear) trails through the $E_m \circ E_u$ (resp. $E_\ell \circ E_m$) forward (resp.
backward). Let $n = m \cdot c$ be the block size of $E$, where $c$ represents the cell size
and $m$ is the number of cells in each state. We define the binary variables $XU_t[i]$
 UNIT: [0,1]
(resp. $XL_t[i]$) to represent the activeness pattern in the $i$th cell of the internal
state in round $t$ of $E_u$ (resp. $E_\ell$) for differential (resp. linear) propagation. We
also define the binary variables $XMU_t[i]$ (resp. $XML_t[i]$) to represent the activeness
pattern of the internal state in round $t$ of $E_m$ in the differential (resp. linear)
propagation.

Let CSP<sub>u</sub> (XU<sub>0</sub>, ..., XU<sub>r<sub>u</sub></sub>) represent the CSP model for the differential prop-
agation over E<sub>u</sub>, and CSP<sub>ℓ</sub> (XL<sub>0</sub>, ..., XL<sub>r<sub>ℓ</sub></sub>) denote the CSP model for the linear
propagation over E<sub>ℓ</sub>. Similarly, let CSP<sub>mu</sub> (XMU<sub>0</sub>, ..., XMU<sub>r<sub>mu</sub></sub>) be the CSP model
for the differential propagation over E<sub>m</sub>, and CSP<sub>mℓ</sub> (XML<sub>0</sub>, ..., XML<sub>r<sub>m</sub></sub>) represent
the CSP model for the linear propagation over E<sub>m</sub><sup>-1</sup>. While CSP<sub>u</sub>, and CSP<sub>ℓ</sub> en-
code the propagation of truncated trails over E<sub>u</sub> and E<sub>ℓ</sub> as usual, CSP<sub>mu</sub> and
CSP<sub>mℓ</sub> encode the propagation over E<sub>m</sub> in a deterministic manner. Determin-
istic means that the model does not allow cancellation through the diffusion
layers, though it can happen with a certain probability. The main reason for
this choice is that almost all common active S-boxes in the middle affect the
correlation for the middle part. If we let the cancellation happen in the middle
part, we are essentially ignoring the effect of some potentially active S-boxes in
the middle part this would lead to many false positive solutions, i.e., solutions
in which the number of common active S-boxes in the middle is essentially much
higher in practice, but we have underestimated it. So, to avoid underestimating
the number of common active S-boxes in the middle part, we use deterministic propagation over $E_m$. This way, we can ensure that the number of actually effective S-boxes in the middle part is as high as the number of common active S-boxes in the solution.

Next, we merge the CSP models CSP_u, CSP_ℓ, CSP_mu, and CSP_mℓ to form a unified CSP model CSP_d for the truncated differential-linear distinguisher. Additionally, we include constraints $\sum_{i=0}^{m} XU_0[i] \neq 0$ and $\sum_{i=0}^{m} XL_{r_\ell}[i] \neq 0$ to exclude trivial solutions. In our CP model, $XU_{r_u}$ and $XMU_0$ correspond to the same internal state at the junction of $E_u$ and $E_m$, and similarly for $XL_0$ and $XML_{r_m}$. Therefore, we enforce constraints $XU_{r_u}[i] = XMU_0[i]$ and $XL_0[i] = XML_{r_m}[i]$ for all $i$. Finally, using constant integer weights $w_u, w_m$, and $w_\ell$, we incorporate the following objective function to build a unified optimization problem COP_d:

$$ \sum_{t=0}^{r_u} w_u \cdot XU_t[i] + \sum_{t=0}^{r_d} w_m \cdot \mathit{bool2int}(XMU_t[i] + XML_t[i] = 2) + \sum_{t=0}^{r_\ell} w_\ell \cdot XL_t[i]. \quad (7) $$

The integer weights $w_u, w_m$, and $w_\ell$ should be proportional to the differential uniformity (DU), differential-linear uniformity (DLU), and squared linearity ($L^2$) of the S-box, respectively. For example, in the case of WARP, we have $DU = 2^2, L = 2^3$ and $DLU = 2^4$, or equivalently, $\mathbb{P}_{DDT} \le 2^{-2}, \mathbb{C}_{LAT}^2 \le 2^{-2}$, and $\mathbb{C}_{DLCT} \le 1$. In addition, in our CP/MILP models, we work with the absolute logarithm of probability transitions or squared correlation, i.e., $|\log_2(\mathbb{P}_{DDT})|, |\log_2(\mathbb{C}_{LAT})|$, and $|\log_2(\mathbb{C}_{DLCT})|$. Therefore, the cost of each active S-box in $E_u$ and $E_\ell$ is approximately twice as much as an active S-box in $E_m$. As a result, (2, 1, 2) is a reasonable choice for $(w_u, w_m, w_\ell)$ for WARP. For ciphers that employ different S-boxes with different DU, L, and DLU in the design, e.g., CLEFIA, we can use different appropriate weights for each S-box in the CP model.

After finding a solution for COP_d, we find concrete differential (resp. linear) trails for $E_u$ (resp. $E_\ell$) that satisfy the activeness pattern of the solution for COP_d. To this end, we generate bit-wise CP/MILP models for differential (resp. linear) trails over $E_u$ (resp. $E_\ell$) and set all inactive bits to zero. After solving the bit-wise models and deriving concrete differential (resp. linear) trails for $E_u$ (resp. $E_\ell$), we only fix the differences (resp. linear masks) at the input and output of $E_u$, and $E_\ell$, i.e., $\Delta_i, \Delta_m, \lambda_m, \lambda_o$ in Figure 5. Then we compute $p$ and $q^2$, where we consider the clustering effect for computing $p$. Lastly, we compute $r$ using the generalized DLCT framework or experimental approach and use the $prq^2$ formula to estimate the total correlation of the distinguisher. We applied our cell-wise model to AES, SKINNY, CLEFIA, WARP, LBlock, LBlock-s and TWINE and found new DL distinguishers for these ciphers. In what follows, we briefly discuss the discoveries based on our cell-wise model.

**Application to AES** We applied our method to search for DL distinguishers of AES in the single-key setting. Refer to Section C for a brief specification of AES. Given that AES achieves full diffusion within cells after 2 rounds, we set the length of the middle part ($E_m$) in our searches to 3. This choice sufficiently captures the effect of the middle part while also modeling the dependency between
differential and linear trails. Table 5 summarizes the results of our searches for
AES with 2 to 5 rounds. When running our tool for 3 to 5 rounds of AES, due to
the symmetry of AES design, it discovered nearly identical activeness patterns
for the middle part of our distinguishers, with 3 common active S-boxes. Addi-
tionally, the correlation of the 3-round middle part of our DL distinguishers for
AES can be accurately evaluated using Equation 5. Evaluating Equation 5 for all
possible input/output differences and masks reveals that the absolute correla-
tion of the middle part ranges from 2⁻⁸.⁴³ to 2⁻⁷.⁶⁶ (as shown in Figure 8). This
observation confirms that for strongly aligned ciphers such as AES, the choice
of the optimal cell-wise pattern for the distinguisher has a greater impact on its
correlation than selecting the actual values for the active input/output cells of
the middle part. Referring to the previous literature on DL distinguishers for
AES, there are only two results thus far, exclusively in the related-key setting
and limited to (up to 5 rounds) AES-192 [52, 60]. Therefore, we are the first to
find DL distinguishers for up to 5 rounds of (all versions of) AES in the single-key
setting.

**Application to CLEFIA** As one of the most important Feistel ciphers, we applied our tool to the ISO standard (ISO/IEC 29192-2) block cipher CLEFIA. Section L provides a brief specification of CLEFIA. The full diffusion of CLEFIA at the byte level is 5. So, we set the length of the middle part to 5 in our searches. Table 34 summarizes the results for CLEFIA. The most interesting property of CLEFIA is the Diffusion Switching Mechanism (DSM) [50, 51]. Thanks to this mechanism, the number of differentially/linearly active S-boxes of CLEFIA is 40% higher than an ordinary Generalized Feistel Structure (GFS) without DSM. The diffusion switching mechanism of CLEFIA comes into effect for more than 3 (resp. 7) rounds in the linear (resp. differential) analysis. So, one may expect a much higher resistance against DL distinguishers for CLEFIA compared to boomerang distinguishers. Due to this feature, and also considering that there is no previous result on DL distinguishers for CLEFIA, comparing our DL distinguishers to boomerang distinguishers of CLEFIA is of great interest. To date, the best boomerang distinguishers proposed for CLEFIA cover up to 9 rounds [33]. As can be seen in Table 34, our DL distinguishers also reach up to 9 rounds. However, for up to 8 rounds of CLEFIA, our DL distinguishers significantly surpass the best boomerang distinguishers. For example, whereas the data complexity of the best boomerang distinguisher for 7 (resp. 8) rounds of CLEFIA is 2³².⁶⁷ (resp. 2⁷⁶.⁰³), the data complexity of our 7-round (resp. 8-round) DL distinguisher is 2²³.⁵⁰ (resp. 2⁶⁶.⁸⁶).

**Application to SKINNY** As an application from lightweight tweakable block ciphers, we targeted SKINNY in both single-tweakey and related-tweakey settings. Section F briefly describes the SKINNY family of block ciphers. The full diffusion of SKINNY on the word-level is 6 rounds. So we set the length of the middle part to 6 or more in our searches. Table 8 summarizes our results for SKINNY in the single-key setting. Notably, we achieved an 11-round DL distin-
guisher, matching the effectiveness of the best-known single-key distinguishers of SKINNY in terms of the number of rounds. We also achieved interesting results for the related-tweakey setting (refer to Table 9, Table 10). The most potent combined distinguishers on SKINNY in the related-tweakey setting are the boomerang distinguisher [30]. However, its efficacy comes at the cost of requiring a minimum of four related tweakeys. Among the related-tweakey distinguishers of SKINNY with only two related tweakeys, the impossible-differential distinguishers are the longest ones which cover up to 14 rounds (resp. 16 rounds) of SKINNY-$n-2n$ (resp. SKINNY-$n-3n$) [34]. However, our related-tweakey DL distinguisher covers one round more, reaching 15 rounds of SKINNY-$n-2n$, and 17 rounds of SKINNY-$n-3n$.

**Application to WARP** Here we propose DL distinguishers for WARP for the first time. Section K briefly describes the lightweight block cipher WARP. According to the designers of WARP [2], the nibble-wise full diffusion of WARP is achieved after 10 rounds. So, we set the length of the middle part to 10 or 11 in our searches. Although the designers of WARP claimed nibble-wise full diffusion after 10 rounds, we discovered a deterministic DL distinguisher for 11 rounds of WARP that is noteworthy. This observation arises not only from the diffusion layer but also from the differential-linear behavior of WARP's S-box. Table 30 illustrates the DLCT of WARP's S-box. As shown, the differential-linear uniformity of WARP's S-box is 16 ($\mathcal{DLU}_{WARP} = 16$), indicating that the correlation of the common active S-box in the middle can reach 1 for certain input/output differences/linear masks. For instance, in our 11-round distinguisher for WARP, we can express the correlation as $C_{\text{DLCT}}^2(\Delta_i, \lambda_o)$, where $\Delta_i$ and $\lambda_o$ denote the difference and linear mask of the active cell at the input and output of the middle part, respectively. According to Table 30, we have $C_{\text{DLCT}}(2, 2) = 1$. Table 32 and Table 33 summarize our results for WARP. As another interesting example of our new DLCT tables, the correlation of the 11-round middle part of our DL distinguishers for 16 to 22 rounds of WARP can be compactly formulated by only one DDLCT. In particular, let $\Delta_i$ and $\lambda_o$ denote the difference and linear mask of the active cell at the input and output of the middle part, respectively. Then, the correlation of the middle part of our 16- to 22-round distinguishers is given by $C_{\text{DDLCT}}^3(\Delta_i, \lambda_o)$. Table 31 shows the DDLCT of WARP's S-box. As seen in Table 31, if $(\Delta_i, \lambda_o) \in \{(\text{a}, 2), (2, \text{b}), (2, \text{e})\}$, the absolute correlation of the middle part is maximum.

**Application to TWINE** Section M provides a brief specification of TWINE. TWINE achieves full nibble-wise diffusion after 8 rounds. Thus, we set $r_m$ to more than 9 rounds in our searches to ensure that we capture the effect of the middle part and consider the dependencies between differential and linear trails. Table 37 shows the DLCT of TWINE's S-box. In contrast to WARP's S-box, which exhibits maximal $\mathcal{DLU}$, TWINE's S-box has $\mathcal{DLU}_{\text{TWINE}} = 8$, not maximal. Thus, TWINE's S-box is more resistant to DL distinguishers. Table 40 summarizes our results for TWINE. As an application of our new DLCT tables, we can formu-
late the correlation of our 8-round distinguisher for TWINE using one DDLCT. Table 38 illustrates the DDLCT of TWINE’s S-box, indicating that the maximum absolute correlation is achieved by setting the active input/output differences/-linear masks to (8, 2). As another interesting example, we can formulate the correlation of our 9-round distinguisher for TWINE by only one 3-DLCT. More precisely, if $Δ_i$ and $λ_o$ denote the difference and linear mask of the active cell at the input and output of the middle part, respectively, then the correlation of our 9-round distinguisher is given by $C_{3-DLCT}^2(Δ_i, λ_o)$. Table 39 describes the 3-DLCT of TWINE’s S-box. According to Table 39, choosing the active input/output differences/linear masks from {(4, 5), (5, a)}, results in the maximum absolute correlation. As seen in Table 40, we propose DL distinguisher for up to 17 rounds of TWINE for the first time. Interestingly, our 17-round DL distinguisher is one round longer than all previous distinguishers for TWINE, including its longest boomerang distinguisher in [33].

**Application to LBlock and LBlock-s** Section J provides a brief specification of LBlock and LBlock-s. Although LBlock employs 8 different S-boxes in its design, for all of them, $\mathcal{DU} = \mathcal{L}^2 = \mathcal{DLU}/4 = 4$. Therefore, in our cell-wise CP model, we treat all S-boxes equally (similar to the cell-wise CP model for LBlock-s). Like TWINE, LBlock exhibits full nibble-wise diffusion after 8 rounds for both encryption and decryption. Consequently, we set the middle part length in our searches to at least 8 rounds. Table 24 and Table 25 summarize our results for LBlock-s and LBlock, respectively. As an application of our new DLCT tables, the middle part of our 8- to 12-round distinguishers for LBlock-s can be compactly formulated by only one DDLCT. Table 23 illustrates the DDLCT of LBlock-s’s S-box. According to Table 23, the maximum absolute correlation is achieved by setting the active input/output differences/linear masks to (a, 1). We managed to propose DL distinguishers for up to 17 rounds of LBlock-s and LBlock for the first time. Our 17-round DL distinguisher for LBlock and LBlock-s exceeds the length of the longest boomerang distinguishers for both ciphers reported in [33], highlighting the superiority of DL distinguishers over boomerang ones.

The advantage of our cell-wise model lies in its high efficiency and sufficient accuracy, particularly for strongly aligned ciphers. For instance, results for AES and CLEFIA are typically obtained within minutes, while those for TWINE, SKINNY-64, and WARP are often solvable within seconds on a standard laptop. However, when dealing with weakly aligned designs such as Ascon, KNOT, SERPENT, or Simeck, a cell-wise CP model lacks the precision required to track the deterministic differential/linear transitions in the middle part. To tackle this issue, we introduce a bit-wise model in Section 4.3.

## 4.3 Bit-Wise Modeling for Distinguishers

To capture the bit-wise switches for one S-box layer, DLCT is reasonably sufficient. Indeed, one can even model all valid bit-wise differential-linear transitions for a single S-box layer by using some CP constraints encoding the DLCT [40].
Nevertheless, this approach is not extendable to more than one round. In this section, we first show that the idea of deterministic bit-wise differential/linear transitions can capture many bit-wise switches across multiple rounds. Then, we propose a CP/MILP-based method to model the deterministic bit-wise differential/linear trails. Lastly, we use our deterministic bit-wise model to create a CP model to explore DL distinguishers of weakly aligned primitives.

<table><caption>Table 4: DLCT of KNOT’s S-box.</caption><thead><tr><th>Δ \ λ</th><th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>a</th><th>b</th><th>c</th><th>d</th><th>e</th><th>f</th></tr></thead><tbody><tr><th>0</th><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td></tr><tr><th>1</th><td>16</td><td>0</td><td>0</td><td>0</td><td>-16</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>2</th><td>16</td><td>-8</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>8</td><td>-8</td><td>0</td><td>-8</td><td>0</td><td>8</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>3</th><td>16</td><td>0</td><td>-8</td><td>-8</td><td>0</td><td>-8</td><td>8</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>8</td></tr><tr><th>4</th><td>16</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>-16</td><td>0</td><td>8</td><td>0</td><td>0</td><td>0</td><td>8</td><td>0</td></tr><tr><th>5</th><td>16</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>8</td><td>0</td><td>-16</td><td>0</td><td>8</td><td>0</td><td>0</td></tr><tr><th>6</th><td>16</td><td>-8</td><td>8</td><td>-8</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>8</td></tr><tr><th>7</th><td>16</td><td>0</td><td>8</td><td>0</td><td>0</td><td>-8</td><td>-8</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>8</td><td>0</td><td>-8</td><td>0</td><td>0</td></tr><tr><th>8</th><td>16</td><td>0</td><td>0</td><td>0</td><td>-16</td><td>0</td><td>0</td><td>0</td><td>-16</td><td>0</td><td>0</td><td>0</td><td>16</td><td>0</td><td>0</td><td>0</td></tr><tr><th>9</th><td>16</td><td>-8</td><td>0</td><td>-8</td><td>16</td><td>-8</td><td>0</td><td>-8</td><td>0</td><td>8</td><td>0</td><td>-8</td><td>0</td><td>8</td><td>0</td><td>-8</td></tr><tr><th>a</th><td>16</td><td>0</td><td>0</td><td>8</td><td>0</td><td>8</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>-8</td><td>-8</td><td>-8</td><td>-8</td></tr><tr><th>b</th><td>16</td><td>8</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>8</td><td>0</td><td>-8</td><td>-8</td><td>-8</td><td>0</td><td>0</td><td>-8</td><td>0</td></tr><tr><th>c</th><td>16</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>16</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>-8</td></tr><tr><th>d</th><td>16</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>8</td><td>0</td><td>0</td><td>-16</td><td>8</td><td>0</td><td>0</td></tr><tr><th>e</th><td>16</td><td>0</td><td>0</td><td>0</td><td>8</td><td>0</td><td>8</td><td>0</td><td>0</td><td>-8</td><td>-8</td><td>0</td><td>-8</td><td>-8</td><td>-8</td><td>0</td></tr><tr><th>f</th><td>16</td><td>8</td><td>0</td><td>8</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>-8</td></tr></tbody></table>

To explain why the deterministic bit-wise differential/linear transitions can capture many bit-wise switches, we give a basic example in the level of one S-box layer. However, this approach can be extended beyond one S-box layer. Let $S$ be the S-box of KNOT. Table 4 illustrates the DLCT of KNOT’s S-box. Also assume that we represent the difference (resp. linear mask) in each bit of differential (resp. linear) trail by $\{0, 1, ?\}$, where ? denotes the unknown bits in terms of difference (resp. linear mask) value. Table 14 shows the DDT of KNOT’s S-box. Let $\Delta_i$, and $\Delta_o$ be the input and output difference of the S-box, respectively. By checking all input differences in $\{0, 1, ?\}^4$, we can identify the following nontrivial deterministic differential transitions $\Delta_i \xrightarrow{S} \Delta_o$:

$$ \begin{align} \Delta_i &= (0, 0, 0, 1) \xrightarrow{S} \Delta_o = (?, 1, ?, ?) & \Delta_i &= (0, 1, 0, 0) \xrightarrow{S} \Delta_o = (1, ?, ?, ?) \nonumber \\ \Delta_i &= (1, 0, 0, 0) \xrightarrow{S} \Delta_o = (1, 1, ?, ?) & \Delta_i &= (1, 0, 0, 1) \xrightarrow{S} \Delta_o = (?, 0, ?, ?) \tag{8} \nonumber \\ \Delta_i &= (1, 1, 0, 0) \xrightarrow{S} \Delta_o = (0, ?, ?, ?) \nonumber \end{align} $$

Referring to Equation 8, when $\Delta_i = (1, 0, 0, 0)$, then $\Delta_o = (1, 1, ?, ?)$. Thus, if $\lambda_o \in (0, 1, 0, 0), (1, 0, 0, 0), (1, 1, 0, 0)$, $\lambda_o \cdot \Delta_o$ remains constant for all input pairs
with difference $\Delta_i$. This explains the bit-wise switches at indices $(8, 4)$, $(8, 8)$, $(8, c)$ in DLCT. Similarly, when $\Delta_i = (1, 0, 0, 1)$, $\Delta_o = (?, 0, ?, ?)$, indicating that for $\lambda_o = (0, 1, 0, 0)$, $\lambda_o \cdot \Delta_o$ remains constant for all input pairs with difference $\Delta_i$. This accounts for the bit-wise switch at index $(9, 4)$ in DLCT. Similarly, other bit-wise switches, such as $(1, 4)$, $(4, 8)$, and $(c, 8)$, can be explained using only the bit-wise deterministic differential transitions.

We can also explain the same bit-wise switches by using deterministic backward linear transitions. Table 15 shows the LAT of KNOT's S-box. Let $\lambda_i$ and $\lambda_o$ be the input and output linear masks of the S-box, respectively. One can see that there are 3 nontrivial deterministic linear transitions for $\lambda_i \stackrel{S}{\leftarrow} \lambda_o$:

$$ \begin{aligned} \lambda_i &= (1, ?, ?, 1) \stackrel{S}{\leftarrow} \lambda_o = (0, 1, 0, 0) & \lambda_i &= (1, 1, ?, ?) \stackrel{S}{\leftarrow} \lambda_o = (1, 0, 0, 0) \\ \lambda_i &= (0, ?, ?, ?) \stackrel{S}{\leftarrow} \lambda_o = (1, 1, 0, 0) \end{aligned} \qquad (9) $$

Based on Equation 9 if $\lambda_o = (1, 0, 0, 0)$ then $\lambda_i = (1, 1, ?, ?)$. Therefore, $\lambda_i \cdot \Delta_i$ is fixed for all $\Delta_i \in \{(0, 1, 0, 0), (1, 0, 0, 0), (1, 1, 0, 0)\}$, explaining the bit-wise switches $\{(4, 8), (8, 8), (c, 8)\}$. As another example, if $\lambda_o = (0, 1, 0, 0)$, then $\lambda_i = (1, ?, ?, 1)$. Thus, if $\Delta_i \in \{(1, 0, 0, 1), (1, 0, 0, 0), (0, 0, 0, 1)\}$ then $\lambda_i \cdot \Delta_i$ is constant. It explains the bit-wise switches $\{(9, 4), (8, 4), (1, 4)\}$ in DLCT. The bit-wise switch $(8, c)$ can also be identified by only using the bit-wise deterministic linear transitions.

Now, we explain how to model deterministic bit-wise differential/linear transitions. For each bit of the internal state in our bit-wise model, we define an integer variable with domain $\{-1, 0, 1\}$ to represent if the difference (linear mask) is unknown, zero, or one, respectively. Next, we define some constraints to model the truncated differential/linear trails at the bit level. In what follows, we define the constraints for the common cryptographic operations, e.g., XOR, Copy, and S-boxes. We describe our method for truncated differential trails, and a similar method applies to truncated linear trails.

**Proposition 3 (XOR).** For $f: \mathbb{F}_2^n \to \mathbb{F}_2$, $f(x_0, x_1, \dots, x_{n-1}) = y$, where $y = x_0 \oplus x_1 \oplus \dots \oplus x_{n-1}$, the valid deterministic differential transitions satisfy:

$$ \text{XOR}_b(Y, X[0], \dots, X[n-1]) := \begin{cases} \text{if } \bigvee_{i=0}^{n-1} (X[i] = -1) & \text{then } Y = -1 \\ \text{else } Y = X[0] + X[1] + \dots + X[n-1] \mod 2 & \text{endif,} \end{cases} $$

where $X[i]$, and $Y$ are integer variables in $\{-1, 0, 1\}$ for $0 \le i \le n-1$.

**Proposition 4 (Copy).** For $f: \mathbb{F}_2 \to \mathbb{F}_2^n$, $f(x) = (y_0, y_1, \dots, y_{n-1})$ where $y_0 = y_1 = \dots = x$, valid transitions for deterministic differential trails satisfy

$$ \text{Branch}_b(X, Y[0], \dots, Y[n-1]) := \bigwedge_{i=0}^{n-1} (Y[i] = X), $$

where $X$, and $Y[i]$ are integer variables with domain $\{-1, 0, 1\}$ for all $0 \le i \le n-1$.
Regarding S-boxes or generally a non-linear vectorial Boolean function, we refer to its DDT (resp. LAT) to identify deterministic bit-wise differential (resp. linear) transitions. Then, we define some constraints to model these deterministic transitions. To explain our bit-wise model for S-boxes, we give a basic example. Take the 4-bit S-box of KNOT as an example. Let $X[i]$ and $Y[i]$ be integer variables with domain $\{-1, 0, 1\}$ for $0 \le i \le 3$, to denote the input and output difference bits, respectively, where $X[0], Y[0]$ correspond the MSB. The bit-wise deterministic differential transitions of KNOT's S-box are represented in Equation 9. In CP modeling, we can model these transitions using the following constraints:

$$ \begin{cases} 
\text{if } (X[0] = 0 \land X[1] = 0 \land X[2] = 0 \land X[3] = 0) \text{ then } (Y[0] = 0 \land Y[1] = 0 \land Y[2] = 0 \land Y[3] = 0) \\ 
\text{elseif } (X[0] = 0 \land X[1] = 0 \land X[2] = 0 \land X[3] = 1) \text{ then } (Y[0] = -1 \land Y[1] = 1 \land Y[2] = -1 \land Y[3] = -1) \\ 
\text{elseif } (X[0] = 0 \land X[1] = 1 \land X[2] = 0 \land X[3] = 0) \text{ then } (Y[0] = 1 \land Y[1] = -1 \land Y[2] = -1 \land Y[3] = -1) \\ 
\text{elseif } (X[0] = 1 \land X[1] = 0 \land X[2] = 0 \land X[3] = 0) \text{ then } (Y[0] = 1 \land Y[1] = 1 \land Y[2] = -1 \land Y[3] = -1) \\ 
\text{elseif } (X[0] = 1 \land X[1] = 0 \land X[2] = 0 \land X[3] = 1) \text{ then } (Y[0] = -1 \land Y[1] = 0 \land Y[2] = -1 \land Y[3] = -1) \\ 
\text{elseif } (X[0] = 1 \land X[1] = 1 \land X[2] = 0 \land X[3] = 0) \text{ then } (Y[0] = 0 \land Y[1] = -1 \land Y[2] = -1 \land Y[3] = -1) \\ 
\text{else } (Y[0] = -1 \land Y[1] = -1 \land Y[2] = -1 \land Y[3] = -1) \text{ endif;}
\end{cases} $$

We can model the backward deterministic bit-wise linear transitions in Equation 9 in the same way.

Now, we explain our bit-wise model for finding DL distinguishers. As before, we split the primitive $E$ into three parts $E_u$, $E_m$, and $E_\ell$ of lengths $r_u$, $r_m$, and $r_\ell$, respectively. Let $XU_t[i]$ (resp. $XL_t[i]$) represents the value of the difference (resp. linear mask) in the $i$th bit of the internal state in round $t$ of $E_u$ (resp. $E_\ell$). Besides, let $XMU_t[i]$ (resp. $XML_t[i]$) represents the $i$th bit of the internal state in round $t$ of $E_m$ for differential (resp. linear) propagation. We create CP models $CSP_u(XU_t, \dots, XU_{r_u})$ and $CSP_\ell(XL_0, \dots, XL_{r_\ell})$ to model the bit-wise differential and linear trails through $E_u$ and $E_\ell$, respectively. For this purpose, we employ the methods outlined in prior studies such as [1, 35, 53] for the propagation of differential and linear trails at the bit level. However, for $E_m$, we switch to deterministic propagation at the bit level. For this, we create $CSP_{mu}(XMU_0, \dots, XMU_{r_m})$ (resp. $CSP_{m\ell}(XML_0, \dots, XML_{r_m})$) to model the deterministic propagation of differential (resp. linear) trails through $E_m$ (resp. $E_m^{-1}$).

In $CSP_u$, we encode the DDT by CP constraints to model the probability of differential transition over $E_u$. In $CSP_\ell$, we encode LAT$^2$ by CP constraints to model the squared correlation of linear approximation over $E_\ell$. We use the open-source S-box Analyzer tool [33] (refer to Section N) to effectively encode the differential and linear behavior of S-boxes and other operations in our CP models. Any feasible solution for $CSP_u$ (resp. $CSP_\ell$) is a differential (resp. linear) trail for $E_u$ (resp. $E_\ell$). Assume that the probability of differential transition over $E_u$ is $p$ and the squared correlation of linear transition over $E_\ell$ is $q^2$. In our CP model, we define the variables PU and CL to encode $-\log_2(p)$ and $-\log_2(q^2)$, respectively. Depending on the DDT and LAT, the variables PU and CL can be integer or real-valued variables. Lastly, we combine $CSP_u, CSP_\ell, CSP_{mu},$ and $CSP_{m\ell}$ to create a unified CP model for the DL distinguisher. Like our cell-wise CP model, we add some constraints to link the internal states at the join points of $E_u$ and $E_m$ and $E_m$ and $E_\ell$. To identify the number of bit positions that are active in both
differential and linear propagations in the middle part and take unknown values in at least one of the differential and linear propagations, we define the following integer variable:

$$CM = \sum_{t=0}^{r_m} \mathit{bool2int}((\mathit{XMU}_t[i] = -1 \lor \mathit{XML}_t[i] = -1) \land (\mathit{XMU}_t[i] \neq 0 \land \mathit{XML}_t[i] \neq 0)) \quad (10)$$

Next, assuming that $w_u$, $w_m$, and $w_\ell$ are some integer constants, we set the objective function to: $\min (w_u \cdot \mathit{PU} + w_m \cdot \mathit{CM} + w_\ell \cdot \mathit{CL})$. If the number of common active bits in the middle is high, then computing the correlation of the middle part becomes more difficult. Therefore, we typically use these integer weights to make a trade-off between the weight of differential and linear transitions over $E_u$ and $E_\ell$, and the number of common active bits in the middle part. After finding a solution for the unified CP model, we use the DLCT framework or experimental approach to compute the correlation of the middle part. Lastly, we put $p = 2^{-\mathit{PU}}$, $q^2 = 2^{-\mathit{CL}}$, and $r$ together in the $\mathit{prq}^2$ formula to estimate the total correlation of the distinguisher.

It is worth noting that, while our cell-wise model is inspired by techniques for finding boomerang distinguishers [30], there is no equivalent method for our bit-wise model in the context of boomerang distinguishers. For example, very recently, Bonnetain and Lallemand [15] demonstrated at ToSC 2023 that previous tools for finding boomerang distinguishers are not applicable to bit-sliced designs like Simeck, and they had to propose a different approach to find boomerang distinguishers. However, our bit-wise model can be applied to both strongly aligned primitives like WARP and weakly aligned primitives like Simeck.

**Application to Ascon Permutation** To illustrate the usefulness of our bit-wise model, we first applied it to Ascon [23,24], the winner of the NIST lightweight cryptography standardization (LWC) process. Section D.2 briefly describes the Ascon permutation. Ascon achieves full diffusion at the bit-level after 3.5 rounds. Therefore, we set the length of the middle part to 2, 3, or 4 in our searches. Table 6 summarizes our results for Ascon. We discovered the first 4-round deterministic DL distinguisher for Ascon. To find the 4-round DL distinguisher, we set $r_m$ to 4. In this case, our tool returns a solution with no overlap between the active bits in the differential and linear propagations at the output of the S-box layer. As a result, due the bit-wise switches, the correlation of our 4-round DL distinguisher is 1, which we also verified experimentally. Nevertheless, as Figure 6 shows, there are many common active S-boxes whose input difference and output linear masks are non-zero, and all switches are bit-wise switches that are not detectable by the cell-wise models. This example showcases the effectiveness of our bit-wise model. Moreover, we uncovered a 5-round DL distinguisher for Ascon that raises the correlation from $2^{-9}$ in the best previous 5-round distinguishers [22] to $2^{-4.33}$. Due to the rotational invariant property of Ascon with respect to differences and linear trails, each of our DL distinguishers represent 64 different DL distinguishers with the same correlation.
<figure><img src="image_7.png" /><figcaption>Fig. 6: DL distinguisher I for 4 rounds of Ascon.</figcaption></figure>

**Application to SERPENT** As another important bit-sliced cipher, we applied our method to the runner-up of the AES competition, namely SERPENT [8]. Refer to Section E.1 for a brief specification of SERPENT. The full diffusion of SERPENT at the bit-level is achieved after 3 rounds. Thus, we set the length of the middle part to 3 in our searches. Since SERPENT uses different S-boxes in each round, its differential/linear behavior depends on the starting round. So, we also searched for DL distinguishers for different starting rounds. Table 7 summarizes our results for SERPENT. One of the first applications of DL analysis was on SERPENT in [11], and this cipher has been the center of attention for much research on DL analysis. The longest DL distinguisher for SERPENT is a 9-round distinguisher with a correlation of $2^{-58}$ proposed in [11]. Later, in [26], the authors performed experiments on a reduced-round version of the 9-round DL distinguisher and showed that the correlation is $2^{-56.5}$. Using our bit-wise model, we found a 9-round DL distinguisher with a correlation of $2^{-50.95}$.

**Application to Simeck** Section I.1 briefly describes the Simeck family of lightweight block ciphers. Here, we discuss the application of our method to
Simeck. Table 17, Table 18, and Table 19 describe the specification of our dis-
covered DL distinguishers. The number of rounds required for full diffusion in
Simeck-32, Simeck-48, and Simeck-64 is 8, 9, and 11, respectively [37]. Our dis-
coveries also match this fact: we found deterministic 7-, 8-, and 10-round DL dis-
tinguishers for Simeck-32, Simeck-48, and Simeck-64, respectively. Very recently,
the authors of [61] applied the new MILP/MIQCP-based tool [7] to Simeck and
proposed the DL distinguishers for all variants of Simeck for the first time. Using
our bit-wise model, we could significantly improve all of the results of [61]. The
authors of [61] proposed two types of estimations for the correlation of their dis-
tinguishers: the first one is based on the MILP/MIQCP model, and the second
one is based on experimental measurements of the correlation for smaller parts
of the distinguishers. Referring to [61], one can see that the correlation derived
by the MILP/MIQCP model extremely underestimates the real correlation. To
have a fair comparison, we compare the correlation of our new distinguishers with
the (experimental) correlation of distinguishers reported in [61]. The authors of
[61] proposed 14-, 18-, and 25-round DL distinguishers for Simeck-32, Simeck-48,
and Simeck-64, with (experimentally measured) correlations of 2<sup>-15.57</sup>, 2<sup>-17.88</sup>,
and 2<sup>-29.65</sup>, respectively. However, we found 14-, 18, and 25-round DL distin-
guishers for the corresponding variants of Simeck with correlations of 2<sup>-13.92</sup>,
2<sup>-15.89</sup>, and 2<sup>-27.07</sup>, respectively. Interestingly, we discovered a 20-round DL
distinguisher for Simeck-48 with a data complexity of 2<sup>43.78</sup>, improving its DL
distinguisher by 2 rounds. Moreover, we provided a 26-round DL distinguisher
for Simeck-64, improving its best known DL distinguisher by 1 round.

**Application to KNOT Permutation and PRESENT** We also applied our method to the KNOT permutation, one of the second-round candidates of LWC. We analyzed the main variant of the KNOT family of lightweight authenticated encryption algorithms, denoted as KNOT-256. The length of the middle part was set to 9, sufficient to capture its effect. Table 16 briefly describes our results for KNOT-256. The only previous result on DL distinguishers for KNOT is a conditional DL distinguisher for 15 rounds of KNOT-256 in [56], applicable to the initialization phase. However, as illustrated in Figure 40b, we propose an unconditional DL distinguisher for 15 rounds of KNOT-256 with a correlation of 2<sup>-17.20</sup>, also targeting the initialization phase, with a data limit of 2<sup>64</sup>. Another significant finding is our discovery of up to 23-round DL distinguishers for KNOT-256, the longest for this permutation, surpassing the 17-round integral distinguisher proposed in [28]. To demonstrate the versatility of our method, we also applied it to PRESENT and proposed DL distinguishers for up to 13 rounds of this cipher for the first time (see Table 12).

5 Conclusion and Future Works

In this paper, we presented a general framework for formalizing the correlation
of DL distinguishers, along with new CP-based models designed to search for
high-quality distinguishers efficiently. We proposed two CP/MILP-based models:
a cell-wise model suitable for strongly aligned primitives and a bit-wise model suitable for weakly aligned primitives. Our new CP/MILP-based models are efficient and user-friendly, allowing for easy incorporation of future improvements in the search for either differential or linear characteristics to find better DL distinguishers. To demonstrate the usefulness and versatility of our new tools, we applied them to a wide range of symmetric-key primitive designs. In all applications, our DL distinguishers exhibit superior correlation and/or cover more rounds than previously known ones. In several instances, we showed that DL distinguishers can surpass boomerang distinguishers or even the best-known (integral) distinguishers. Our work enables further exploration of the similarities between boomerang and DL cryptanalysis and demonstrates that one can adapt many advances in one area to the other.

Our research also raises several open questions and suggests directions for future studies. Our method for identifying DL distinguishers can be applied to other cryptographic primitives. Extending our bit-wise model to ARX primitives could be a potential future work. We also suggest considering neutral bits [9] while searching for DL distinguishers as another future work. Moreover, it is worth inspecting the impact of our approach for finding rotational DL distinguishing [42, 45]. Another interesting avenue for future work is extending our models to a unified CP model for finding complete DL key recovery.

In our applications to SKINNY, we observed that the experimental correlation of the distinguisher is often much higher than the approximation provided by the $prq^2$ formula. It might be due to partial key addition. Therefore, another interesting area for future work would be to accurately consider the dependencies between rounds for ciphers with partial key addition, potentially leading to the discovery of better distinguishers. Additionally, during our analyses of several symmetric-key primitives, we noticed that the DLCT of many S-boxes contains numerous bit-wise switches, rendering them weaker against DL cryptanalysis. Thus, further studies on constructing strong S-boxes against DL cryptanalysis appear necessary. For example, investigating the application of DDLCT or t-DLCT in the design and analysis of S-boxes resistant to DL cryptanalysis would be intriguing.

**Acknowledgments.** This work has been supported in part by the Austrian Science Fund (FWF SFB project SPyCoDe), by the France 2030 program under grant agreement No. ANR-22-PECY-0010, by the French Agence Nationale de la Recherche through the OREO project under Contract ANR-22-CE39-0015 and it has been partially funded by the European Union (ERC-2023-COG, SoBaSyC, 101125450). Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or the European Research Council Executive Agency. Neither the European Union nor the granting authority can be held responsible for them.

The authors would like to thank the anonymous reviewers for their valuable comments and suggestions. The first author would like to thank Fredrick Meisingseth for reading the manuscript and providing valuable feedback.
References

1. Abdelkhalek, A., Sasaki, Y., Todo, Y., Tolba, M., Youssef, A.M.: MILP modeling for (large) s-boxes to optimize probability of differential characteristics. IACR Trans. Symmetric Cryptol. 2017(4), 99–129 (2017). https://doi.org/10.13154/ TOSC.V2017.I4.99-129

2. Banik, S., Bao, Z., Isobe, T., Kubo, H., Liu, F., Minematsu, K., Sakamoto, K., Shibata, N., Shigeri, M.: WARP: Revisiting GFN for lightweight 128-bit block cipher. In: SAC. LNCS, vol. 12804, pp. 535–564. Springer (2020). https://doi. org/10.1007/978-3-030-81652-0_21

3. Bar-On, A., Dunkelman, O., Keller, N., Weizman, A.: DLCT: A new tool for differential-linear cryptanalysis. In: EUROCRYPT 2019. LNCS, vol. 11476, pp. 313–342. Springer (2019). https://doi.org/10.1007/978-3-030-17653-2_11

4. Beaulieu, R., Shors, D., Smith, J., Treatman-Clark, S., Weeks, B., Wingers, L.: The SIMON and SPECK lightweight block ciphers. In: DAC 2015. pp. 175:1–175:6. ACM (2015). https://doi.org/10.1145/2744769.2747946

5. Beierle, C., Jean, J., Kölbl, S., Leander, G., Moradi, A., Peyrin, T., Sasaki, Y., Sasdrich, P., Sim, S.M.: The SKINNY family of block ciphers and its low-latency variant MANTIS. In: CRYPTO 2016. pp. 123–153. Springer (2016). https://doi. org/10.1007/978-3-662-53008-5_5

6. Beierle, C., Leander, G., Todo, Y.: Improved differential-linear attacks with applications to ARX ciphers. In: CRYPTO 2020. LNCS, vol. 12172, pp. 329–358. Springer (2020). https://doi.org/10.1007/978-3-030-56877-1_12

7. Bellini, E., Gérault, D., Grados, J., Makarim, R.H., Peyrin, T.: Fully automated differential-linear attacks against ARX ciphers. In: CT-RSA 2023. LNCS, vol. 13871, pp. 252–276. Springer (2023). https://doi.org/10.1007/ 978-3-031-30872-7_10

8. Biham, E., Anderson, R.J., Knudsen, L.R.: Serpent: A new block cipher proposal. In: Vaudenay, S. (ed.) FSE’98. LNCS, vol. 1372, pp. 222–238. Springer (1998). https://doi.org/10.1007/3-540-69710-1_15

9. Biham, E., Chen, R.: Near-collisions of SHA-0. In: Franklin, M.K. (ed.) CRYPTO 2004. LNCS, vol. 3152, pp. 290–305. Springer (2004). https://doi.org/10.1007/ 978-3-540-28628-8_18

10. Biham, E., Dunkelman, O., Keller, N.: Enhancing differential-linear cryptanalysis. In: ASIACRYPT 2002. LNCS, vol. 2501, pp. 254–266. Springer (2002). https://doi.org/10.1007/3-540-36178-2_16

11. Biham, E., Dunkelman, O., Keller, N.: Differential-linear cryptanalysis of Serpent. In: Johansson, T. (ed.) FSE 2003. LNCS, vol. 2887, pp. 9–21. Springer (2003). https://doi.org/10.1007/978-3-540-39887-5_2

12. Biham, E., Shamir, A.: Differential cryptanalysis of DES-like cryptosystems. In: Menezes, A., Vanstone, S.A. (eds.) CRYPTO ’90. LNCS, vol. 537, pp. 2–21. Springer (1990). https://doi.org/10.1007/3-540-38424-3_1

13. Blondeau, C., Leander, G., Nyberg, K.: Differential-linear cryptanalysis revisited. J. Cryptol. 30(3), 859–888 (2017). https://doi.org/10.1007/ s00145-016-9237-5

14. Bogdanov, A., Knudsen, L.R., Leander, G., Paar, C., Poschmann, A., Robshaw, M.J.B., Seurin, Y., Vikkelsoe, C.: PRESENT: an ultra-lightweight block cipher. In: Paillier, P., Verbauwhede, I. (eds.) CHES 2007. LNCS, vol. 4727, pp. 450–466. Springer (2007). https://doi.org/10.1007/978-3-540-74735-2_31
15. Bonnetain, X., Lallemand, V.: On boomerang attacks on quadratic feistel ciphers new results on KATAN and simon. IACR Trans. Symmetric Cryptol. **2023**(3), 101–145 (2023). https://doi.org/10.46586/TOSC.V2023.I3.101-145

16. Boukerrou, H., Huynh, P., Lallemand, V., Mandal, B., Minier, M.: On the feistel counterpart of the boomerang connectivity table introduction and analysis of the FBCT. IACR Trans. Symmetric Cryptol. **2020**(1), 331–362 (2020). https://doi.org/10.13154/TOSC.V2020.I1.331-362

17. Canteaut, A., Kölsch, L., Li, C., Li, C., Li, K., Qu, L., Wiemer, F.: Autocorrelations of vectorial boolean functions. In: Longa, P., Ràfols, C. (eds.) LATINCRYPT 2021. LNCS, vol. 12912, pp. 233–253. Springer (2021). https://doi.org/10.1007/978-3-030-88238-9_12

18. Chen, Y., Bao, Z., Yu, H.: Differential-linear approximation semi-unconstrained searching and partition tree: Application to LEA and Speck. IACR Cryptology ePrint Archive, Paper 2023/1414 (2023), https://eprint.iacr.org/2023/1414

19. Cid, C., Huang, T., Peyrin, T., Sasaki, Y., Song, L.: Boomerang connectivity table: A new cryptanalysis tool. In: Nielsen, J.B., Rijmen, V. (eds.) EUROCRYPT 2018. LNCS, vol. 10821, pp. 683–714. Springer (2018). https://doi.org/10.1007/978-3-319-78375-8_22

20. Daemen, J., Rijmen, V.: The Design of Rijndael: AES – The Advanced Encryption Standard. Information Security and Cryptography, Springer (2002). https://doi.org/10.1007/978-3-662-04722-4

21. Delaune, S., Derbez, P., Vavrille, M.: Catching the fastest boomerangs application to SKINNY. IACR Trans. Symmetric Cryptol. **2020**(4), 104–129 (2020). https://doi.org/10.46586/tosc.v2020.i4.104-129

22. Dobraunig, C., Eichlseder, M., Mendel, F., Schläffer, M.: Cryptanalysis of Ascon. In: Nyberg, K. (ed.) CT-RSA 2015. LNCS, vol. 9048, pp. 371–387. Springer (2015). https://doi.org/10.1007/978-3-319-16715-2_20

23. Dobraunig, C., Eichlseder, M., Mendel, F., Schläffer, M.: Ascon v1.2: Lightweight authenticated encryption and hashing. Journal of Cryptology **34**(3), 33 (2021). https://doi.org/10.1007/s00145-021-09398-9

24. Dobraunig, C., Eichlseder, M., Mendel, F., Schläffer, M.: Ascon v1.2 (Submission to NIST). Finalist submission to the NIST lightweight cryptography standardization process (2021), https://csrc.nist.gov/Projects/Lightweight-Cryptography

25. Dong, X., Qin, L., Sun, S., Wang, X.: Key guessing strategies for linear key-schedule algorithms in rectangle attacks. In: Dunkelman, O., Dziembowski, S. (eds.) EUROCRYPT 2022. LNCS, vol. 13277, pp. 3–33. Springer (2022). https://doi.org/10.1007/978-3-031-07082-2_1

26. Dunkelman, O., Indesteege, S., Keller, N.: A differential-linear attack on 12-round Serpent. In: Chowdhury, D.R., Rijmen, V., Das, A. (eds.) INDOCRYPT 2008. LNCS, vol. 5365, pp. 308–321. Springer (2008). https://doi.org/10.1007/978-3-540-89754-5_24

27. Dunkelman, O., Keller, N., Shamir, A.: A practical-time related-key attack on the KASUMI cryptosystem used in GSM and 3G telephony. J. Cryptol. **27**(4), 824–849 (2014). https://doi.org/10.1007/s00145-013-9154-9

28. Ghosh, S., Dunkelman, O.: Automatic search for bit-based division property. In: Longa, P., Ràfols, C. (eds.) LATINCRYPT 2021. LNCS, vol. 12912, pp. 254–274. Springer (2021). https://doi.org/10.1007/978-3-030-88238-9_13

29. Gurobi Optimization, LLC: Gurobi Optimizer Reference Manual (2022), https://www.gurobi.com
30. Hadipour, H., Bagheri, N.: Improved rectangle attacks on SKINNY and CRAFT. IACR Trans. Symmetric Cryptol. 2021(2), 140–198 (2021). https://doi.org/10.4658/tosc.v2021.i2.140-198

31. Hadipour, H., Eichlseder, M.: Integral cryptanalysis of WARP based on monomial prediction. IACR Trans. Symmetric Cryptol. 2022(2), 92–112 (2022). https://doi.org/10.4658/tosc.v2022.i2.92-112

32. Hadipour, H., Gerhalter, S., Sadeghi, S., Eichlseder, M.: Improved search for integral, impossible differential and zero-correlation attacks application to ascon, forskinny, skinny, mantis, PRESENT and qarmav2. IACR Trans. Symmetric Cryptol. 2024(1), 234–325 (2024). https://doi.org/10.46586/TOSC.V2024.I1.234-325

33. Hadipour, H., Nageler, M., Eichlseder, M.: Throwing boomerangs into feistel structures application to CLEFIA, WARP, LBlock, LBlock-s and TWINE. IACR Trans. Symmetric Cryptol. 2022(3), 271–302 (2022). https://doi.org/10.46586/tosc.v2022.i3.271-302

34. Hadipour, H., Sadeghi, S., Eichlseder, M.: Finding the impossible: Automated search for full impossible-differential, zero-correlation, and integral attacks. In: Hazay, C., Stam, M. (eds.) EUROCRYPT 2023. LNCS, vol. 14007, pp. 128–157. Springer (2023). https://doi.org/10.1007/978-3-031-30634-1_5

35. Hadipour, H., Sadeghi, S., Niknam, M.M., Song, L., Bagheri, N.: Comprehensive security analysis of CRAFT. IACR Trans. Symmetric Cryptol. 2019(4), 290–317 (2019). https://doi.org/10.13154/TOSC.V2019.I4.290-317

36. Huang, T., Tjuawinata, I., Wu, H.: Differential-linear cryptanalysis of ICEPOLE. In: Leander, G. (ed.) FSE 2015. LNCS, vol. 9054, pp. 243–263. Springer (2015). https://doi.org/10.1007/978-3-662-48116-5_12

37. Kölbl, S., Roy, A.: A brief comparison of Simon and Simeck. In: Bogdanov, A. (ed.) Lightweight Cryptography for Security and Privacy - 5th International Workshop, LightSec 2016, Aksaray, Turkey, September 21-22, 2016, Revised Selected Papers. LNCS, vol. 10098, pp. 69–88. Springer (2016). https://doi.org/10.1007/978-3-319-55714-4_6

38. Langford, S.K., Hellman, M.E.: Differential-linear cryptanalysis. In: CRYPTO '94. vol. 839, pp. 17–25. Springer (1994). https://doi.org/10.1007/3-540-48658-5_3

39. Leurent, G.: Improved differential-linear cryptanalysis of 7-round Chaskey with partitioning. In: Fischlin, M., Coron, J. (eds.) EUROCRYPT 2016. LNCS, vol. 9665, pp. 344–371. Springer (2016). https://doi.org/10.1007/978-3-662-49890-3_14

40. Li, M., Sun, L., Wang, M.: Automated key recovery attacks on round-reduced Orthros. In: Batina, L., Daemen, J. (eds.) AFRICACRYPT 2022. LNCS, vol. 13503, pp. 189–213. Springer Nature Switzerland (2022). https://doi.org/10.1007/978-3-031-17433-9_9

41. Liu, M., Lu, X., Lin, D.: Differential-linear cryptanalysis from an algebraic perspective. In: Malkin, T., Peikert, C. (eds.) CRYPTO 2021. LNCS, vol. 12827, pp. 247–277. Springer (2021). https://doi.org/10.1007/978-3-030-84252-9_9

42. Liu, Y., Sun, S., Li, C.: Rotational cryptanalysis from a differential-linear perspective - practical distinguishers for round-reduced friet, xoodoo, and alzette. In: Canteaut, A., Standaert, F. (eds.) EUROCRYPT 2021. LNCS, vol. 12696, pp. 741–770. Springer (2021). https://doi.org/10.1007/978-3-030-77870-5_26

43. Matsui, M.: Linear cryptanalysis method for DES cipher. In: Helleseth, T. (ed.) EUROCRYPT '93. LNCS, vol. 765, pp. 386–397. Springer (1993). https://doi.org/10.1007/3-540-48285-7_33
44. Nethercote, N., Stuckey, P.J., Becket, R., Brand, S., Duck, G.J., Tack, G.: Minizinc: Towards a standard CP modelling language. In: CP 2007. LNCS, vol. 4741, pp. 529–543. Springer (2007)

45. Niu, Z., Sun, S., Liu, Y., Li, C.: Rotational differential-linear distinguishers of ARX ciphers with arbitrary output linear masks. In: Dodis, Y., Shrimpton, T. (eds.) CRYPTO 2022. LNCS, vol. 13507, pp. 3–32. Springer (2022). https://doi.org/10.1007/978-3-031-15802-5_1

46. Nyberg, K.: Differentially uniform mappings for cryptography. In: Hellerseth, T. (ed.) EUROCRYPT '93. LNCS, vol. 765, pp. 55–64. Springer (1993). https://doi.org/10.1007/3-540-48285-7_6

47. Perron, L., Furnon, V.: OR-Tools, https://developers.google.com/optimization/

48. Qin, L., Dong, X., Wang, X., Jia, K., Liu, Y.: Automated search oriented to key recovery on ciphers with linear key schedule applications to boomerangs in SKINNY and forkskinny. IACR Trans. Symmetric Cryptol. 2021(2), 249–291 (2021). https://doi.org/10.46586/TOSC.V2021.I2.249-291

49. Sage Developers: SageMath, the Sage Mathematics Software System (Version 9.5.0) (2022), https://www.sagemath.org

50. Shirai, T., Shibutani, K.: Improving immunity of feistel ciphers against differential cryptanalysis by using multiple MDS matrices. In: FSE 2004. LNCS, vol. 3017, pp. 260–278. Springer (2004). https://doi.org/10.1007/978-3-540-25937-4_17

51. Shirai, T., Shibutani, K., Akishita, T., Moriai, S., Iwata, T.: The 128-bit blockcipher CLEFIA (extended abstract). In: FSE 2007. LNCS, vol. 4593, pp. 181–195. Springer (2007). https://doi.org/10.1007/978-3-540-74619-5_12

52. Sun, L., Gérault, D., Wang, W., Wang, M.: On the usage of deterministic (related-key) truncated differentials and multidimensional linear approximations for SPN ciphers. IACR Trans. Symmetric Cryptol. 2020(3), 262–287 (2020). https://doi.org/10.13154/tosc.v2020.i3.262-287

53. Sun, L., Wang, W., Wang, M.: More accurate differential properties of LED64 and midori64. IACR Trans. Symmetric Cryptol. 2018(3), 93–123 (2018). https://doi.org/10.13154/TOSC.V2018.I3.93-123

54. Suzaki, T., Minematsu, K., Morioka, S., Kobayashi, E.: Twine: A lightweight block cipher for multiple platforms. In: Knudsen, L.R., Wu, H. (eds.) SAC 2012. LNCS, vol. 7707, pp. 339–354. Springer (2012). https://doi.org/10.1007/978-3-642-35999-6_22

55. Wagner, D.A.: The boomerang attack. In: Knudsen, L.R. (ed.) FSE '99. LNCS, vol. 1636, pp. 156–170. Springer (1999). https://doi.org/10.1007/3-540-48519-8_12

56. Wang, S., Hou, S., Liu, M., Lin, D.: Differential-linear cryptanalysis of the lightweight crytographic algorithm KNOT. In: Yu, Y., Yung, M. (eds.) Inscrypt 2021. LNCS, vol. 13007, pp. 171–190. Springer (2021). https://doi.org/10.1007/978-3-030-88323-2_9

57. Wu, W., Zhang, L.: Lblock: A lightweight block cipher. In: López, J., Tsudik, G. (eds.) ACNS 2011. LNCS, vol. 6715, pp. 327–344 (2011). https://doi.org/10.1007/978-3-642-21554-4_19

58. Yang, G., Zhu, B., Suder, V., Aagaard, M.D., Gong, G.: The simeck family of lightweight block ciphers. In: Güneysu, T., Handschuh, H. (eds.) CHES 2015. LNCS, vol. 9293, pp. 307–329. Springer (2015). https://doi.org/10.1007/978-3-662-48324-4_16
59. Zhang, W., Ding, T., Yang, B., Bao, Z., Xiang, Z., Ji, F., Zhao, X.: KNOT: Algorithm specifications and supporting document. Submission to NIST lightweight cryptography project (2019)

60. Zhang, W., Zhang, L., Wu, W., Feng, D.: Related-key differential-linear attacks on reduced AES-192. In: Srinathan, K., Rangan, C.P., Yung, M. (eds.) INDOCRYPT 2007. LNCS, vol. 4859, pp. 73–85. Springer (2007). https://doi.org/10.1007/978-3-540-77026-8_7

61. Zhou, Y., Wang, S., Hu, B.: MILP/MIQCP-based fully automatic method of searching for differential-linear distinguishers for SIMON-like ciphers. IET Information Security **2024** (2024). https://doi.org/10.1049/2024/8315115
— Supplementary Material —

A Comparison of our Approach with the State-of-the-Art

Here, we briefly compare our approach with the state-of-the-art in DL analysis. After introducing DL cryptanalysis in CRYPTO 1994 [38], efforts to formalize computing the correlation of DL distinguishers have been extensive, while automation of the search for DL distinguishers has received less attention. One of the most interesting works is that of Blondeau, Leander, and Nyberg [13]. They relaxed one of the two critical assumptions from the original work of Langford and Hellman, providing a closed formula to compute the correlation of DL distinguishers. In EUROCRYPT 2019, Bar-On et al. [3] further relaxed another critical assumption in computing the correlation of DL distinguishers. They proposed the DLCT and utilized the sandwich framework to formulate the correlation of DL distinguishers. Another interesting work is that of Liu et al. [41], presented at CRYPTO 2021. They introduce a purely algebraic approach to compute the correlation of DL distinguishers across multiple rounds. Recently, at EUROCRYPT 2021, Liu et al. [42] combined the concepts of rotational differentials and DL analysis. They proposed a novel combined attack known as rotational DL analysis. This work was further extended in CRYPTO 2022 [45], presenting an efficient algorithm for computing the (rotational) differential-linear correlation of modular additions for arbitrary output linear masks. However, most of these interesting works have focused mainly on formalizing the correlation of DL distinguishers and rarely on providing a (generic CP-based) automatic tool for finding DL distinguishers. Other interesting works have also aimed to improve the key recovery of DL attacks, such as the one by Beierle et al. presented at CRYPTO 2020 [6].

Only very recently have there been some interesting works regarding the
automatic search for DL distinguishers. For example, in 2023, Bellini et al. [7]
introduced an automated tool based on MILP/MIQCP for identifying DL dis-
tinguishers in ARX ciphers and applied it to Speck-32. However, the authors
acknowledge that their CP model is resource-intensive, limiting its application
to smaller variants of Speck like Speck-32. Furthermore, the tool's efficiency con-
cerning SPN ciphers remains an open question. Later, Zhou et al. [61] applied this
method to Simon and Simeck. In another recent work from ASIACRYPT 2023,
Chen et al. [18] proposed an alternative method for searching for DL distin-
guishers. However, their approach is also tailored to ARX ciphers and does not
leverage general-purpose CP/MILP solvers. Developing an efficient and generic
approach to automatically search for effective DL distinguishers across various
classes of primitives, especially SPN designs, remained an open problem. In our
paper, we initially examine the interdependency between two DL distinguishers
components from the boomerang analysis perspective to extend the framework
proposed in [3]. Subsequently, we introduce a novel tool for automating the
search for DL distinguishers.
The advantage of our approach is that it allows us to capitalize on the progress made in boomerang analysis within DL analysis. Our CP-based automatic tool also addresses the need for a generic and efficient CP-based method for exploring DL distinguishers, especially for strongly aligned SPN ciphers. Additionally, our approach can be integrated with some intriguing previous approaches, such as the algebraic one presented in CRYPTO 2021 [41]. For instance, while our generalized DLCT framework is very efficient for formulat-ing/computing the correlation across multiple rounds of strongly aligned prim-itives, it is more complicated to use it for weakly aligned primitives, where the algebraic approach in [41] might be more efficient. However, our tool for finding the DL distinguishers performs well for strongly and weakly aligned primitives. Therefore, one can use our automatic tool for finding DL distinguishers and then use either the generalized DLCT framework or the algebraic approach in [41] to compute the correlation of the middle part.
## B Constraint Satisfaction and Constraint Optimization Problems

A constraint satisfaction problem (CSP) is a mathematical problem including a set of constraints over a set of variables that should be satisfied. The following definition is a formal definition of CSPs.

**Definition 13.** A CSP is a triple $(\mathcal{X}, \mathcal{D}, \mathcal{C})$, where

- $\mathcal{X} = \{X_0, X_1, \dots, X_{n-1}\}$ is a set of variables;

- $\mathcal{D} = \{\mathcal{D}_0, \mathcal{D}_1, \dots, \mathcal{D}_{n-1}\}$ is the set of domains such that $X_i \in \mathcal{D}_i$, $0 \le i \le n-1$; and

- $\mathcal{C} = \{C_0, C_1, \dots, C_{n-1}\}$ is a set of constraints.

Each constraint $C_j \in \mathcal{C}$ is a tuple $(S_j, \mathcal{R}_j)$, where $S_j = \{X_{i_0}, \dots, X_{i_{k-1}}\} \subseteq \mathcal{X}$ and $\mathcal{R}_j$ is a relation on the corresponding domains, i.e., $\mathcal{R}_j \subseteq \mathcal{D}_{i_0} \times \dots \times \mathcal{D}_{i_{k-1}}$.

Any assignment of domain values to the variables that satisfies all constraints of a CSP problem is a feasible solution. Including an objective function to be minimized (or maximized) in a CSP problem results in a constraint optimization problem (COP). We refer to finding a feasible solution for a CSP or COP problem as constraint programming (CP). The tools that are used to solve CSP and COP problems are called CP solvers.

To generate our COP models in this paper, we use MiniZinc [44]. The main advantage of MiniZinc is that it allows modeling the CSP and COP problems in a high-level and solver-independent way. It compiles the model into FlatZinc, a standard language supported by a wide range of CP solvers. As a result, once a model is written in MiniZinc, it can be solved by any CP solver that supports FlatZinc, which includes a wide range of powerful CP solvers, e.g., Gurobi [29], and Or-Tools [47]. In this paper we use Gurobi and Or-Tools as the CP solvers.
# C Application to AES

## C.1 Brief Specification of AES

The AES family of 128-bit block ciphers with key sizes $k \in \{128, 192, 256\}$ bits was designed by Rijmen and Daemen [20] and standardized in NIST FIPS PUB 197 in 2001. The state of all family members is a $4 \times 4$ matrix of bytes, while the key is a $4 \times \{4, 6, 8\}$ matrix depending on the key size. The state is updated in 10, 12, or 14 rounds, respectively. The round function is illustrated in Figure 7 and consists of the operations SubBytes, ShiftRows, MixColumns, and AddRoundKey. An additional round key is added before the first round, while MixColumns is omitted in the last round.

<figure><img src="image_8.png" /><figcaption>Fig. 7: Round function of AES.</figcaption></figure>
## C.2 The DL Distinguishers of AES

<table><caption>Table 5: DL distinguishers for 2 to 5 rounds of AES (single-key).</caption><tr><td colspan="2">2 Rounds, Figure 9a</td></tr><tr><td>r<sub>0</sub> = 0, r<sub>m</sub> = 2, r<sub>1</sub> = 0, p = 1, r = 1, q = 1, prq<sup>2</sup> = 1</td><td></td></tr><tr><td>ΔX<sub>0</sub> 01000000000100000000010000000001 ΓX<sub>2</sub> 0000000000850000000600000000000</td><td></td></tr><tr><td colspan="2">3 Rounds, Figure 9b</td></tr><tr><td>r<sub>0</sub> = 0, r<sub>m</sub> = 3, r<sub>1</sub> = 0, p = 1, r = 2<sup>-7.66</sup>, q = 1, prq<sup>2</sup> = 2<sup>-7.66</sup></td><td></td></tr><tr><td>ΔX<sub>0</sub> 00000000000000000000000000000000b400 ΓX<sub>3</sub> 0032000000ab00000066000000980000</td><td></td></tr><tr><td colspan="2">4 Rounds, Figure 9c</td></tr><tr><td>r<sub>0</sub> = 1, r<sub>m</sub> = 3, r<sub>1</sub> = 0, p = 2<sup>-24</sup>, r = 2<sup>-7.66</sup>, q<sup>2</sup> = 1, prq<sup>2</sup> = 2<sup>-31.66</sup></td><td></td></tr><tr><td>ΔX<sub>0</sub> 00005200000000f58f000000007b0000 ΓX<sub>4</sub> 0032000000ab00000066000000980000</td><td></td></tr><tr><td colspan="2">5 Rounds, Figure 9d</td></tr><tr><td>r<sub>0</sub> = 1, r<sub>m</sub> = 3, r<sub>1</sub> = 1, p = 2<sup>-24.00</sup>, r = 2<sup>-7.66</sup>, q<sup>2</sup> = 2<sup>-24.00</sup>, prq<sup>2</sup> = 2<sup>-55.66</sup></td><td></td></tr><tr><td>ΔX<sub>0</sub> 00005200000000f58f000000007b0000 ΓX<sub>4</sub> 0032000000ab00000066000000980000 ΓX<sub>5</sub> 208acd121f4b3ff232f46e51299eda33</td><td></td></tr></table>

<figure><img src="image_9.png" /><figcaption>Fig. 8: Correlation matrix visualization for 3-round AES DL distinguisher.</figcaption></figure>
<figure><img src="image_10.png" /><figcaption>Fig. 9: DL distinguishers for 2 to 5 rounds of AES (difference linear mask).</figcaption></figure>
# D Application to Ascon

## D.1 Brief Specification of Ascon

Ascon is a family of authenticated encryption and hashing designed by the Ascon team [23,24] and has been selected by NIST as the new standard for lightweight cryptography (LWC). Its underlying primitive is a 320-bit permutation. This permutation is defined with a different number of rounds (6, 8, or 12) for different phases of the encryption scheme. The SPN-based round transformation $p$ consists of three steps, $p = p_L \circ p_S \circ p_C$. Ascon's 320-bit state $S$ is split into five 64-bit registers words $x_i$, $S = x_0 \parallel x_1 \parallel x_2 \parallel x_3 \parallel x_4$ (see Figure 10).

<figure><img src="image_11.png" /><figcaption>Fig. 10: The register words of the 320-bit state $S$ and operations $p_L \circ p_S \circ p_C$.</figcaption></figure>

The substitution layer $p_S$ updates the state $S$ with 64 parallel applications of the 5-bit S-box $S(x)$ defined in Figure 11a to each bit-slice of the five registers $x_0...x_4$. The linear diffusion layer $p_L$ applies a linear function $\Sigma_i(x_i)$ defined in Figure 11b to each word $x_i$.

<figure><img src="image_12.png" /><figcaption>Fig. 11: Ascon's substitution layer and linear diffusion layer.</figcaption></figure>
D.2 The DL Distinguishers of Ascon

<figure><img src="image_13.png" /><figcaption>Fig. 12: DL distinguisher II for 4 rounds of Ascon.</figcaption></figure>
<table><caption>Table 6: Specification of DL distinguishers for Ascon (Ĉ: experimental correlation).</caption><thead><tr><th colspan="4">4 Rounds, Figure 6</th></tr><tr><th colspan="4">r<sub>u</sub> = 0, r<sub>m</sub> = 4, r<sub>l</sub> = 0, p = 1, r = 1, q<sup>2</sup> = 1, prq<sup>2</sup> = 1, Ĉ = 1</th></tr><tr><th>ΔX<sub>0</sub></th><th>ΓX<sub>4</sub></th><th></th><th></th></tr></thead><tbody><tr><td>0020000000000000</td><td>c9125b6925b76d24</td><td></td><td></td></tr><tr><td>0000000000000000</td><td>0000000000000000</td><td></td><td></td></tr><tr><td>0000000000000000</td><td>0000000000000000</td><td></td><td></td></tr><tr><td>0020000000000000</td><td>0000000000000000</td><td></td><td></td></tr><tr><td>0020000000000000</td><td>0000000000000000</td><td></td><td></td></tr></tbody><thead><tr><th colspan="4">4 Rounds, Figure 12</th></tr><tr><th colspan="4">r<sub>u</sub> = 0, r<sub>m</sub> = 4, r<sub>l</sub> = 0, p = 1, r = 2<sup>-1</sup>, q<sup>2</sup> = 1, prq<sup>2</sup> = 2<sup>-1</sup>, Ĉ = 2<sup>-1</sup></th></tr><tr><th>ΔX<sub>0</sub></th><th>ΓX<sub>4</sub></th><th></th><th></th></tr></thead><tbody><tr><td>8000000000000000</td><td>496da496ddb49324</td><td></td><td></td></tr><tr><td>0000000000000000</td><td>0000000000000000</td><td></td><td></td></tr><tr><td>0000000000000000</td><td>0000000000000000</td><td></td><td></td></tr><tr><td>0000000000000000</td><td>0000000000000000</td><td></td><td></td></tr><tr><td>0000000000000000</td><td>0000000000000000</td><td></td><td></td></tr></tbody><thead><tr><th colspan="4">4 Rounds, Figure 13</th></tr><tr><th colspan="4">r<sub>u</sub> = 0, r<sub>m</sub> = 4, r<sub>l</sub> = 0, p = 1, r = 2<sup>-1</sup>, q<sup>2</sup> = 1, prq<sup>2</sup> = 2<sup>-1</sup>, Ĉ = 2<sup>-1</sup></th></tr><tr><th>ΔX<sub>0</sub></th><th>ΓX<sub>4</sub></th><th></th><th></th></tr></thead><tbody><tr><td>0000000000000000</td><td>892db492dbb69264</td><td></td><td></td></tr><tr><td>0100000000000000</td><td>ba6e221eea5a47cc</td><td></td><td></td></tr><tr><td>0100000000000000</td><td>0000000000000000</td><td></td><td></td></tr><tr><td>0000000000000000</td><td>0000000000000000</td><td></td><td></td></tr><tr><td>0000000000000000</td><td>0000000000000000</td><td></td><td></td></tr></tbody><thead><tr><th colspan="4">5 Rounds, Figure 14</th></tr><tr><th colspan="4">r<sub>u</sub> = 1, r<sub>m</sub> = 3, r<sub>l</sub> = 1, p = 2<sup>-2</sup>, r = 1, q<sup>2</sup> = 2<sup>-2</sup>, prq<sup>2</sup> = 2<sup>-4</sup>, Ĉ = 2<sup>-4.33</sup></th></tr><tr><th>ΔX<sub>0</sub></th><th>ΔX<sub>1</sub></th><th>ΓX<sub>4</sub></th><th>ΓX<sub>5</sub></th></tr></thead><tbody><tr><td>0000000000000080</td><td>0000000000000000</td><td>0000000000000000</td><td>6da496ddb4932449</td></tr><tr><td>0000000000000000</td><td>0000000000000000</td><td>0000000000000000</td><td>7110f752d23e65d3</td></tr><tr><td>0000000000000000</td><td>00000000000000c2</td><td>0000000000020000</td><td>0000000000000000</td></tr><tr><td>0000000000000080</td><td>0000000000000000</td><td>0000000000000000</td><td>0000000000000000</td></tr><tr><td>0000000000000080</td><td>0000000000000000</td><td>0000000000000000</td><td>e631e6e25c7f614b</td></tr></tbody><thead><tr><th colspan="4">5 Rounds, Figure 14</th></tr><tr><th colspan="4">r<sub>u</sub> = 1, r<sub>m</sub> = 3, r<sub>l</sub> = 1, p = 2<sup>-2</sup>, r = 2<sup>-0.83</sup>, q<sup>2</sup> = 2<sup>-4</sup>, prq<sup>2</sup> = 2<sup>-6.83</sup>, Ĉ = 2<sup>-7.61</sup></th></tr><tr><th>ΔX<sub>0</sub></th><th>ΔX<sub>1</sub></th><th>ΓX<sub>4</sub></th><th>ΓX<sub>5</sub></th></tr></thead><tbody><tr><td>0000000000000000</td><td>0100002010000000</td><td>0000000000000080</td><td>125b6925b76d24c9</td></tr><tr><td>0100000000000000</td><td>0000000000000000</td><td>0000000000000000</td><td>74dc443dd4b48f99</td></tr><tr><td>0100000000000000</td><td>0000000000000000</td><td>0000000000000000</td><td>0000000000000000</td></tr><tr><td>0000000000000000</td><td>0000000000000000</td><td>0000000000000000</td><td>0000000000000000</td></tr><tr><td>0000000000000000</td><td>0000000000000000</td><td>0000000000000000</td><td>0000000000000000</td></tr></tbody></table>
<figure><img src="image_14.png" /><figcaption>active difference unknown difference active mask unknown mask</figcaption></figure>

<caption>Fig. 13: DL distinguisher III for 4 rounds of Ascon.</caption>
<figure><img src="image_15.png" /></figure>

<figure><img src="image_16.png" /><figcaption>Fig. 14: DL distinguisher I for 5 rounds of Ascon.</figcaption></figure>
<figure><img src="image_17.png" /><figcaption>active difference unknown difference active mask unknown mask</figcaption></figure>

<caption>Fig. 15: DL distinguisher II for 5 rounds of Ascon.</caption>
# E Application to SERPENT

## E.1 Brief Specification of SERPENT

The SERPENT family of 128-bit block ciphers with key sizes $k \in \{128, 192, 256\}$ bits was designed by Anderson, Biham, and Knudsen [8] and was a finalist in the AES competition. The state of all family members is a $4 \times 32$ matrix of bits, i.e., it is organized in four 32-bit words $X_0, \dots, X_3$. SERPENT has a very generous security margin with a total of 32 SPN rounds. The round function consists of a round key addition, a bitsliced S-box layer across words, and a linear layer (omitted in the last round) that mixes all four words. The S-box layer alternates between different S-boxes $S_0, \dots, S_7$ in consecutive rounds. Overall, the round function in round $i$ is defined by the instructions in Figure 16, where $Y_i$ is the output state of round $i-1$, $K_i$ is the current round key, and $\lll, \ll$ denote left rotation and left shift, respectively.

<figure><img src="image_18.png" /><figcaption>Fig. 16: Round function of SERPENT.</figcaption></figure>

## E.2 The DL Distinguishers of SERPENT
<figure><img src="image_19.png" /><figcaption>(a) 3-round SERPENT</figcaption></figure>

<figure><img src="image_20.png" /><figcaption>Fig. 17: DL distinguishers for 3 to 4 rounds of SERPENT.</figcaption></figure>
<figure><img src="image_21.png" /><figcaption>Fig. 18: DL distinguishers for 5 to 6 rounds of SERPENT.</figcaption></figure>
<figure><img src="image_22.png" /></figure>

<figure><img src="image_23.png" /><figcaption>Fig. 19: DL distinguishers for 7 to 8 rounds of SERPENT.</figcaption></figure>
<figure><img src="image_24.png" /><figcaption>Fig. 20: DL distinguishers for 9 rounds of SERPENT.</figcaption></figure>
# F Application to SKINNY

## F.1 Brief Specification of SKINNY

SKINNY is a family of tweakable block ciphers introduced by Beierle et al. at CRYPTO 2016 [5]. The SKINNY family offers two block sizes, $n \in \{64, 128\}$, and for each block size there are three tweakey sizes available, $t \in \{n, 2n, 3n\}$. SKINNY-$n$-$t$ denotes SKINNY with $n$-bit blocks and $t$-bit tweakey. The internal state is a $4 \times 4$ array of cells, where the cell size is 4 (or 8) bits when $n = 64$ (resp. $n = 128$). The tweakey state consists of $z$ arrays TK1, TK2, ..., TKz of $4 \times 4$ cells, where $z = \frac{t}{n} \in \{1, 2, 3\}$ depends on the tweakey size.

<figure><img src="image_25.png" /><figcaption>Fig. 21: Round function of SKINNY</figcaption></figure>

Each round of SKINNY applies five basic operations to the internal state: SubCells (SC), AddConstants (AC), AddRoundTweakey (ART), ShiftRows (SR), and MixColumns (MC) (see Figure 21). The SC operation applies a 4-bit (or 8-bit) S-box on each cell. AC XORs the round constant to the internal state. In the ART layer, the cells in the first and the second rows of subtweakey are XORed to the corresponding cells in the internals state. SR applies a permutation $P$ on the position of the state cells, where $P = [0, 1, 2, 3, 7, 4, 5, 6, 10, 11, 8, 9, 13, 14, 15, 12]$. MC multiplies each column of the internal state by a non-MDS matrix $M$:

$$M = \begin{pmatrix} 1 & 0 & 1 & 1 \\ 1 & 0 & 0 & 0 \\ 0 & 1 & 1 & 0 \\ 1 & 0 & 1 & 0 \end{pmatrix}, \quad M^{-1} = \begin{pmatrix} 0 & 1 & 0 & 0 \\ 0 & 1 & 1 & 1 \\ 0 & 1 & 0 & 1 \\ 1 & 0 & 0 & 1 \end{pmatrix}.$$

The tweakey schedule of SKINNY updates each $n$-bit tweakey array TK1, ..., TKz independently with a linear update function: First, a permutation $h$ is applied to each tweakey array, such that $TKm_r[n] \leftarrow TKm_{r-1}[h(n)]$ for all $0 \le n \le 15$, and $m \in \{1, 2, 3\}$. Next, an LFSR is applied to each cell of the first and the second rows of TK2r and TK3r. The final subtweakey added in the $r$th round is then the XOR of these $z$ arrays.

## F.2 The DL Distinguishers of SKINNY
<table><caption>Table 8: Specification of DL distinguishers for SKINNY-64 (Single-Tweakey) (Ĉ: experimental correlation)</caption><tbody><tr><td colspan="4">6 Rounds, Figure 22a<br>r<sub>u</sub> = 0, r<sub>m</sub> = 6, r<sub>l</sub> = 0, p = 1, r = 1, q<sup>2</sup> = 1, prq<sup>2</sup> = 1</td></tr><tr><td>ΔX<sub>0</sub></td><td>0000000000008000</td><td>ΓX<sub>6</sub></td><td>2000022902202229</td></tr><tr><td colspan="4">7 Rounds, Figure 22b<br>r<sub>u</sub> = 0, r<sub>m</sub> = 6, r<sub>l</sub> = 1, p = 1, r = 1, q<sup>2</sup> = 2<sup>-4</sup>, prq<sup>2</sup> = 2<sup>-4</sup>, Ĉ = 2<sup>-2.32</sup></td></tr><tr><td>ΔX<sub>0</sub></td><td>0000000000000100</td><td></td><td></td></tr><tr><td>ΓX<sub>6</sub></td><td>0000a000000a000</td><td>ΓX<sub>7</sub></td><td>0004040004000404</td></tr><tr><td colspan="4">8 Rounds, Figure 22c<br>r<sub>u</sub> = 0, r<sub>m</sub> = 7, r<sub>l</sub> = 1, p = 1, r = 2<sup>-3.87</sup>, q<sup>2</sup> = 2<sup>-4</sup>, prq<sup>2</sup> = 2<sup>-7.87</sup>, Ĉ = 2<sup>-6.75</sup></td></tr><tr><td>ΔX<sub>0</sub></td><td>0000000000000040</td><td></td><td></td></tr><tr><td>ΓX<sub>7</sub></td><td>9000000000009000</td><td>ΓX<sub>8</sub></td><td>0008c00000000008</td></tr><tr><td colspan="4">9 Rounds, Figure 23a<br>r<sub>u</sub> = 1, r<sub>m</sub> = 7, r<sub>l</sub> = 1, p = 2<sup>-6</sup>, r = 2<sup>-3.94</sup>, q<sup>2</sup> = 2<sup>-4</sup>, prq<sup>2</sup> = 2<sup>-13.94</sup>, Ĉ = 2<sup>-10.86</sup></td></tr><tr><td>ΔX<sub>0</sub></td><td>0000010010000001</td><td>ΔX<sub>1</sub></td><td>0000000000000090</td></tr><tr><td>ΓX<sub>8</sub></td><td>9000000000009000</td><td>ΓX<sub>9</sub></td><td>0008c00000000008</td></tr><tr><td colspan="4">10 Rounds, Figure 23b<br>r<sub>u</sub> = 1, r<sub>m</sub> = 8, r<sub>l</sub> = 1, p = 2<sup>-6</sup>, r = 2<sup>-7.72</sup>, q<sup>2</sup> = 2<sup>-6</sup>, prq<sup>2</sup> = 2<sup>-19.72</sup></td></tr><tr><td>ΔX<sub>0</sub></td><td>0000010010000001</td><td>ΔX<sub>1</sub></td><td>00000000000000b0</td></tr><tr><td>ΓX<sub>9</sub></td><td>000000b000b000b0</td><td>ΓX<sub>10</sub></td><td>0900900900099909</td></tr><tr><td colspan="4">11 Rounds, Figure 23c<br>r<sub>u</sub> = 1, r<sub>m</sub> = 8, r<sub>l</sub> = 2, p = 2<sup>-6</sup>, r = 2<sup>-10.36</sup>, q<sup>2</sup> = 2<sup>-8.87</sup>, prq<sup>2</sup> = 2<sup>-26.36</sup></td></tr><tr><td>ΔX<sub>0</sub></td><td>0000040010000004</td><td>ΔX<sub>1</sub></td><td>00000000000000b0</td></tr><tr><td>ΓX<sub>10</sub></td><td>0100000000000100</td><td>ΓX<sub>11</sub></td><td>000bb0b000b000bb</td></tr></tbody></table>

<table><caption>Table 9: DL distinguishers for SKINNY-64-128 (Related-Tweakey)</caption><tbody><tr><td colspan="4">8 Rounds, Figure 24<br>r<sub>u</sub> = 0, r<sub>m</sub> = 8, r<sub>l</sub> = 0, p = 1, r = 1, q<sup>2</sup> = 1, prq<sup>2</sup> = 1</td></tr><tr><td>ΔTK</td><td>0000000000040000000000000020000</td><td></td><td></td></tr><tr><td>ΔX<sub>0</sub></td><td>0000000000000000</td><td>ΓX<sub>8</sub></td><td>0010170010001710</td></tr><tr><td colspan="4">14 Rounds, Figure 25a<br>r<sub>u</sub> = 2, r<sub>m</sub> = 10, r<sub>l</sub> = 2, p = 2<sup>-4</sup>, r = 2<sup>-9.03</sup>, q<sup>2</sup> = 2<sup>-10</sup>, prq<sup>2</sup> = 2<sup>-23.03</sup></td></tr><tr><td>ΔTK</td><td>00000000040000000000000010000000</td><td></td><td></td></tr><tr><td>ΔX<sub>0</sub></td><td>0000000000000000c</td><td>ΔX<sub>2</sub></td><td>0000000000000000</td></tr><tr><td>ΓX<sub>12</sub></td><td>a00000000000a000</td><td>ΓX<sub>14</sub></td><td>0020020f02000220</td></tr><tr><td colspan="4">15 Rounds, Figure 25b<br>r<sub>u</sub> = 3, r<sub>m</sub> = 10, r<sub>l</sub> = 2, p = 2<sup>-10.42</sup>, r = 2<sup>-8.30</sup>, q<sup>2</sup> = 2<sup>-10</sup>, prq<sup>2</sup> = 2<sup>-28.72</sup></td></tr><tr><td>ΔTK</td><td>c0000000000000000f0000000000000000</td><td></td><td></td></tr><tr><td>ΔX<sub>0</sub></td><td>20000100d00d000</td><td>ΔX<sub>3</sub></td><td>0000000000000000</td></tr><tr><td>ΓX<sub>13</sub></td><td>a00000000000a000</td><td>ΓX<sub>15</sub></td><td>00400f040f000f40</td></tr></tbody></table>
<figure><img src="image_26.png" /><figcaption>(a) DL distinguisher for 6 rounds of SKINNY</figcaption></figure>

<figure><img src="image_27.png" /><figcaption>(b) DL distinguisher for 7 rounds of SKINNY</figcaption></figure>

<figure><img src="image_28.png" /><figcaption>(c) DL distinguisher for 8 rounds of SKINNY</figcaption></figure>

<caption>Fig. 22: DL distinguishers for 6 to 8 rounds of SKINNY-64 (Single-Tweakey) (difference linear mask)</caption>
<figure><img src="image_29.png" /><figcaption>(a) DL distinguisher for 9 rounds of SKINNY</figcaption></figure>

<figure><img src="image_30.png" /><figcaption>(b) DL distinguisher for 10 rounds of SKINNY</figcaption></figure>

<figure><img src="image_31.png" /><figcaption>(c) DL distinguisher for 11 rounds of SKINNY</figcaption></figure>

<caption>Fig. 23: DL distinguishers for 9 to 11 rounds of SKINNY-64 (Single-Tweakey) (difference linear mask)</caption>
<figure><img src="image_32.png" /><figcaption>Fig. 24: DL distinguisher for 8 rounds of SKINNY-64-128 (Related-Tweakey) (difference linear mask)</figcaption></figure>

<table><caption>Table 10: DL distinguishers for SKINNY-64-192 (Related-Tweakey)</caption><tr><td colspan="4">10 Rounds, Figure 26a</td></tr><tr><td colspan="4">r<sub>u</sub> = 0, r<sub>m</sub> = 10, r<sub>l</sub> = 0, p = 1, r = 1, q<sup>2</sup> = 1, prq<sup>2</sup> = 1</td></tr><tr><td colspan="4">ΔTK 00000000000008000000000000000b0000000000000000e00</td></tr><tr><td>ΔX<sub>0</sub></td><td>0000000000000000</td><td>ΓX<sub>8</sub></td><td>0010130010001310</td></tr><tr><td colspan="4">16 Rounds, Figure 25a</td></tr><tr><td colspan="4">r<sub>u</sub> = 7, r<sub>m</sub> = 7, r<sub>l</sub> = 2, p = 2<sup>-2.42</sup>, r = 2<sup>-8.15</sup>, q<sup>2</sup> = 2<sup>-10</sup>, prq<sup>2</sup> = 2<sup>-20.57</sup></td></tr><tr><td colspan="4">ΔTK 000000000100000000000000b00000000000000008000000</td></tr><tr><td>ΔX<sub>0</sub></td><td>0000000000000200</td><td>ΔX<sub>7</sub></td><td>000000000000000</td></tr><tr><td>ΓX<sub>14</sub></td><td>3000000000003000</td><td>ΓX<sub>16</sub></td><td>00c00c0c0c000cc0</td></tr><tr><td colspan="4">17 Rounds, Figure 25b</td></tr><tr><td colspan="4">r<sub>u</sub> = 8, r<sub>m</sub> = 7, r<sub>l</sub> = 2, p = 2<sup>-9.09</sup>, r = 2<sup>-8.50</sup>, q<sup>2</sup> = 2<sup>-10</sup>, prq<sup>2</sup> = 2<sup>-27.59</sup></td></tr><tr><td colspan="4">ΔTK 0200000000000000700000000000000010000000000000</td></tr><tr><td>ΔX<sub>0</sub></td><td>090020000020020</td><td>ΔX<sub>8</sub></td><td>000000000000000</td></tr><tr><td>ΓX<sub>15</sub></td><td>3000000000003000</td><td>ΓX<sub>17</sub></td><td>00c00c0c0c000cc0</td></tr></table>
<figure><img src="image_33.png" /><figcaption>(a) DL distinguisher for 14 rounds of SKINNY-64-128</figcaption></figure>

<figure><img src="image_34.png" /><figcaption>(b) DL distinguisher for 15 rounds of SKINNY-64-128</figcaption></figure>

<caption>Fig. 25: DL distinguishers for 14 to 15 rounds of SKINNY-64-128 (Related-Tweakey) (difference) (linear mask)</caption>
<figure><img src="image_35.png" /><figcaption>(a) DL distinguisher for 10 rounds of SKINNY-64-192 (Related-Tweakey) (difference linear mask)</figcaption></figure>

<figure><img src="image_36.png" /><figcaption>(b) DL distinguisher for 16 rounds of SKINNY-64-192</figcaption></figure>

<caption>Fig. 26: DL distinguishers for 10 and 16 rounds of SKINNY-64-192 (Related-Tweakey) (difference linear mask)</caption>
<figure><img src="image_37.png" /><figcaption>Fig. 27: DL distinguishers for 17 rounds of SKINNY-64-192 (Related-Tweakey) (difference ▷ linear mask)</figcaption></figure>
# G Application to PRESENT

## G.1 Brief Specification of PRESENT

PRESENT is a 64-bit block cipher supporting 80-bit and 128-bit keys designed by Bogdanov et al. in 2007 [14]. The design is a minimalistic SPN construction consisting of a round key addition, a 4-bit S-box layer, and a bit permutation layer. The S-box is specified in Table 11. The bit permutation and the entire round function are both illustrated in Figure 28. The full diffusion of PRESENT is achieved after 4 rounds.

<table><caption>Table 11: S-box of PRESENT</caption><tr><td>x</td><td>0</td><td>1</td><td>2</td><td>3</td><td>4</td><td>5</td><td>6</td><td>7</td><td>8</td><td>9</td><td>a</td><td>b</td><td>c</td><td>d</td><td>e</td><td>f</td></tr><tr><td>S(x)</td><td>c</td><td>5</td><td>6</td><td>b</td><td>9</td><td>0</td><td>a</td><td>d</td><td>3</td><td>e</td><td>f</td><td>8</td><td>4</td><td>7</td><td>1</td><td>2</td></tr></table>

<figure><img src="image_38.png" /><figcaption>Fig. 28: Round function of PRESENT.</figcaption></figure>

## G.2 The DL Distinguishers of PRESENT

Table 12 briefly describes the DL distinguishers of PRESENT.
<table><caption>Table 12: Specification of DL distinguishers for PRESENT</caption><thead><tr><th></th><th colspan="3">3 Rounds, Figure 29a</th></tr><tr><th></th><th>r<sub>u</sub> = 0, r<sub>m</sub> = 3, r<sub>l</sub> = 0, p = 1, r = 1, q<sup>2</sup> = 1, prq<sup>2</sup> = 1</th><th></th><th></th></tr></thead><tbody><tr><td>ΔX<sub>0</sub></td><td>9900000900900000</td><td>ΓX<sub>3</sub></td><td>1111111111111111</td></tr><tr><td></td><td></td><td></td><td></td></tr><tr><td></td><td colspan="3">4 Rounds, Figure 29b</td></tr><tr><td></td><td>r<sub>u</sub> = 0, r<sub>m</sub> = 4, r<sub>l</sub> = 0, p = 1, r = 2<sup>-0.82</sup>, q<sup>2</sup> = 1, prq<sup>2</sup> = 2<sup>-0.82</sup></td><td></td><td></td></tr><tr><td>ΔX<sub>0</sub></td><td>00000000000000090</td><td>ΓX<sub>4</sub></td><td>0010000000000000</td></tr><tr><td></td><td></td><td></td><td></td></tr><tr><td></td><td colspan="3">5 Rounds, Figure 30</td></tr><tr><td></td><td>r<sub>u</sub> = 0, r<sub>m</sub> = 5, r<sub>l</sub> = 0, p = 1, r = 2<sup>-1.19</sup>, q<sup>2</sup> = 1, prq<sup>2</sup> = 2<sup>-1.19</sup></td><td></td><td></td></tr><tr><td>ΔX<sub>0</sub></td><td>000000000000090000</td><td>ΓX<sub>5</sub></td><td>0010000000100010</td></tr><tr><td></td><td></td><td></td><td></td></tr><tr><td></td><td colspan="3">6 Rounds, Figure 31</td></tr><tr><td></td><td>r<sub>u</sub> = 0, r<sub>m</sub> = 6, r<sub>l</sub> = 0, p = 1, r = 2<sup>-2.85</sup>, q<sup>2</sup> = 1, prq<sup>2</sup> = 2<sup>-2.85</sup></td><td></td><td></td></tr><tr><td>ΔX<sub>0</sub></td><td>00000000000000090</td><td>ΓX<sub>6</sub></td><td>0800000008000800</td></tr><tr><td></td><td></td><td></td><td></td></tr><tr><td></td><td colspan="3">7 Rounds, Figure 32</td></tr><tr><td></td><td>r<sub>u</sub> = 0, r<sub>m</sub> = 7, r<sub>l</sub> = 0, p = 1, r = 2<sup>-5.32</sup>, q<sup>2</sup> = 1, prq<sup>2</sup> = 2<sup>-5.32</sup></td><td></td><td></td></tr><tr><td>ΔX<sub>0</sub></td><td>0000009000000000</td><td>ΓX<sub>7</sub></td><td>0800000008000800</td></tr><tr><td></td><td></td><td></td><td></td></tr><tr><td></td><td colspan="3">8 Rounds, Figure 33</td></tr><tr><td></td><td>r<sub>u</sub> = 0, r<sub>m</sub> = 8, r<sub>l</sub> = 0, p = 1, r = 2<sup>-6.43</sup>, q<sup>2</sup> = 1, prq<sup>2</sup> = 2<sup>-6.43</sup></td><td></td><td></td></tr><tr><td>ΔX<sub>0</sub></td><td>00000000000000090</td><td>ΓX<sub>8</sub></td><td>0080000000800080</td></tr><tr><td></td><td></td><td></td><td></td></tr><tr><td></td><td colspan="3">9 Rounds, Figure 34</td></tr><tr><td></td><td>r<sub>u</sub> = 0, r<sub>m</sub> = 9, r<sub>l</sub> = 0, p = 1, r = 2<sup>-9.23</sup>, q<sup>2</sup> = 1, prq<sup>2</sup> = 2<sup>-9.23</sup></td><td></td><td></td></tr><tr><td>ΔX<sub>0</sub></td><td>0000009000000000</td><td>ΓX<sub>9</sub></td><td>002000000200020</td></tr><tr><td></td><td></td><td></td><td></td></tr><tr><td></td><td colspan="3">10 Rounds, Figure 35</td></tr><tr><td></td><td>r<sub>u</sub> = 1, r<sub>m</sub> = 8, r<sub>l</sub> = 1, p = 2<sup>-4</sup>, r = 2<sup>-7.97</sup>, q<sup>2</sup> = 2<sup>-2</sup>, prq<sup>2</sup> = 2<sup>-13.97</sup></td><td></td><td></td></tr><tr><td>ΔX<sub>0</sub></td><td>00000000000007007</td><td>ΔX<sub>1</sub></td><td>0000000000000009</td></tr><tr><td>ΓX<sub>9</sub></td><td>0000000000800000</td><td>ΓX<sub>10</sub></td><td>0020002000200000</td></tr><tr><td></td><td></td><td></td><td></td></tr><tr><td></td><td colspan="3">11 Rounds, Figure 36</td></tr><tr><td></td><td>r<sub>u</sub> = 2, r<sub>m</sub> = 9, r<sub>l</sub> = 0, p = 2<sup>-6</sup>, r = 2<sup>-11.36</sup>, q<sup>2</sup> = 1, prq<sup>2</sup> = 2<sup>-17.36</sup></td><td></td><td></td></tr><tr><td>ΔX<sub>0</sub></td><td>0000000090090000</td><td>ΔX<sub>2</sub></td><td>0000020000000000</td></tr><tr><td>ΓX<sub>11</sub></td><td>0800000008000800</td><td>-</td><td>-</td></tr><tr><td></td><td></td><td></td><td></td></tr><tr><td></td><td colspan="3">12 Rounds, Figure 37</td></tr><tr><td></td><td>r<sub>u</sub> = 2, r<sub>m</sub> = 9, r<sub>l</sub> = 1, p = 2<sup>-6</sup>, r = 2<sup>-11.77</sup>, q<sup>2</sup> = 2<sup>-6</sup>, prq<sup>2</sup> = 2<sup>-23.77</sup></td><td></td><td></td></tr><tr><td>ΔX<sub>0</sub></td><td>00000000700f0000</td><td>ΔX<sub>2</sub></td><td>0000000200000000</td></tr><tr><td>ΓX<sub>11</sub></td><td>0800000008000800</td><td>ΓX<sub>12</sub></td><td>4044404440444044</td></tr><tr><td></td><td></td><td></td><td></td></tr><tr><td></td><td colspan="3">13 Rounds, Figure 38</td></tr><tr><td></td><td>r<sub>u</sub> = 1, r<sub>m</sub> = 8, r<sub>l</sub> = 4, p = 2<sup>-4</sup>, r = 2<sup>-9.01</sup>, q<sup>2</sup> = 2<sup>-14</sup>, prq<sup>2</sup> = 2<sup>-27.01</sup></td><td></td><td></td></tr><tr><td>ΔX<sub>0</sub></td><td>9009000000000000</td><td>ΔX<sub>1</sub></td><td>0000900000000000</td></tr><tr><td>ΓX<sub>9</sub></td><td>0080000000000000</td><td>ΓX<sub>13</sub></td><td>40004000000004000</td></tr></tbody></table>
<figure><img src="image_39.png" /><figcaption>Fig. 29: DL distinguishers for 3-4 rounds of PRESENT (— differential — linear)</figcaption></figure>
<figure><img src="image_40.png" /><figcaption>Fig. 30: DL distinguisher for 5 rounds of PRESENT</figcaption></figure>
<figure><img src="image_41.png" /><figcaption>Fig. 31: DL distinguisher for 6 rounds of PRESENT</figcaption></figure>
<figure><img src="image_42.png" /><figcaption>Fig. 32: DL distinguisher for 7 rounds of PRESENT</figcaption></figure>
<figure><img src="image_43.png" /><figcaption>Fig. 33: DL distinguisher for 8 rounds of PRESENT (— differential - linear)</figcaption></figure>
<figure><img src="image_44.png" /><figcaption>Fig. 34: DL distinguisher for 9 rounds of PRESENT (— differential — linear)</figcaption></figure>
<figure><img src="image_45.png" /><figcaption>Fig. 35: DL distinguisher for 10 rounds of PRESENT (— differential — linear)</figcaption></figure>
<figure><img src="image_46.png" /><figcaption>Fig. 36: DL distinguisher for 11 rounds of PRESENT (— differential — linear)</figcaption></figure>
<figure><img src="image_47.png" /><figcaption>Fig. 37: DL distinguisher for 12 rounds of PRESENT (— differential — linear)</figcaption></figure>
<figure><img src="image_48.png" /><figcaption>Fig. 38: DL distinguisher for 13 rounds of PRESENT (— differential — linear)</figcaption></figure>
# H Application to KNOT

## H.1 Brief Specification of KNOT

KNOT was a round-2 candidate in the NIST Lightweight Cryptography project designed by Zhang et al. [59]. Its core primitive is the KNOT permutation, available in three variants with 256-bit, 384-bit, or 512-bit state size, respectively. The state is organized in 4 words of 64, 96, or 128 bits. We focus on the 256-bit variant with 64-bit words used in the primary recommendation for LWC in the following. Each of the variants uses a similar round function consisting of a round constant addition, a bitsliced S-box layer (SubColumn), and a word-wise rotation (ShiftRow). The number of rounds differs between the phases of the authenticated encryption scheme and is 52 (initialization), 28 (data), or 32 (finalization). The S-box is specified in Table 13, and its differential and linear properties are given in Table 14 and Table 15, respectively. In the rotation layer of the 256-bit variant, the words $a_0, a_1, a_2, a_3$ are rotated left as follows:

$$a_0 \leftarrow a_0 \ll 0$$

$$a_1 \leftarrow a_1 \ll 1$$

$$a_2 \leftarrow a_2 \ll 8$$

$$a_3 \leftarrow a_3 \ll 25$$

<table><caption>Table 13: S-box of KNOT</caption><tr><td>x</td><td>0</td><td>1</td><td>2</td><td>3</td><td>4</td><td>5</td><td>6</td><td>7</td><td>8</td><td>9</td><td>a</td><td>b</td><td>c</td><td>d</td><td>e</td><td>f</td></tr><tr><td>S(x)</td><td>4</td><td>0</td><td>a</td><td>7</td><td>b</td><td>e</td><td>1</td><td>d</td><td>9</td><td>f</td><td>6</td><td>8</td><td>5</td><td>2</td><td>c</td><td>3</td></tr></table>

## H.2 The DL Distinguishers of KNOT
<table><caption>Table 14: DDT of KNOT's S-box</caption><thead><tr><th>Δ<sub>i</sub> \ Δ<sub>o</sub></th><th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>a</th><th>b</th><th>c</th><th>d</th><th>e</th><th>f</th></tr></thead><tbody><tr><th>0</th><td>16</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>1</th><td>0</td><td>0</td><td>0</td><td>0</td><td>2</td><td>2</td><td>2</td><td>2</td><td>0</td><td>0</td><td>0</td><td>0</td><td>2</td><td>2</td><td>2</td><td>2</td></tr><tr><th>2</th><td>0</td><td>2</td><td>0</td><td>2</td><td>0</td><td>0</td><td>0</td><td>4</td><td>0</td><td>2</td><td>2</td><td>0</td><td>0</td><td>0</td><td>2</td><td>2</td></tr><tr><th>3</th><td>0</td><td>2</td><td>0</td><td>2</td><td>0</td><td>0</td><td>4</td><td>0</td><td>0</td><td>2</td><td>2</td><td>0</td><td>0</td><td>0</td><td>2</td><td>2</td></tr><tr><th>4</th><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>4</td><td>4</td><td>2</td><td>2</td><td>2</td><td>2</td></tr><tr><th>5</th><td>0</td><td>0</td><td>0</td><td>0</td><td>2</td><td>2</td><td>2</td><td>2</td><td>0</td><td>0</td><td>4</td><td>4</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>6</th><td>0</td><td>2</td><td>0</td><td>2</td><td>0</td><td>4</td><td>0</td><td>0</td><td>0</td><td>2</td><td>2</td><td>0</td><td>2</td><td>2</td><td>0</td><td>0</td></tr><tr><th>7</th><td>0</td><td>2</td><td>0</td><td>2</td><td>4</td><td>0</td><td>0</td><td>0</td><td>0</td><td>2</td><td>2</td><td>0</td><td>2</td><td>2</td><td>0</td><td>0</td></tr><tr><th>8</th><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>4</td><td>4</td><td>4</td><td>4</td></tr><tr><th>9</th><td>0</td><td>4</td><td>4</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>4</td><td>0</td><td>4</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>a</th><td>0</td><td>0</td><td>2</td><td>2</td><td>2</td><td>0</td><td>0</td><td>2</td><td>4</td><td>0</td><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>2</td></tr><tr><th>b</th><td>0</td><td>0</td><td>2</td><td>2</td><td>0</td><td>2</td><td>2</td><td>0</td><td>4</td><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>2</td><td>0</td></tr><tr><th>c</th><td>0</td><td>4</td><td>4</td><td>0</td><td>2</td><td>2</td><td>2</td><td>2</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>d</th><td>0</td><td>0</td><td>0</td><td>0</td><td>2</td><td>2</td><td>2</td><td>2</td><td>0</td><td>4</td><td>0</td><td>4</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>e</th><td>0</td><td>0</td><td>2</td><td>2</td><td>0</td><td>2</td><td>2</td><td>0</td><td>4</td><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>2</td><td>0</td></tr><tr><th>f</th><td>0</td><td>0</td><td>2</td><td>2</td><td>2</td><td>0</td><td>0</td><td>2</td><td>4</td><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>2</td><td>0</td></tr></tbody></table>

<table><caption>Table 15: LAT of KNOT's S-box (scale: $2^4 \cdot \text{correlation}$)</caption><thead><tr><th>λ<sub>i</sub> \ λ<sub>o</sub></th><th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>a</th><th>b</th><th>c</th><th>d</th><th>e</th><th>f</th></tr></thead><tbody><tr><th>0</th><td>16</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>1</th><td>0</td><td>0</td><td>4</td><td>-4</td><td>0</td><td>-8</td><td>-4</td><td>-4</td><td>0</td><td>0</td><td>4</td><td>-4</td><td>-8</td><td>0</td><td>4</td><td>4</td></tr><tr><th>2</th><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>8</td><td>8</td><td>0</td><td>0</td><td>8</td><td>-8</td><td>0</td><td>0</td></tr><tr><th>3</th><td>0</td><td>-8</td><td>4</td><td>4</td><td>0</td><td>0</td><td>-4</td><td>4</td><td>0</td><td>0</td><td>-4</td><td>4</td><td>-8</td><td>0</td><td>-4</td><td>-4</td></tr><tr><th>4</th><td>0</td><td>4</td><td>0</td><td>4</td><td>0</td><td>4</td><td>8</td><td>-4</td><td>0</td><td>4</td><td>0</td><td>4</td><td>-8</td><td>0</td><td>-4</td><td>4</td></tr><tr><th>5</th><td>0</td><td>4</td><td>-4</td><td>-8</td><td>0</td><td>-4</td><td>-4</td><td>0</td><td>0</td><td>4</td><td>-4</td><td>8</td><td>0</td><td>-4</td><td>-4</td><td>0</td></tr><tr><th>6</th><td>0</td><td>-4</td><td>8</td><td>4</td><td>0</td><td>-4</td><td>0</td><td>-4</td><td>0</td><td>4</td><td>0</td><td>4</td><td>8</td><td>-4</td><td>0</td><td>4</td></tr><tr><th>7</th><td>0</td><td>4</td><td>4</td><td>0</td><td>0</td><td>-4</td><td>4</td><td>-8</td><td>0</td><td>-4</td><td>-4</td><td>0</td><td>0</td><td>4</td><td>-4</td><td>-8</td></tr><tr><th>8</th><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>8</td><td>8</td><td>0</td><td>0</td><td>8</td><td>-8</td><td>0</td><td>0</td></tr><tr><th>9</th><td>0</td><td>0</td><td>-4</td><td>4</td><td>8</td><td>0</td><td>-4</td><td>-4</td><td>0</td><td>0</td><td>4</td><td>-4</td><td>0</td><td>-8</td><td>-4</td><td>-4</td></tr><tr><th>a</th><td>0</td><td>8</td><td>0</td><td>8</td><td>0</td><td>-8</td><td>0</td><td>8</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>b</th><td>0</td><td>0</td><td>-4</td><td>4</td><td>-8</td><td>0</td><td>-4</td><td>-4</td><td>0</td><td>8</td><td>-4</td><td>-4</td><td>0</td><td>0</td><td>4</td><td>-4</td></tr><tr><th>c</th><td>0</td><td>4</td><td>0</td><td>4</td><td>0</td><td>4</td><td>-8</td><td>-4</td><td>8</td><td>-4</td><td>0</td><td>4</td><td>0</td><td>4</td><td>0</td><td>4</td></tr><tr><th>d</th><td>0</td><td>4</td><td>4</td><td>0</td><td>-8</td><td>4</td><td>-4</td><td>0</td><td>-8</td><td>-4</td><td>4</td><td>0</td><td>0</td><td>-4</td><td>-4</td><td>0</td></tr><tr><th>e</th><td>0</td><td>4</td><td>8</td><td>-4</td><td>0</td><td>4</td><td>0</td><td>4</td><td>8</td><td>4</td><td>0</td><td>-4</td><td>0</td><td>-4</td><td>0</td><td>-4</td></tr><tr><th>f</th><td>0</td><td>-4</td><td>-4</td><td>0</td><td>-8</td><td>-4</td><td>4</td><td>0</td><td>8</td><td>-4</td><td>4</td><td>0</td><td>0</td><td>-4</td><td>-4</td><td>0</td></tr></tbody></table>
<table><caption>Table 16: Specification of DL distinguishers for KNOT-256 permutation</caption><thead><tr><th colspan="4">8 Rounds (I), Figure 39a</th></tr><tr><th colspan="4">r<sub>u</sub> = 0, r<sub>m</sub> = 8, r<sub>l</sub> = 0, p = 1, r = 1, q<sup>2</sup> = 1, prq<sup>2</sup> = 1</th></tr><tr><th>ΔX<sub>0</sub></th><th>ΓX<sub>8</sub></th><th></th><th></th></tr></thead><tbody><tr><td>0000000000000000</td><td>0000000000000000</td><td></td><td></td></tr><tr><td>0000000000000000</td><td>0000000000000000</td><td></td><td></td></tr><tr><td>0000000010000000</td><td>0000000000080000</td><td></td><td></td></tr><tr><td>0000000010000000</td><td>0000001000000000</td><td></td><td></td></tr></tbody><thead><tr><th colspan="4">8 Rounds (II), Figure 39b</th></tr><tr><th colspan="4">r<sub>u</sub> = 0, r<sub>m</sub> = 8, r<sub>l</sub> = 0, p = 1, r = 2<sup>-1</sup>, q<sup>2</sup> = 1, prq<sup>2</sup> = 2<sup>-1</sup></th></tr><tr><th>ΔX<sub>0</sub></th><th>ΓX<sub>8</sub></th><th></th><th></th></tr></thead><tbody><tr><td>0000000000000000</td><td>0000800000000000</td><td></td><td></td></tr><tr><td>0000000000000001</td><td>0000000000000000</td><td></td><td></td></tr><tr><td>0000000000000000</td><td>0000000000000000</td><td></td><td></td></tr><tr><td>0000000000000000</td><td>0000000000000000</td><td></td><td></td></tr></tbody><thead><tr><th colspan="4">15 Rounds (I), Figure 40a</th></tr><tr><th colspan="4">r<sub>u</sub> = 4, r<sub>m</sub> = 9, r<sub>l</sub> = 2, p = 2<sup>-10</sup>, r = 2<sup>-3.20</sup>, q<sup>2</sup> = 2<sup>-4</sup>, prq<sup>2</sup> = 2<sup>-17.20</sup></th></tr><tr><th>ΔX<sub>0</sub></th><th>ΔX<sub>4</sub></th><th>ΓX<sub>13</sub></th><th>ΓX<sub>15</sub></th></tr></thead><tbody><tr><td>0000000000000000</td><td>0000000000000000</td><td>0000000000000000</td><td>0000000000000000</td></tr><tr><td>0000000000000000</td><td>0008000000000000</td><td>0000100000000000</td><td>0000000000000000</td></tr><tr><td>0000020000000000</td><td>0000000000000000</td><td>0000000000000000</td><td>0010000000000000</td></tr><tr><td>0000020000000000</td><td>0000000000008000</td><td>0000100000000000</td><td>0000000000000020</td></tr></tbody><thead><tr><th colspan="4">15 Rounds (II), Figure 40b</th></tr><tr><th colspan="4">r<sub>u</sub> = 4, r<sub>m</sub> = 9, r<sub>l</sub> = 2, p = 2<sup>-13</sup>, r = 2<sup>-6.15</sup>, q<sup>2</sup> = 2<sup>-6</sup>, prq<sup>2</sup> = 2<sup>-25.15</sup></th></tr><tr><th>ΔX<sub>0</sub></th><th>ΔX<sub>4</sub></th><th>ΓX<sub>13</sub></th><th>ΓX<sub>15</sub></th></tr></thead><tbody><tr><td>0000000000000000</td><td>0000000000000000</td><td>0000000200000000</td><td>0000020000000000</td></tr><tr><td>0000000000800000</td><td>0000010000000000</td><td>0000000000000000</td><td>0000000000000000</td></tr><tr><td>0000000000000000</td><td>0000000000000001</td><td>0000000000000000</td><td>0000000000000000</td></tr><tr><td>0000000000000000</td><td>0000000000200010</td><td>0000000200000000</td><td>0000000000000000</td></tr></tbody><thead><tr><th colspan="4">23 Rounds, Figure 41</th></tr><tr><th colspan="4">r<sub>u</sub> = 6, r<sub>m</sub> = 9, r<sub>l</sub> = 8, p = 2<sup>-21</sup>, r = 2<sup>-3.77</sup>, q<sup>2</sup> = 2<sup>-34</sup>, prq<sup>2</sup> = 2<sup>-58.88</sup></th></tr><tr><th>ΔX<sub>0</sub></th><th>ΔX<sub>6</sub></th><th>ΓX<sub>15</sub></th><th>ΓX<sub>23</sub></th></tr></thead><tbody><tr><td>0000000000000000</td><td>0000000000000000</td><td>0000002000000000</td><td>0000010000000000</td></tr><tr><td>0000000000000002</td><td>2000000000000000</td><td>0000004000000000</td><td>0000000000000002</td></tr><tr><td>0004000002000000</td><td>0000000000000000</td><td>0000002000000000</td><td>0001000000000000</td></tr><tr><td>0004000002000002</td><td>0000000000200000</td><td>0000004000000000</td><td>0000000002000002</td></tr></tbody></table>
<figure><img src="image_49.png" /><figcaption>Fig. 39: DL distinguishers for 8 rounds of KNOT.</figcaption></figure>
<figure><img src="image_50.png" /><figcaption>Fig. 40: DL distinguishers for 15 rounds of KNOT.</figcaption></figure>
<figure><img src="image_51.png" /><figcaption>Fig. 41: DL distinguishers for 23 rounds of KNOT (active difference unknown difference active mask unknown mask).</figcaption></figure>
# I Application to Simeck

## I.1 Brief Specification of Simeck

Simeck is a family of lightweight block ciphers designed introduced in CHES 2015 [58]. The design is inspired by Simon and Speck [4], combining an AndRX round function similar to Simon with a nonlinear key schedule as in Speck. The Simeck family consists of several family members Simeck2n/4n operating on n-bit words with a state size of 2n bits and a key size of 4n bits for n ∈ {16, 24, 32}. In round i, the 2n-bit input state of round i is split into two n-bit words (Lᵢ, Rᵢ) and updated with a Feistel-based round function F to produce (Lᵢ₊₁, Rᵢ₊₁) using the n-bit round key Kᵢ. The round function is a quadratic Feistel function using bitwise XOR (x ⊕ y), bitwise AND (x ⊙ y), and cyclic left-shifts by c bits (x ≪ c):

$$ 
\begin{aligned}
R_{i+1} &= L_i \\
L_{i+1} &= R_i \oplus K_i \oplus (L_i \odot (L_i \ll 5)) \oplus (L_i \ll 1),
\end{aligned}
$$

as illustrated in Figure 42. The round key Kᵢ is produced using a similar nonlinear update function. The total number of rounds is 32 rounds for Simeck32-64 (also referred to as Simeck-32 for short), 36 rounds for Simeck48-96 (aka Simeck-48), and 44 rounds for Simeck64-128 (aka Simeck-64). For a more detailed specification, we refer to the design paper [58].

<figure><img src="image_52.png" /><figcaption>Fig. 42: Round function of Simeck-32.</figcaption></figure>

## I.2 The DL Distinguishers of Simeck
<table><caption>Table 17: Specification of DL distinguishers for Simeck-32</caption><thead><tr><th></th><th colspan="3">7 Rounds, Figure 43</th></tr><tr><th></th><th colspan="3">r<sub>u</sub> = 0, r<sub>m</sub> = 7, r<sub>ℓ</sub> = 0, p = 1, r = 1, q<sup>2</sup> = 1, prq<sup>2</sup> = 1</th></tr></thead><tbody><tr><th>ΔX<sub>0</sub></th><td>00001000</td><td>ΓX<sub>7</sub></td><td>00000400</td></tr><tr><th colspan="4">14 Rounds, Figure 44</th></tr><tr><th colspan="4">r<sub>u</sub> = 1, r<sub>m</sub> = 10, r<sub>ℓ</sub> = 3, p = 2<sup>-2</sup>, r = 2<sup>-7.92</sup>, q<sup>2</sup> = 2<sup>-4</sup>, prq<sup>2</sup> = 2<sup>-13.92</sup>, Ĉ = 2<sup>-13.35</sup></th></tr><tr><th>ΔX<sub>0</sub></th><td>00020005</td><td>ΔX<sub>1</sub></td><td>00010002</td></tr><tr><th>ΓX<sub>11</sub></th><td>80000000</td><td>ΓX<sub>14</sub></td><td>4000a000</td></tr></tbody></table>

<table><caption>Table 18: Specification of DL distinguishers for Simeck-48</caption><thead><tr><th></th><th colspan="3">8 Rounds, Figure 45</th></tr><tr><th></th><th colspan="3">r<sub>u</sub> = 0, r<sub>m</sub> = 8, r<sub>ℓ</sub> = 0, p = 1, r = 1, q<sup>2</sup> = 1, prq<sup>2</sup> = 1</th></tr></thead><tbody><tr><th>ΔX<sub>0</sub></th><td>000000020000</td><td>ΓX<sub>6</sub></td><td>000000010000</td></tr><tr><th colspan="4">17 Rounds</th></tr><tr><th colspan="4">r<sub>u</sub> = 1, r<sub>m</sub> = 14, r<sub>ℓ</sub> = 2, p = 2<sup>-2</sup>, r = 2<sup>-9.89</sup>, q<sup>2</sup> = 2<sup>-2</sup>, prq<sup>2</sup> = 2<sup>-13.89</sup>, Ĉ = 2<sup>-13.25</sup></th></tr><tr><th>ΔX<sub>0</sub></th><td>000010000020</td><td>ΔX<sub>1</sub></td><td>000000000010</td></tr><tr><th>ΓX<sub>15</sub></th><td>000010000000</td><td>ΓX<sub>17</sub></td><td>000010000008</td></tr><tr><th colspan="4">18 Rounds, Figure 46</th></tr><tr><th colspan="4">r<sub>u</sub> = 2, r<sub>m</sub> = 14, r<sub>ℓ</sub> = 2, p = 2<sup>-4</sup>, r = 2<sup>-9.89</sup>, q<sup>2</sup> = 2<sup>-2</sup>, prq<sup>2</sup> = 2<sup>-15.89</sup></th></tr><tr><th>ΔX<sub>0</sub></th><td>000020000050</td><td>ΔX<sub>2</sub></td><td>000000000010</td></tr><tr><th>ΓX<sub>16</sub></th><td>000010000000</td><td>ΓX<sub>18</sub></td><td>000010000008</td></tr><tr><th colspan="4">19 Rounds</th></tr><tr><th colspan="4">r<sub>u</sub> = 2, r<sub>m</sub> = 14, r<sub>ℓ</sub> = 3, p = 2<sup>-4</sup>, r = 2<sup>-9.89</sup>, q<sup>2</sup> = 2<sup>-4</sup>, prq<sup>2</sup> = 2<sup>-17.89</sup></th></tr><tr><th>ΔX<sub>0</sub></th><td>000020000050</td><td>ΔX<sub>2</sub></td><td>000000000010</td></tr><tr><th>ΓX<sub>16</sub></th><td>000010000000</td><td>ΓX<sub>19</sub></td><td>000008000014</td></tr><tr><th colspan="4">20 Rounds</th></tr><tr><th colspan="4">r<sub>u</sub> = 3, r<sub>m</sub> = 14, r<sub>ℓ</sub> = 3, p = 2<sup>-8</sup>, r = 2<sup>-9.89</sup>, q<sup>2</sup> = 2<sup>-4</sup>, prq<sup>2</sup> = 2<sup>-21.89</sup></th></tr><tr><th>ΔX<sub>0</sub></th><td>000050000080</td><td>ΔX<sub>3</sub></td><td>000000000010</td></tr><tr><th>ΓX<sub>17</sub></th><td>000010000000</td><td>ΓX<sub>20</sub></td><td>000008000014</td></tr></tbody></table>
<table><caption>Table 19: Specification of DL distinguishers for Simeck-64</caption><thead><tr><th colspan="4">10 Rounds, Figure 47</th></tr><tr><th colspan="4">r<sub>u</sub> = 0, r<sub>m</sub> = 10, r<sub>l</sub> = 0, p = 1, r = 1, q<sup>2</sup> = 1, prq<sup>2</sup> = 1</th></tr></thead><tbody><tr><td>ΔX<sub>0</sub></td><td>0000000000000010</td><td>ΓX<sub>6</sub></td><td>0000000000000002</td></tr><tr><td colspan="4">24 Rounds</td></tr><tr><td colspan="4">r<sub>u</sub> = 3, r<sub>m</sub> = 17, r<sub>l</sub> = 4, p = 2<sup>-4</sup>, r = 2<sup>-13.14</sup>, q<sup>2</sup> = 2<sup>-8</sup>, prq<sup>2</sup> = 2<sup>-25.14</sup></td></tr><tr><td>ΔX<sub>0</sub></td><td>00000040000008e0</td><td>ΔX<sub>3</sub></td><td>0000002000000000</td></tr><tr><td>ΓX<sub>20</sub></td><td>0000001a00000004</td><td>ΓX<sub>24</sub></td><td>0000000000000010</td></tr><tr><td colspan="4">25 Rounds, Figure 48</td></tr><tr><td colspan="4">r<sub>u</sub> = 3, r<sub>m</sub> = 17, r<sub>l</sub> = 5, p = 2<sup>-4</sup>, r = 2<sup>-13.14</sup>, q<sup>2</sup> = 2<sup>-10</sup>, prq<sup>2</sup> = 2<sup>-27.14</sup></td></tr><tr><td>ΔX<sub>0</sub></td><td>00000040000008e0</td><td>ΔX<sub>3</sub></td><td>0000002000000000</td></tr><tr><td>ΓX<sub>20</sub></td><td>0000001a00000004</td><td>ΓX<sub>25</sub></td><td>0000001080000018</td></tr><tr><td colspan="4">26 Rounds, Figure 49</td></tr><tr><td colspan="4">r<sub>u</sub> = 5, r<sub>m</sub> = 16, r<sub>l</sub> = 5, p = 2<sup>-9.30</sup>, r = 2<sup>-13.05</sup>, q<sup>2</sup> = 2<sup>-8</sup>, prq<sup>2</sup> = 2<sup>-30.35</sup></td></tr><tr><td>ΔX<sub>0</sub></td><td>0000001000000020</td><td>ΔX<sub>5</sub></td><td>0000008000000050</td></tr><tr><td>ΓX<sub>21</sub></td><td>0000000e0000004</td><td>ΓX<sub>26</sub></td><td>000000040000000e</td></tr></tbody></table>

<figure><img src="image_53.png" /><figcaption>Fig. 43: DL distinguisher for 7-round Simeck-32 (active difference unknown difference active mask unknown mask).</figcaption></figure>
<figure><img src="image_54.png" /><figcaption>Fig. 44: DL distinguisher for 14-round Simeck-32 (active difference unknown difference active mask unknown mask).</figcaption></figure>
<figure><img src="image_55.png" /><figcaption>Fig. 45: DL distinguisher for 8-round Simeck-48 (active difference unknown difference active mask unknown mask).</figcaption></figure>
<figure><img src="image_56.png" /><figcaption>Fig. 46: DL distinguisher for 18-round Simeck-48 (active difference unknown difference active mask unknown mask).</figcaption></figure>
<figure><img src="image_57.png" /><figcaption>Fig. 47: DL distinguisher for 10-round Simeck-64 ( active difference unknown difference active mask unknown mask).</figcaption></figure>
<figure><img src="image_58.png" /><figcaption>Fig. 48: DL distinguisher for 25-round Simeck-64 (active difference unknown difference active mask unknown mask).</figcaption></figure>
<figure><img src="image_59.png" /><figcaption>Fig. 49: DL distinguisher for 26-round Simeck-64 (active difference unknown difference active mask unknown mask).</figcaption></figure>
# J Application to LBlock and LBlock-s

## J.1 Brief Specification of LBlock

LBlock is a block cipher with a 64-bit block size and an 80-bit key size, introduced in ACNS 2011 [57]. As shown in Figure 50a, the round function of LBlock is a 2-branch balanced Feistel structure that applies an 8-bit left rotation to the right branch. The round function uses 8 different $4 \times 4$ S-boxes, denoted by $S_i$ for $0 \le i \le 7$. Notably, the differential uniformity and linearity of the S-boxes are the same, being 4 and 8, respectively. LBlock achieves full nibble-wise diffusion after 8 rounds. LBlock-s is a simplified version of LBlock, employing exactly the same structure as LBlock, except that it only uses the S-box $S_0$ for all nibbles in the round function. The DDT, LAT, DLCT, and DDLCT of $S_0$ are given in Table 20, Table 21, Table 22, and Table 23, respectively.

<figure><img src="image_60.png" /><figcaption>Fig. 50: LBlock block cipher.</figcaption></figure>

## J.2 The DL Distinguishers of LBlock and LBlock-s
<table><caption>Table 20: DDT of the S-box $S_0$ in LBlock</caption><thead><tr><th>Δ<sub>i</sub> \ Δ<sub>o</sub></th><th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>a</th><th>b</th><th>c</th><th>d</th><th>e</th><th>f</th></tr></thead><tbody><tr><th>0</th><td>16</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>1</th><td>0</td><td>4</td><td>0</td><td>2</td><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>4</td><td>0</td><td>2</td><td>0</td><td>0</td><td>0</td><td>2</td></tr><tr><th>2</th><td>0</td><td>4</td><td>0</td><td>2</td><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>4</td><td>0</td><td>2</td><td>0</td><td>0</td><td>0</td><td>2</td></tr><tr><th>3</th><td>0</td><td>0</td><td>4</td><td>0</td><td>0</td><td>0</td><td>4</td><td>0</td><td>0</td><td>4</td><td>0</td><td>0</td><td>0</td><td>4</td><td>0</td><td>0</td></tr><tr><th>4</th><td>0</td><td>0</td><td>0</td><td>2</td><td>4</td><td>2</td><td>4</td><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>2</td><td>0</td><td>0</td><td>0</td></tr><tr><th>5</th><td>0</td><td>0</td><td>0</td><td>0</td><td>4</td><td>2</td><td>0</td><td>2</td><td>0</td><td>0</td><td>4</td><td>0</td><td>0</td><td>2</td><td>0</td><td>2</td></tr><tr><th>6</th><td>0</td><td>0</td><td>4</td><td>0</td><td>4</td><td>2</td><td>0</td><td>2</td><td>0</td><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>2</td><td>0</td></tr><tr><th>7</th><td>0</td><td>0</td><td>0</td><td>2</td><td>4</td><td>2</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>2</td><td>4</td><td>0</td></tr><tr><th>8</th><td>0</td><td>0</td><td>2</td><td>2</td><td>0</td><td>0</td><td>2</td><td>2</td><td>0</td><td>0</td><td>2</td><td>2</td><td>0</td><td>0</td><td>2</td><td>2</td></tr><tr><th>9</th><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>0</td><td>0</td><td>2</td><td>4</td><td>0</td><td>0</td><td>2</td><td>4</td><td>0</td><td>0</td><td>2</td></tr><tr><th>a</th><td>0</td><td>4</td><td>2</td><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>0</td><td>4</td><td>2</td><td>0</td></tr><tr><th>b</th><td>0</td><td>4</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>4</td><td>0</td><td>0</td><td>0</td><td>4</td><td>4</td><td>0</td><td>0</td></tr><tr><th>c</th><td>0</td><td>0</td><td>2</td><td>2</td><td>0</td><td>2</td><td>2</td><td>0</td><td>2</td><td>2</td><td>0</td><td>2</td><td>0</td><td>0</td><td>0</td><td>2</td></tr><tr><th>d</th><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>2</td><td>0</td><td>0</td><td>2</td><td>2</td><td>2</td><td>0</td><td>2</td><td>0</td><td>2</td><td>2</td></tr><tr><th>e</th><td>0</td><td>0</td><td>2</td><td>0</td><td>0</td><td>2</td><td>2</td><td>2</td><td>2</td><td>2</td><td>0</td><td>2</td><td>2</td><td>0</td><td>0</td><td>0</td></tr><tr><th>f</th><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>2</td><td>2</td><td>2</td><td>2</td><td>2</td><td>0</td><td>2</td><td>0</td><td>0</td></tr></tbody></table>

<table><caption>Table 21: LAT of S-box $S_0$ in LBlock (scale: $2^4 \cdot \text{correlation}$)</caption><thead><tr><th>λ<sub>i</sub> \ λ<sub>o</sub></th><th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>a</th><th>b</th><th>c</th><th>d</th><th>e</th><th>f</th></tr></thead><tbody><tr><th>0</th><td>16</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>1</th><td>0</td><td>0</td><td>0</td><td>0</td><td>-4</td><td>4</td><td>4</td><td>-4</td><td>-8</td><td>-8</td><td>0</td><td>0</td><td>4</td><td>-4</td><td>4</td><td>-4</td></tr><tr><th>2</th><td>0</td><td>0</td><td>0</td><td>-8</td><td>-4</td><td>-4</td><td>4</td><td>-4</td><td>4</td><td>-4</td><td>4</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>0</td></tr><tr><th>3</th><td>0</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>8</td><td>4</td><td>-4</td><td>4</td><td>4</td><td>4</td><td>4</td><td>4</td><td>-4</td></tr><tr><th>4</th><td>0</td><td>0</td><td>0</td><td>0</td><td>8</td><td>0</td><td>8</td><td>0</td><td>0</td><td>0</td><td>0</td><td>8</td><td>0</td><td>-8</td><td>0</td><td>0</td></tr><tr><th>5</th><td>0</td><td>0</td><td>0</td><td>0</td><td>-4</td><td>-4</td><td>4</td><td>4</td><td>0</td><td>0</td><td>8</td><td>-8</td><td>-4</td><td>-4</td><td>-4</td><td>-4</td></tr><tr><th>6</th><td>0</td><td>0</td><td>0</td><td>-8</td><td>4</td><td>-4</td><td>-4</td><td>-4</td><td>-4</td><td>4</td><td>4</td><td>0</td><td>8</td><td>0</td><td>0</td><td>0</td></tr><tr><th>7</th><td>0</td><td>8</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>4</td><td>-4</td><td>4</td><td>4</td><td>4</td><td>-4</td><td>4</td><td>4</td></tr><tr><th>8</th><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>8</td><td>8</td><td>8</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>9</th><td>0</td><td>0</td><td>-8</td><td>-8</td><td>-4</td><td>4</td><td>-4</td><td>4</td><td>0</td><td>0</td><td>0</td><td>4</td><td>-4</td><td>-4</td><td>4</td><td>4</td></tr><tr><th>a</th><td>0</td><td>0</td><td>8</td><td>0</td><td>-4</td><td>-4</td><td>-4</td><td>4</td><td>-4</td><td>-4</td><td>4</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>0</td></tr><tr><th>b</th><td>0</td><td>8</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>8</td><td>-4</td><td>4</td><td>-4</td><td>-4</td><td>4</td><td>4</td><td>4</td><td>-4</td></tr><tr><th>c</th><td>0</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>8</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>8</td><td>0</td><td>8</td><td>0</td></tr><tr><th>d</th><td>0</td><td>0</td><td>-8</td><td>8</td><td>-4</td><td>-4</td><td>-4</td><td>-4</td><td>0</td><td>0</td><td>0</td><td>0</td><td>4</td><td>4</td><td>-4</td><td>-4</td></tr><tr><th>e</th><td>0</td><td>0</td><td>-8</td><td>0</td><td>4</td><td>-4</td><td>4</td><td>4</td><td>-4</td><td>-4</td><td>-4</td><td>4</td><td>-8</td><td>0</td><td>0</td><td>0</td></tr><tr><th>f</th><td>0</td><td>8</td><td>0</td><td>0</td><td>0</td><td>8</td><td>0</td><td>0</td><td>4</td><td>-4</td><td>4</td><td>4</td><td>-4</td><td>-4</td><td>-4</td><td>-4</td></tr></tbody></table>
<table><caption>Table 22: DLCT of S-box $S_0$ in LBlock</caption><thead><tr><th>Δ<sub>i</sub> \ λ<sub>o</sub></th><th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>a</th><th>b</th><th>c</th><th>d</th><th>e</th><th>f</th></tr></thead><tbody><tr><th>0</th><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td></tr><tr><th>1</th><td>16</td><td>-16</td><td>0</td><td>0</td><td>8</td><td>-8</td><td>8</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>2</th><td>16</td><td>-16</td><td>0</td><td>0</td><td>8</td><td>-8</td><td>8</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>3</th><td>16</td><td>16</td><td>-16</td><td>-16</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>4</th><td>16</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>-8</td><td>-8</td><td>8</td><td>8</td><td>8</td><td>0</td><td>0</td><td>-8</td><td>-8</td><td>0</td><td>0</td></tr><tr><th>5</th><td>16</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>8</td><td>-8</td><td>-8</td><td>0</td><td>0</td><td>8</td><td>8</td><td>-8</td><td>-8</td><td>0</td><td>0</td></tr><tr><th>6</th><td>16</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>8</td><td>-8</td><td>-8</td><td>8</td><td>8</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>-8</td></tr><tr><th>7</th><td>16</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>-8</td><td>-8</td><td>8</td><td>0</td><td>0</td><td>8</td><td>8</td><td>0</td><td>0</td><td>-8</td><td>-8</td></tr><tr><th>8</th><td>16</td><td>0</td><td>-16</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>9</th><td>16</td><td>0</td><td>0</td><td>16</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>-8</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>a</th><td>16</td><td>0</td><td>0</td><td>-16</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>8</td><td>-8</td><td>8</td><td>-8</td><td>-8</td></tr><tr><th>b</th><td>16</td><td>0</td><td>16</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>-8</td><td>-8</td><td>-8</td><td>8</td><td>-8</td><td>8</td><td>-8</td><td>-8</td></tr><tr><th>c</th><td>16</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>-8</td><td>0</td><td>0</td><td>-8</td><td>8</td><td>8</td></tr><tr><th>d</th><td>16</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>-8</td><td>8</td></tr><tr><th>e</th><td>16</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>-8</td><td>-8</td><td>8</td><td>0</td><td>0</td><td>0</td></tr><tr><th>f</th><td>16</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>-8</td><td>0</td><td>0</td><td>-8</td><td>8</td><td>0</td><td>0</td><td>0</td></tr></tbody></table>

<table><caption>Table 23: DDLCT of S-box $S_0$ in LBlock</caption><thead><tr><th>Δ<sub>i</sub> \ λ<sub>o</sub></th><th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>a</th><th>b</th><th>c</th><th>d</th><th>e</th><th>f</th></tr></thead><tbody><tr><th>0</th><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td></tr><tr><th>1</th><td>256</td><td>-32</td><td>0</td><td>32</td><td>16</td><td>-48</td><td>16</td><td>-16</td><td>-64</td><td>-64</td><td>-32</td><td>-32</td><td>0</td><td>0</td><td>0</td><td>-32</td></tr><tr><th>2</th><td>256</td><td>-32</td><td>0</td><td>32</td><td>16</td><td>-48</td><td>16</td><td>-16</td><td>-64</td><td>-64</td><td>-32</td><td>-32</td><td>0</td><td>0</td><td>0</td><td>-32</td></tr><tr><th>3</th><td>256</td><td>-64</td><td>0</td><td>-64</td><td>0</td><td>0</td><td>0</td><td>-64</td><td>32</td><td>32</td><td>-32</td><td>-32</td><td>0</td><td>0</td><td>0</td><td>-64</td></tr><tr><th>4</th><td>256</td><td>32</td><td>0</td><td>-32</td><td>-80</td><td>16</td><td>-80</td><td>-16</td><td>32</td><td>32</td><td>0</td><td>0</td><td>-32</td><td>-64</td><td>-32</td><td>-32</td></tr><tr><th>5</th><td>256</td><td>0</td><td>0</td><td>-64</td><td>-64</td><td>-32</td><td>-64</td><td>32</td><td>0</td><td>0</td><td>32</td><td>32</td><td>-32</td><td>-64</td><td>0</td><td>-32</td></tr><tr><th>6</th><td>256</td><td>-64</td><td>0</td><td>0</td><td>-32</td><td>-64</td><td>-32</td><td>0</td><td>0</td><td>0</td><td>32</td><td>32</td><td>-64</td><td>-32</td><td>-32</td><td>0</td></tr><tr><th>7</th><td>256</td><td>32</td><td>0</td><td>-32</td><td>-48</td><td>-16</td><td>-48</td><td>16</td><td>0</td><td>0</td><td>-32</td><td>-32</td><td>-64</td><td>-32</td><td>0</td><td>0</td></tr><tr><th>8</th><td>256</td><td>0</td><td>0</td><td>-64</td><td>-16</td><td>-16</td><td>-16</td><td>-16</td><td>-16</td><td>-16</td><td>-16</td><td>0</td><td>0</td><td>0</td><td>-64</td><td>0</td></tr><tr><th>9</th><td>256</td><td>32</td><td>-64</td><td>-32</td><td>-16</td><td>-16</td><td>-16</td><td>16</td><td>-32</td><td>-32</td><td>-32</td><td>0</td><td>0</td><td>-32</td><td>0</td><td>0</td></tr><tr><th>a</th><td>256</td><td>-96</td><td>0</td><td>-32</td><td>32</td><td>-32</td><td>32</td><td>-64</td><td>-16</td><td>-16</td><td>-16</td><td>0</td><td>0</td><td>-32</td><td>0</td><td>0</td></tr><tr><th>b</th><td>256</td><td>-64</td><td>-64</td><td>0</td><td>32</td><td>-32</td><td>32</td><td>-32</td><td>-32</td><td>-32</td><td>-32</td><td>0</td><td>0</td><td>-64</td><td>64</td><td>0</td></tr><tr><th>c</th><td>256</td><td>0</td><td>-64</td><td>0</td><td>-16</td><td>16</td><td>-16</td><td>-48</td><td>-16</td><td>-16</td><td>-16</td><td>-32</td><td>0</td><td>-32</td><td>0</td><td>0</td></tr><tr><th>d</th><td>256</td><td>32</td><td>-64</td><td>-32</td><td>-16</td><td>16</td><td>-16</td><td>-16</td><td>-32</td><td>-32</td><td>-32</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>e</th><td>256</td><td>-32</td><td>0</td><td>32</td><td>-32</td><td>0</td><td>-32</td><td>-32</td><td>-16</td><td>-16</td><td>-16</td><td>0</td><td>-32</td><td>-32</td><td>-32</td><td>-32</td></tr><tr><th>f</th><td>256</td><td>0</td><td>0</td><td>0</td><td>-32</td><td>0</td><td>-32</td><td>0</td><td>-32</td><td>-32</td><td>-32</td><td>0</td><td>-32</td><td>0</td><td>-32</td><td>0</td></tr></tbody></table>
<table><caption>Table 24: Specification of the DL Distinguishers for LBlock-s.</caption><thead><tr><th colspan="4">7 Rounds</th></tr></thead><tbody><tr><td>δ, λ ∈ F<sub>2</sub><sup>4</sup> \ {0}, r<sub>u</sub> = 0, r<sub>m</sub> = 7, r<sub>ℓ</sub> = 0, p = 1, r = 1, q<sup>2</sup> = 1, prq<sup>2</sup> = 1, Ĉ = 1</td><td>ΔX<sub>0</sub></td><td>0000000000δ000000</td><td>ΔX<sub>3</sub></td><td>00000000000000λ0</td></tr><tr><td colspan="5">8 Rounds</td></tr><tr><td>r<sub>u</sub> = 0, r<sub>m</sub> = 8, r<sub>ℓ</sub> = 0, p = 1, r = 2<sup>-1.42</sup>, q<sup>2</sup> = 1, prq<sup>2</sup> = 2<sup>-1.42</sup>, Ĉ = 2<sup>-1.42</sup></td><td>ΔX<sub>0</sub></td><td>0000000000a000000</td><td>ΓX<sub>8</sub></td><td>00000000000010000</td></tr><tr><td colspan="5">9 Rounds</td></tr><tr><td>r<sub>u</sub> = 1, r<sub>m</sub> = 8, r<sub>ℓ</sub> = 0, p = 2<sup>-2</sup>, r = 2<sup>-1.42</sup>, q<sup>2</sup> = 1, prq<sup>2</sup> = 2<sup>-3.42</sup>, Ĉ = 2<sup>-3.45</sup></td><td>ΔX<sub>0</sub></td><td>00000000a0000001</td><td>ΔX<sub>1</sub></td><td>00000000000000a</td></tr><tr><td>ΓX<sub>9</sub></td><td>0000000000000100</td><td></td><td></td><td></td></tr><tr><td colspan="5">10 Rounds</td></tr><tr><td>r<sub>u</sub> = 1, r<sub>m</sub> = 8, r<sub>ℓ</sub> = 1, p = 2<sup>-2</sup>, r = 2<sup>-1.42</sup>, q<sup>2</sup> = 2<sup>-2</sup>, prq<sup>2</sup> = 2<sup>-5.42</sup>, Ĉ = 2<sup>-5.43</sup></td><td>ΔX<sub>0</sub></td><td>0000000a00100000</td><td>ΔX<sub>1</sub></td><td>00000000000000a0</td></tr><tr><td>ΓX<sub>9</sub></td><td>00000000000001000</td><td></td><td>ΓX<sub>10</sub></td><td>001000007000000</td></tr><tr><td colspan="5">11 Rounds</td></tr><tr><td>r<sub>u</sub> = 2, r<sub>m</sub> = 8, r<sub>ℓ</sub> = 1, p = 2<sup>-4</sup>, r = 2<sup>-1.42</sup>, q<sup>2</sup> = 2<sup>-2</sup>, prq<sup>2</sup> = 2<sup>-7.42</sup>, Ĉ = 2<sup>-7.43</sup></td><td>ΔX<sub>0</sub></td><td>000000100900000a</td><td>ΔX<sub>2</sub></td><td>0000000000000a00</td></tr><tr><td>ΓX<sub>10</sub></td><td>0000000000000001</td><td></td><td>ΓX<sub>11</sub></td><td>000001000000007</td></tr><tr><td colspan="5">12 Rounds</td></tr><tr><td>r<sub>u</sub> = 2, r<sub>m</sub> = 8, r<sub>ℓ</sub> = 2, p = 2<sup>-4</sup>, r = 2<sup>-1.42</sup>, q<sup>2</sup> = 2<sup>-4</sup>, prq<sup>2</sup> = 2<sup>-9.42</sup>, Ĉ = 2<sup>-9.42</sup></td><td>ΔX<sub>0</sub></td><td>000000100900000a</td><td>ΔX<sub>2</sub></td><td>0000000000000a00</td></tr><tr><td>ΓX<sub>10</sub></td><td>0000000000000001</td><td></td><td>ΓX<sub>11</sub></td><td>000001000000007</td></tr><tr><td colspan="5">13 Rounds</td></tr><tr><td>r<sub>u</sub> = 2, r<sub>m</sub> = 9, r<sub>ℓ</sub> = 2, p = 2<sup>-4</sup>, r = 2<sup>-4.18</sup>, q<sup>2</sup> = 2<sup>-4</sup>, prq<sup>2</sup> = 2<sup>-12.10</sup>, Ĉ = 2<sup>-12.10</sup></td><td>ΔX<sub>0</sub></td><td>0200000030100000</td><td>ΔX<sub>2</sub></td><td>0000000000000030</td></tr><tr><td>ΓX<sub>11</sub></td><td>0000000010000000</td><td></td><td>ΓX<sub>13</sub></td><td>00b0000080000010</td></tr><tr><td colspan="5">14 Rounds</td></tr><tr><td>r<sub>u</sub> = 2, r<sub>m</sub> = 9, r<sub>ℓ</sub> = 3, p = 2<sup>-4</sup>, r = 2<sup>-6.80</sup>, q<sup>2</sup> = 2<sup>-4</sup>, prq<sup>2</sup> = 2<sup>-14.80</sup></td><td>ΔX<sub>0</sub></td><td>000000100900000a</td><td>ΔX<sub>2</sub></td><td>0000000000000a00</td></tr><tr><td>ΓX<sub>11</sub></td><td>0100000000000000</td><td></td><td>ΓX<sub>14</sub></td><td>0000700000000b01</td></tr><tr><td colspan="5">15 Rounds</td></tr><tr><td>r<sub>u</sub> = 3, r<sub>m</sub> = 9, r<sub>ℓ</sub> = 3, p = 2<sup>-8</sup>, r = 2<sup>-6.80</sup>, q<sup>2</sup> = 2<sup>-4</sup>, prq<sup>2</sup> = 2<sup>-18.80</sup></td><td>ΔX<sub>0</sub></td><td>90a000000000c110</td><td>ΔX<sub>3</sub></td><td>00000000a000000</td></tr><tr><td>ΓX<sub>12</sub></td><td>1000000000000000</td><td></td><td>ΓX<sub>15</sub></td><td>0070000b0000010</td></tr><tr><td colspan="5">16 Rounds</td></tr><tr><td>r<sub>u</sub> = 4, r<sub>m</sub> = 9, r<sub>ℓ</sub> = 3, p = 2<sup>-8</sup>, r = 2<sup>-6.80</sup>, q<sup>2</sup> = 2<sup>-8</sup>, prq<sup>2</sup> = 2<sup>-22.80</sup></td><td>ΔX<sub>0</sub></td><td>000090a081100000</td><td>ΔX<sub>4</sub></td><td>00a000000000000</td></tr><tr><td>ΓX<sub>13</sub></td><td>0000000000001000</td><td></td><td>ΓX<sub>16</sub></td><td>10500000770000b0</td></tr><tr><td colspan="5">17 Rounds</td></tr><tr><td>r<sub>u</sub> = 4, r<sub>m</sub> = 9, r<sub>ℓ</sub> = 4, p = 2<sup>-8</sup>, r = 2<sup>-6.80</sup>, q<sup>2</sup> = 2<sup>-14</sup>, prq<sup>2</sup> = 2<sup>-28.80</sup></td><td>ΔX<sub>0</sub></td><td>0a00000901100008</td><td>ΔX<sub>4</sub></td><td>00000a000000000</td></tr><tr><td>ΓX<sub>13</sub></td><td>0000000000000001</td><td></td><td>ΓX<sub>17</sub></td><td>f00705000c310b07</td></tr></tbody></table>
<table><caption>Table 25: Specification of the DL Distinguishers for LBlock.</caption><thead><tr><th colspan="4">7 Rounds</th></tr></thead><tbody><tr><td>δ, λ ∈ F<sub>2</sub><sup>4</sup> \ {0}, r<sub>u</sub> = 0, r<sub>m</sub> = 7, r<sub>ℓ</sub> = 0, p = 1, r = 1, q<sup>2</sup> = 1, prq<sup>2</sup> = 1, Ĉ = 1</td><td>ΔX<sub>0</sub></td><td>0000000000δ000000</td><td>ΔX<sub>3</sub></td><td>00000000000000λ0</td></tr><tr><td colspan="5">8 Rounds</td></tr><tr><td>r<sub>u</sub> = 0, r<sub>m</sub> = 8, r<sub>ℓ</sub> = 0, p = 1, r = 2<sup>-2.00</sup>, q<sup>2</sup> = 1, prq<sup>2</sup> = 2<sup>-2.00</sup>, Ĉ = 2<sup>-2.00</sup></td><td>ΔX<sub>0</sub></td><td>00000000000000a0</td><td>ΓX<sub>8</sub></td><td>000000002000000</td></tr><tr><td colspan="5">9 Rounds</td></tr><tr><td>r<sub>u</sub> = 0, r<sub>m</sub> = 9, r<sub>ℓ</sub> = 0, p = 1, r = 2<sup>-3.89</sup>, q<sup>2</sup> = 1, prq<sup>2</sup> = 2<sup>-3.89</sup>, Ĉ = 2<sup>-3.89</sup></td><td>ΔX<sub>0</sub></td><td>0000000000000030</td><td>ΓX<sub>9</sub></td><td>000000001000000</td></tr><tr><td colspan="5">10 Rounds</td></tr><tr><td>r<sub>u</sub> = 1, r<sub>m</sub> = 8, r<sub>ℓ</sub> = 1, p = 2<sup>-2</sup>, r = 2<sup>-2.00</sup>, q<sup>2</sup> = 2<sup>-2</sup>, prq<sup>2</sup> = 2<sup>-6.00</sup>, Ĉ = 2<sup>-6.03</sup></td><td>ΔX<sub>0</sub></td><td>000000a00e000000</td><td>ΔX<sub>1</sub></td><td>00000000000000a0</td></tr><tr><td>ΓX<sub>9</sub></td><td>0000000000001000</td><td>ΓX<sub>10</sub></td><td>00100000a000000</td></tr><tr><td colspan="5">11 Rounds</td></tr><tr><td>r<sub>u</sub> = 2, r<sub>m</sub> = 8, r<sub>ℓ</sub> = 1, p = 2<sup>-4</sup>, r = 2<sup>-2.00</sup>, q<sup>2</sup> = 2<sup>-2</sup>, prq<sup>2</sup> = 2<sup>-8.00</sup>, Ĉ = 2<sup>-8.04</sup></td><td>ΔX<sub>0</sub></td><td>000000010a000001</td><td>ΔX<sub>2</sub></td><td>00000000000000a</td></tr><tr><td>ΓX<sub>10</sub></td><td>0000000001000000</td><td>ΓX<sub>11</sub></td><td>00000001000000a0</td></tr><tr><td colspan="5">12 Rounds</td></tr><tr><td>r<sub>u</sub> = 2, r<sub>m</sub> = 8, r<sub>ℓ</sub> = 2, p = 2<sup>-4</sup>, r = 2<sup>-2.00</sup>, q<sup>2</sup> = 2<sup>-4</sup>, prq<sup>2</sup> = 2<sup>-10.00</sup>, Ĉ = 2<sup>-9.98</sup></td><td>ΔX<sub>0</sub></td><td>b0000000000080a0</td><td>ΔX<sub>2</sub></td><td>000000000000a000</td></tr><tr><td>ΓX<sub>10</sub></td><td>000000000000010</td><td>ΓX<sub>11</sub></td><td>0004000000901000</td></tr><tr><td colspan="5">13 Rounds</td></tr><tr><td>r<sub>u</sub> = 2, r<sub>m</sub> = 9, r<sub>ℓ</sub> = 2, p = 2<sup>-4</sup>, r = 2<sup>-3.89</sup>, q<sup>2</sup> = 2<sup>-4</sup>, prq<sup>2</sup> = 2<sup>-11.89</sup>, Ĉ = 2<sup>-11.54</sup></td><td>ΔX<sub>0</sub></td><td>0100000030200000</td><td>ΔX<sub>2</sub></td><td>0000000000000030</td></tr><tr><td>ΓX<sub>11</sub></td><td>0000000010000000</td><td>ΓX<sub>13</sub></td><td>0030000020000010</td></tr><tr><td colspan="5">14 Rounds</td></tr><tr><td>r<sub>u</sub> = 2, r<sub>m</sub> = 9, r<sub>ℓ</sub> = 3, p = 2<sup>-4</sup>, r = 2<sup>-7.17</sup>, q<sup>2</sup> = 2<sup>-4</sup>, prq<sup>2</sup> = 2<sup>-15.17</sup></td><td>ΔX<sub>0</sub></td><td>00000070040000a</td><td>ΔX<sub>2</sub></td><td>0000000000000a00</td></tr><tr><td>ΓX<sub>11</sub></td><td>0100000000000000</td><td>ΓX<sub>14</sub></td><td>0000a00000000901</td></tr><tr><td colspan="5">15 Rounds</td></tr><tr><td>r<sub>u</sub> = 3, r<sub>m</sub> = 9, r<sub>ℓ</sub> = 3, p = 2<sup>-4</sup>, r = 2<sup>-7.13</sup>, q<sup>2</sup> = 2<sup>-8</sup>, prq<sup>2</sup> = 2<sup>-19.13</sup></td><td>ΔX<sub>0</sub></td><td>00200000000a0100</td><td>ΔX<sub>3</sub></td><td>0000000a0000000</td></tr><tr><td>ΓX<sub>12</sub></td><td>000000000000100</td><td>ΓX<sub>15</sub></td><td>01000008b00b0010</td></tr><tr><td colspan="5">16 Rounds</td></tr><tr><td>r<sub>u</sub> = 3, r<sub>m</sub> = 9, r<sub>ℓ</sub> = 4, p = 2<sup>-8</sup>, r = 2<sup>-7.13</sup>, q<sup>2</sup> = 2<sup>-8</sup>, prq<sup>2</sup> = 2<sup>-23.13</sup></td><td>ΔX<sub>0</sub></td><td>000a010000012020</td><td>ΔX<sub>3</sub></td><td>000000000a000000</td></tr><tr><td>ΓX<sub>12</sub></td><td>0000010000000000</td><td>ΓX<sub>16</sub></td><td>01000008b00b0010</td></tr><tr><td colspan="5">17 Rounds</td></tr><tr><td>r<sub>u</sub> = 4, r<sub>m</sub> = 9, r<sub>ℓ</sub> = 4, p = 2<sup>-8</sup>, r = 2<sup>-7.15</sup>, q<sup>2</sup> = 2<sup>-14</sup>, prq<sup>2</sup> = 2<sup>-29.15</sup></td><td>ΔX<sub>0</sub></td><td>0a00000a20e00001</td><td>ΔX<sub>4</sub></td><td>000a000000000000</td></tr><tr><td>ΓX<sub>13</sub></td><td>0000000001000000</td><td>ΓX<sub>17</sub></td><td>e0900f008604010c</td></tr></tbody></table>
# K Application to WARP

## K.1 Brief Specification of WARP

WARP is a block cipher with 128-bit plaintext and key designed by Banik et al. [2]. It performs 40 full rounds plus 1 partial round to produce the ciphertext. The internal state of WARP is organized in nibbles $X = X_0||...||X_{31}$, where $X_i \in \{0,1\}^4$. WARP splits the 128-bit key $K$ into two 64-bit halves $K = K^0||K^1$, where $K^{(r-1) \text{ mod } 2}$ is used as the $r$th round-key. The $i$th nibble of the round input $X^{(r-1)}$ and round-key $K^{((r-1) \text{ mod } 2)}$ in round $r$ are denoted by $X_i^{(r-1)}$ and $K_i^{(b)}$, where $1 \le r \le 41$, $b \in \{0,1\}$, and $0 \le i \le 15$.

<figure><img src="image_61.png" /><figcaption>Fig. 51: The round function of WARP.</figcaption></figure>

The round function of WARP, illustrated in Figure 51, first applies an S-box $S: \{0,1\}^4 \rightarrow \{0,1\}^4$ (Table 27) as well as the round-key and round-constant addition on each of two consecutive nibbles of internal state. Next, a nibble permutation $\pi$ (Table 26) is applied, except in the last round.

<table><caption>Table 26: Nibble permutation $\pi$ of WARP.</caption><tr><td>x</td><td>0</td><td>1</td><td>2</td><td>3</td><td>4</td><td>5</td><td>6</td><td>7</td><td>8</td><td>9</td><td>10</td><td>11</td><td>12</td><td>13</td><td>14</td><td>15</td></tr><tr><td>π(x)</td><td>31</td><td>6</td><td>29</td><td>14</td><td>1</td><td>12</td><td>21</td><td>8</td><td>27</td><td>2</td><td>3</td><td>0</td><td>25</td><td>4</td><td>23</td><td>10</td></tr><tr><td>x</td><td>16</td><td>17</td><td>18</td><td>19</td><td>20</td><td>21</td><td>22</td><td>23</td><td>24</td><td>25</td><td>26</td><td>27</td><td>28</td><td>29</td><td>30</td><td>31</td></tr><tr><td>π(x)</td><td>15</td><td>22</td><td>13</td><td>30</td><td>17</td><td>28</td><td>5</td><td>24</td><td>11</td><td>18</td><td>19</td><td>16</td><td>9</td><td>20</td><td>7</td><td>26</td></tr></table>

<table><caption>Table 27: 4-bit S-box $S$ of WARP.</caption><tr><td>x</td><td>0</td><td>1</td><td>2</td><td>3</td><td>4</td><td>5</td><td>6</td><td>7</td><td>8</td><td>9</td><td>a</td><td>b</td><td>c</td><td>d</td><td>e</td><td>f</td></tr><tr><td>S(x)</td><td>c</td><td>a</td><td>d</td><td>3</td><td>e</td><td>b</td><td>f</td><td>7</td><td>8</td><td>9</td><td>1</td><td>5</td><td>0</td><td>2</td><td>4</td><td>6</td></tr></table>