<table><caption>Table 28: DDT of WARP's S-box.</caption><thead><tr><th>Δ<sub>i</sub> \ Δ<sub>o</sub></th><th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>a</th><th>b</th><th>c</th><th>d</th><th>e</th><th>f</th></tr></thead><tbody><tr><th>0</th><td>16</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>1</th><td>0</td><td>2</td><td>4</td><td>0</td><td>2</td><td>2</td><td>2</td><td>0</td><td>2</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td></tr><tr><th>2</th><td>0</td><td>4</td><td>0</td><td>0</td><td>4</td><td>0</td><td>0</td><td>0</td><td>4</td><td>0</td><td>0</td><td>4</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>3</th><td>0</td><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>4</td><td>2</td><td>2</td><td>2</td><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>2</td></tr><tr><th>4</th><td>0</td><td>2</td><td>4</td><td>2</td><td>2</td><td>2</td><td>0</td><td>0</td><td>2</td><td>0</td><td>0</td><td>2</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>5</th><td>0</td><td>2</td><td>0</td><td>0</td><td>2</td><td>0</td><td>0</td><td>4</td><td>0</td><td>2</td><td>4</td><td>0</td><td>2</td><td>0</td><td>0</td><td>0</td></tr><tr><th>6</th><td>0</td><td>2</td><td>0</td><td>4</td><td>0</td><td>0</td><td>0</td><td>2</td><td>2</td><td>0</td><td>0</td><td>0</td><td>2</td><td>2</td><td>0</td><td>2</td></tr><tr><th>7</th><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>4</td><td>2</td><td>0</td><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>4</td><td>2</td><td>0</td></tr><tr><th>8</th><td>0</td><td>2</td><td>0</td><td>2</td><td>2</td><td>0</td><td>2</td><td>0</td><td>0</td><td>2</td><td>0</td><td>2</td><td>2</td><td>0</td><td>2</td><td>0</td></tr><tr><th>9</th><td>0</td><td>0</td><td>4</td><td>2</td><td>0</td><td>2</td><td>0</td><td>0</td><td>2</td><td>2</td><td>0</td><td>2</td><td>2</td><td>0</td><td>0</td><td>0</td></tr><tr><th>a</th><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>4</td><td>0</td><td>0</td><td>0</td><td>0</td><td>4</td><td>0</td><td>0</td><td>4</td><td>0</td><td>4</td></tr><tr><th>b</th><td>0</td><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>0</td><td>2</td><td>2</td><td>2</td><td>0</td><td>4</td><td>0</td><td>2</td><td>0</td><td>2</td></tr><tr><th>c</th><td>0</td><td>0</td><td>4</td><td>0</td><td>0</td><td>2</td><td>2</td><td>0</td><td>2</td><td>2</td><td>0</td><td>0</td><td>2</td><td>0</td><td>2</td><td>0</td></tr><tr><th>d</th><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>0</td><td>2</td><td>4</td><td>0</td><td>0</td><td>4</td><td>2</td><td>0</td><td>0</td><td>2</td><td>0</td></tr><tr><th>e</th><td>0</td><td>2</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>2</td><td>2</td><td>0</td><td>0</td><td>0</td><td>2</td><td>2</td><td>4</td><td>2</td></tr><tr><th>f</th><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>0</td><td>2</td><td>0</td><td>0</td><td>0</td><td>4</td><td>2</td><td>0</td><td>0</td><td>2</td><td>4</td></tr></tbody></table>

<table><caption>Table 29: LAT of WARP's S-box (scale: $2^4 \cdot \text{correlation}$).</caption><thead><tr><th>λ<sub>i</sub> \ λ<sub>o</sub></th><th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>a</th><th>b</th><th>c</th><th>d</th><th>e</th><th>f</th></tr></thead><tbody><tr><th>0</th><td>16</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>1</th><td>0</td><td>4</td><td>8</td><td>4</td><td>-4</td><td>0</td><td>4</td><td>0</td><td>-4</td><td>0</td><td>4</td><td>0</td><td>8</td><td>-4</td><td>0</td><td>-4</td></tr><tr><th>2</th><td>0</td><td>8</td><td>0</td><td>0</td><td>8</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>8</td><td>0</td><td>0</td><td>0</td></tr><tr><th>3</th><td>0</td><td>4</td><td>0</td><td>4</td><td>-4</td><td>0</td><td>4</td><td>8</td><td>4</td><td>-8</td><td>-4</td><td>0</td><td>0</td><td>4</td><td>0</td><td>4</td></tr><tr><th>4</th><td>0</td><td>-4</td><td>8</td><td>-4</td><td>4</td><td>0</td><td>-4</td><td>0</td><td>-4</td><td>-8</td><td>-4</td><td>0</td><td>0</td><td>-4</td><td>0</td><td>4</td></tr><tr><th>5</th><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>-8</td><td>0</td><td>0</td><td>8</td><td>-8</td><td>0</td></tr><tr><th>6</th><td>0</td><td>4</td><td>0</td><td>4</td><td>-4</td><td>0</td><td>4</td><td>-8</td><td>-4</td><td>0</td><td>-4</td><td>0</td><td>-8</td><td>-4</td><td>0</td><td>4</td></tr><tr><th>7</th><td>0</td><td>0</td><td>0</td><td>8</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>0</td></tr><tr><th>8</th><td>0</td><td>-4</td><td>-8</td><td>4</td><td>-4</td><td>0</td><td>-4</td><td>0</td><td>-8</td><td>-4</td><td>0</td><td>4</td><td>4</td><td>0</td><td>4</td><td>0</td></tr><tr><th>9</th><td>0</td><td>0</td><td>0</td><td>-8</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>-4</td><td>4</td><td>-4</td><td>4</td><td>4</td><td>-4</td><td>4</td><td>4</td></tr><tr><th>a</th><td>0</td><td>4</td><td>0</td><td>-4</td><td>-4</td><td>-8</td><td>-4</td><td>0</td><td>0</td><td>-4</td><td>8</td><td>-4</td><td>-4</td><td>0</td><td>4</td><td>0</td></tr><tr><th>b</th><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>-8</td><td>4</td><td>-4</td><td>-4</td><td>4</td><td>4</td><td>4</td><td>-4</td><td>-4</td></tr><tr><th>c</th><td>0</td><td>8</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>4</td><td>4</td><td>-4</td><td>4</td><td>4</td><td>-4</td><td>4</td><td>4</td></tr><tr><th>d</th><td>0</td><td>-4</td><td>8</td><td>4</td><td>-4</td><td>0</td><td>-4</td><td>0</td><td>4</td><td>0</td><td>4</td><td>-4</td><td>8</td><td>4</td><td>0</td><td>0</td></tr><tr><th>e</th><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>8</td><td>0</td><td>-8</td><td>4</td><td>-4</td><td>4</td><td>-4</td><td>4</td><td>4</td><td>4</td><td>4</td></tr><tr><th>f</th><td>0</td><td>-4</td><td>0</td><td>4</td><td>4</td><td>-8</td><td>4</td><td>0</td><td>0</td><td>4</td><td>0</td><td>-4</td><td>4</td><td>0</td><td>4</td><td>8</td></tr></tbody></table>
<table><caption>Table 30: DLCT of WARP's S-box.</caption><thead><tr><th>Δ<sub>i</sub> \ λ<sub>o</sub></th><th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>a</th><th>b</th><th>c</th><th>d</th><th>e</th><th>f</th></tr></thead><tbody><tr><th>0</th><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td></tr><tr><th>1</th><td>16</td><td>8</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>8</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>-8</td></tr><tr><th>2</th><td>16</td><td>0</td><td>16</td><td>0</td><td>0</td><td>-16</td><td>0</td><td>-16</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>3</th><td>16</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>8</td><td>0</td><td>0</td><td>8</td><td>-8</td><td>0</td><td>-8</td><td>-8</td><td>0</td><td>0</td></tr><tr><th>4</th><td>16</td><td>0</td><td>0</td><td>0</td><td>8</td><td>0</td><td>-8</td><td>0</td><td>8</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>-8</td><td>-8</td></tr><tr><th>5</th><td>16</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-16</td><td>0</td><td>-8</td><td>0</td><td>8</td><td>-8</td><td>0</td><td>8</td><td>0</td></tr><tr><th>6</th><td>16</td><td>-8</td><td>0</td><td>8</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>-8</td><td>0</td><td>8</td><td>-8</td><td>0</td><td>0</td><td>0</td></tr><tr><th>7</th><td>16</td><td>-8</td><td>0</td><td>-8</td><td>-8</td><td>0</td><td>-8</td><td>16</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>8</th><td>16</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-16</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>9</th><td>16</td><td>0</td><td>0</td><td>0</td><td>8</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>-8</td><td>0</td><td>8</td><td>-8</td><td>0</td></tr><tr><th>a</th><td>16</td><td>-8</td><td>0</td><td>-8</td><td>-8</td><td>16</td><td>-8</td><td>0</td><td>-8</td><td>0</td><td>8</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>8</td></tr><tr><th>b</th><td>16</td><td>-8</td><td>0</td><td>8</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>8</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>-8</td></tr><tr><th>c</th><td>16</td><td>8</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>-8</td><td>0</td><td>8</td><td>-8</td><td>0</td></tr><tr><th>d</th><td>16</td><td>0</td><td>-16</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>8</td><td>-8</td><td>0</td><td>8</td><td>0</td></tr><tr><th>e</th><td>16</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>8</td><td>0</td><td>-8</td><td>-8</td><td>0</td><td>0</td><td>8</td><td>0</td><td>0</td><td>-8</td></tr><tr><th>f</th><td>16</td><td>0</td><td>-16</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>8</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>8</td></tr></tbody></table>

<table><caption>Table 31: DDLCT of WARP's S-box.</caption><thead><tr><th>Δ<sub>i</sub> \ λ<sub>o</sub></th><th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>a</th><th>b</th><th>c</th><th>d</th><th>e</th><th>f</th></tr></thead><tbody><tr><th>0</th><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td></tr><tr><th>1</th><td>256</td><td>0</td><td>64</td><td>0</td><td>0</td><td>-96</td><td>0</td><td>-96</td><td>16</td><td>-48</td><td>-16</td><td>-16</td><td>16</td><td>-16</td><td>-16</td><td>-48</td></tr><tr><th>2</th><td>256</td><td>64</td><td>0</td><td>-64</td><td>64</td><td>0</td><td>-64</td><td>0</td><td>64</td><td>0</td><td>-64</td><td>-128</td><td>0</td><td>64</td><td>-128</td><td>-64</td></tr><tr><th>3</th><td>256</td><td>-48</td><td>-64</td><td>16</td><td>16</td><td>-32</td><td>-48</td><td>32</td><td>0</td><td>-48</td><td>-32</td><td>-16</td><td>16</td><td>-32</td><td>-16</td><td>0</td></tr><tr><th>4</th><td>256</td><td>0</td><td>64</td><td>0</td><td>0</td><td>-96</td><td>0</td><td>-96</td><td>16</td><td>16</td><td>-16</td><td>-16</td><td>-48</td><td>-16</td><td>-16</td><td>-48</td></tr><tr><th>5</th><td>256</td><td>-32</td><td>0</td><td>-96</td><td>-32</td><td>64</td><td>-96</td><td>64</td><td>0</td><td>0</td><td>0</td><td>-64</td><td>0</td><td>0</td><td>-64</td><td>0</td></tr><tr><th>6</th><td>256</td><td>16</td><td>-64</td><td>-48</td><td>-48</td><td>-32</td><td>16</td><td>32</td><td>0</td><td>16</td><td>-32</td><td>-16</td><td>-48</td><td>-32</td><td>-16</td><td>0</td></tr><tr><th>7</th><td>256</td><td>-32</td><td>-64</td><td>32</td><td>-32</td><td>0</td><td>32</td><td>-64</td><td>-32</td><td>-64</td><td>-32</td><td>64</td><td>-64</td><td>-32</td><td>64</td><td>-32</td></tr><tr><th>8</th><td>256</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-64</td><td>-64</td><td>0</td><td>0</td><td>-64</td><td>-64</td></tr><tr><th>9</th><td>256</td><td>0</td><td>64</td><td>0</td><td>0</td><td>-96</td><td>0</td><td>-96</td><td>-16</td><td>16</td><td>-48</td><td>-16</td><td>-48</td><td>16</td><td>-16</td><td>-16</td></tr><tr><th>a</th><td>256</td><td>-32</td><td>-128</td><td>-32</td><td>-32</td><td>64</td><td>-32</td><td>-64</td><td>-64</td><td>-64</td><td>64</td><td>64</td><td>-64</td><td>-64</td><td>64</td><td>64</td></tr><tr><th>b</th><td>256</td><td>-48</td><td>-64</td><td>16</td><td>16</td><td>-32</td><td>-48</td><td>32</td><td>-32</td><td>16</td><td>0</td><td>-16</td><td>-48</td><td>0</td><td>-16</td><td>-32</td></tr><tr><th>c</th><td>256</td><td>0</td><td>64</td><td>0</td><td>0</td><td>-96</td><td>0</td><td>-96</td><td>-16</td><td>-48</td><td>-48</td><td>-16</td><td>16</td><td>16</td><td>-16</td><td>-16</td></tr><tr><th>d</th><td>256</td><td>-96</td><td>0</td><td>-32</td><td>-96</td><td>64</td><td>-32</td><td>64</td><td>-64</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-64</td><td>0</td><td>0</td></tr><tr><th>e</th><td>256</td><td>16</td><td>-64</td><td>-48</td><td>-48</td><td>-32</td><td>16</td><td>32</td><td>-32</td><td>-48</td><td>0</td><td>-16</td><td>16</td><td>0</td><td>-16</td><td>-32</td></tr><tr><th>f</th><td>256</td><td>-64</td><td>-64</td><td>0</td><td>-64</td><td>64</td><td>0</td><td>0</td><td>-96</td><td>0</td><td>32</td><td>0</td><td>0</td><td>-96</td><td>0</td><td>32</td></tr></tbody></table>
<table><caption>Table 33: Specification of DL distinguishers for 18 to 22 rounds of WARP.</caption><thead><tr><th colspan="2">18 Rounds, Figure 55b</th></tr><tr><th>r<sub>u</sub> = 4, r<sub>m</sub> = 11, r<sub>l</sub> = 3, p = 2<sup>-8</sup>, r = 2<sup>-3.00</sup>, q<sup>2</sup> = 2<sup>-8</sup>, prq<sup>2</sup> = 2<sup>-19.00</sup></th><th></th></tr></thead><tbody><tr><td>ΔX<sub>0</sub> 29000004000000000000000000002100</td><td>ΔX<sub>4</sub> 000000000000000000000000000000000000020</td></tr><tr><td>ΓX<sub>15</sub> 0000000000000000000000000000000000</td><td>ΓX<sub>18</sub> 0000000000000500050000000005e0b0</td></tr></tbody><thead><tr><th colspan="2">19 Rounds, Figure 55c</th></tr><tr><th>r<sub>u</sub> = 4, r<sub>m</sub> = 11, r<sub>l</sub> = 4, p = 2<sup>-14</sup>, r = 2<sup>-3.00</sup>, q<sup>2</sup> = 2<sup>-8</sup>, prq<sup>2</sup> = 2<sup>-25.00</sup></th><th></th></tr></thead><tbody><tr><td>ΔX<sub>0</sub> 00124200000200000000020000000042</td><td>ΔX<sub>4</sub> 0000000000000000000002000000000000</td></tr><tr><td>ΓX<sub>15</sub> b00000000000000000000000000000000</td><td>ΓX<sub>19</sub> 0000000000000500050000000005e0b0</td></tr></tbody><thead><tr><th colspan="2">20 Rounds, Figure 56a</th></tr><tr><th>r<sub>u</sub> = 5, r<sub>m</sub> = 11, r<sub>l</sub> = 4, p = 2<sup>-14</sup>, r = 2<sup>-3.00</sup>, q<sup>2</sup> = 2<sup>-14</sup>, prq<sup>2</sup> = 2<sup>-31.00</sup></th><th></th></tr></thead><tbody><tr><td>ΔX<sub>0</sub> 00124200000200000000020000000042</td><td>ΔX<sub>5</sub> 000000000000000000000000000000000000020</td></tr><tr><td>ΓX<sub>16</sub> 0000000000000000000000000000000000</td><td>ΓX<sub>20</sub> 0000500b03000003700b00900a000000</td></tr></tbody><thead><tr><th colspan="2">21 Rounds, Figure 56b</th></tr><tr><th>r<sub>u</sub> = 5, r<sub>m</sub> = 11, r<sub>l</sub> = 5, p = 2<sup>-24</sup>, r = 2<sup>-3.00</sup>, q<sup>2</sup> = 2<sup>-14</sup>, prq<sup>2</sup> = 2<sup>-41.00</sup></th><th></th></tr></thead><tbody><tr><td>ΔX<sub>0</sub> 000002000000000420012420000020000</td><td>ΔX<sub>5</sub> 000000000000000200000000000000000000000000</td></tr><tr><td>ΓX<sub>16</sub> 000000000000000000b0000000000000000000000000</td><td>ΓX<sub>21</sub> 00f00502000c006005600c00b01f0c07</td></tr></tbody><thead><tr><th colspan="2">22 Rounds, Figure 56c</th></tr><tr><th>r<sub>u</sub> = 6, r<sub>m</sub> = 10, r<sub>l</sub> = 6, p = 2<sup>-24</sup>, r = 2<sup>-3.00</sup>, q<sup>2</sup> = 2<sup>-24</sup>, prq<sup>2</sup> = 2<sup>-51.00</sup></th><th></th></tr></thead><tbody><tr><td>ΔX<sub>0</sub> 00040024290000002100002104210400</td><td>ΔX<sub>6</sub> 000000000000020000000000000000000000000000</td></tr><tr><td>ΓX<sub>16</sub> 0000000000000000000000000000000000</td><td>ΓX<sub>22</sub> 0060050c000c006007600c00b06c0c07</td></tr></tbody></table>
<figure><img src="image_62.png" /><figcaption>Fig. 52: DL distinguishers for 11 to 12 rounds of WARP (— differential — linear).</figcaption></figure>
<figure><img src="image_63.png" /><figcaption>Fig. 53: DL distinguishers for 13 to 14 rounds of WARP (— differential — linear).</figcaption></figure>
<figure><img src="image_64.png" /><figcaption>Fig. 54: DL distinguishers for 15 to 16 rounds of WARP (— differential — linear).</figcaption></figure>
<figure><img src="image_65.png" /><figcaption>Fig. 55: DL distinguishers for 17 to 19 rounds of WARP (— differential — linear).</figcaption></figure>
<figure><img src="image_66.png" /><figcaption>Fig. 56: DL distinguishers for 20 to 22 rounds of WARP (— differential – linear).</figcaption></figure>
# L Application to CLEFIA

## L.1 Brief Specification of CLEFIA

CLEFIA [51] is a 128-bit block cipher supporting 128-bit, 192-bit, and 256-bit keys. CLEFIA was designed by a team from Sony Corporation and published at FSE 2007 by Shirai et al. It is internationally standardized in ISO/IEC 29192-2. Depending on the key size, the number of rounds is 18 (128-bit key), 22 (192-bit key), or 26 (256-bit key). The round function of CLEFIA uses the generalized Feistel structure with four 32-bit branches in which two 32-bit functions $F_0$ and $F_1$ are applied in parallel (Figure 57). $F_0$ and $F_1$ follow the SP structure and perform three basic operations, including sub-key addition, application of four 8-bit S-boxes in parallel, and diffusing the output bytes of the S-box layer by applying a 4 × 4 MDS matrix over $\mathbb{F}_{2^8}$. CLEFIA employs two different S-boxes which are used in different order in $F_0$ and $F_1$. The diffusion layer was designed based on the new Diffusion Switching Mechanism technique [50,51] to obtain a larger minimum number of active S-boxes. The Hadamard-type MDS matrices are specified in Figure 57b. The 8-bit S-boxes $S_0$, $S_1$ are specified as follows. For $S_0$, the 4-bit S-boxes $SS_0$, $SS_1$ (see Figure 57c) are applied to the input halves; then each half is updated by adding 2 times the other half; then $SS_2$ and $SS_3$ are applied. The other S-box $S_1$ is defined using modular inversion, like AES.

<figure><img src="image_67.png" /></figure>

<table><caption>Fig. 57: CLEFIA round function.</caption><tr><td>x</td><td>0 1 2 3 4 5 6 7 8 9 a b c d e f</td><td>x</td><td>0 1 2 3 4 5 6 7 8 9 a b c d e f</td></tr><tr><td>SS<sub>0</sub>(x)</td><td>e 6 c a 8 7 2 f b 1 4 0 5 9 d 3</td><td>SS<sub>0</sub>(x)</td><td>6 4 0 d 2 b a 3 9 c e f 8 7 5 1</td></tr><tr><td>SS<sub>1</sub>(x)</td><td>b 8 5 e a 6 4 c f 7 2 3 1 0 d 9</td><td>SS<sub>1</sub>(x)</td><td>a 2 6 d 3 4 5 e 0 7 8 9 b f c 1</td></tr></table>
## L.2 The DL Distinguishers of CLEFIA

<table><caption>Table 34: DL distinguishers for 4 to 9 rounds of CLEFIA (with final permutation).</caption><thead><tr><th></th><th></th><th></th></tr></thead><tbody><tr><td colspan="3">4 Rounds</td></tr><tr><td colspan="3">r<sub>0</sub> = 0, r<sub>m</sub> = 4, r<sub>1</sub> = 0, p = 1, r = 1, q = 1, prq<sup>2</sup> = 1</td></tr><tr><td>ΔX<sub>0</sub></td><td>00000000000000100000000000000000</td><td>ΓX<sub>4</sub> 00000000010000000000000000000000</td></tr><tr><td colspan="3">5 Rounds</td></tr><tr><td colspan="3">r<sub>0</sub> = 0, r<sub>m</sub> = 5, r<sub>1</sub> = 0, p = 1, r = 2<sup>-2.68</sup>, q = 1, prq<sup>2</sup> = 2<sup>-2.68</sup></td></tr><tr><td>ΔX<sub>0</sub></td><td>0000000000000800000000000000000000</td><td>ΓX<sub>5</sub> 00000000381c8e920000000000000000</td></tr><tr><td colspan="3">6 Rounds</td></tr><tr><td colspan="3">r<sub>0</sub> = 0, r<sub>m</sub> = 5, r<sub>1</sub> = 1, p = 1, r = 2<sup>-2.68</sup>, q<sup>2</sup> = 2<sup>-4.39</sup>, prq<sup>2</sup> = 2<sup>-7.07</sup></td></tr><tr><td>ΔX<sub>0</sub></td><td>0000000000008000000000000000000000</td><td>-</td></tr><tr><td>ΓX<sub>5</sub></td><td>00000000381c8e920000000000000000</td><td>ΓX<sub>6</sub> 381c8e9200000000000000f5000000</td></tr><tr><td colspan="3">7 Rounds</td></tr><tr><td colspan="3">r<sub>0</sub> = 1, r<sub>m</sub> = 5, r<sub>1</sub> = 1, p = 2<sup>-4.68</sup>, r = 2<sup>-2.68</sup>, q<sup>2</sup> = 2<sup>-4.39</sup>, prq<sup>2</sup> = 2<sup>-11.75</sup></td></tr><tr><td>ΔX<sub>0</sub></td><td>00000000000000800000000000000000</td><td>ΔX<sub>1</sub> 00000000008000000000000000000000</td></tr><tr><td>ΓX<sub>6</sub></td><td>00000000381c8e920000000000000000</td><td>ΓX<sub>7</sub> 381c8e9200000000000000f5000000</td></tr><tr><td colspan="3">8 Rounds</td></tr><tr><td colspan="3">r<sub>0</sub> = 2, r<sub>m</sub> = 5, r<sub>1</sub> = 1, p = 2<sup>-26.36</sup>, r = 2<sup>-2.68</sup>, q<sup>2</sup> = 2<sup>-4.39</sup>, r = 2<sup>-13.95</sup>, prq<sup>2</sup> = 2<sup>-33.43</sup></td></tr><tr><td>ΔX<sub>0</sub></td><td>d77e2bfcbe919d96000000000080000</td><td>ΔX<sub>2</sub> 00000000008000000000000000000000</td></tr><tr><td>ΓX<sub>7</sub></td><td>00000000381c8e920000000000000000</td><td>ΓX<sub>8</sub> 381c8e9200000000000000f5000000</td></tr><tr><td colspan="3">9 Rounds</td></tr><tr><td colspan="3">r<sub>0</sub> = 2, r<sub>m</sub> = 5, r<sub>1</sub> = 2, p = 2<sup>-26.36</sup>, r = 2<sup>-3</sup>, q<sup>2</sup> = 2<sup>-25.93</sup>, r = 2<sup>-13.95</sup>, prq<sup>2</sup> = 2<sup>-55.29</sup></td></tr><tr><td>ΔX<sub>0</sub></td><td>2bfcd77e9d96be910000000000000008</td><td>ΔX<sub>2</sub> 00000000000000800000000000000000</td></tr><tr><td>ΓX<sub>7</sub></td><td>00000000f11200000000000000000000</td><td>ΓX<sub>9</sub> 000000000ae00ee69bffcc00f1120000</td></tr></tbody></table>
# M Application to TWINE

## M.1 Brief Specification of TWINE

TWINE is a 64-bit block cipher designed by Suzuki et al. [54] which supports key sizes of 80 and 128 bits. This cipher uses a Type-2 generalized Feistel structure with 16 4-bit branches. Both variants apply 36 rounds of the round function illustrated in Figure 58. The round function includes a nonlinear layer consisting of 8 parallel applications of the same 4-bit S-box and a diffusion layer permuting the 16 nibbles.

<figure><img src="image_68.png" /><figcaption>Fig. 58: The round function of TWINE.</figcaption></figure>

## M.2 The DL Distinguishers of TWINE
<table><caption>Table 35: DDT of TWINE's S-box.</caption><thead><tr><th>Δ<sub>i</sub> \ Δ<sub>o</sub></th><th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>a</th><th>b</th><th>c</th><th>d</th><th>e</th><th>f</th></tr></thead><tbody><tr><th>0</th><td>16</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>1</th><td>0</td><td>0</td><td>2</td><td>0</td><td>0</td><td>2</td><td>0</td><td>0</td><td>0</td><td>2</td><td>2</td><td>2</td><td>4</td><td>0</td><td>0</td><td>2</td></tr><tr><th>2</th><td>0</td><td>0</td><td>0</td><td>2</td><td>2</td><td>2</td><td>0</td><td>2</td><td>0</td><td>0</td><td>4</td><td>2</td><td>0</td><td>0</td><td>2</td><td>0</td></tr><tr><th>3</th><td>0</td><td>0</td><td>2</td><td>0</td><td>0</td><td>2</td><td>2</td><td>2</td><td>2</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>2</td><td>4</td></tr><tr><th>4</th><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>0</td><td>2</td><td>0</td><td>0</td><td>2</td><td>0</td><td>4</td><td>0</td><td>2</td><td>2</td><td>2</td></tr><tr><th>5</th><td>0</td><td>2</td><td>4</td><td>2</td><td>0</td><td>0</td><td>2</td><td>2</td><td>0</td><td>2</td><td>2</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>6</th><td>0</td><td>2</td><td>0</td><td>0</td><td>0</td><td>4</td><td>0</td><td>2</td><td>0</td><td>2</td><td>0</td><td>0</td><td>2</td><td>2</td><td>2</td><td>0</td></tr><tr><th>7</th><td>0</td><td>0</td><td>0</td><td>2</td><td>2</td><td>2</td><td>2</td><td>0</td><td>2</td><td>4</td><td>0</td><td>0</td><td>2</td><td>0</td><td>0</td><td>0</td></tr><tr><th>8</th><td>0</td><td>2</td><td>2</td><td>4</td><td>2</td><td>2</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>2</td></tr><tr><th>9</th><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>0</td><td>0</td><td>2</td><td>4</td><td>0</td><td>2</td><td>0</td><td>2</td><td>2</td><td>0</td><td>2</td></tr><tr><th>a</th><td>0</td><td>2</td><td>0</td><td>0</td><td>2</td><td>0</td><td>0</td><td>4</td><td>2</td><td>2</td><td>0</td><td>2</td><td>0</td><td>0</td><td>0</td><td>2</td></tr><tr><th>b</th><td>0</td><td>0</td><td>2</td><td>0</td><td>2</td><td>0</td><td>2</td><td>2</td><td>0</td><td>0</td><td>2</td><td>2</td><td>4</td><td>0</td><td>0</td><td>0</td></tr><tr><th>c</th><td>0</td><td>0</td><td>2</td><td>0</td><td>2</td><td>0</td><td>0</td><td>0</td><td>2</td><td>2</td><td>2</td><td>0</td><td>0</td><td>2</td><td>4</td><td>0</td></tr><tr><th>d</th><td>0</td><td>4</td><td>2</td><td>2</td><td>0</td><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>0</td><td>2</td><td>2</td><td>0</td><td>2</td><td>0</td></tr><tr><th>e</th><td>0</td><td>2</td><td>0</td><td>0</td><td>4</td><td>0</td><td>2</td><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>2</td><td>0</td><td>2</td><td>2</td></tr><tr><th>f</th><td>0</td><td>2</td><td>0</td><td>0</td><td>0</td><td>2</td><td>4</td><td>0</td><td>2</td><td>0</td><td>2</td><td>2</td><td>0</td><td>2</td><td>0</td><td>0</td></tr></tbody></table>

<table><caption>Table 36: LAT of TWINE's S-box (scale: $2^4 \cdot \text{correlation}$).</caption><thead><tr><th>λ<sub>i</sub> \ λ<sub>o</sub></th><th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>a</th><th>b</th><th>c</th><th>d</th><th>e</th><th>f</th></tr></thead><tbody><tr><th>0</th><td>16</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>1</th><td>0</td><td>0</td><td>4</td><td>-4</td><td>0</td><td>0</td><td>4</td><td>-4</td><td>-4</td><td>4</td><td>-8</td><td>-8</td><td>4</td><td>-4</td><td>0</td><td>0</td></tr><tr><th>2</th><td>0</td><td>4</td><td>0</td><td>4</td><td>8</td><td>-4</td><td>0</td><td>4</td><td>0</td><td>-4</td><td>0</td><td>-4</td><td>8</td><td>4</td><td>0</td><td>-4</td></tr><tr><th>3</th><td>0</td><td>4</td><td>4</td><td>0</td><td>0</td><td>4</td><td>-4</td><td>-8</td><td>4</td><td>-8</td><td>0</td><td>-4</td><td>-4</td><td>0</td><td>0</td><td>-4</td></tr><tr><th>4</th><td>0</td><td>0</td><td>0</td><td>8</td><td>0</td><td>8</td><td>0</td><td>0</td><td>-4</td><td>-4</td><td>-4</td><td>4</td><td>4</td><td>-4</td><td>4</td><td>4</td></tr><tr><th>5</th><td>0</td><td>0</td><td>4</td><td>4</td><td>-8</td><td>0</td><td>-4</td><td>4</td><td>-8</td><td>0</td><td>4</td><td>-4</td><td>0</td><td>0</td><td>-4</td><td>-4</td></tr><tr><th>6</th><td>0</td><td>4</td><td>8</td><td>4</td><td>0</td><td>-4</td><td>0</td><td>4</td><td>4</td><td>0</td><td>-4</td><td>0</td><td>-4</td><td>0</td><td>-4</td><td>8</td></tr><tr><th>7</th><td>0</td><td>4</td><td>-4</td><td>0</td><td>0</td><td>-4</td><td>4</td><td>0</td><td>-8</td><td>-4</td><td>-4</td><td>0</td><td>-8</td><td>4</td><td>4</td><td>0</td></tr><tr><th>8</th><td>0</td><td>0</td><td>0</td><td>0</td><td>4</td><td>4</td><td>-4</td><td>-4</td><td>-4</td><td>4</td><td>4</td><td>-4</td><td>0</td><td>8</td><td>0</td><td>8</td></tr><tr><th>9</th><td>0</td><td>0</td><td>-4</td><td>4</td><td>-4</td><td>-4</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>-4</td><td>4</td><td>4</td><td>4</td><td>-8</td><td>0</td></tr><tr><th>a</th><td>0</td><td>4</td><td>0</td><td>4</td><td>-4</td><td>0</td><td>-4</td><td>0</td><td>4</td><td>8</td><td>-4</td><td>0</td><td>0</td><td>4</td><td>8</td><td>-4</td></tr><tr><th>b</th><td>0</td><td>4</td><td>-4</td><td>-8</td><td>-4</td><td>0</td><td>-8</td><td>4</td><td>0</td><td>-4</td><td>-4</td><td>0</td><td>4</td><td>0</td><td>0</td><td>4</td></tr><tr><th>c</th><td>0</td><td>8</td><td>0</td><td>0</td><td>-4</td><td>-4</td><td>4</td><td>-4</td><td>0</td><td>0</td><td>8</td><td>0</td><td>4</td><td>-4</td><td>4</td><td>4</td></tr><tr><th>d</th><td>0</td><td>-8</td><td>-4</td><td>4</td><td>-4</td><td>-4</td><td>0</td><td>0</td><td>4</td><td>-4</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>4</td><td>4</td></tr><tr><th>e</th><td>0</td><td>-4</td><td>8</td><td>-4</td><td>-4</td><td>0</td><td>4</td><td>0</td><td>0</td><td>-4</td><td>0</td><td>4</td><td>4</td><td>8</td><td>4</td><td>0</td></tr><tr><th>f</th><td>0</td><td>-4</td><td>4</td><td>0</td><td>4</td><td>-8</td><td>-8</td><td>-4</td><td>-4</td><td>0</td><td>0</td><td>4</td><td>0</td><td>-4</td><td>4</td><td>0</td></tr></tbody></table>
<table><caption>Table 37: DLCT of TWINE's S-box.</caption><thead><tr><th>Δ<sub>i</sub> \ λ<sub>o</sub></th><th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>a</th><th>b</th><th>c</th><th>d</th><th>e</th><th>f</th></tr></thead><tbody><tr><th>0</th><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td><td>16</td></tr><tr><th>1</th><td>16</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>-8</td><td>-8</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>8</td><td>0</td><td>8</td><td>0</td></tr><tr><th>2</th><td>16</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>-8</td><td>8</td><td>8</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>3</th><td>16</td><td>0</td><td>-8</td><td>0</td><td>-8</td><td>8</td><td>8</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>-8</td><td>0</td></tr><tr><th>4</th><td>16</td><td>-8</td><td>-8</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>8</td><td>-8</td><td>8</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>5</th><td>16</td><td>0</td><td>-8</td><td>-8</td><td>8</td><td>0</td><td>0</td><td>-8</td><td>8</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><th>6</th><td>16</td><td>-8</td><td>8</td><td>-8</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>8</td><td>0</td><td>0</td></tr><tr><th>7</th><td>16</td><td>0</td><td>8</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>-8</td><td>0</td><td>-8</td><td>8</td></tr><tr><th>8</th><td>16</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>8</td><td>0</td><td>0</td><td>0</td><td>8</td><td>-8</td><td>-8</td><td>0</td></tr><tr><th>9</th><td>16</td><td>0</td><td>0</td><td>8</td><td>0</td><td>8</td><td>0</td><td>0</td><td>-8</td><td>-8</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>0</td></tr><tr><th>a</th><td>16</td><td>-8</td><td>0</td><td>8</td><td>0</td><td>0</td><td>8</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>-8</td><td>0</td></tr><tr><th>b</th><td>16</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>-8</td><td>0</td><td>8</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>8</td><td>-8</td><td>0</td></tr><tr><th>c</th><td>16</td><td>8</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>8</td><td>0</td><td>0</td><td>-8</td><td>-8</td></tr><tr><th>d</th><td>16</td><td>0</td><td>0</td><td>0</td><td>8</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>-8</td><td>8</td><td>0</td><td>0</td><td>-8</td></tr><tr><th>e</th><td>16</td><td>8</td><td>0</td><td>0</td><td>-8</td><td>-8</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>8</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>0</td></tr><tr><th>f</th><td>16</td><td>0</td><td>0</td><td>-8</td><td>0</td><td>0</td><td>0</td><td>8</td><td>0</td><td>0</td><td>0</td><td>-8</td><td>-8</td><td>-8</td><td>8</td><td>0</td></tr></tbody></table>

<table><caption>Table 38: DDLCT of TWINE's S-box.</caption><thead><tr><th>Δ<sub>i</sub> \ λ<sub>o</sub></th><th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>a</th><th>b</th><th>c</th><th>d</th><th>e</th><th>f</th></tr></thead><tbody><tr><th>0</th><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td><td>256</td></tr><tr><th>1</th><td>256</td><td>16</td><td>-32</td><td>-32</td><td>0</td><td>16</td><td>-16</td><td>-16</td><td>-32</td><td>-16</td><td>-32</td><td>32</td><td>-48</td><td>-32</td><td>0</td><td>-64</td></tr><tr><th>2</th><td>256</td><td>-32</td><td>-32</td><td>16</td><td>-32</td><td>-32</td><td>32</td><td>-48</td><td>0</td><td>32</td><td>-32</td><td>-16</td><td>-48</td><td>-16</td><td>-16</td><td>-32</td></tr><tr><th>3</th><td>256</td><td>-16</td><td>0</td><td>-64</td><td>-16</td><td>-32</td><td>-32</td><td>0</td><td>32</td><td>-32</td><td>0</td><td>-16</td><td>-48</td><td>-48</td><td>0</td><td>16</td></tr><tr><th>4</th><td>256</td><td>0</td><td>0</td><td>-16</td><td>-64</td><td>0</td><td>-16</td><td>0</td><td>-16</td><td>-32</td><td>-48</td><td>0</td><td>-32</td><td>32</td><td>-48</td><td>0</td></tr><tr><th>5</th><td>256</td><td>-32</td><td>-16</td><td>16</td><td>-32</td><td>16</td><td>-16</td><td>-32</td><td>-32</td><td>-64</td><td>0</td><td>0</td><td>-64</td><td>16</td><td>-32</td><td>16</td></tr><tr><th>6</th><td>256</td><td>32</td><td>-16</td><td>-32</td><td>32</td><td>-32</td><td>-16</td><td>-64</td><td>-16</td><td>-32</td><td>-48</td><td>-16</td><td>0</td><td>-16</td><td>-32</td><td>0</td></tr><tr><th>7</th><td>256</td><td>-32</td><td>-32</td><td>-16</td><td>-16</td><td>32</td><td>0</td><td>0</td><td>-32</td><td>-32</td><td>-48</td><td>0</td><td>16</td><td>-32</td><td>-48</td><td>-16</td></tr><tr><th>8</th><td>256</td><td>-16</td><td>-80</td><td>-32</td><td>0</td><td>0</td><td>0</td><td>0</td><td>-16</td><td>-16</td><td>0</td><td>-64</td><td>-16</td><td>0</td><td>-16</td><td>0</td></tr><tr><th>9</th><td>256</td><td>-32</td><td>0</td><td>-16</td><td>0</td><td>-16</td><td>0</td><td>0</td><td>16</td><td>-16</td><td>-16</td><td>-32</td><td>0</td><td>-48</td><td>-64</td><td>-32</td></tr><tr><th>a</th><td>256</td><td>-32</td><td>16</td><td>0</td><td>-16</td><td>-32</td><td>-48</td><td>16</td><td>-32</td><td>16</td><td>-64</td><td>-32</td><td>-32</td><td>-32</td><td>-16</td><td>32</td></tr><tr><th>b</th><td>256</td><td>-16</td><td>0</td><td>-32</td><td>0</td><td>-64</td><td>-32</td><td>16</td><td>-32</td><td>-32</td><td>-16</td><td>0</td><td>0</td><td>16</td><td>-16</td><td>-48</td></tr><tr><th>c</th><td>256</td><td>-16</td><td>-32</td><td>32</td><td>-16</td><td>-48</td><td>-16</td><td>-32</td><td>-16</td><td>-32</td><td>32</td><td>0</td><td>0</td><td>-64</td><td>-16</td><td>-32</td></tr><tr><th>d</th><td>256</td><td>16</td><td>-32</td><td>-16</td><td>-48</td><td>0</td><td>-64</td><td>-48</td><td>-32</td><td>0</td><td>16</td><td>-16</td><td>0</td><td>0</td><td>-32</td><td>0</td></tr><tr><th>e</th><td>256</td><td>-32</td><td>-16</td><td>-32</td><td>-32</td><td>-48</td><td>0</td><td>0</td><td>-64</td><td>16</td><td>16</td><td>-16</td><td>-32</td><td>0</td><td>0</td><td>-16</td></tr><tr><th>f</th><td>256</td><td>-64</td><td>16</td><td>-32</td><td>-16</td><td>-16</td><td>-32</td><td>-48</td><td>16</td><td>-32</td><td>-32</td><td>-32</td><td>16</td><td>32</td><td>0</td><td>-32</td></tr></tbody></table>
<table><caption>Table 39: 3-DLCT of TWINE's S-box.</caption><thead><tr><th>Δ<sub>i</sub> \ λ<sub>o</sub></th><th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>a</th><th>b</th><th>c</th><th>d</th><th>e</th><th>f</th></tr></thead><tbody><tr><th>0</th><td>4096</td><td>4096</td><td>4096</td><td>4096</td><td>4096</td><td>4096</td><td>4096</td><td>4096</td><td>4096</td><td>4096</td><td>4096</td><td>4096</td><td>4096</td><td>4096</td><td>4096</td><td>4096</td></tr><tr><th>1</th><td>4096</td><td>-480</td><td>-160</td><td>32</td><td>-256</td><td>-480</td><td>-256</td><td>-320</td><td>-192</td><td>-320</td><td>-192</td><td>-224</td><td>-256</td><td>-320</td><td>-352</td><td>-320</td></tr><tr><th>2</th><td>4096</td><td>-384</td><td>-64</td><td>-288</td><td>-384</td><td>-320</td><td>-384</td><td>32</td><td>-416</td><td>-256</td><td>-416</td><td>-288</td><td>-384</td><td>-288</td><td>-192</td><td>-64</td></tr><tr><th>3</th><td>4096</td><td>-480</td><td>-320</td><td>-288</td><td>-224</td><td>-192</td><td>-128</td><td>-480</td><td>-256</td><td>-320</td><td>-352</td><td>-352</td><td>-224</td><td>32</td><td>-288</td><td>-224</td></tr><tr><th>4</th><td>4096</td><td>-256</td><td>-96</td><td>-512</td><td>-160</td><td>-544</td><td>-416</td><td>-256</td><td>-224</td><td>-320</td><td>-192</td><td>-256</td><td>-128</td><td>-96</td><td>-320</td><td>-320</td></tr><tr><th>5</th><td>4096</td><td>-256</td><td>-256</td><td>-256</td><td>-160</td><td>-256</td><td>-96</td><td>-320</td><td>-128</td><td>-96</td><td>-544</td><td>-192</td><td>-416</td><td>-480</td><td>-384</td><td>-256</td></tr><tr><th>6</th><td>4096</td><td>-288</td><td>-352</td><td>-96</td><td>-352</td><td>-64</td><td>-256</td><td>-320</td><td>-448</td><td>-416</td><td>-64</td><td>-64</td><td>-384</td><td>-288</td><td>-448</td><td>-256</td></tr><tr><th>7</th><td>4096</td><td>-224</td><td>-288</td><td>-256</td><td>-192</td><td>-256</td><td>-192</td><td>-256</td><td>-64</td><td>-448</td><td>-160</td><td>-416</td><td>-256</td><td>-480</td><td>-384</td><td>-224</td></tr><tr><th>8</th><td>4096</td><td>-256</td><td>-192</td><td>-384</td><td>-448</td><td>-160</td><td>-352</td><td>-384</td><td>-64</td><td>-320</td><td>-224</td><td>-224</td><td>-480</td><td>-256</td><td>-96</td><td>-256</td></tr><tr><th>9</th><td>4096</td><td>-352</td><td>-448</td><td>-320</td><td>-256</td><td>-192</td><td>-384</td><td>-224</td><td>-192</td><td>-288</td><td>-192</td><td>-448</td><td>-160</td><td>-288</td><td>-288</td><td>-64</td></tr><tr><th>a</th><td>4096</td><td>-352</td><td>-320</td><td>-384</td><td>-224</td><td>-32</td><td>-192</td><td>-96</td><td>-256</td><td>-384</td><td>-448</td><td>-288</td><td>-32</td><td>-256</td><td>-320</td><td>-512</td></tr><tr><th>b</th><td>4096</td><td>-64</td><td>-352</td><td>-160</td><td>-384</td><td>-288</td><td>-352</td><td>-448</td><td>-352</td><td>-224</td><td>-224</td><td>-224</td><td>-64</td><td>-288</td><td>-320</td><td>-352</td></tr><tr><th>c</th><td>4096</td><td>-320</td><td>-320</td><td>-256</td><td>-448</td><td>-352</td><td>-192</td><td>-160</td><td>-416</td><td>64</td><td>-192</td><td>-480</td><td>-320</td><td>-256</td><td>-224</td><td>-224</td></tr><tr><th>d</th><td>4096</td><td>-192</td><td>-448</td><td>-352</td><td>-192</td><td>-384</td><td>-160</td><td>-192</td><td>-320</td><td>-192</td><td>-128</td><td>-96</td><td>-480</td><td>-352</td><td>-128</td><td>-480</td></tr><tr><th>e</th><td>4096</td><td>-192</td><td>-128</td><td>-256</td><td>-352</td><td>-320</td><td>-320</td><td>-288</td><td>-352</td><td>-224</td><td>-384</td><td>-320</td><td>-192</td><td>-352</td><td>0</td><td>-416</td></tr><tr><th>f</th><td>4096</td><td>0</td><td>-352</td><td>-320</td><td>-64</td><td>-256</td><td>-416</td><td>-384</td><td>-416</td><td>-352</td><td>-384</td><td>-224</td><td>-320</td><td>-128</td><td>-352</td><td>-128</td></tr></tbody></table>
<table><caption>Table 40: Specification of DL distinguishers for TWINE.</caption><thead><tr><th></th><th></th><th></th></tr></thead><tbody><tr><td colspan="3">7 Rounds, Figure 59a</td></tr><tr><td>δ, λ ∈ ℝ<sup>4</sup>, r<sub>u</sub> = 0, r<sub>m</sub> = 7, r<sub>ℓ</sub> = 0, p = 1, r = 1, q<sup>2</sup> = 1, prq<sup>2</sup> = 1</td><td>0δ00000000000000</td><td>ΓX<sub>7</sub></td><td>00000000000000λ00</td></tr><tr><td colspan="3">8 Rounds, Figure 59b</td></tr><tr><td>r<sub>u</sub> = 0, r<sub>m</sub> = 8, r<sub>ℓ</sub> = 0, p = 1, r = 2<sup>-1.68</sup>, q<sup>2</sup> = 1, prq<sup>2</sup> = 2<sup>-1.68</sup></td><td>00000000000000800</td><td>ΓX<sub>8</sub></td><td>0000000000000002</td></tr><tr><td colspan="3">9 Rounds, Figure 60a</td></tr><tr><td>r<sub>u</sub> = 0, r<sub>m</sub> = 9, r<sub>ℓ</sub> = 0, p = 1, r = 2<sup>-5.82</sup>, q<sup>2</sup> = 1, prq<sup>2</sup> = 2<sup>-5.82</sup></td><td>0000000000000004</td><td>ΓX<sub>9</sub></td><td>0005000000000000</td></tr><tr><td colspan="3">10 Rounds, Figure 60b</td></tr><tr><td>r<sub>u</sub> = 1, r<sub>m</sub> = 9, r<sub>ℓ</sub> = 0, p = 2<sup>-2</sup>, r = 2<sup>-5.85</sup>, q<sup>2</sup> = 1, prq<sup>2</sup> = 2<sup>-7.85</sup></td><td>0000a70000000000</td><td>ΔX<sub>1</sub></td><td>0000000a00000000</td></tr><tr><td>ΔX<sub>0</sub><br>ΓX<sub>10</sub></td><td>0000000000000001</td><td></td><td></td></tr><tr><td colspan="3">11 Rounds, Figure 61a</td></tr><tr><td>r<sub>u</sub> = 1, r<sub>m</sub> = 9, r<sub>ℓ</sub> = 1, p = 2<sup>-2</sup>, r = 2<sup>-6.49</sup>, q<sup>2</sup> = 2<sup>-2</sup>, prq<sup>2</sup> = 2<sup>-10.49</sup></td><td>0000000000000a700</td><td>ΔX<sub>1</sub></td><td>00000000000000a</td></tr><tr><td>ΔX<sub>0</sub><br>ΓX<sub>10</sub></td><td>000000a000000000</td><td>ΓX<sub>11</sub></td><td>000000010000a000</td></tr><tr><td colspan="3">12 Rounds, Figure 61b</td></tr><tr><td>r<sub>u</sub> = 1, r<sub>m</sub> = 10, r<sub>ℓ</sub> = 1, p = 2<sup>-2</sup>, r = 2<sup>-7.49</sup>, q<sup>2</sup> = 2<sup>-2</sup>, prq<sup>2</sup> = 2<sup>-11.49</sup></td><td>0000a700000000000</td><td>ΓX<sub>11</sub></td><td>0a00000000000000</td></tr><tr><td>ΔX<sub>0</sub><br>ΔX<sub>1</sub></td><td>0000000a00000000</td><td>ΓX<sub>12</sub></td><td>a00010000000000</td></tr><tr><td colspan="3">13 Rounds, Figure 62a</td></tr><tr><td>r<sub>u</sub> = 1, r<sub>m</sub> = 10, r<sub>ℓ</sub> = 2, p = 2<sup>-2</sup>, r = 2<sup>-7.58</sup>, q<sup>2</sup> = 2<sup>-4</sup>, prq<sup>2</sup> = 2<sup>-13.58</sup></td><td>00a7000000000000</td><td>ΔX<sub>1</sub></td><td>0a00000000000000</td></tr><tr><td>ΔX<sub>0</sub><br>ΓX<sub>11</sub></td><td>0000000a00000000</td><td>ΓX<sub>13</sub></td><td>0200c00000000a00</td></tr><tr><td colspan="3">14 Rounds, Figure 62b</td></tr><tr><td>r<sub>u</sub> = 2, r<sub>m</sub> = 10, r<sub>ℓ</sub> = 2, p = 2<sup>-4</sup>, r = 2<sup>-7.64</sup>, q<sup>2</sup> = 2<sup>-4</sup>, prq<sup>2</sup> = 2<sup>-15.64</sup></td><td>0000000a00790000</td><td>ΔX<sub>2</sub></td><td>0000000000000a00</td></tr><tr><td>ΔX<sub>0</sub><br>ΓX<sub>12</sub></td><td>0000000000000a0000</td><td>ΓX<sub>14</sub></td><td>0a0000c000000200</td></tr><tr><td colspan="3">15 Rounds, Figure 63a</td></tr><tr><td>r<sub>u</sub> = 2, r<sub>m</sub> = 10, r<sub>ℓ</sub> = 3, p = 2<sup>-8</sup>, r = 2<sup>-7.49</sup>, q<sup>2</sup> = 2<sup>-8</sup>, prq<sup>2</sup> = 2<sup>-19.49</sup></td><td>000000000000a79</td><td>ΔX<sub>2</sub></td><td>000000000a000000</td></tr><tr><td>ΔX<sub>0</sub><br>ΓX<sub>12</sub></td><td>0000000000000a0000</td><td>ΓX<sub>15</sub></td><td>01a000d001000800</td></tr><tr><td colspan="3">16 Rounds, Figure 63b</td></tr><tr><td>r<sub>u</sub> = 3, r<sub>m</sub> = 10, r<sub>ℓ</sub> = 3, p = 2<sup>-8</sup>, r = 2<sup>-7.64</sup>, q<sup>2</sup> = 2<sup>-8</sup>, prq<sup>2</sup> = 2<sup>-23.64</sup></td><td>00000000a7009807</td><td>ΔX<sub>3</sub></td><td>000000000a000000</td></tr><tr><td>ΔX<sub>0</sub><br>ΓX<sub>13</sub></td><td>0000000000000a0000</td><td>ΓX<sub>16</sub></td><td>01a000d001000800</td></tr><tr><td colspan="3">17 Rounds, Figure 63c</td></tr><tr><td>r<sub>u</sub> = 3, r<sub>m</sub> = 10, r<sub>ℓ</sub> = 4, p = 2<sup>-8.00</sup>, r = 2<sup>-8</sup>, q<sup>2</sup> = 2<sup>-14</sup>, prq<sup>2</sup> = 2<sup>-29.62</sup></td><td>0000a70000000798</td><td>ΔX<sub>3</sub></td><td>0000000000000a00</td></tr><tr><td>ΔX<sub>0</sub><br>ΓX<sub>13</sub></td><td>000000000000a0000</td><td>ΓX<sub>17</sub></td><td>0c001a0d0c061020</td></tr></tbody></table>
<figure><img src="image_69.png" /><figcaption>Fig. 59: DL distinguishers for 7 to 8 rounds of TWINE (— differential — linear).</figcaption></figure>
<figure><img src="image_70.png" /><figcaption>Fig. 60: DL distinguishers for 9 to 10 rounds of TWINE (— differential — linear).</figcaption></figure>
<figure><img src="image_71.png" /><figcaption>Fig. 61: DL distinguishers for 11 to 12 rounds of TWINE (— differential — linear).</figcaption></figure>
<figure><img src="image_72.png" /><figcaption>Fig. 62: DL distinguishers for 13 to 14 rounds of TWINE (— differential — linear).</figcaption></figure>
<figure><img src="image_73.png" /><figcaption>Fig. 63: DL distinguishers for 15 to 17 rounds of TWINE (— differential — linear).</figcaption></figure>
<figure><img src="image_74.png" /><figcaption>Fig. 64: The 13-round DL distinguisher of TWINE in Example 2 (— differential - linear). p = 2⁻⁴, r = 2⁻⁵.⁸³ (for ΔX₂[5] = 4, ΓX₁₁[15] = 5), q² = 2⁻⁴, prq² = 2⁻¹³.⁸³.</figcaption></figure>
## N Encoding S-boxes

The S-box Analyzer [33], a SageMath [49] module, is an open-source tool designed to efficiently encode the differential, linear, and integral properties of S-boxes through MILP, SMT/SAT, and CP models. It has been applied for differential, integral, impossible-differential, zero-correlation, and boomerang attacks on various block ciphers, as detailed in [31–33]. The tool is openly available to the public at: https://github.com/hadipourh/sboxanalyzer

We also added some new features regarding differential-linear analysis to the S-box Analyzer, e.g., deriving the DLCT, DDLCT, and encoding the DLCT tables. Listing 1.1, and Listing 1.2 briefly demonstrates how to use the S-box Analyzer to derive the CP constraints modeling the DDT, LAT², deterministic differential/-linear behavior and also the DLCT of S-boxes.

```python
1 sage: from sboxanalyzer import *
2 sage: from sage/crypto.sboxes import KNOT as sa
3 sage: sa = SboxAnalyzer(sa)
4
5
6 # Model the DDT
7 sage: cnf, milp = sa.minimized_diff_constraints()
8 Time used to simplify the constraints: 0.01 seconds
9 Number of constraints: 37
10 Input: a0||a1||a2||a3; a0: msb
11 Output: b0||b1||b2||b3; b0: msb
12 Weight: 3.0000 p0 + 2.0000 p1
13
14 sage: pretty_print(milp)
15
16 ['- p0 - p1 >= -1',
17     '- a0 - a2 + b0 + p0 >= -1',
18     '- a3 - b0 - b1 + p0 >= -2',
19     '- a2 + b0 - b1 + p0 >= 0',
20     '- a2 - b0 - b3 + p0 >= -2',
21     '- a2 + b1 - b2 + p1 >= 0',
22     '- a0 + b1 + b2 + p1 >= 0',
23     '- a0 - a1 + a2 + a3 - b0 >= -2',
24     '- a0 - a1 + a2 + a3 + b0 >= 0',
25     '- a0 + a1 + a2 - a3 + b1 >= 0',
26     '- a0 - a1 - a2 - b1 - b2 >= -3',
27     '- a0 + a1 - a2 - b1 + b2 >= -1',
28     '- a0 + a2 + b1 + b2 - b3 >= 0',
29     '- a0 - b0 + b1 - b2 + b3 >= -2',
30     '- a1 - a3 + b0 + b1 + p0 >= -1',
31     '- b0 + b1 - b2 - b3 - p1 >= -2',
32     '- a1 + a2 - a3 - b0 + p1 >= -2',
33     '- a0 + a1 + a2 - b1 + p1 >= -1',
34     '- a1 + a2 + a3 - b1 + p1 >= 0',
35     '- a0 - a2 + b0 - b1 + p1 >= -1',
36     '- a0 - a3 - b0 - b3 + p1 >= -3',
37     '- b0 + b1 - b2 - b3 + p1 >= -2',
38     '- b0 + b1 + b2 + b3 + p1 >= 0',
39     '- a1 + a3 + b0 - b1 + b2 - b3 >= -1',
40     '- a0 - a2 + a3 - b0 - b1 + b3 >= -3',
41     '- a1 - a2 - a3 + b0 + b2 + b3 >= -1',
42     '- a1 + a2 + a3 + b1 + p0 - p1 >= 0',
43
```
```
'a2 + b1 + b2 + b3 + p0 - p1 >= 0',
'a0 + b0 + b1 + b3 - p0 + p1 >= 0',
'a1 - a2 - a3 + b0 - b1 - b2 - b3 >= -4',
'- a1 - a2 - a3 + b0 - b1 + b2 - b3 >= -4',
'a1 - a2 + a3 + b0 - b1 - b2 + b3 >= -2',
'- a1 - a2 + a3 + b0 - b1 + b2 + b3 >= -2',
'- a1 - a2 - a3 + b0 - b1 - b2 + b3 >= -4',
'- a1 - a2 + a3 + b0 - b1 - b2 - b3 >= -4']
```

```
54 # Model the squared LAT
55 sage: cnf, milp = sa.minimized linear_constraints()
56 Time used to simplify the constraints: 0.01 seconds
57 Number of constraints: 34
58 Input: a0||a1||a2||a3; a0: msb
59 Output: b0||b1||b2||b3; b0: msb
60 Weight: 4.0000 p0 + 2.0000 p1
61
62 sage: pretty_print(milp)
63
64 '- p0 - p1 >= -1',
65 'a1 + a3 - p0 >= 0',
66 'a1 - a3 - b2 + p0 >= -1',
67 '- a0 - a1 - b3 + p0 >= -2',
68 '- a1 + b2 - b3 + p0 >= -1',
69 '- a0 + a1 + a3 + p1 >= 0',
70 'a1 - a2 + b2 + p1 >= 0',
71 'a1 - b1 + b2 + p1 >= 0',
72 'a3 - b2 + b3 + p1 >= 0',
73 '- a1 + b2 + b3 + p1 >= 0',
74 '- a0 + a1 + a3 - b0 + b2 >= -1',
75 'a1 + a2 - a3 + b1 + b2 >= 0',
76 '- a0 + a1 - b0 + b2 + b3 >= -1',
77 'a1 + a3 - b0 + b2 + b3 >= 0',
78 '- a0 - a1 - b0 - b1 + p0 >= -3',
79 '- a0 - a3 + b0 + b1 + p0 >= -1',
80 '- a0 - a2 - b0 - b2 + p0 >= -3',
81 '- a0 + a2 + b0 - b3 + p0 >= -1',
82 'a0 + a3 + b0 - b3 + p0 >= 0',
83 '- a1 - a2 + b1 - b3 + p0 >= -2',
84 'a0 + a3 - b2 - b3 + p0 >= -1',
85 'a0 - a3 + b0 + b3 + p0 >= 0',
86 'a1 + a3 + b0 + b3 - p1 >= 0',
87 'a3 + b0 + b2 + b3 - p1 >= 0',
88 '- a1 - a3 - b2 - b3 + p1 >= -3',
89 'a0 + a1 + a2 - b0 + b2 - b3 >= -1',
90 '- a1 + a2 - a3 - b1 - b2 + p0 >= -3',
91 '- a2 - a3 - b1 + b2 - b3 + p0 >= -3',
92 '- a1 - a3 - b0 - b1 + b3 + p0 >= -3',
93 'a0 - a1 - b0 + b1 + b3 + p0 >= -1',
94 'a0 + a2 - b0 - b2 + b3 + p0 >= -1',
95 '- a1 - a2 - b1 - b2 + b3 + p0 >= -3',
96 '- a1 + a2 + b1 - b2 + b3 + p0 >= -1']
```

```
99 # Model the deterministic differential behavior
100 sage: detdiff = sa.encode_deterministic_differential_behavior()
101 sage: cpdetdiff = sa(generateCP_constraints detdiff)
102 Input: a0||a1||a2||a3; a0: msb
103 Output: b0||b1||b2||b3; b0: msb
```
```python
104 sage: print(cpdetdiff)
105 if (a0==0/\a1==0/\a2==0/\a3==0) then (b0=0/\b1=0/\b2=0/\b3==0)
106 elsif (a0==0/\a1==0/\a2==0/\a3==1) then (b0=-1/\b1=1/\b2=-1/\b3=-1)
107 elsif (a0==0/\a1==1/\a2==0/\a3==0) then (b0=1/\b1=-1/\b2=-1/\b3=-1)
108 elsif (a0==1/\a1==0/\a2==0/\a3==0) then (b0=1/\b1=1/\b2=-1/\b3=-1)
109 elsif (a0==1/\a1==0/\a2==0/\a3==1) then (b0=-1/\b1=0/\b2=-1/\b3=-1)
110 elsif (a0==1/\a1==1/\a2==0/\a3==0) then (b0=0/\b1=-1/\b2=-1/\b3=-1)
111 else (b0=-1/\b1=-1/\b2=-1/\b3=-1)
112 endif
113
114
115 # Model the deterministic linear behavior
116 sage: detlin = sa.encode_deterministic_line
117 sage: cpdetlin = sa(generate_c
118 Input: a0||a1||a2||a3; a0: msb
119 Output: b0||b1||b2||b3; b0: msb
120 sage: print(cpdetlin)
121 if (a0==0/\a1==0/\a2==0/\a3==0) then (b0=0/\b1=0/\b2=0/\b3==0)
122 elsif (a0==0/\a1==0/\a2==1/\a3==0) then (b0=1/\b1=-1/\b2=-1/\b3=-1)
123 elsif (a0==1/\a1==0/\a2==0/\a3==0) then (b0=1/\b1=-1/\b2=1/\b3=-1)
124 elsif (a0==1/\a1==0/\a2==1/\a3==0) then (b0=0/\b1=-1/\b2=-1/\b3=1)
125 else (b0=-1/\b1=-1/\b2=-1/\b3=-1)
126 endif
```

<caption>Listing 1.1: Encoding differential-linear behavior of S-boxes in S-box Analyzer</caption>