New zero‐sum distinguishers on full 24‐round K <scp>eccak</scp> ‐f using the division property

IET Information SecurityVolume 13, Issue 5 p. 469-478 Research ArticleFree Access New zero-sum distinguishers on full 24-round Keccak -f using the division property Hailun Yan, Hailun Yan Department of Computer Science and Engineering, Shanghai Jiao Tong University, Shanghai, 200240 People's Republic of ChinaSearch for more papers by this authorXuejia Lai, Corresponding Author Xuejia Lai laix@sjtu.edu.cn Department of Computer Science and Engineering, Shanghai Jiao Tong University, Shanghai, 200240 People's Republic of China Westone Cryptologic Research Center, Beijing, 100070 People's Republic of ChinaSearch for more papers by this authorLei Wang, Lei Wang Department of Computer Science and Engineering, Shanghai Jiao Tong University, Shanghai, 200240 People's Republic of China Westone Cryptologic Research Center, Beijing, 100070 People's Republic of ChinaSearch for more papers by this authorYu Yu, Yu Yu Department of Computer Science and Engineering, Shanghai Jiao Tong University, Shanghai, 200240 People's Republic of China Westone Cryptologic Research Center, Beijing, 100070 People's Republic of ChinaSearch for more papers by this authorYiran Xing, Yiran Xing Department of Computer Science and Engineering, Shanghai Jiao Tong University, Shanghai, 200240 People's Republic of ChinaSearch for more papers by this author Hailun Yan, Hailun Yan Department of Computer Science and Engineering, Shanghai Jiao Tong University, Shanghai, 200240 People's Republic of ChinaSearch for more papers by this authorXuejia Lai, Corresponding Author Xuejia Lai laix@sjtu.edu.cn Department of Computer Science and Engineering, Shanghai Jiao Tong University, Shanghai, 200240 People's Republic of China Westone Cryptologic Research Center, Beijing, 100070 People's Republic of ChinaSearch for more papers by this authorLei Wang, Lei Wang Department of Computer Science and Engineering, Shanghai Jiao Tong University, Shanghai, 200240 People's Republic of China Westone Cryptologic Research Center, Beijing, 100070 People's Republic of ChinaSearch for more papers by this authorYu Yu, Yu Yu Department of Computer Science and Engineering, Shanghai Jiao Tong University, Shanghai, 200240 People's Republic of China Westone Cryptologic Research Center, Beijing, 100070 People's Republic of ChinaSearch for more papers by this authorYiran Xing, Yiran Xing Department of Computer Science and Engineering, Shanghai Jiao Tong University, Shanghai, 200240 People's Republic of ChinaSearch for more papers by this author First published: 01 September 2019 https://doi.org/10.1049/iet-ifs.2018.5263AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract The authors analyse the security of Keccak (the winner in SHA-3 competition) by focusing on the zero-sum distinguishers of its underlying permutation (named Keccak -f). The authors' analyses are developed by using the division property, a generalised integral property that was initially used in the integral cryptanalysis of symmetric-key algorithms. Following the work pioneered by Todo at CRYPTO 2015, they first formalise and prove a more delicate propagation rule of the division property under the assumption that the S-box's specification is known to attackers. Then, they apply this rule to the inverse S-box in Keccak -f with a further study on properties of its algebraic degree. They find that the rate of decline in the division property is gentler than that of a randomly chosen S-box. Meanwhile, they get the same results for the S-box in Ascon permutation. Thanks to this vulnerable property, they can improve the higher-order differential characteristics against the inverse of Keccak -f in terms of the required number of chosen plaintexts. As an application, they give new zero-sum distinguishers on full 24-round Keccak -f of size . To the authors' knowledge, this is currently the best zero-sum distinguishers of full-round Keccak -f permutation. Incidentally, they give the corresponding results for 12-round Ascon permutation. 1 Introduction The Keccak hash function family was proposed by Bertoni et al. [1], and follows the so-called sponge construction. It was selected as the winner of the SHA-3 competition [2] and subsequently standardised as SHA-3 standard [3]. Since the design was made public, Keccak has attracted intensive cryptanalysis [4-11], including zero-sum distinguishers on its underlying permutation Keccak -f. Zero-sum distinguishers were introduced by Aumasson and Meier at CHES 2009 [4]. In order to construct zero-sum distinguishers of a permutation, attackers need to search for a set of zero-sum input values (called zero-sum), of which the corresponding output values also sum to zero. In other words, for a permutation P, they find a set V of values such that and . Given all inputs in V except one and the P -outputs of all inputs of V but one, the existence of zero-sum distinguishers allows to compute the missing input and output by simply summing over the known elements without calling P. The small size of zero-sum may give adversaries an advantage in an attack. In the public comment on the NIST Hash competition 2010 [12], zero-sum distinguishers are shown to be valid and qualitatively different from generic methods, albeit with a very small advantage. The existence of the zero-sum distinguisher over 16 rounds of Keccak - in [4] motivated the designers to increase the total number of rounds for Keccak -f permutation in order to increase the security margin against possible attacks, since the hermetic sponge strategy adopted in the Keccak sponge function impose the underlying permutation to be free from structural distinguishers [13, 14]. In practice, the search for zero-sum distinguishers on a hash function usually begins in the intermediate state and extends to both ends, since there is no secret parameter in the internal functions. Meanwhile, the analysis mainly uses the higher-order differential technique [15] combined with the degree estimation on the iterated round functions. More specifically, for an r -round iterated permutation , suppose that the algebraic degrees of the forward rounds and the t backward rounds are bounded by d. According to a well-known higher-order differential property, for a Boolean function f with deg , the outputs sum to zero if the inputs form a linear subspace of dimension . Then, by choosing a linear subspace of size in the intermediate state after t rounds, both the inputs and outputs of P sum to zero, i.e. and . The zero-sum V of the r -round zero-sum distinguisher can be got by . See Fig. 1. Fig. 1Open in figure viewerPowerPoint Zero-sum distinguishers constructed with degree estimation Zero-sum distinguishers on Keccak -f permutation mainly exploit the following property of the only non-linear step in the round function: the algebraic degree of the 5-bit S-box is 2 and the algebraic degree of its inverse is 3, which is (relatively) low. Until now, there have been distinguishers of 9–15 rounds for Keccak -f permutation of 1600 bits, with complexities bounded by (birthday bound) [4, 9]. Besides this, Guo et al. [16] formalised the idea of linear structures and inserted three rounds for free in the middle. Compared with the previous zero-sum distinguishers in [4], they generally increased the rounds of attack by two without increasing the complexity. Zero-sum distinguishers with more rounds on the Keccak -f permutation were given by Boura et al. [17, 18], where the zero-sum of the full 24-round Keccak -f is of size . Then, Duan and Lai [19] improved Boura et al. 's work by lowering the size of the zero-sum to . Another important work related to our paper is the division property, which was proposed by Todo [20] at EUROCRYPT 2015. It generalised the integral property [21] by further exploiting the algebraic degree of block ciphers. Therefore, division property usually leads to more accurate higher-order differential characteristics for many cryptographic primitives. We briefly recall the concept of division property here and give the formal definition later. When we say the multi-set whose elements take values from has the division property , it satisfies such properties: for , if we evaluate the product of any i bits of the elements in , then the sum of the evaluation over is zero. Moreover, for , the sum becomes unknown. According to this definition, when the multi-set is of , the sum of all the elements in the multi-set is zero. Todo gave some propagation rules (Substitution, Copy, Compression by XOR, Split and Concatenation) of the division property in [20]. Note that in the propagation rule of Substitution, it is assumed that nothing of the S-box's specification is known to the attackers but the algebraic degree. While in practice, the details of the S-box are usually public knowledge. For the 7-bit S-box in MISTY1 [22], Todo gave an improved propagation characteristic of the division property by further considering its specification [23]. Based on this, Todo found an integral distinguisher of 6-round on MISTY1 and successfully mounted the full-round integral attack on MISTY1. However, for the division property's propagation characteristic specific to , no generic method was given or proved. Moreover, Todo proposed an algorithm in [20] based on the division property to search for higher-order differential (integral) distinguishers. Although the attack developed by his algorithm is generic, it can make an improvement on the higher-order differential distinguishers of several specific primitives, including Keccak -f. Compared with the previous zero-sum distinguishers on Keccak -f constructed by Boura et al. [18] using a degree estimation, Todo's algorithm can make a reduction on the number of the required chosen data (see Table 1). Then, a natural question is that, if such things also happened for the inverse of Keccak -f, it might be possible to construct a better zero-sum distinguisher with a smaller size. However, for the higher-order differential distinguishers against the inverse of Keccak -f, our experiments show that Todo's generic search algorithm has less advantage over Duan and Lai's degree estimation [19]. This is mainly because Duan and Lai have made an improvement in Boura et al. 's generic degree estimation by considering the inherent properties of Keccak -f. In this paper, we consider how to improve Todo's search algorithm for the inverse of Keccak -f permutation with a further study on properties of its non-linear layer. Table 1. Data complexity of r -round higher-order differential (integral) characteristic on Keccak -f and its inverse Target application (#texts) Method Reference (5,2,320)-SPN Keccak -f 257 513 1025 1409 1537 1579 1593 1598 degree [18] 130 258 515 1025 1410 1538 1580 1595 division property Algorithm 1 (Fig. 7) [20] (5,3,320)-SPN Keccak - 1383 1492 1546 1573 1587 1594 1597 1599 degree division property Algorithm 1 (Fig. 7) [18, 19] 1310 1505 1570 1590 1599 — — — [20] 1165 1384 1494 1546 1574 1589 1595 1599 division property Algorithm 2 (Fig. 8) Section 4.2 Following the pioneering work of Todo in [20, 23], there have been many extensions and applications of the division property [24-30]. Particularly, in [31], Xiang et al. extended mixed-integer linear programming (MILP) method, which is used to search differential characteristics and linear trails of block ciphers, to search integral distinguishers of block ciphers based on division property. In [27], Sun et al. proposed automatic tools to detect ARX ciphers' division property relying on Boolean Satisfiability (SAT) problem. In [28], Todo et al. exploit the division property to mount cube attacks on non-blackbox polynomials, which is the first application of the division property to stream ciphers. Our contribution: In general, there are mainly two different approaches to improve the zero-sum distinguishers, finding tighter upper bounds on the degree of iterated permutations [18, 19], or trying to insert more rounds for free in the middle [4, 16, 17]. In this paper, our work is in a new direction. We use the division property to improve the zero-sum distinguishers on Keccak -f. In our work, we first formalise and prove the propagation rule of the division property used by Todo [23], combined with the weight-degree table. We call it table-based propagation rule of the division property. Then, we apply this rule to the inverse of the S-box used in the round permutation of Keccak -f (see Table 2). We find that, the rate of decline in the division property is gentler than that of a randomly chosen S-box. More specifically, for the inverse of the S-box in Keccak -f, the deterioration of the division property can be improved from to . Table 2. Division property's propagation characteristic of the inverse S-box in Keccak -f (the same for Ascon permutation) for input set for output set for output set (improved) Combined with the above property, we improve Todo's search algorithm for the inverse of Keccak -f, getting better higher-order differential distinguishers. The results are summarised in Table 1, where the inverse of Keccak -f is denoted by Keccak -. Finally, we obtain new zero-sum distinguishers on 23-round Keccak -f of size with higher-order differential characteristics of 12 rounds forward and 11 rounds backward, which are connected by the propagation of the division property. By transforming the vectorial division property to the general division property in the intermediate part, we obtain zero-sum distinguishers on full 24-round Keccak -f of size . We have made an improvement compared with the previous best one of size [19]. Although our improvement seems limited, it is a novel application of the division property to hash functions, and offers new possibilities to search for zero-sum distinguishers. Our technique applies to other permutations. As a by-product of our research, we show our analytic results of the inner permutation of Ascon, which is one of the finalists in the CAESAR competition. For Ascon permutation, the propagation characteristic of the division property against its S-box is exactly the same as that against in Keccak, evaluated by our table-based propagation rule of the division property (see Table 2). Therefore, we can also improve the higher-order differential characteristics against the inverse of Ascon permutation in terms of the required number of chosen plaintexts (see Table 3). We get zero-sum distinguishers on 12-round Ascon permutation of size , which is in accordance with distinguishers given by Dobraunig et al. at CT-RSA 2015 [32]. We have summarised the corresponding results of the Ascon permutation in Appendix 2. We do not show the details in this paper considering the technical similarities. Table 3. Data complexity of r -round higher-order differential (integral) characteristic on Ascon permutation and its inverse Target application (#texts) Method (5,2,64)-SPN Ascon permutation 4 5 5 10 18 35 65 130 258 300 315 division property Algorithm 1 (Fig. 7) (5,3,64)-SPN inverse of Ascon permutation 4 5 10 30 84 245 295 314 – – – division property Algorithm 1 (Fig. 7) 4 5 10 29 84 201 261 291 306 314 319 division property Algorithm 2 (Fig. 8) 2 Preliminaries 2.1 Basic definitions - SPN (substitute-permutation network) [20]. SPN is a basic structure in designing block ciphers. The round function of an SPN iterated block cipher is composed of the S-Layer and the P-Layer. For an -SPN, there are m n -bit parallel S-boxes in the S-Layer with degree at most d. Also, there is one -bit linear function in the P-Layer. Hamming weight. Let . Define the Hamming weight of a as Let . Define the extended Hamming weight of as Bit product function. Let , . Define the bit product function as Let , . The bit product function is defined as Algebraic normal form (ANF). For a Boolean function , its ANF is expressed as The algebraic degree of f is defined as , denoted by deg. Note that an n -bit S-box is a vectorial Boolean function from to . The algebraic degree of an S-box is defined as the maximal algebraic degree of these n Boolean function coordinates. 2.2 Division property In this part, we first give summary of the definition of the division property. Then we present several propagation rules of the division property related to this paper. For a better understanding of this part, please refer to [20, 23]. In [20], Todo gave three types of division properties, which are the (general) division property, vectorial division property and collective division property. In the following, we only formally introduce the definition of collective division property, where the other two types of division property can be regarded as its special case. Definition 1 (Collective division property).Denote by a multi-set whose elements take values in . Let , where take values between 0 and n. When we say that the multi-set has the collective division property , it fulfils: if . Otherwise, becomes unknown. Note that for , means that for all . Otherwise, . In particular, for , the multi-set whose elements take values in has the vectorial division property . For , , the multi-set whose elements take values in has the division property . Namely, when and becomes unknown when . Given the division property of the input multi-set of an S-box, in order to evaluate the division property of the output multi-set, Todo gave the following propagation characteristic [20], which we call the generalised propagation rule of the division property. Property 1.For an S-box with degree d, the division property of the input multi-set propagates to the division property of the output multi-set. Particularly, suppose that the S-box is a permutation, then propagates to .Rule 1 (Substitution) [23]: Let F: be a function, which is composed of m n -bit S-boxes defined over with algebraic degree d. When the input multi-set has the collective division property , the output multi-set has the collective division property , which is calculated as Rule 2 (Concatenation) [23]: Let F be a concatenation function defined over , . Through F, the collective division property of the input multi-set propagates to the division property of the output multi-set, which is calculated as Rule 3 (Partition) [23]: Let F be a split function from into , where . . Through F, the division property of the input multi-set propagates to the collective division property of the output multi-set, which is calculated as Here . 2.3 Keccak -f permutation Fig. 2Open in figure viewerPowerPoint Sponge construction The operation mode of Keccak hash function is the sponge construction [14], which is depicted in Fig. 2. There are seven choices of the inherent permutation of Keccak, indicated by Keccak -, where is the input (and the output) size of the permutation. The Keccak -f permutation used in SHA-3 is 1600 bits, i.e. Keccak -, which is the case we consider in this paper. In all the following, we denote Keccak - by Keccak -f for simplicity. The state of Keccak -f permutation can be represented as a state, like that in Fig. 3. Keccak -f has 24 rounds in total. The round permutation R consists of five operations: Fig. 3Open in figure viewerPowerPoint Keccak state The first three steps , , and the last step are all linear transformations. The only non-linear step is composed of 320 parallel 5-bit S-box in each row. We show the Boolean expression of and in Tables 4 and 5, respectively (see Appendix 1). Note that the degree of is 2 and the degree of its inverse is 3. The linear function provides diffusion in all the three dimensions of the state while the non-linear function is applied to each row to provide confusion. Table 4. Boolean expression of the 5-bit S-box in Keccak -f Input Output Corresponding Boolean function Table 5. Boolean expression of the 5-bit S-box Input Output Corresponding Boolean function In [18], Boura et al. gave a bound on the degree of the iterated round permutations of Keccak -f and of its inverse. Then Duan and Lai [19] improved the upper bounds on the degree of the inverse of Keccak -f. We summarised the results in Table 6. Based on the degree estimation of the iterated round permutations in Keccak -f and its inverse, Duan and Lai gave a zero-sum distinguisher of size for the full Keccak -f permutation. Note that the degree of the backward 11 (resp. forward 12) rounds for Keccak -f is bounded by 1572 (resp. 1536), if we consider the internal states before the non-linear layer in the 12th round, we can construct zero-sum distinguishers by choosing any subspace with active bits in 315 rows. Refer to Fig. 4. Table 6. Degree estimation of round-reduced Keccak -f and its inverse Number of rounds r 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 bound on 2 4 8 16 32 64 128 256 512 1024 1408 1536 1578 1592 1597 1599 bound on 3 9 27 81 243 729 1164 1382 1491 1545 1572 1586 1593 1596 1598 1599 Fig. 4Open in figure viewerPowerPoint Zero-sum distinguishers on full-round Keccak - f 3 Table-based propagation rule of the division property In this part, we formalise the propagation rule of the division property under the assumption that the specification of an S-box is public. We call it table-based propagation rule of the division property, since the evaluation is supported by a weight-degree table. Note that for the generalised propagation rule of the division property (Property 1), it is assumed that attackers treat the S-box as a black box, with the only knowledge of its algebraic degree. Such propagation rule of the division property against S-box is applicable to any S-box but does not exploit the specific feature of the S-box. In [23], Todo gave a more accurate evaluation of the division property's propagation against the 7-bit S-box in MISTY1 by regarding it as a public function. As a result, for the S-box , the division property can propagate to , with a smaller deterioration than that of a 7-bit black-box S-box, against which propagates to . Thanks to the vulnerable property of , 6-round integral distinguisher was found and the integral attack has been successfully mounted on full MISTY1. Todo's work in [23] is instructive. When considering the specification of a concrete S-box, it might be possible to slow down the deterioration of the division property against the S-box, which potentially leads to a higher-order differential distinguisher of more rounds. However, Todo's work is customised for the S-box in MISTY1. A generic method has not yet been given. It is the first time that we formalise and prove such an improved propagation rule. Before introducing our propagation rule, we first define the product degree of an S-box following [18]. Definition 2.For an n -bit S-box, define the product degree as the maximal algebraic degree of the product of any i output coordinates of the S-box.We call the table that shows the product degree of an n -bit S-box for each i the weight-degree table of the S-box. Table 7. Weight-degree table of the inverse S-box in Keccak -f (the same for Ascon permutation) i 1 2 3 4 5 3 3 4 4 5 Example 1.We calculate the product degree of for , and show its weight-degree table in Table 7. Recall that is the inverse of the 5-bit S-box in Keccak -f, with the algebraic degree equal to 3. One important property which will be used in the following is that the algebraic degree of the product of any two output coordinates of is 3, i.e. . We show the Boolean expression in detail in Table 8. Note that this property has also been exploited by Duan and Lai [19]. Table 8. Product of any two output components of Output Corresponding Boolean function Property 2.(Table-based propagation rule of division property): Let be a function (S-box) and () be its product degree. Then the division property of the input multi-set propagates to the division property of the output multi-set, where . Particularly, if S is a permutation, then propagates to . Proof.First, we consider the division property of the input multi-set . According to the definition of , we have Then for all functions with deg, we have that .Next, we consider the division property of the output multi-set . Suppose that has the division property . For any such that , to ensure that we only need to ensure that deg. When deg, the sum will become unknown. We illustrate such 'division' in the following figure: According to the definition of the product degree of the S-box, the degree of is bounded by . Let . Then, when , deg, and we always have that . □ Remark 1.Some related results are stated in [33, 34]. We revisited the division property in different views. Moreover, it is the first time that we formalise the improved propagation rule of the division property, which is depicted in a clear way and quite easy to follow. The difference between the table-based propagation rule in Property 2 and the generalised propagation rule in Property 1 is that, in Property 1, the degree of is roughly estimated by (see [20]), while in Property 2 it is calculated more accurately by under the assumption that the S-box is public. Here we take of Keccak -f as an example. For and , when , it is estimated in Property 1 that the degree of is bounded by . In fact, the algebraic degree of the product of any two output coordinates of is lower than 4. However, it does not mean that the table-based propagation rule would certainly be better than the generalised propagation rule, where 'better' refers to that the decline of the propagation characteristic is smaller. For example, for (5,3,320)-SPN Keccak -f and (5,3,64)-SPN Ascon permutation [35], our propagation rule can improve the characteristic of the division property against their S-boxes, while for (8,7,16)-SPN AES [36] and (4,3,16)-SPN PRESENT [37], the S-boxes of which both have the highest algebraic degrees, the evaluations of the propagation are the same by using these two rules. So, the question is, when does the evaluation by using Property 2 have an advantage over that by using Property 1? We give the answer in Corollary 1. Corollary 1.Let be a public S-box with algebraic degree d. Let , . Consider the propagation of the division property against S. If , then the deterioration of the division property evaluated by Property 2 is smaller than that evaluated by Property 1. Proof.The outline of the proof is shown in Fig. 5. According to Definition 2, if , then . □ Fig. 5Open in figure viewerPowerPoint Propagation characteristic of division property 3.1 Application to : the inverse of the S-box used in Keccak -f We consider the propagation of the division property of . Especially, we consider the propagation of against . Recall that the degree of the product of any two output components of is bounded by 3 (see Table 7). When the input multi-set which takes values over fulfils , it means that the sum over the input multi-set of the output of any function with degree less than 4 is zero, i.e. for any function with deg. In this case, when , which implies that for the division property of the output multi-set. If we only exploit the algebraic degree, then according to Property 1, we obtain Since , according to Corollary 1, it is possible to improve the propagation characteristic against by further considering the product degree in Table 7. According to our table-based propagation rule of the division property in Property 2, we obtain Recall that is defined as . Following Property 2, we evaluate the table-based propagation rule of the division property against . We list the results in Table 2. Property 3.For , the division property propagates to . For an S-box randomly chosen from all 5-bit S-boxes, about which we only know that the algebraic degree is 3, propagates to . For the sake of descriptive completeness, we calculate the product degree of for , and show its weight-degree table in Table 9. The division property's propagation characteristic of evaluated by our table-based propagation rule (Property 2) is the same as that evaluated by Todo's generic propagation rule (Property 1). See Table 10. Table 9. Weight-degree table of in Keccak -f (the same for Ascon permutation) i 1 2 3 4 5 2 4 4 4 5 Table 10. Propagation characteristic of in Keccak -f (the same for Ascon permutation) for input set for output set 4 Improved higher-order differential characteristics for the inverse of Keccak -f In this section, we construct better higher-order differential characteristics of the inverse of Keccak -f permutation, based on the improved propagation characteristic of the division property. In [20], Todo showed generic attacks against -SPN with an improvement to the higher-order differential (integral) cha