Practical distinguishing attack against the IoT‐friendly block cipher ALLPC

Electronics LettersVolume 58, Issue 16 p. 612-613 LetterOpen Access Practical distinguishing attack against the IoT-friendly block cipher ALLPC Ting Cui, Ting Cui Department of Applied Mathematics, PLA SSF Information Engineering University, Zhengzhou, ChinaSearch for more papers by this authorJiyan Zhang, Corresponding Author Jiyan Zhang xdzhangjiyan@126.com orcid.org/0000-0002-8332-0047 Department of Applied Mathematics, PLA SSF Information Engineering University, Zhengzhou, China Email: xdzhangjiyan@126.comSearch for more papers by this authorChenhui Jin, Chenhui Jin Department of Applied Mathematics, PLA SSF Information Engineering University, Zhengzhou, ChinaSearch for more papers by this authorShiwei Chen, Shiwei Chen Department of Applied Mathematics, PLA SSF Information Engineering University, Zhengzhou, ChinaSearch for more papers by this authorYang Yang, Yang Yang orcid.org/0000-0003-1547-2871 Department of Applied Mathematics, PLA SSF Information Engineering University, Zhengzhou, ChinaSearch for more papers by this author Ting Cui, Ting Cui Department of Applied Mathematics, PLA SSF Information Engineering University, Zhengzhou, ChinaSearch for more papers by this authorJiyan Zhang, Corresponding Author Jiyan Zhang xdzhangjiyan@126.com orcid.org/0000-0002-8332-0047 Department of Applied Mathematics, PLA SSF Information Engineering University, Zhengzhou, China Email: xdzhangjiyan@126.comSearch for more papers by this authorChenhui Jin, Chenhui Jin Department of Applied Mathematics, PLA SSF Information Engineering University, Zhengzhou, ChinaSearch for more papers by this authorShiwei Chen, Shiwei Chen Department of Applied Mathematics, PLA SSF Information Engineering University, Zhengzhou, ChinaSearch for more papers by this authorYang Yang, Yang Yang orcid.org/0000-0003-1547-2871 Department of Applied Mathematics, PLA SSF Information Engineering University, Zhengzhou, ChinaSearch for more papers by this author First published: 14 June 2022 https://doi.org/10.1049/ell2.12544AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinked InRedditWechat Abstract The issue of security and privacy plays an important role in the Internet of Things (IoT) and directly affects its wide applications. In order to meet the security requirements in the IoT environment, a series of lightweight encryption schemes have been proposed. Meanwhile, cryptanalysis against these schemes is critical to the security of IoT. In this paper, a practical distinguishing attack on an IoT-friendly lightweight cipher ALLPC is presented. Specifically, it is found that there exists a fixed point in the differential of ALLPC's S-box, then a differential trail with a period of 14-round has been proposed. By connecting to the periodic differential trail, a differential trail is constructed for the full-round ALLPC with a probability of 2−24. Applying such property, one can distinguish the full-round ALLPC block cipher from a random permutation in about 10 min on a laptop. Introduction Internet of Things (IoT) has received much attention over the last 10 years and many fields employ IoT devices, including smart homes, intelligent transportation etc. However, the fast development of the IoT brings a thirsty requirement for cheap and secure communication. How to protect the data security and privacy in IoT devices is an indispensable issue [1]. Lightweight cryptography is used as a safety-protection strategy to fulfil the security requirements. To address the persistent need for secure and efficient lightweight primitives, many encryption schemes have been proposed [2-6]. In the design of lightweight encryption schemes, any lightweight cryptographic primitives should provide sufficient resistance against all types of attacks, including differential attack, linear attack, distinguishing attack etc [7]. Recently, Cheng et al. proposed a lightweight block cipher named ALLPC [8]. It has a 64-bit block length and a 128-bit key length. ALLPC employs the extended type-1 generalised Feistel networks to achieve good performance on the implementation, e.g. low area, low power consumption, and high throughput. The authors claimed that ALLPC is secure under several types of attacks. In this paper, the security of ALLPC against distinguishing attack has been reconsidered. We construct a full-round differential trail with a probability of 2−24 and present a distinguishing attack against the full-round ALLPC. This is not only a cryptanalysis from the theoretical perspective, but also a practical attack in the real world. The whole attack can be completed on a laptop in about 10 min, which means that the cipher is still vulnerable. An overview of ALLPC Here we briefly review the block cipher ALLPC. For more details, one can refer ref. [8]. ALLPC encrypts a 64-bit message block using a 128-bit master key. Each 64-bit block is partitioned into eight 8-bit sub-blocks and the least sub-block is pulled into a nonlinear F transformation. Then the eight sub-blocks process through a linear layer, followed by a permutation layer π. Figure 1 depicts the structure of one round encryption. ALLPC iterates the round function 25 times and the permutation layer π is omitted in the final round. Fig. 1Open in figure viewerPowerPoint The structure of one round of ALLPC The function F is the only component that provides nonlinear property of ALLPC. The construction of F is indicated in Figure 2, where S $\texttt {S}$ is a 4-bit optimal S-box. The hexadecimal representation of the S-box is S [ 16 ] = E , 4 , B , 1 , 7 , 9 , C , A , D , 2 , 0 , F , 8 , 5 , 3 , 6 . \begin{equation} \texttt {S[16]= E,4,B,1,7,9,C,A,D,2,0,F,8,5,3,6}. \end{equation} (1) Fig. 2Open in figure viewerPowerPoint The detail of the function F Distinguishing attack of full-round ALLPC Differential trails with high probability may cause a potential threat to the security of cryptographic algorithms. The ground-breaking work by Biham and Shamir utilised the high-probability differential trail to break full DES [9]. Next, we focus on finding high-probability differential trails of ALLPC. Definition 1.[9] Let f : { 0 , 1 } n → { 0 , 1 } n $f:\lbrace 0,1\rbrace ^{n} \rightarrow \lbrace 0,1\rbrace ^{n}$ , α ∈ { 0 , 1 } n $\alpha \in \lbrace 0,1\rbrace ^{n}$ , β ∈ { 0 , 1 } n $\beta \in \lbrace 0,1\rbrace ^n$ , then p f ( α → β ) = # { x ∈ { 0 , 1 } n : f ( x ) ⊕ f ( x ⊕ α ) = β } 2 n \begin{equation} p_f(\alpha \rightarrow \beta ) = {\# \lbrace x \in \lbrace 0,1\rbrace ^n:f(x) \oplus f(x \oplus \alpha ) = \beta \rbrace \over 2^n} \end{equation} (2)is said to be the probability of differential α → β $\alpha \rightarrow \beta$ .We estimate the differential probability for the S-Box of ALLPC cipher, by a simple programming work, we can verify p S ( 0 x 9 → 0 x 9 ) = 1 4 . \begin{equation} p_S(\texttt {0x9} \rightarrow \texttt {0x9})={1\over 4}. \end{equation} (3)As a result, we have the following proposition. Proposition 1.Let F be the nonlinear function of ALLPC, then p F ( 0 x 99 → 0 x 99 ) = 1 16 . \begin{equation} p_F(\texttt {0x99} \rightarrow \texttt {0x99})=\frac{1}{16}. \end{equation} (4) Proposition 1 indicates that 0 x 99 → 0 x 99 $\texttt {0x99} \rightarrow \texttt {0x99}$ is a fixed point among the differentials of F. In other words, if the input difference of F is 0 x 99 $\texttt {0x99}$ , then the output difference keeps unchanged with a probability of 2−4. Based on this differential fixed point, we construct a periodic differential trail of 14-round ALLPC. The input difference starts with 0 x 0000999999009900 , \begin{equation} \texttt {0x00 00 99 99 99 00 99 00}, \end{equation} (5)results in the output difference 0 x 0000999999009900 \begin{equation} \texttt {0x00 00 99 99 99 00 99 00} \end{equation} (6)after 14 rounds. The detail of this trail is illustrated in Figure 3. Since the differential of F: 0 x 99 → 0 x 99 $\texttt {0x99} \rightarrow \texttt {0x99}$ appears four times (the grey box in Figure 3), then the probability of the 14-round differentials is ( 2 − 4 ) 4 = 2 − 16 $(2^{-4})^4=2^{-16}$ . Fig. 3Open in figure viewerPowerPoint 14-round differential trail of ALLPC ( α = 0 x 99 ) $(\alpha =\texttt {0x99})$ By cascading the trial above, we get a full 25-round differential trail for ALLPC with a probability of 2−24, i.e. 0 x 00 00 99 99 99 00 99 00 → 14 − round 0 x 00 00 99 99 99 00 99 00 → 10 − round 0 x 99 00 99 99 99 99 99 00 → final − round 0 x 00 99 00 00 99 99 99 00 . \begin{eqnarray} &&\texttt {0x00}\ \texttt {00}\ \texttt {99}\ \texttt {99}\ \texttt {99}\ \texttt {00}\ \texttt {99}\ \texttt {00}\nonumber\\ \rightarrow _{{\bf 14-round}}&& \texttt {0x00}\ \texttt {00}\ \texttt {99}\ \texttt {99}\ \texttt {99}\ \texttt {00}\ \texttt {99}\ \texttt {00} \nonumber\\ \rightarrow _{{\bf 10-round}}&&\texttt {0x99}\ \texttt {00}\ \texttt {99}\ \texttt {99}\ \texttt {99}\ \texttt {99}\ \texttt {99}\ \texttt {00}\nonumber\\ \rightarrow _{{\bf final-round}}&&\texttt {0x00}\ \texttt {99}\ \texttt {00}\ \texttt {00}\ \texttt {99}\ \texttt {99}\ \texttt {99}\ \texttt {00}. \end{eqnarray} (7) Specifically, choose the input difference as 0x0000999999009900, first after 14 rounds of encryption, the difference will be 0x0000999999009900 with a probability of 2−16, and then after 10 rounds of encryption, the difference will be 0x9900999999999900 with a probability of 2−8, and finally after the final round of encryption, the output difference will be 0x0099000099999900 with a probability of 1. Thus, we can construct a full 25-round differential trail for ALLPC with an input difference of 0x0000999999009900 and an output difference of 0x0099000099999900. The probability of this 25-round differential is 2 − 16 × 2 − 8 = 2 − 24 $2^{-16}\times 2^{-8}=2^{-24}$ , which is much higher than that of the designers' claim [8]. Applying the differential property above, we can launch a practical distinguishing attack to distinguish between ALLPC and a 64-bit random permutation. The attack process is described as follows. Step 1. Keep a counter T, which is initialised to 0 at the start of the attack. Step 2. Randomly choose N $\mathcal {N}$ different plaintexts. For each plaintext x, calculate Δ = E ( x ) ⊕ E ( x ⊕ 0 x 0000999999009900 ) , \begin{equation} \Delta =E(x)\oplus E(x\oplus \texttt {0x0000999999009900}), \end{equation} (8)where E is one of the full-round ALLPC encryption and a 64-bit random permutation. If Δ = 0 x 0099000099999900 $\Delta =\texttt {0x0099000099999900}$ , then increment the counter T by 1. Step 3. If the value of T is greater than N × 2 − 64 $\mathcal {N}\times 2^{-64}$ , then one can judge E is the full-round ALLPC encryption, otherwise E is a 64-bit random permutation. Since the expected value of T is N × 2 − 24 $\mathcal {N}\times 2^{-24}$ for ALLPC, but N × 2 − 64 $\mathcal {N}\times 2^{-64}$ for other 64-bit random oracles, one can distinguish them by choosing an appropriate N. In other words, an attacker can distinguish between ALLPC and a random permutation with 224 chosen plaintexts. To make the theoretical analysis more convincing, we verify the above analysis experimentally. Set N = 2 30 $\mathcal {N}=2^{30}$ , and we receive a value of 58 for the counter T in about 10 min on a laptop (Intel(R) Core(TM) i7-10710U CPU, 16 GB RAM, the source code is released on https://github.com/GreetingMan/Cryptanalysis). However, the value of T is approximates 0 for a random permutation. Thus, one can distinguish the full-round ALLPC block cipher from a random permutation quickly. Conclusion Lightweight cipher is one of the effective measures to ensure the data security of IoT. This paper presents a practical distinguishing attack on the IoT-friendly block cipher ALLPC, which suggests that full-round ALLPC is still vulnerable. As a new proposal of block cipher for IoT, ALLPC performs quite well across various platforms. However, from a security perspective, the designers need either increase the number of rounds or employ a less aggressive round function to provide enough resistance against potential attacks. Acknowledgment The authors would like to thank the editor and anonymous reviewers for their valuable suggestions on how to improve this paper. This work was supported by the Natural Science Foundation of China (Grant No: 61772547), Natural Science Foundation of Henan (Grant No: 222300420100), and the Foundation of Key Laboratory of National Defense Science and Technology (Grant No: 61421030107). Conflict of interest The authors declare no conflict of interest. Open Research Data availability statement The data that support the findings of this study are available from the corresponding author upon reasonable request. References 1Fernandes, E., Rahmati, A., Eykholt, K., Prakash, A.: Internet of things security research: a rehash of old ideas or new intellectual challenges? IEEE Secur. Privacy 15(4), 79– 84 (2017) CrossrefWeb of Science®Google Scholar 2Bogdanov, A., Knudsen, L.R., Leander, G., Paar, C., Poschmann, A., Robshaw, M.J.B., Seurin, Y., Vikkelsoe, C.: PRESENT: An Ultra-Lightweight Block Cipher. P. Paillier, I. Verbauwhede (eds.), vol. 4727, pp. 450– 466. Springer, Berlin, Heidelberg (2007) Google Scholar 3Beaulieu, R., Shors, D., Smith, J., Treatman-Clark, S., Weeks, B., Wingers, L.: The SIMON and SPECK families of lightweight block ciphers. In: Proceedings of the 52nd Annual Design Automation Conference, pp. 1– 6. ACM Press, New York (2015) Google Scholar 4Berger, T.P., Francq, J., Minier, M., Thomas, G.: Extended generalized feistel networks using matrix representation to propose a new lightweight block cipher: Lilliput. IEEE Trans. Comput. 65(7), 2074– 2089 (2016) CrossrefGoogle Scholar 5Sliman, L., Omrani, T., Tari, Z., Samhat, A.E., Rhouma, R.: Towards an ultra lightweight block ciphers for internet of things. Int. J. Inf. Secur. Appl. 61, 102897 (2021) Google Scholar 6Xue, W., et al.: Towards a compressive-sensing-based lightweight encryption scheme for the internet of things. IEEE Trans. Mob. Comput. 20(10), 3049– 3065 (2021) CrossrefWeb of Science®Google Scholar 7McKay, K.A., Bassham, L., Turan, M.S., Mouha, N.: Report on lightweight cryptography. NIST DRAFT NISTIR 8114. http://csrc.nist.gov/publications/drafts/nistir-8114/nistir_8114_draft.pdf (2016). Accessed Mar 2017 Google Scholar 8Cheng, J., Guo, S., He, J.: An extended type-1 generalized Feistel networks: lightweight block cipher for IoT. IEEE Internet Things J. (2021). https://doi.org/10.1109/JIOT.2021.3126317CrossrefGoogle Scholar 9Biham, E., Shamir, A.: Differential cryptanalysis of the full 16-round DES. E.F. Brickell (eds.), vol. 740, pp. 487– 496. Springer, Berlin, Heidelberg (1992) Google Scholar Volume58, Issue16August 2022Pages 612-613 FiguresReferencesRelatedInformation