Improved integral attacks on 24‐round LBlock and LBlock‐s

IET Information SecurityVolume 14, Issue 5 p. 505-512 Research ArticleFree Access Improved integral attacks on 24-round LBlock and LBlock-s Yaxin Cui, Yaxin Cui Information Engineering University, Zhengzhou, 450001 People's Republic of ChinaSearch for more papers by this authorHong Xu, Corresponding Author Hong Xu xuhong0504@163.com Information Engineering University, Zhengzhou, 450001 People's Republic of ChinaSearch for more papers by this authorWenfeng Qi, Wenfeng Qi Information Engineering University, Zhengzhou, 450001 People's Republic of ChinaSearch for more papers by this author Yaxin Cui, Yaxin Cui Information Engineering University, Zhengzhou, 450001 People's Republic of ChinaSearch for more papers by this authorHong Xu, Corresponding Author Hong Xu xuhong0504@163.com Information Engineering University, Zhengzhou, 450001 People's Republic of ChinaSearch for more papers by this authorWenfeng Qi, Wenfeng Qi Information Engineering University, Zhengzhou, 450001 People's Republic of ChinaSearch for more papers by this author First published: 01 September 2020 https://doi.org/10.1049/iet-ifs.2019.0353Citations: 2AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract LBlock is a lightweight block cipher with Feistel-SP structure proposed by Wu and Zhang in Applied Cryptography and Network Security 2011, and a modified version LBlock-s is used later in the design of the lightweight authenticated encryption cipher LAC, one of the CAESAR candidates. The best known integral attack on LBlock is presented by Zhang and Wu which can attack 23-round LBlock based on a 16-round integral distinguisher found with division property. In Selected Areas in Cryptography 2018, Eskandari et al. further presented a 17-round integral distinguisher of LBlock with bit-based division property using SAT solver. Using their method, the authors further find some new 17-round integral distinguishers of LBlock and use one of them to present a 24-round integral attack on LBlock. Similarly, they also find some 17-round integral distinguishers of LBlock-s and select one to present a 24-round integral attack on LBlock-s. In this way, they have improved known single-key attacks on LBlock and LBlock-s by one round. Nomenclature M 64-bit plaintext C 64-bit ciphertext K 80-bit master key 32-bit sub-key of the i th round, l th nibble of , , where is the rightmost nibble input to the i th round or the output from the th round j th bit of , , where is the rightmost bit left half part of l th nibble of , , where is the rightmost nibble j th bit of , right half part of l th nibble of , j th bit of , concatenation of Y and Z left rotation of Y by s bits binary form of an integer i 1 Introduction Recently, lightweight ciphers have attracted more and more attention and have been widely used in many resource-constraint environments such as radio-frequency identification tags, sensor network, and so on. LBlock [1] is a lightweight block cipher proposed by Wu and Zhang at Applied Cryptography and Network Security (ACNS) 2011. It adopts a variant of 32-round Feistel-SP structure with a 64-bit block and an 80-bit key. Many research studies have been done on LBlock for its simple structure and fine performance, and the best known single key attacks except for biclique attack on LBlock can reach 23 rounds [2-4]. In 2012, to improve the security of LBlock against biclique and related-key attacks, Wang et al. [5] proposed a new key schedule algorithm with better diffusion. A variant of the new algorithm, LBlock-s, was later used in the CAESAR-authenticated encryption candidate LAC [6]. The integral attack is an important cryptanalytic technique for symmetric-key primitives, which was firstly proposed by Daemen et al. [7] to evaluate the security of square cipher, and was later unified as an integral attack by Knudsen and Wagner [8]. An integral attack usually contains two crucial parts. First, to construct an integral distinguisher and the most widely used integral property is the balanced property. Then, to use the integral distinguisher to discard wrong sub-keys, and partial--sum [9] and meet-in-the-middle [10] techniques are widely used in the key recovery process of the integral attack to reduce the time complexity. In EUROCRYPT 2015, Todo [11] proposed the concept of division property to carefully characterise the propagation rule of integral property and used it to find new integral distinguishers of MISTY1 [12], SIMON [13], and Simeck. Later, MILP and SAT solvers were also used to find integral distinguishers based on division property [14-16]. For integral attacks on LBlock, Wu and Zhang [1] first presented an 18-round attack with a 15-round integral distinguisher, then Sasaki and Wang [17] presented an improved 22-round integral attack using meet-in-the-middle and partial-sum techniques. In INDOCRYPT 2015, Zhang and Wu [18] found a new 16-round integral distinguisher of LBlock based on division property and used it to present a 23-round integral attack on LBlock. Later in SAC 2018, Eskandari et al. [19] further found a new 17-round integral distinguisher of LBlock with bit-based division property using SAT solver. Based on the method proposed by Eskandari et al., we further find some new 17-round integral distinguishers of LBlock and LBlock-s. Using the meet-in-the-middle technique and the relation between sub-keys, we select two 17-round integral distinguishers of LBlock and LBlock-s, respectively, with the least number of guessed sub-key bits, and utilise them to present 24-round integral attacks on LBlock and LBlock-s. The remainder of this paper is organised as follows. Section 2 presents brief descriptions of LBlock and LBlock-s and shows some relations among their sub-key bits. Section 3 presents the 17-round integral distinguishers of LBlock and LBlock-s. Section 4 presents the improved 24-round integral attack on LBlock, and a detailed description of the key recovery procedure is given in the Appendix. Section 5 presents the 24-round integral attack on LBlock-s. Finally, we conclude this paper in Section 6. 2 Preliminaries 2.1 Notations Throughout this paper, we use the notations listed in Nomenclature section. 2.2 Specification of LBlock LBlock is a lightweight block cipher proposed by Wu and Zhang in ACNS 2011 which adopts a variant of Feistel-SP structure with 32 rounds. The block size is 64-bit and the key size is 80-bit. The round function of LBlock is shown in Fig. 1. Fig. 1Open in figure viewerPowerPoint Round function of LBlock 2.2.1 Encryption algorithm of LBlock Let be the input to the i th round of LBlock, and be the sub-key used in the i th round, , and let be the 64-bit plaintext. The detailed encryption procedure of LBlock is shown in Algorithm 1 (see Fig. 2), where S is the S-box layer consisting of eight different 4-bit S-boxes in parallel, and P is a permutation among eight 4-bit nibbles as shown in Fig. 1. Fig. 2Open in figure viewerPowerPoint Algorithm 1: specification of LBlock The contents of eight S-boxes used in the round function and the two S-boxes and used in the key schedule are presented in Table 1. Table 1. S-boxes of LBlock S-box 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 14, 9, 15, 0, 13, 4, 10, 11, 1, 2, 8, 3, 7, 6, 12, 5 4, 11, 14, 9, 15, 13, 0, 10, 7, 12, 5, 6, 2, 8, 1, 3 1, 14, 7, 12, 15, 13, 0, 6, 11, 5, 9, 3, 2, 4, 8, 10 7, 6, 8, 11, 0, 15, 3, 14, 9, 10, 12, 13, 5, 2, 4, 1 14, 5, 15, 0, 7, 2, 12, 13, 1, 8, 4, 9, 11, 10, 6, 3 2, 13, 11, 12, 15, 14, 0, 9, 7, 10, 6, 3, 1, 8, 4, 5 11, 9, 4, 14, 0, 15, 10, 13, 6, 12, 5, 7, 3, 8, 1, 2 13, 10, 15, 0, 14, 4, 9, 11, 2, 1, 8, 3, 7, 5, 12, 6 8, 7, 14, 5, 15, 13, 0, 6, 11, 12, 9, 10, 2, 4, 1, 3 11, 5, 15, 0, 7, 2, 9, 13, 4, 8, 1, 12, 14, 10, 3, 6 2.2.2 Key schedule algorithm of LBlock The 80-bit master key K is stored in a key register and denoted as . Output the leftmost 32 bits of register K as sub-key . For , update the key register K as follows: (i) (ii) (iii) Output the leftmost 32 bits of the current content of register K as round sub-key . Denote by the 80-bit internal state of the key schedule function at the i th round, , then the i th round sub-key is 2.2.3 Relation between sub-keys of LBlock Since the generation of sub-keys of LBlock is based on the rotation of the 80-bit key register where only 13 bits or four nibbles are updated irregularly in each round, we can still find some simple relations between adjacent sub-key bits. Some of them are listed in Table 2, where means the latter variable can be derived from the former by XORing some constants, and , mean the latter variable can be derived from the former by the S-box transformation or its inverse besides XORing some constants. Table 2. Relation between adjacent sub-key bits of LBlock t Relation between and 1 , , , , , , , , , 2.3 Specification of LBlock-s LBlock-s is a lightweight block cipher with a similar structure as LBlock, which is used in the lightweight authenticated encryption candidate LAC. It adopts a new key schedule with better diffusion as shown in [5, 6]. All S-boxes used in the round function and the key schedule of LBlock-s are the same as presented in Table 1. The detailed key schedule of LBlock-s is as follows: 2.3.1 Key schedule algorithm of LBlock-s The 80-bit master key K is stored in a key register and denoted as . Output the leftmost 32 bits of current content of register K as sub-key , then for , update the key register K as follows: (i) (ii) (iii) Output the leftmost 32 bits of the current content of register K as round sub-key . 2.3.2 Relation between sub-keys of LBlock-s Although the update of the key register of LBlock-s is related to more bits than that of LBlock, only 16 bits or four nibbles are changed in each round. Hence we can still find some simple relations between adjacent sub-key bits of LBlock-s, some of them are listed in Table 3. Table 3. Relation between adjacent sub-key bits of LBlock-s t Relation between and 1 , 3 , , 4 , Some of the relations between sub-keys of LBlock or LBlock-s have also been found and used in known attacks on them [1-4, 17, 18, 20, 21]. Next, we will further use the relation to present improved integral attacks on them with new integral distinguishers. 3 Finding of new integral distinguishers of LBlock and LBlock-s In 2015, Zhang and Wu found a new 16-round integral distinguisher of LBlock based on division property, where the state is balanced when all but one bit of the plaintexts are active. With this integral distinguisher, they presented a 23-round integral attack on LBlock using the rightmost balanced nibble . In 2018, Eskandari et al. proposed to use choice vectors to characterise the propagation of division property and presented a new method to efficiently find integral distinguishers of block ciphers with SAT solver. As a result, they found that there exists a 17-round integral distinguisher of LBlock with , where only the 34th bit of the chosen plaintexts is constant, and the balanced bits appear in the leftmost two bits of and . Using the method proposed by Eskandari et al., all valid transitions of choice vectors of copy operation can be given by , , all valid transitions of choice vectors of xor operation can be given by , , , , and all valid transitions of choice vectors of an S-box can be determined by the algebraic normal form (ANF). For example, let be the 4-bit input of and be the corresponding output. Then the ANF of is shown as follows: From above we know that monomial appears in , , and , so there exist valid division trails . Since also appears in some monomials of and multiples of , there also exist division trails . Thus the reduced division trails . Similarly, all division trails of can be obtained, and the reduced division trails are shown in Table 4. Table 4. Reduced division trails of Reduced division trails of All the above transitions of different operations can be transformed into certain conjunctive normal forms. In this way, the search for integral distinguishers of LBlock can be transformed into the corresponding SAT problem and solved by SAT solver. When only one bit of the plaintexts is constant, all the 17-round integral distinguishers of LBlock found are given in Table 5. Similarly, when only the same S-box is used, all the 17-round integral distinguishers of LBlock-s found are given in Table 6. Table 5. Integral distinguishers of 17-round LBlock Constant-bit Balanced-bit Corresponding nibble {34} {2, 3, 30, 31} {35} {2, 3, 30, 31} {36} {5, 7, 10, 11} {38} {5, 7, 10, 11} {41} {5, 7, 10, 11} {43} {5, 7, 10, 11} {46} {12, 14, 17, 19} {47} {12, 14, 17, 19} {48} {12, 14, 17, 19} {51} {12, 14, 17, 19} {54} {22, 23, 24, 27} {55} {22, 23, 24, 27} {58} {22, 23, 24, 27} {59} {22, 23, 24, 27} {61} {2, 3, 30, 31} {63} {2, 3, 30, 31} Table 6. Integral distinguishers of 17-round LBlock-s Constant-bit Balanced-bit Corresponding nibble {34} {2, 3, 30, 31} {35} {2, 3, 30, 31} {38} {6, 7, 10, 11} {39} {6, 7, 10, 11} {42} {6, 7, 10, 11} {43} {6, 7, 10, 11} {46} {14, 15, 18, 19} {47} {14, 15, 18, 19} {50} {14, 15, 18, 19} {51} {14, 15, 18, 19} {54} {22, 23, 26, 27} {55} {22, 23, 26, 27} {58} {22, 23, 26, 27} {59} {22, 23, 26, 27} {62} {2, 3, 30, 31} {63} {2, 3, 30, 31} 4 Integral attack on 24-round LBlock Using the 17-round integral distinguishers as shown in Table 5, we will present an improved 24-round integral attack on LBlock in this section. From Table 5 we know that there exist balanced bits in any nibbles. Take the third row of Table 5 for example, when , i.e. are balanced, the key recovery procedure of the 24-round integral attack on LBlock is given in Fig. 3. Fig. 3Open in figure viewerPowerPoint Key recovery of the 24-round integral attack on LBlock Similar to [17, 18], we can use the meet-in-the-middle technique to reduce the time complexity of key recovery procedure. Denote , since . To check whether are balanced, we need only to check whether . All the involved internal state nibbles and guessed sub-keys in the key recovery phase are shown in Fig. 3, where the internal nibbles in red square brackets are used to calculate and the internal nibbles in green round brackets are used to calculate . According to Fig. 3, the main time complexity of the key-recovery procedure is determined by the computation of , where 80-bit sub-keys and 60-bit ciphertexts are related. Using the relation between sub-key bits as shown in Table 2 of Section 2.2, the number of sub-key bits to be guessed can be reduced from 80 to 55, and detailed relations used here are as follows: Similarly, when balanced bits appear in other nibbles, the number of sub-key bits to be guessed can also be determined. All the results are given in Table 7, where key space for means the number of sub-key bits to be guessed in calculation of , and the sum keys mean the total number of sub-key bits to be guessed in the key recovery procedure. Table 7. Number of guessed keys for LBlock distinguishers Balanced-bit position Corresponding nibble Key space for The sum keys 62 75 62 74 55 69 60 74 63 75 60 70 65 76 67 72 From Table 7 we know that when the balanced bits appear in , a fewer number of sub-key bits need to be guessed in the key recovery process. Combined with Table 5, we can select the 17-round integral distinguisher , where only the 36th bit of each chosen plaintext is constant, and the balanced bits appear in the rightmost two bits of . Such integral distinguisher can also be written as , where A refers to the active nibble, means the rightmost bit of the nibble is constant and other bits are active, means the third and the second bits of the nibble are balanced. 4.1 Key recovery We can present a 24-round integral attack on LBlock by appending seven rounds to the above 17-round integral distinguisher as shown in Fig. 3. The main key recovery phase is as follows: (i) Choose plaintexts that are constant at the 36th bit and active at the remaining bits. (ii) Compute by guessing the 55-bit key. (iii) Compute by guessing the 47-bit key independently. (iv) Find matches between the two results, and get the corresponding 69-bit key as key candidates. By judging whether , we could obtain key candidates. (v) For key candidates, we exhaustively search the remaining 11-bit key to recover the master key. A detailed computation procedure and sub-key relation is given in the Appendix. A summary of computation of in step 2 is given in Table 8, where 60-bit ciphertexts are related and totally 55-bit sub-keys are guessed. More specifically, the time complexity for each step is estimated as the product of the previous data size and the total number of guessed bits. Thus the total complexity to compute is almost 24-round encryptions of LBlock. The procedure to compute is similar, where only 48-bit sub-keys should be guessed and the time complexity is almost 24-round encryptions. Table 8. Summary of computation of in 24-round integral attack of LBlock Guessed key bits Texts values in the set Data space complexity — 0 4 8 12 16 17 21 25 27 31 33 37 41 45 45 49 49 50 50 52 55 From the above analysis, we know that the time complexity of the key recovery procedure is determined by exhaustively searching in step 5. Thus the time complexity of the attack is almost 24-round encryptions, where chosen plaintexts are used, and bytes of memory is needed to save 15 nibbles of ciphertexts involved in the computation of . 5 Integral attack on 24-round LBlock-s Similar to above, using the 17-round integral distinguishers shown in Table 6 of Section 3, we can present an integral attack on 24-round LBlock-s as follows. Take the first row of Table 5 for example, when , i.e. are balanced, the key recovery procedure of the 24-round integral attack on LBlock-s is given in Fig. 4. Denote , since . We need only to check whether . All the involved internal state nibbles and guessed sub-keys in the key recovery phase are shown in Fig. 4, where the internal nibbles in red square brackets are used to calculate and the internal nibbles in green round brackets are used to calculate . Fig. 4Open in figure viewerPowerPoint Key recovery of the 24-round integral attack on LBlock-s According to Fig. 4, the main time complexity of the key-recovery procedure is determined by the computation of , where 80-bit sub-keys and 60-bit ciphertexts are related. Using the relation between sub-key bits as shown in Table 3 of Section 2.3, the number of sub-key bits to be guessed can be reduced from 80 to 56. In the following, we list utilised relations in detail When balanced bits appear in other nibbles, the number of sub-key bits to be guessed can also be determined by the same method. All the results are given in Table 9. In this case, we choose the balanced bits appearing in , where a fewer number of sub-key bits needed to be guessed in the key recovery process. Combined with Table 6, we select the best 17-round integral distinguisher , where only the 34th bit of each chosen plaintext is constant, and the balanced bits appear in the leftmost two bits of . Table 9. Number of guessed sub-key bits for different distinguishers of LBlock-s Balanced-bit position Corresponding nibble Key space for The sum keys 56 68 60 76 60 64 64 76 60 68 64 72 60 72 72 80 Such an integral distinguisher can also be written as , where A refers to the active nibble, means the second bit of the nibble is constant and other bits are active, means the leftmost two bits of the nibble are balanced. 5.1 Key recovery We can present a 24-round integral attack on LBlock-s by appending seven rounds to the above 17-round integral distinguisher as shown in Fig. 4. The main key recovery phase is as follows: (i) Choose plaintexts that are constant at the 34th bit and active at the remaining bits. (ii) Compute by guessing the 56-bit key. (iii) Compute by guessing the 40-bit key independently. (iv) Find matches between two results, then get the corresponding 68-bit key as key candidates. By judging whether equal to , respectively, we could obtain key candidates. (v) For key candidates, we exhaustively search the remaining 12-bit key to recover the master key. A summary of computation of in step 2 is given in Table 10, where 60-bit ciphertexts are related and totally 56-bit sub-keys are guessed, the total time complexity to compute is almost 24-round encryptions of LBlock-s. Table 10. Summary of computation of in 24-round integral attack of LBlock-s Guessed key Bits Texts values in the set Data space complexity — 0 4 8 12 16 20 24 28 32 32 36 36 40 44 48 48 52 52 52 52 56 From the above analysis, we know that the time complexity of the key recovery procedure is also determined by exhaustively searching in step 5. Thus the time complexity of the attack is almost 24-round encryptions, where chosen plaintexts are used, and bytes of memory is needed to save 15 nibbles of ciphertexts involved in the computation of . 6 Conclusion LBlock and LBlock-s are two lightweight block ciphers with a similar structure and different key schedules. The best known single-key attacks on LBlock and LBlock-s can only reach 23 rounds. By carefully analysing the division property of S-boxes, we find new 17-round integral distinguishers with Eskandari et al. 's method. Using the meet-in-the-middle technique and the relation between sub-keys, we select two best 17-round integral distinguishers and utilise them to present 24-round integral attacks on LBlock and LBlock-s. This is the longest round that can be attacked by single-key attacks except for biclique attacks. 7 Acknowledgments This work was partially supported by the National Natural Science Foundation of China (U1536101, 61521003) and the National Cryptography Development Fund of China (MMJJ20180204, MMJJ20170103). 9 Appendix Computation procedure of ⊕Z17 [4] We need to guess the 55-bit key to compute the value of according to the key schedule. The procedure is as follows. (i) Query plaintexts which are constant at one bit and are active at other bits. (ii) Count whether each 15-nibble value appears even or odd times, and pick the values which appear odd times. (iii) Guess four bits of , and compute with . Compress the data into texts of the value of . (iv) Guess four bits of , and compute with . Compress the data into texts of the value of . (v) Guess four bits of , and compute with . Compress the data into texts of the value of appearing odd times. (vi) Guess four bits of , and compute with . Compress the data into texts of the value of appearing odd times. (vii) Owing to the key schedule, is determined by rightmost three bits in . Then we only need to guess the rightmost one bit in . Compute with . Compress the data into texts of the value of . (viii) Guess four bits of , and compute with . Compress the data into texts of the value of . (ix) Guess four bits of , and compute with . Compress the data into texts of the value of . (x) Owing to the key schedule, is determined by leftmost two bits in . Then we only need to guess the leftmost two bit in . Compute with . Compress the data into texts of the value of appearing odd times. (xi) Guess four bits of , and compute with . Compress the data into texts of the value of . (xii) Owing to the key schedule, is determined by rightmost two bits in . Then we only need to guess the rightmost two bits in . Compute with . Compress the data into texts of the value of . (xiii) Guess four bits of , and compute with . Compress the data into texts of the value of . (xiv) Guess four bits of , and compute with . Compress the data into texts of the value of . (xv) Guess four bits of , and compute with . Compress the data into texts of the value of . (xvi) Owing to the key schedule, is determined by rightmost three bits in and leftmost one bit of . Compute with . Compress the data into texts of the value of . (xvii) Guess four bits of , and compute with . Compress the data into texts of the value of . (xviii) Owing to the key schedule, is determined by rightmost three bits in and leftmost one bit of . Compute with . Compress the data into texts of the value of . (xix) Owing to the key schedule, is determined by leftmost three bits in . Then we only need to guess the leftmost one bit in . Compute with . Compress the data into texts of the value of . (xx) Owing to the key schedule, is determined by rightmost three bits in and leftmost one bit of . Compute with . Compress the data into texts of the value of . (xxi) Owing to the key schedule, is determined by rightmost one bit in and one bit of . Compute with . Compress the data into texts of the value of . (xxii) Owing to the key schedule, is determined by rightmost one bits in . Then we only need to guess rightmost three bits of . Compute . Eventually, compute the values appearing odd time and get the sum . 8 References 1Wu, W., Zhang, L.: 'LBlock: a lightweight block cipher'. 9th Int. Conf. on Applied Cryptography and Network Security – ACNS 2011, Nerja, Spain, June 2011, pp. 327– 344 2Wang, Y., Wu, W.: 'Improved multidimensional zero-correlation linear cryptanalysis and applications to LBlock and TWINE'. 19th Australasian Conf. on Information Security and Privacy – ACISP 2014, Wollongong, NSW, Australia, July 2014, pp. 1– 16 3Boura, C., Naya-Plasencia, M., Suder, V.: 'Scrutinizing and improving impossible differential attacks: applications to CLEFIA, Camellia, LBlock and SIMON'. Proc. Advances in Cryptology – ASIACRYPT 2014, Kaoshiung, Taiwan, R.O.C., December 2014, pp. 179– 199 4Lin, L., Wu, W., Zheng, Y.: 'Automatic search for key-bridging technique: applications to LBlock and TWINE'. 23rd Int. Workshop on Fast Software Encryption – FSE 2016, Bochum, Germany, March 2016, pp. 247– 267 5Wang, Y., Wu, W., Yu, X. et al: 'Security on LBlock against Biclique cryptanalysis'. 13th Int. Workshop on Information Security Applications – WISA 2012, Jeju Island, Korea, 16–18 August 2012, pp. 1– 14 6Zhang, L., Wu, W., Wang, Y. et al: ' LAC: A lightweight authenticated encryption cipher'. Submitted to CAESAR. Available at http://competitions.cr.yp.to/round1/lacv1.pdf, Version 1, 15 March 2014 7Daemen, J., Knudsen, L.R., Rijmen, V.: 'The block cipher SQUARE'. 4th Int. Workshop on Fast Software Encryption, FSE 1997, Haifa, Israel, 20–22 January 1997, pp. 149– 165 8Knudsen, L.R., Wagner, D.A.: 'Integral cryptanalysis'. 9th Int. Workshop on Fast Software Encryption, FSE 2002, Leuven, Belgium, February 2002, pp. 112– 127 9Ferguson, N., Kelsey, J., Lucks, S. et al: 'Improved cryptanalysis of Rijndael'. 7th Int. Workshop on Fast Software Encryption, FSE 2000, New York, NY, USA, April 2000, pp. 213– 230 10Sasaki, Y., Wang, L.: 'Meet-in-the-middle technique for integral attacks against Feistel ciphers'. 19th Int. Conf. on Selected Areas in Cryptography, SAC 2012, Windsor, ON, Canada, 15–16 August 2012, pp. 234– 251 11Todo, Y.: 'Structural evaluation by generalized integral property'. Proc. Advances in Cryptology – EUROCRYPT 2015, Sofia, Bulgaria, April 2015, pp. 287– 314 12Todo, Y.: 'Integral cryptanalysis on full MISTY1', J. Cryptol., 2017, 30, (3), pp. 920– 959 13Todo, Y., Morii, M.: 'Bit-based division property and application to simon family'. 23rd Int. Workshop on Fast Software Encryption – FSE 2016, Bochum, Germany, March 2016, pp. 357– 377 14Xiang, Z., Zhang, W., Bao, Z. et al: 'Applying MILP method to searching integral distinguishers based on division property for 6 lightweight block ciphers'. Proc. Advances in Cryptology – ASIACRYPT 2016, Hanoi, Vietnam, December 2016, pp. 648– 678 15Sun, L., Wang, W., Liu, R. et al: 'MILP-aided bit-based division property for ARX ciphers', Sci. China Inf. Sci., 2018, 61, (11), pp. 118102:1– 118102:3 16Sun, L., Wang, W., Wang, M.: 'Automatic search of bit-based division property for ARX ciphers and word-based division property'. Proc. Advances in Cryptology – ASIACRYPT 2017, Hong Kong, China, December 2017, pp. 128– 157 17Sasaki, Y., Wang, L.: 'Comprehensive study of integral analysis on 22-round lblock'. 15th Int. Conf. on Information Security and Cryptology – ICISC 2012, Seoul, Korea, November 2012, pp. 156– 169 18Zhang, H., Wu, W.: 'Structural evaluation for generalized Feistel structures and applications to LBlock and TWINE'. Progress in Cryptology – INDOCRYPT 2015 – 16th Int. Conf. on Cryptology in India, Bangalore, India, December 2015, pp. 218– 237 19Eskandari, Z., Kidmose, A.B., Kölbl, S. et al: 'Finding integral distinguishers with ease'. 25th Int. Conf. on Selected Areas in Cryptography – SAC 2018, Calgary, AB, Canada, August 2018, pp. 115– 138 20Xu, H., Jia, P., Huang, G. et al: 'Multidimensional zero-correlation linear cryptanalysis on 23-round LBlock-s'. 17th Int. Conf. on Information and Communications Security – ICICS 2015, Beijing, China, 9–11 December 2015, pp. 97– 108 21Jia, P., Xu, H., Lai, X.: 'Impossible differential cryptanalysis of reduced round LBlock-s', Acta Electron. Sin., 2017, 45, (4), pp. 966– 973 (in Chinese) Citing Literature Volume14, Issue5September 2020Pages 505-512 FiguresReferencesRelatedInformation