Division cryptanalysis of block ciphers with a binary diffusion layer

IET Information SecurityVolume 13, Issue 2 p. 87-95 Research ArticleFree Access Division cryptanalysis of block ciphers with a binary diffusion layer Wenying Zhang, Corresponding Author Wenying Zhang wenyingzh@sohu.com School of Information Science and Engineering, Shandong Normal University, Jinan, People's Republic of ChinaSearch for more papers by this authorVincent Rijmen, Vincent Rijmen Department Electrical Engineering (ESAT), KU Leuven and Imec, Leuven, BelgiumSearch for more papers by this author Wenying Zhang, Corresponding Author Wenying Zhang wenyingzh@sohu.com School of Information Science and Engineering, Shandong Normal University, Jinan, People's Republic of ChinaSearch for more papers by this authorVincent Rijmen, Vincent Rijmen Department Electrical Engineering (ESAT), KU Leuven and Imec, Leuven, BelgiumSearch for more papers by this author First published: 01 March 2019 https://doi.org/10.1049/iet-ifs.2018.5151Citations: 11AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract In this study, the authors propose an accurate approach to model the propagation of the division property of linear layers by the smallest amount of inequalities. The solutions of the inequalities are exactly the division trails of a linear transformation. Therefore, the description is compact and optimal. As applications of their results, they present a 7-round integral distinguisher for both Midori64 and Midori128. The designers of Midori only obtained a 3.5-round integral characteristic. For Skinny64, they find a 10-round integral distinguisher which was previously found by the designers. It is well to remind that their result proves that 7 rounds and 10 rounds are the upper bounds of Midori and Skinny64 correspondingly when searching for integral distinguishers based on division property. The significance of their result lies in that they shed light on how far division cryptanalysis can influence the security analysis of block ciphers with a binary diffusion layer, and their technique can be used to prove security against division cryptanalysis. 1 Introduction Recently, in order to reduce the energy consumed in data processing, block cipher designers have started to use binary matrices on finite fields as the diffusion layer. The most typical examples are Midori [1], proposed at ASIACRYPT 2015 and Skinny [2], proposed at CRYPTO 2016. The main goal of Skinny is to offer an alternative to the National Security Agency (NSA) design SIMON in terms of hardware/software performance [3]. With their reputation for reaching the requirements of low latency as well as fast diffusion [2], the diffusion layer of SKINNY is an important highlight of its design strategy. Therefore, it is of great importance to evaluate the resistance of ciphers using binary matrices to known cryptanalysis and to give a proof of their security. The division property [4] is a generalised integral property initially proposed by Todo at EUROCRYPT 2015. At FSE 2016, Todo and Morii proposed the bit-based division property and applied it to find a 14-round integral distinguisher for SIMON32 [5]. At CRYPTO 2016, Boura and Canteaut [6] came up with a new approach by introducing the notion of parity sets, permitting the formulation and characterisation of the division property of any order in a simple way, especially for the construction of the division trails of S-boxes. At ASIACRYPT 2016, Xiang et al. [7] proposed a method to characterise the bit-based division property with the mixed integer linear programming (MILP) model, which successfully overcomes the difficulty of huge time and memory complexities of utilising the bit-based division property in a security evaluation. They accurately described the division-property propagations by choosing an appropriate objective function and analysed six block ciphers with bit-permutation diffusion layers. They left the feasibility of MILP method applied to ciphers with diffusion layers that are not bit permutations as a future work. Soon after, Sun et al. [8, 9] handled the feasibility of MILP-aided division property for primitives with non-bit-permutation linear layers. They successfully extended the MILP method to exclusive-OR (XOR)-based and Addition-Rotation-XOR operation (ARX)-based structures by introducing some intermediate variables in the linear layer, building inequalities for the n -bit linear layers. However, we found that the solutions of linear inequalities in [8] contain some impossible division trails, which may eventually lead the search for integral trails to a premature end and result in a shorter integral distinguisher. In the following, for block ciphers with a binary linear layer, we will give a compact description [10] of the propagation of the division property through the linear layer. Combined with our compact description, the method in [8, 9] will be more precise and closer to perfection. 1.1 Our contributions We model the propagation of the division property through a linear layer by constructing linear inequalities from the XOR operations described by the matrix of the linear layer, so that their solutions exactly represent all division trails of the linear layer. Just like for an S-box, the solutions set of the linear inequalities is equal to the set of division trails of the linear transformation when taking the linear transformation as a big S-box. We find that there is a one-to-one map from the vectors in the division trails of a linear transformation to invertible submatrices of the matrix , and we can give a simple description of the invertibility of the submatrices by some inequalities. As applications of our methodology, we propose compact representations for the division properties through the linear layer of Midori and Skinny. We describe exactly all division trails of their linear layers without any extra parasitical one. As for Midori64 and Midori128, the designers have obtained a 3.5-round integral characteristic. In comparison with the former method, we find 7-round integral characteristics, twice what the former method achieves, for both Midori64 and Midori128. In Eurocrypt 2017, Sasaki and Todo [11] found a 7-round truncated impossible differential for Midori128 by an automated tool, but there is no corresponding result for Midori64. For Skinny64, we find the same 10-round integral distinguisher for Skinny64 that the designers have found. The designers of Skinny mentioned in their security analysis that the division property can probably be used to slightly extend their results. Our results, however, show that any improvement in the length of the integral distinguisher using the division property is impossible. A summary of the comparisons of our results with the previous integral characteristics is shown in Table 1. The highlight of our work is that we found a way to build distinguishers for the linear layer of a block cipher and gave a compact description. Thanks to the compact representation, we can accurately evaluate the propagation of the division property through binary linear layers. Therefore, we proposed a method to check the security of block ciphers against integral cryptanalysis using the division property. This paper is organised as follows. In Section 2, we give some preliminaries for division property and MILP, introduce Midori and Skinny and model S-boxes in the two ciphers which will be used later. In Section 3, we propose a theoretical compact description and a practical compact description of the division properties of binary linear layers. In Section 4, we apply the method in Section 3 of the Midori family of block ciphers and show the improvements. In Section 5, we present a 10-round integral distinguisher for Skinny64. In Section 6, we discuss the application of our method on complicated matrices and propose the technical improvements of our method prior over the preceding ones. Finally, in Section 7, we end with a conclusion and possible future work. Table 1. Our results on Skinny and Midori, and compared with previous results Cipher Rounds (previous) Rounds (ours) Midori64 3.5 [1] 7 (=upper bound) Midori128 3.5 [1] 7 (=upper bound) Skinny64 10 [2] 10 (=upper bound) 2 Preliminaries and preparations 2.1 Notations and definitions We present our notations in Table 2. Table 2. Notations used throughout this paper an n -bit boolean vector Hamming weight of the boolean vector x matrix transposition of x submatrix of unit vector whose the i th bit is 1 Hamming weight of the row of set of real numbers set of all n -bit boolean vectors finite field of size set of natural numbers set of integer numbers t integer boolean vector If is a vector of , we denote by the bit product The division property is defined for a multi-set X and is calculated by summing the bit product function over all vectors of X. Definition 1.(Division property): A multi-set is said to fulfil the division property [4, 6] of order t, for some , if the sum over all vectors x in X of the product equals 0, for all vectors that have a hamming weight less than t, i.e. Notations: In this paper, we consider the case where the inputs of a transformation (for instance: a round function, an S-box and a linear transformation) run over a subspace or an affine subspace of . In particular, the components of them each take the values 0 and 1, while the other components are fixed. We denote the division property by , where and the components of are 1 and the others are 0. For example, represents the inputs of a transformation on are formed as for , where vary from 0 to 1, is fixed. Definition 2.(Division Trail): Let be the round function of an iterated block cipher. Let be a set of vectors in . Assume the input multi-set to the block cipher has initial division property , and denote the division property after i rounds of propagation through by . Thus, we have the following chain of division-property propagations: Moreover, for any vector in , there must exist a vector in such that can propagate to by division property propagation rules. Furthermore, for if can propagate to for all , we call an r -round division trail. Moreover, is called the initial division property [4, 7, 8]. Division trails are vectors which show the propagation path of the division property in the process of encryption, showing the balancedness of intermediate states. The propagation of the division property through a round function of the block cipher is actually a series of transitions of vectors. Assume that the input multi-set to the S-box has division property , and the output multi-set has division property , where , , then we call a division trail of this S-box [7, 10]. Especially, when the S-box is a linear transformation, we call a division trail of the linear transformation. For the details of the construction of division trails, please see [6, Section 5.3] or [10, Section 2.4]. 2.2 MILP and integral cryptanalysis Now, we briefly introduce MILP, MILP is a general mathematical tool, which takes an objective function and a system of linear inequalities with respect to real numbers as input, and searches for an optimal solution which minimises/maximises the objective function satisfying all the inequalities. Mouha et al. [12] showed that the problem of finding the optimal differential path can be converted to MILP. An MILP problem can formally be described as follows. MILP: Find a vector with , so that the linear function is minimised (or maximised), where and . In recent years, MILP has been explicitly applied in varieties of cryptographic research areas [11-13]. We are mainly concerned about the application of the MILP method in integral cryptanalysis. Integral cryptanalysis was described by Knudsen and Wagner in [14]. There are two major techniques to construct an integral characteristic; one uses the propagation characteristic of integral properties [14, 15] and the other estimates the algebraic degree [16]. In this paper, we study the propagation of the integral property. In the MILP progress, we have to give an initial division property and a stopping rule by constructing an objective function in terms of the Hamming weight of the division trail. Stopping rule. Let be the output division property after i rounds of encryption. Let be the input division property of the first round. If contains all the n unit vectors for the first time, it means that none of the n bits of output is balanced, and the division-property propagation should stop and an r -round distinguisher can be derived from . 2.3 Midori block cipher Midori is a family of lightweight block ciphers recently published at ASIACRYPT 2015. They follow the Substitution-permutation network (SPN) structure and have been advertised as one of the first lightweight ciphers optimised with respect to the energy consumed by the circuit per bit in the encryption or decryption operation. To achieve the desired low-energy goal, several design decisions were made such as using a diffusion layer consisting of almost-Maximum Distance Separable (MDS) binary matrices. The Midori family consists of two ciphers: Midori64 and Midori128. The block sizes are 64 and 128 bits and the number of rounds is 16 and 20, respectively, and the key size is 128 bits for both. The plaintext and the intermediate state are described by matrices of size The size of each cell is 4 bits for Midori64 and 8 bits for Midori128. The round function consists of the four operations SubCell, ShuffleCell, MixColumn and KeyAdd that update the n -bit state S : SubCell: Apply the 4 bit S-box Sb0 and 8 bit S-box to each cell of Midori64 and Midori128, respectively. The truth tables of Sb0 and Sb1 are listed in Table 3. ShuffleCell: Each cell of the state is shuffled as follows: MixColumn: Multiply each column by a matrix over the finite field and correspondingly, where is Table 3. Specifications of S4, Sb0 and Sb1 x 0 1 2 3 4 5 6 7 8 9 a b c d e f c 6 9 0 1 a 2 b 3 8 5 d 4 e 7 f c a d 3 e b f 7 8 9 1 5 0 2 4 6 1 0 5 3 e 2 f 7 d a 9 b c 8 4 6 2.4 Skinny block cipher Skinny [2] is a family of lightweight block ciphers proposed at Crypto 2016. It adopts the SPN structure just like Advanced Encryption Standard (AES). Skinny has variable block sizes of 64 and 128 bits, and key sizes of 64, 192 or 256 bits. In this paper, for simplicity, we just focus on the 64 bit block size. The 64 bit plaintext and the intermediate state are described by nibble matrices of size Each round of Skinny is composed of four operations applied to the internal state in the order specified below: SubByte: Apply the 4 bit S-box (Table 3) to each nibble. AddConstants and AddRoundKey(AK): XOR the state with constant and subkey. ShiftRow: Shift the i th row by i nibbles to the right . MixColumn: Multiply each column by a constant matrix over the field , where For completeness, we list the primitive representation of in Section 12, by 'primitive representation' we mean the original , viewed as a matrix with entries from . Since XORing with constants does not influence the division property, we do not consider AddConstants (AC) and AddRoundKey (AK) in our analysis. For more details about Midori and Skinny, please see [1, 2], respectively. 2.5 Modelling S-boxes To use MILP in block cipher evaluation, a critical step is to build a set of linear inequalities to describe division property propagations for the round function. A compact representation of the round function should satisfy the following two conditions according to Xiang et al. [7]. C1: Each division trail must satisfy all linear inequalities of the linear inequality system. That is, each division trail corresponds to a solution of the linear inequalities. C2: Each solution of the linear inequalities corresponds to a division trail. That is the set of all solutions of the linear inequalities which does not contain any impossible division trail. Since XORing with constants and subkeys does not influence the propagation of division property, and ShuffleCell just shuffles the division trails, we just need to model the S-box and the diffusion layer. For the propagation through an S-box, we apply the table-aided bit-based division property introduced in [6] to generate the propagation table of the S-box. After that, just as what has been introduced in [7], by using the inequality_generator() function in the Sage software, a set of linear inequalities is returned. Furthermore, this set can be reduced by the greedy algorithm (Algorithm 1) in [13]. The inequalities are the five inequalities used to describe the Midori64 S-box . Their solutions are exactly the 48 division trails of . The inequalities are the ten inequalities used to describe the Midori128 S-box . Their solutions are exactly the 49 division trails of . Since are processed by two in parallel, we need 20 inequalities for each 8 bit S-box used in Midori128. The inequalities in Section 9 are the 12 inequalities used to describe the Skinny S-box. Their solutions are exactly the 44 division trails of . 3 Compact characterisation of division trails through binary linear layers In block ciphers with bit-based permutations, the division property of bit i propagates to the bit when the bit i is moved to the bit . Therefore, modelling the S-box is enough for the modelling of the round function. However, for more general linear diffusion layers, modelling the linear layer is a distinctive and sophisticated step of MILP-based cryptanalysis. The most popular idea to describe the division property of a linear layer is to introduce some intermediate binary variables . For example, the equations used in [8] are (1)However, the following example will show that (1) does not include enough inequalities. Example 1.We take the following 4 bit linear transformation as an example: . It is an S-box with algebraic degree 1: (2)According to (1), one can introduce intermediate variables and get the following equations in binary variables: (3)Given one can get by (3). Table 4 lists all the 44 solutions of linear system (3), where vectors on are in hexadecimal notation. However, Table 4 does not show correctly the propagation characteristic of the bit-based division property of the linear transformation L as an S-box.Indeed, the four vectors shown in bold are superfluous; the correct propagation of division property has all vectors excluding them. It must be noted that, in some time, these four vectors may lead to n unit vectors and force the searching process to end prematurely. Now, we explore how this happens. In fact, the cause of the problem is that the left-upper-order three submatrices of M are non-invertible. The ANF of is . Although the monomial appears in this expression, it appears twice and will be completely cancelled out. It follows that should not be included in the division table corresponding to the input . That is, is not a division trail. According to the proceeding methods, the division trail is counted by verifying whether a monomial appears at least once in the calculation progress of the ANF, without taking into account possible cancellation. Table 4. Propagation of the bit-based division property for a linear transformation L k of input k of output k of input k of output 0 {0} 8 {8} 1 {1,2} 9 {9,A,} 2 {2,4} A {A,C} 3 {3,5,6} B {B,D,E} 4 {1,2,4,8} C {9,A,C} 5 {5,6,9,A,3 } D {D,E,B } 6 {3,5,6, A,C} E {D,E, B} 7 {7,B,D,E} F {F} The four vectors shown in bold are superfluous; they are not the division trails but the others are. Hence in the MILP process by (1), one will get extra vectors that do not correspond to division trails. In other words, a part of the solutions is parasitical. Therefore, (1) does not describe the division property through linear layer compactly. We describe now our method. 3.1 Compact theoretical description Observation: The inherent character of the division property of a linear transform is the independence of variables. By this, we mean the following. If the input of an invertible n -bit permutation runs from 0 to , then the output takes all values. Hence, the n output bits can be described as n independent variables, since they each take the values 0 and 1 often equally, independent of the value of the other output bits. On the contrary, if the input of an n bit permutation cannot take all values from 0 to , then the output bits will not act as n independent variables. However, some of the bits may still be independent of one another. Just like an invertible linear transformation maps a space of dimension to a space of dimension , it holds that if the input of a linear transformation has the division property of order k, then also the output must have the division property of order . Similarly, we propose the following main theorem about how the independence of input variables propagates to the output variables and how this is related to the division property of order . Theorem 1.Let be the matrix of an invertible linear transformation L. Let , , . Then, is one of the division trails of L if and only if the order submatrix whose columns indices are taken from and rows indices are taken from is invertible. Proof.The i th row of contains the coefficients of the linear transformation , which is the i th component of the linear transformation, corresponding to the list of all monomials with degree one in the ANF of . Since the linear transformation is invertible, it maps a -dimensional subspace onto a -dimensional subspace. Therefore, if is one of the division trails, we have .'' By [6, Proposition 7], if is a division trail of an order n linear transformation, then the monomial appears in the expansion of , which equals to (4)In the expanded form of (5), the coefficient of is a sum of terms which take exactly one coefficient as a factor from each factor of This results in (5)where runs over all permutations of . Equation (5) is exactly the definition of the determinant of the binary matrix formed by taking the columns and rows from (6)Hence, if is a division trail, then .'' If , then the columns of are linearly independent, that is, are linearly independent. Moreover, similarly are linearly independent. According to the observation before Theorem 1, which means that if the input of a linear transformation has the division property , then the output of this linear transformation has the division property y. Hence is a division trail. □ Theorem 1 shows that there is a one-to-one correspondence between the invertible submatrices of and its division trails. The internal relation between the division trail and the matrix is the invertibility of the submatrix. Therefore, checking whether a vector is a division trail of a linear transformation is equivalent to check whether the corresponding submatrix of is invertible. 3.2 Compact practical description So far, we have given a compact theoretical description for division trails of linear layers of block ciphers. In the following, we will describe a practical method to build a series of inequalities such that their solutions are exactly the division trails of the linear transformation. According to Theorem 1, in order to get all the division trails, it is sufficient to find all the invertible submatrices of . Now, the key point is to have a way to describe the character of the invertible submatrices. Inspired by the way of representing the division trails of S-box as linear inequalities in [7], we want to find a practical way to describe invertible submatrices by inequalities. In the following, we consider a matrix that is derived by starting from a linear map defined by an matrix and then choosing a basis in and representing all elements of as n -bit vectors. We consider only the matrix derived from a matrix with coefficients . Since each division trail satisfies , has even Hamming weight. A division trail with Hamming weight corresponds to an invertible order t submatrix of . We describe the division trails by the invertible submatrices in ascending order of Hamming weight. 3.2.1 Describing the division trails with hamming weight 2 First, we describe all the invertible submatrices of order 1, that is, all non-zero entries in . They correspond to division trails, where are both basis vectors. Suppose that are the ones in the i th row of . The trails are the solutions of the set of inequalities(7)since by (7), when , there are at least one of equals to 1. Therefore, we get vectors . They are all the division trails with Hamming weight 2. 3.2.2 Describing the trails with hamming weight 4 Corresponding to the division trails with Hamming weight 4, we have to characterise 's invertible submatrices of order 2. It is well known that a matrix is invertible if and only if its row vectors are linearly independent. So we consider the linear combinations of two rows. We divide the rows of into n cosets. Let . We first consider the case , i.e. i and j are in different cosets. Taking into account the fact that is a binary matrix over the finite field , we see that when the i th row and the j th row have no common non-zero entries. The inequalities given the order two invertible submatrices containing the i th and the j th rows. Now, we consider the case where i and j are in the same coset. We study the XOR of the i th row and the j th row, with . If a submatrix includes these rows, then it must contain at least one column k, where or else the submatrix will be singular. Therefore, it is enough to use (8)to describe this phenomenon. For example, for the third and the 11th rows in (see Section 11), we have . The two rows are the same, except for the 3rd, 7th and 15th components. Hence, if a submatrix includes these two rows, at least one of the 3rd, 7th or 15th column should be taken or else the submatrix will be singular. Therefore, it is enough to use to describe this phenomenon. 3.2.3 Describing the trails with hamming weight Similar to the argumentations in Section 3.2.2, after collecting the XOR of t special rows of , we get the following inequalities which describe trails with Hamming weight : (9)For , we have This implies that if are all equal to 1, then either or is 1; otherwise, the 0, 4 and 8 rows in the submatrix will be linearly dependent, and the submatrix is singular. 3.2.4 Describing the division trails of hamming weight By collecting the XOR of all the rows of , and taking into account the compression rule of the XOR operation [7], noting that are the only inputs of and only include , we get the following equations for some special division trails with Hamming weight : (10) 3.3 Necessity and sufficiency of the proceeding inequalities We claim that the four steps in Section 3.2 give all the division trails for the binary linear layer. This is proven in Theorem 2. Theorem 2.The four steps in Section 3.2 describe exactly the invertible submatrices of the matrix of the binary linear layer. The number of inequalities used to describe the division trails of the linear layer is , where s is the order of over . Proof.On the one hand, for an invertible submatrix of any order, we can divide its rows indices into the following cosets: . Since the rows in different cosets have no common non-zero entries in the same column, we can take into account the XOR operation of rows in each coset separately. For the 's with indices in the same coset, we construct inequalities according to Section 3.2. Hence for a submatrix of any order, we have the corresponding inequalities.On the other hand, the set of linear inequalities, we constructed, forms the optimum selection. By this we mean that it has the smallest number of inequalities; each of these inequalities and each combination of these inequalities stands for a large class of invertible submatrices. If one of them is removed, then some singular submatrices will come in, just like the four bold vectors in Table 4.Hence, the four steps in Sections 3.2.1–3.2.4 are sufficient and necessary to describe all the invertible submatrices of the linear layer matrix. The number of inequalities for the binary linear layer is □ 4 Application to Midori In this section, we show the application of our technique on the cryptanalysis of Midori. 4.1 Modelling the linear layer Each division trail of the linear transformation of Midori64 can be viewed as a 32 bit vector. Using the methods of Section 3.2, we get 60 inequalities formed as (7)–(10), which completely describe the propagation of division trails of . Together with the compact representation of the S-box, they are really sufficient descriptions of the Midori64 round function. We have also verified this by making an exhaustive search for the solutions of the 60 inequalities and for the invertible submatrices of . The number of invertible submatrices is