Efficient constructions for large‐state block ciphers based on AES New Instructions

IET Information SecurityVolume 16, Issue 3 p. 145-160 ORIGINAL RESEARCHOpen Access Efficient constructions for large-state block ciphers based on AES New Instructions Rentaro Shiba, Corresponding Author Rentaro Shiba rentaro.shiba@gmail.com orcid.org/0000-0003-2306-9978 Graduate School of Applied Informatics, University of Hyogo, Hyogo, Japan Correspondence Rentaro Shiba, Graduate School of Applied Informatics, University of Hyogo, Hyogo, Japan. Email: rentaro.shiba@gmail.comSearch for more papers by this authorKosei Sakamoto, Kosei Sakamoto Graduate School of Applied Informatics, University of Hyogo, Hyogo, JapanSearch for more papers by this authorTakanori Isobe, Takanori Isobe Graduate School of Applied Informatics, University of Hyogo, Hyogo, Japan National Institute of Information and Communications Technology, Tokyo, JapanSearch for more papers by this author Rentaro Shiba, Corresponding Author Rentaro Shiba rentaro.shiba@gmail.com orcid.org/0000-0003-2306-9978 Graduate School of Applied Informatics, University of Hyogo, Hyogo, Japan Correspondence Rentaro Shiba, Graduate School of Applied Informatics, University of Hyogo, Hyogo, Japan. Email: rentaro.shiba@gmail.comSearch for more papers by this authorKosei Sakamoto, Kosei Sakamoto Graduate School of Applied Informatics, University of Hyogo, Hyogo, JapanSearch for more papers by this authorTakanori Isobe, Takanori Isobe Graduate School of Applied Informatics, University of Hyogo, Hyogo, Japan National Institute of Information and Communications Technology, Tokyo, JapanSearch for more papers by this author First published: 23 December 2021 https://doi.org/10.1049/ise2.12053Citations: 1AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinked InRedditWechat Abstract Large-state block ciphers with 256 bits or 512 bits block sizes receive much attention from the viewpoint of long-term security. Existing large-state block ciphers, such as Haraka-v2 and Pholkos, consist of only the AES New Instructions set (AES-NI) and a word shuffle that can be efficiently executed by SIMD instructions for fast software implementation. In Haraka-v2 and Pholkos, the AES round function is executed twice in parallel at each step and its outputs are shuffled (called two-round constructions). In this study, optimal constructions based on AES-NI and efficient word shuffles for such large-state block ciphers in terms of the encryption speed for software are explored. Specifically, an optimal class of word shuffles that can achieve security in a smaller number of rounds from the class of word shuffles that can be efficiently implemented in SIMD to contribute to the improvement of the performance of large-state block ciphers is identified. Their speed for each CPU architecture is measured. As a result, the authors reveal the constructions such that two rounds of the AES round function is executed in parallel at each step and its outputs are shuffled (called two-round constructions) and are optimal in all CPUs with Skylake architecture or later versions. Furthermore, the authors reveal that there is a clear difference in word shuffle instructions with respect to the speed, even if they theoretically require the same number of cycles. Consequently, the authors clarify the optimal construction for each architecture by taking these differences into consideration. 1 INTRODUCTION Block ciphers with large block sizes such as 256- and 512-bit block ciphers receive much attention from the viewpoint of long-term security as they can provide stronger security than 128-bit block ciphers. In 2016, Kölbl et al. proposed a short-input hash function based on a large-state block cipher, Haraka-v2 [1], which repeats executions of AES round functions in parallel and a word shuffle of its output using SIMD instructions such as the AES New Instructions set (AES-NI) [2], which supports the AES round function and the key scheduling algorithm. In 2020, Bossert et al. proposed a family of block ciphers, Pholkos [3], based on Haraka-v2. This is a large-state block cipher with 256 bits or 512 bits block sizes. Both Haraka-v2 and Pholkos have a structure that repeats two rounds of AES round functions and wordwise permutation with a 32-bit unit of 1-word in each step (called two-round constructions). The instructions used for permutations are different between Haraka-v2 and Pholkos, that is, vpunpckhdq and vpunpckldq are used in the former and vpblendd is used in the latter, respectively. The designers of Pholkos claim that vpblendd is faster than vpunpckldq and vpunpckhdq and is the reason why they use vpblendd. Pholkos and Haraka-v2 are based on two-round constructions. It makes the security evaluation easy because two rounds of the AES round function guarantee at least five active S-boxes. In addition, it can be viewed as one non-linear layer of four larger S-boxes with the input/output size of the 32-bit so-called Super S-box. However, it is unknown whether two-round constructions are optimal in terms of the security and the encryption speed for large-state block ciphers. In this study, we explore the optimal constructions based on AES-NI and efficient word shuffles for such a large-state block cipher in terms of the encryption speed for software. Specifically, we identify an optimal class of word shuffles that can achieve security in fewer rounds from classes of word shuffles that can be efficiently implemented in SIMD. In addition, we consider the structure that has only a single AES round function in each step (called one-round constructions). We measured their speed for each CPU architecture. As a result, the contribution can be summarized as follows. When encrypting one 256-bit block, using vpunpckldq and vpunpckhdq is faster than using vpblendd on all Intel CPUs that we used for our experiments When encrypting one 512-bit block, using vpblendd is faster than using vpunpckldq and vpunpckhdq on all Intel CPUs that we used for our experiments. When encrypting one block, two-round constructions are faster than one-round constructions in conditions that are resistant against differential/linear, impossible differential and integral attacks on all Intel CPUs that we use for our experiments. From these results, we reveal the most efficient constructions of large-state block ciphers using vpunpckldq and vpunpckhdq or vpblendd for each CPU architecture. The rest of the paper is organized as follows. In Section 2, we give an overview of AES-NI, Haraka-v2, and Pholkos as the preliminaries and explain the security evaluation of differential/linear attacks by the active S-box search. In Section 3, we explore two-round constructions and one-round constructions. In Section 4, we show the results of security evaluations for the one-round and two-round constructions with various classes of permutations. In Section 5, we show the results of the encryption speed evaluation of the implementation and conclude the paper in Section 6. 2 PRELIMINARIES In this section, we first explain the details of AES-NI and describe the specification of Haraka-v2 and Pholkos. After that we explain how to evaluate the security against differential/linear attacks by the active S-box search as preliminaries for our research. Finally, we point out the open problems of the existing constructions. 2.1 AES-NI and SIMD instructions AES-NI (Advanced Encryption Standard New instructions-set) [2] is an instruction set extension, which provides the fast execution of AES encryption/decryption and subkey generation operations. For example, aesenc is for executing one round of the AES round function (SubBytes, ShiftRows, MixColumns, and AddRoundKey), and aesenclast is for executing the last round of AES round functions (SubBytes, ShiftRows, and AddRoundKey). SIMD (Single instruction/Multiple data) refers to an architecture that operates multiple data with a single instruction. SIMD instructions can store multiple data in vector registers and perform complex computations efficiently. Most modern CPUs include AES-NI and SIMD instruction sets to improve their performance. In this study, we consider large-state block ciphers using aesenc in AES-NI and some SIMD instructions that perform wordwise shuffles. We use vpunpckhdq and vpunpckldq in AVX or vpblendd in AVX2 as their shuffle layer. The execution speed of these instructions can be evaluated in terms of latency, throughput, and port usage. Latency means the number of clock cycles that are required for the execution of an instruction. Throughput means the number of clock cycles required to wait before the responsible ports are free to accept the same instruction again. Figure 1 shows the parallel execution for aesenc with a latency of 4 cycles and a throughput of 1 cycle. ISA (Instruction Set Architecture) instructions are decomposed into micro-operations (μops). It is important to consider which ports can execute these μops. Latency, throughput and port usage depend on the architecture of the CPUs. FIGURE 1Open in figure viewerPowerPoint Parallel execution of aesenc with latency 4 and throughput 1 2.2 Haraka-v2 Haraka-v2 [3] is a fast short-input hash function based on two-round constructions and the shuffle layer can be conveniently implemented and efficiently executed using vpunpckldq and vpunpckhdq. Haraka-v2 is classified into the following two variants: Haraka-v2-256 with 256-bit input and Haraka-v2-512 with 512-bit input. Both have five steps and 256-bit output. The step function of Haraka-v2-256 consists of 2-round AES round functions and a permutation of 8 words. Let the input of the step function in the r step of Haraka-v2-256 be x i r ∈ { 0 , 1 } 32 , ( i = 0 , … , 7 ) . The step function of Haraka-v2-256 is shown in Figure 2. FIGURE 2Open in figure viewerPowerPoint Step function of Haraka-v2-256 The step function of Haraka-v2-512 consists of four parallel applications of two rounds of the AES round functions and a permutation of 16 words. Let the input of the step function in the r step of Haraka-v2-512 be x ^ j r ∈ { 0 , 1 } 32 , ( j = 0 , … , 15 ) . The step function of Haraka-v2-512 is shown in Figure 3. FIGURE 3Open in figure viewerPowerPoint Step function of Haraka-v2-512 2.3 Pholkos Pholkos [1] is a large-state tweakable block cipher based on two-round constructions and the shuffle layer can be conveniently implemented and efficiently executed using vpblendd. Pholkos is classified into the following two variants: Pholkos-256 with 256-bit block and Pholkos-512 with 512-bit input. In both variants, no permutation is executed in the final step, that is, the AES round function used at the end is the one without MixColumns. There are also various types depending on the key length and tweak size. Let n be the block size, k be the key length and t be the tweak size; the parameters of each Pholkos are shown in Table 1. Pholkos consists of two major functions. The first is a step function and the second is a tweakey schedule function [4], which generates round tweakeys from the secret key and tweak. The step function of Pholkos-256 consists of two 2-round AES round functions and a permutation of 8 words. Let the input of the step function in the r step of Pholkos-256 be y i r ∈ { 0 , 1 } 32 , ( i = 0 , … , 7 ) . The step function of Pholkos-256 is shown in Figure 4. TABLE 1. Variants and parameters of Pholkos Version Block (n) Key (k) Tweak (t) Steps Pholkos-256-256 256 256 128 8 Pholkos-256-perm 256 - 128 12 Pholkos-512-256 512 256 128 10 Pholkos-512-512 512 512 128 10 Pholkos-512-perm 512 - 128 14 FIGURE 4Open in figure viewerPowerPoint Step function of Pholkos-256 The step function of Pholkos-512 consists of four 2-round AES round functions and a permutation of 16 words. Let the input of the step function in the r step of Pholkos-512 be y ^ j r ∈ { 0 , 1 } 32 , ( j = 0 , … , 15 ) . The step function of Pholkos-512 is shown in Figure 5. FIGURE 5Open in figure viewerPowerPoint Step function of Pholkos-512 2.4 Security evaluation of differential/Linear attacks by the active S-box Differential/Linear attacks are the most basic attacks on block ciphers. To evaluate the security of the n-bit block cipher f against differential/linear attacks, we derive the differential probability (DPf) and the linear potential (LPf) defined by the following equations and evaluate them using their maximum value. Δx and Δy are input/output differentials and Γx and Γy are input/output linear masks. D P f ( Δ x , Δ y ) = # { x ∈ { 0 , 1 } n | f ( x ) ⊕ f ( x ⊕ Δ x ) = Δ y } 2 n , L P f ( Γ x , Γ y ) = ( 2 # { x ∈ { 0 , 1 } n | x ⋅ Γ x = f ( x ) ⋅ Γ y } 2 n − 1 ) 2 . When the block size n is relatively small, it is easy to obtain the maximum differential/linear potential, but it is impossible to derive them in a realistic time for the 64/128-bit block size of most of the currently proposed block ciphers. Therefore, the maximum differential/linear characteristic probability (DCPfmax/LCPfmax) is used as an approximation of the maximum differential/linear potential in the actual evaluation. They are defined as the product of the differential/linear characteristic probability (DPf/LPf) for each round. D C P f = ∏ R = 1 r D P f ( Δ x R , Δ x R + 1 ) , L C P f = ∏ R = 1 r L P f ( Γ x R , Γ x R + 1 ) , D C P f m a x = max Δ x 1 ≠ 0 Δ x 2 , … , Δ x r + 1 D C P f , L C P f m a x = max Γ x 1 ≠ 0 Γ x 2 , … , Γ x r + 1 L C P f . In general, the minimal number of active S-boxes is used to evaluate the security against differential/linear attacks. When the input differential/linear mask for an S-box is non-zero, the S-box is called active S-box. The differential/linear characteristic probability is computed by the product of maximum differential/linear potential of the active S-box for the entire system. We can evaluate the upper bounds of the differential/linear characteristic probability by considering all possible transitional differential/linear mask paths and evaluating the lower bounds of the number of active S-boxes. In general, there are two ways to evaluate the number of active S-boxes in a block cipher. One is to use a lower bound on the number of active S-boxes shown by proofs, and the other is to evaluate the lower bound on the number of active S-boxes by search algorithms. In this study, we use the latter way. This can be performed efficiently using Mixed Integer Linear Programming (MILP), which is a method of searching for the value of a variable that optimizes (maximizes or minimizes) an objective function given by a linear expression under a constraint equation for a variable. In the method proposed by Mouha et al [5], they expressed each component of a cipher as linear expressions that are given as constraints. Then, the total number of active S-boxes is given as the objective function, and the minimum number of active S-boxes is obtained by minimizing it. In this study, we use the Gurobi Optimiser [6] as a MILP solver and evaluate the security of large-state block ciphers with various classes of permutations, using the same method as that followed in Mouha et al. In addition to differential/linear attacks, we also evaluate the security against impossible differential and integral attacks on large-state block ciphers using MILP. We omit a detailed description of these attacks but show the search results in Section 4. 2.5 Open problems As described in 2.2 and 2.3, Haraka-v2 and Pholkos are based on the two-round constructions, which consist two rounds of AES round functions and a shuffle operation in each step. This is because the two-round AES round function can guarantee at least five active S-boxes. It allows reducing the problem of analysing the security analysis to that of counting the minimal number of active S-boxes. However, it is unknown that the two-round AES round function is optimal in terms of security and encryption speed. In this study, we try to search for optimal constructions of 256- and 512-bit block ciphers in terms of security and encryption speed. Specifically, we explore 256- and 512-bit block ciphers with a two-round and one-round construction where only a single AES round function is executed in each step. We evaluate their security against differential/linear, impossible differential and integral attacks using MILP and compare the encryption speed of these block ciphers using SIMD instructions and AES-NI implementation. Since the encryption speed depends on the architecture of the CPUs, we measure the encryption speed on multiple CPUs with different architectures and compare each construction. 3 TARGET CONSTRUCTIONS In this section, we explain our target constructions of 256-bit and 512-bit block ciphers consisting of only AES-NI and a wordwise permutation. Let π8 be the permutation of 8 words, π16 be the permutation of 16 words, and RAES be the one-round AES round function. 3.1 Two-round construction In the two-round construction, we apply the two-round AES round function in parallel as with Pholkos and Haraka-v2 and then apply a permutation at each step. Let S(2,256) and S(2,512) be the step function of 256-bit and 512-bit block ciphers with the two-round constructions, respectively. The step functions of these constructions are expressed as follows. S ( 2 , 256 ) = π 8 ◦ ( R A E S ‖ R A E S ) ◦ ( R A E S ‖ R A E S ) , S ( 2 , 512 ) = π 16 ◦ ( R A E S ‖ R A E S ‖ R A E S ‖ R A E S ) ◦ ( R A E S ‖ R A E S ‖ R A E S ‖ R A E S ) . Figure 6 illustrates the two-round construction for w = 256. FIGURE 6Open in figure viewerPowerPoint Two-round construction (256-bit block ciphers) 3.2 One-round construction In the one-round construction, we apply tow AES round functions in parallel and then apply a permutation at each step. Let S(1,256) and S(1,512) be the step function of 256-bit and 512-bit block ciphers with one-round constructions, respectively. The step functions of these constructions are expressed as follows. S ( 1 , 256 ) = π 8 ◦ ( R A E S ‖ R A E S ) , S ( 1 , 512 ) = π 16 ◦ ( R A E S ‖ R A E S ‖ R A E S ‖ R A E S ) . Figure 7 illustrates the one-round construction of 256-bit block ciphers. FIGURE 7Open in figure viewerPowerPoint One-round construction (256-bit block ciphers) 4 FINDING OPTIMAL PERMUTATIONS In this section, we explore the optimal permutations for the target constructions shown in Section 3. First, we explain the SIMD instructions used in Pholkos and Haraka-v2. Next, we show a class of permutations to be studied in this paper. Then we search for the optimal permutations by the evaluation of the active S-box and impossible differential and integral attacks for each construction. If we consider the propagation of the differential or integral property with respect to bits, we might be able to obtain more detailed distinguishers, which can apply sophisticated cryptanalysis. However, our goal is to reduce the search space of permutations. Thus, we search for permutations by evaluating the security with respect to bytes. 4.1 Permutations of Pholkos and Haraka-v2 As underlying permutations, Pholkos uses vpblendd (_mm_blend_epi32) in AVX2, and Haraka uses iterations of vpunpckhdq (_mm_unpackhi_epi32) and vpunpckldq (_mm_unpacklo_epi32) in AVX. All of them use instructions for operating 128-bit registers as a vector containing four 32-bit words. Algorithms 1, 2 and 3 show the algorithms for each instruction [7]. On the architectures of the CPU considered in this study, these instructions have a common latency of one cycle [8]. However, since permutations of 512-bit block ciphers need two executions of these permutations, they need the double latency of the execution of the permutation of 256-bit block ciphers. Table 2 shows the SIMD instructions used to realize the permutations used in Pholkos and Haraka-v2 and the latency of each instruction [8], where π 8 u and π 8 b express the permutation of 256-bit block ciphers using vpblendd and iterations of vpunpckldq and vpunpckhdq, respectively. π 16 u and π 16 b express the permutation of 512-bit block ciphers using vpblendd and iterations of vpunpckldq and vpunpckhdq, respectively. TABLE 2. Permutations and their latency used in Pholkos and Haraka-v2 Permutation Primitive Instruction Latency # of patterns π 8 u Haraka-v2-256 vpunpckldq, vpunpckhdq 1 23 π 8 b Pholkos-256 Vpblendd 1 24 π 16 u Haraka-v2-512 vpunpckldq, vpunpckhdq 2 222.92 π 16 b Pholkos-512 Vpblendd 2 218.34 There are 8 (= 23) variants of permutations in a class of π 8 u and 16 (= 24) permutations in a class of π 8 b . In the case of π 16 u , words 0 through 4 are mapped to one of the values in words 0, 4, 8, or 12 of the previous state. Similarly, the next four words are mapped to one of the words 1, 5, 9, or 13 of the previous state. Considering the rest in the same way, there are 4! variants of permutations in each 128 bits segment (a 128 bits chunk) in the state. Since a state consists of four 128 bits segments, we have 4 ⋅ 4! variants. In addition, if we consider the permutations between each 128 bits segment, the number of π 16 b is 4! × (4!)4. In the case of π 16 b , the first word of a 128 bits segment is mapped to one of the 0, 4, 8, or 12 words of the previous state. The second word of a 128 bits segment is mapped to one of the 1, 5, 9, and 13 words of the previous state. Considering the rest in the same way, the number of π 16 b is (4!)4. As a result, there are 7962624 (≈222.92) variants of permutations in a class of π 16 u and 331776 (≈218.34) permutations in a class of π 16 b . We search for the optimal permutations among these classes. Algorithm 1. vpunpckldq (_mm_unpacklo_epi32) Input: dst[128], src1[128], src2[128] Store the result in: dst[128] dst[31:0] ←src1[31:0] dst[63:32] ←src2[31:0] dst[95:64] ←src1[63:32] dst[127:96] ←src2[63:32] Algorithm 2. vpunpckhdq (_mm_unpackhi_epi32) Input: dst[128], src1[128], src2[128] Store the result in: dst[128] dst[31:0] ←src1[95:64] dst[63:32] ←src2[95:64] dst[95:64] ←src1[127:96] dst[127:96] ←src2[127:96] Algorithm 3. vpblendd (_mm_blend_epi32) Input: dst[128], a[128], b[128], imm8 Store the result in:dst[128] for j = 0 to 3 do i ←j*32 if imm8[j] then dst[i+31:i] ←b[i+31:i] Else dst[i+31:i] ←a[i+31:i] end if end for dst[MAX:128] ←0 4.2 Active S-box search For the constructions of 256-bit block ciphers, we perform active S-box evaluation by MILP for permutations in the classes of π 8 u and π 8 b . Since the maximum differential/linear characteristic probability of the S-box in AES is 2−6, we search for constructions where the minimum number of active S-boxes is more than or equal to 43 (2−6×43 < 2−256) with the smallest number of rounds. For the constructions of 512-bit block ciphers, we perform the active S-box evaluation by MILP for 120 000 (≈216.87) out of a total of π 16 u and all permutations of the class of π 16 b because it is computationally difficult to search all π 16 b permutations. These permutations of π 16 u are selected from the top of the lexicographic order. As in the case of 512-bit block ciphers, we consider the maximum differential/linear characteristic probability of the AES S-box and search for constructions where the minimum number of active S-boxes is greater than or equal to 86 (2−6×86 < 2−512) with a smaller number of steps. 4.2.1 Search results For 256-bit block ciphers, we found that all constructions using the permutation of π 8 u and π 8 b satisfy 43 active S-boxes in 3.5 steps (3 × S(2,256) + RAES). We also found that all constructions using the permutation of π 8 u and π 8 b satisfy 43 active S-boxes in 6 steps in one-round constructions (6 × S(1,256)). For 512-bit block ciphers, in the case of π 16 b permutations, we found 5464 (≈212.16) constructions that satisfy 86 active S-boxes in 4.5 steps (4 × S(2,512) + RAES) in two-round constructions. In one-round constructions, we found 432 (≈28.75) constructions that satisfy 86 active S-boxes in eight steps (8 × S(1,512)). In the case of π 16 u permutations, all searched 120 000 (≈216.87) permutations satisfy 86 active S-boxes in 4.5 steps in two-round constructions, and the same number of constructions satisfy 86 active S-boxes in 10 steps (10 × S(1,512)) in one-round constructions. From the results of our search, the number of executions of the AES round function and a permutation with each class of permutations in one-round and two-round constructions, respectively, are shown in Table 3. TABLE 3. The number of executions of AES round function RAES and permutation with each class of permutations Construction Block size (-bit) Permutation class Execution of RAES Execution of permutation # of found patterns One-round 256 π 8 u 6 5 210.17 π 8 b 6 5 24.85 512 π 16 u 8 7 216.87 π 16 b 10 9 28.75 Two-round 256 π 8 u 7 3 210.17 π 8 b 7 3 24.85 512 π 16 u 9 4 216.87 π 16 b 9 4 212.16 4.3 Impossible differential search Next, we evaluated the security of these constructions, which possess a sufficient number of active S-boxes in the previous search against differential attacks. Impossible differential attacks [9, 10] exploit the differences holding with probability 0 (called impossible difference), while an ordinary differential attack exploits the high-probability differences. We search for the constructions, which have no such pairs of input and output differences using MILP. In this study, we consider the byte-truncated input/output differences and searched for impossible differences where the Hamming weight of input/output differences are both 1. 4.3.1 Search results For 256-bit block ciphers, we found that the number of impossible differences where the Hamming weight of input/output differences are both one becomes zero after 3.5 steps in all two-round constructions and after 6 steps in all one-round constructions, which possess 43 or more active S-boxes in previous search, respectively. For 512-bit block ciphers, in the case of π 16 b permutations, we found that the number of impossible differences where the Hamming weight of input/output differences are both one becomes zero after 3.5 steps in all 576 out of 5464 two-round constructions and eight steps in all 432 one-round constructions, which possess 86 or more active S-boxes. The construction using the permutation of Pholkos contains 576 two-constructions, which have no impossible difference where the Hamming weight of input/output difference is 1. In the case of π 16 u permutations, we search for 3000 one- and two-round constructions that were randomly chosen from 120 000 constructions that achieve 86 active S-boxes in 10 and 4.5 steps, respectively. We found that the number of impossible differences where the Hamming weight of input/output differences are both one becomes zero after 6 steps in all searched 3000 one-round constructions and 3.5 steps in all 3000 two-round constructions, which possess 86 or more active S-boxes. We can find that the construction using a permutation of Haraka v2 also needs 6 steps in one-round constructions and 3.5 steps in two-round constructions to prohibit impossible differences whose Hamming weight of the input and output difference are both 1. 4.4 Integral distinguisher search Finally, we evaluated the security against integral attacks of constructions that have sufficient resistance against differential/linear attacks. That is, for integral attacks, we only considered 256/512-bit block constructions whose minimum number of active S-boxes after 3.5/8 steps are no less than 43/86. Integral attacks [11] use a set of plaintexts, which has a constant value at some bit while the other part varies through all possible values, whereas differential attacks use a pair of chosen plaintexts with a fixed difference. The distinguishers can be constructed by observing the propagation of the integral property. In this study, we use the division property, which is the generalized notation of the integral property [12]. The propagation of the division property can also be modelled by MILP [13]. In this study, we consider the division property where the input multiset has only one bit constant values and other bits vary through all possible values, and we evaluate the propagation of the division property bytewise. 4.4.1 Search results We only evaluate security of constructions using permutations of Pholkos and Haraka v2, which show sufficient security against differential/linear and impossible differential attacks. As a result, there are no integral distinguishers after four AES rounds (the second step in two-round constructions and the fourth step in one-round constructions) in all cases (256-bit two- or one-round constructions and 512-bit two- or one-round constructions). 5 PERFORMANCE EVALUATION In this section, we evaluate the encr