MILP‐aided bit‐based division property for primitives with non‐bit‐permutation linear layers

IET Information SecurityVolume 14, Issue 1 p. 12-20 Research ArticleFree Access MILP-aided bit-based division property for primitives with non-bit-permutation linear layers Ling Sun, Ling Sun Key Laboratory of Cryptologic Technology and Information Security, Ministry of Education, Shandong University, Jinan, 250100 People's Republic of China School of Computer Science and Technology, Shandong University, Qingdao, 266237 People's Republic of ChinaSearch for more papers by this authorWei Wang, Wei Wang Key Laboratory of Cryptologic Technology and Information Security, Ministry of Education, Shandong University, Jinan, 250100 People's Republic of China School of Cyber Science and Technology, Shandong University, Qingdao, 266237 People's Republic of China Qilu University of Technology (Shandong Academy of Sciences), Jinan, 250353 People's Republic of ChinaSearch for more papers by this authorMeiqin Q. Wang, Corresponding Author Meiqin Q. Wang mqwang@sdu.edu.cn Key Laboratory of Cryptologic Technology and Information Security, Ministry of Education, Shandong University, Jinan, 250100 People's Republic of China School of Cyber Science and Technology, Shandong University, Qingdao, 266237 People's Republic of ChinaSearch for more papers by this author Ling Sun, Ling Sun Key Laboratory of Cryptologic Technology and Information Security, Ministry of Education, Shandong University, Jinan, 250100 People's Republic of China School of Computer Science and Technology, Shandong University, Qingdao, 266237 People's Republic of ChinaSearch for more papers by this authorWei Wang, Wei Wang Key Laboratory of Cryptologic Technology and Information Security, Ministry of Education, Shandong University, Jinan, 250100 People's Republic of China School of Cyber Science and Technology, Shandong University, Qingdao, 266237 People's Republic of China Qilu University of Technology (Shandong Academy of Sciences), Jinan, 250353 People's Republic of ChinaSearch for more papers by this authorMeiqin Q. Wang, Corresponding Author Meiqin Q. Wang mqwang@sdu.edu.cn Key Laboratory of Cryptologic Technology and Information Security, Ministry of Education, Shandong University, Jinan, 250100 People's Republic of China School of Cyber Science and Technology, Shandong University, Qingdao, 266237 People's Republic of ChinaSearch for more papers by this author First published: 01 January 2020 https://doi.org/10.1049/iet-ifs.2018.5283AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract In this study, the authors settle the feasibility of mixed integer linear programming (MILP)-aided bit-based division property for ciphers with non-bit-permutation linear layers. First, they transform the complicated linear layers to their primitive representations. Then, the original Copy and exclusive OR models are generalised, and these models are exploited to depict the primitive representations. Accord- ingly, the MILP-aided bit-based division property can be applied to much more primitives with complicated linear layers. As an illus- tration, they rst evaluate the bit-based division properties of some word-oriented block ciphers. For Midori64, they obtain a 7-round integral distinguisher, which achieves one more round than the previous results. At the same time, the data requirements of some existing distinguishers are also reduced. They decrease the data complexities of 4-round and 5-round distinguishers for LED and Joltik-BC by half. Then, the bit-based division properties of some bit-oriented ciphers such as Serpent and Noekeon are considered. The data complexities of their distinguishers for short rounds are reduced. Besides, they evaluate the bit-based division properties of the internal permutations in some hash functions. An 18-round zero-sum distinguisher for SPONGENT-88 is proposed, which achieves four more rounds than the previous ones. Some integral distinguishers for PHOTON permutations are improved. 1 Introduction The integral cryptanalysis was first introduced as a dedicate attack for the word-oriented block cipher SQUARE by Daemen et al. [1] at Fast software encryption (FSE) 1997. Theoretically, integral attacks can be applied to bit-oriented block ciphers. However, till FSE 2008 [2], Z'aba et al. first gave a specific tool to find integral distinguishers for bit-oriented block ciphers and the bit-pattern-based integral attack was successfully demonstrated on reduced-round variants of the block ciphers Noekeon [3], PRESENT [4], and Serpent [5]. At EUROCRYPT 2015, Todo [6] generalised the integral property to division property, which can precisely depict the inherent properties between traditional ALL and BALANCE properties. By propagating division property, the integral distinguishers can be constructed, efficiently. At CRYPTO 2015, Todo [7] showed that division property could be more useful if the S-box was supposed to be a public function. He detected a 6-round integral distinguisher for MISTY1 [8] by utilising the vulnerable property of and achieved the first attack against full MISTY1. At FSE 2016, Todo and Morii [9] proposed the bit-based division property and explored the 14-round integral distinguisher for SIMON32 [10]. They pointed out that the complexity of using bit-based division property was roughly for an n -bit block cipher. On the one hand, the considerable complexity restricted its application. On the other hand, whether the bit-based division property could be employed to analyse other bit-oriented block ciphers was unknown. Many kinds of research focusing on these interesting issues have occurred in succession. At CRYPTO 2016, by introducing the notion of parity sets, Boura and Canteaut [11] presented a new approach to deal with division property. For PRESENT, they provided some low-data integral distinguishers. By replacing the Substitution rule, which managed the propagation of S-box, with a more subtle propagation table, Sun and Wang [12] worked out the table-aided bit-based division property and successfully applied it to some bit-oriented primitives such as RECTANGLE [13] and SPONGENT-88 [14]. Thus, the bit-based division property can be compatible with ciphers other than SIMON. At ASIACRYPT 2016, Xiang et al. [15] applied mixed integer linear programming (MILP) method to search integral distinguisher based on division property, which is called MILP-aided bit-based division property in this paper, and found some longer integral distinguishers for SIMON family, Simeck family [16], PRESENT, RECTANGLE, LBlock [17], and TWINE [18]. Their work handled the problem about the complexity and showed that bit-based division property could be efficiently applied to some ciphers whose block sizes are more significant than 32. However, the linear layers for all these analytical ciphers are restricted to only simple bit-permutations. Thus, the feasibility of MILP method to analyse ciphers with linear layers besides bit-permutations was left as a future work [15]. Our contributions: In this paper, we settle the open problem and improve some integral distinguishers for various primitives by MILP-aided bit-based division property. The contributions of this paper are summarised as follows: Construct new searching models for complicated linear layers not limited to bit-permutations: First, we transform the complicated linear layers to the primitive representations. Then, the original Copy and exclusive OR (XOR) models are, respectively, generalised to deal with more output branches and input elements, and these generalised models are exploited to depict the primitive representations. In this way, we can model all kinds of linear layers only if we have their primitive representations, and we will find that getting the primitive representation of a linear layer is an easy task. Thus, the MILP-aided bit-based division property can be applied to much more primitives with relatively complicated linear layers. Apply MILP-aided bit-based division property to some word-oriented ciphers including Midori64 [19], light-emitting diode [20], Joltik-BC [21], and Advanced Encryption Standard (AES) [22]: For Midori64, we obtain a 7-round integral distinguisher, which gains one more round than the previous analysis. Moreover, the data complexity is reduced significantly for r -round distinguisher when . As to LED and Joltik-BC, the data requirements for 4-round and 5-round distinguishers are decreased by half. As to AES, our searching experiments show that integral distinguishers, which are based on the bit-based division property, covering more than four rounds probably do not exist. Consider the bit-based division properties of some bit-oriented block ciphers such as Serpent [5] and Noekeon [3]: Owing to their relatively complicated linear layers and large block sizes, it is difficult to perform integral cryptanalysis. At FSE 2008, Z'aba et al. [2] proposed 3.5-round integral distinguishers for Noekeon and Serpent. Todo [6] improved it with traditional division property. Applying the new method, we also reduce the data complexities of some short-round distinguishers for these two ciphers. Evaluate the bit-based division properties of the internal permutations involved in some hash functions, e.g. SPONGENT [14] and PHOTON [23]: The published results all focused on SPONGENT-88, that is, the 14-round zero-sum distinguishers proposed by Dong et al. [24], Fan et al. [25], and Sun and Wang [12]. The best one we obtained is an 18-round zero-sum distinguisher with complexity , which gains four more rounds than the previous ones. Moreover, we provide 20-round and 21-round zero-sum distinguishers for SPONGENT-128 and SPONGENT-160, respectively. For PHOTON permutations with 4 b cell, the data complexities for the 4-round distinguishers are reduced by half. Besides, we obtain a 9-round distinguisher for , which gains one more round than the previous ones. Furthermore, for using 8 b S-boxes, the data complexities of the distinguishers are dramatically improved. The comparisons of the main results with previous results for some block ciphers and internal permutations of hash functions are shown in Tables 1 and 2, respectively. Table 1. Comparison of our main results for some block ciphers with previous results Cipher Reference r = 4 r = 5 r = 6 r = 7 Midori64 4 12 45 61 Section 4.1 28 52 60 — [6]b Serpenta 23 83 113 124 Section 4.2 28 84 113 124 [6] Noekeon 27 83 113 124 Section 4.2 28 84 113 124 [6] : the exponent of the number of required chosen plaintexts. a Since Serpent uses different S-boxes, which have distinct properties, in different rounds, the starting round may influence the resulting distinguisher. Here, we refer to the case where the initial round is the first round. b Corresponding distinguishers are derived with the method introduced in the literature. Table 2. Comparison of our main results for some internal permutations of hash functions with previous results Cipher Round Reference SPONGENT-88 18 87 Section 4.3 17 85 — 16 84 — 15 80 — 14 84 [24] 14 80 [12, 25] SPONGENT-128 20 126 Section 4.3 SPONGENT-160 21 159 Section 4.3 in PHOTON 3 8 Section 4.3 3 253 [26]a 4 48 Section 4.3 4 283 [26]a a Corresponding distinguishers are derived with the method introduced in the literature. Outline: The rest of this paper is organised as follows. In Section 2, we briefly review some notations and definitions about MILP-aided bit-based division property. Section 3 illustrates how to apply MILP-aided bit-based division property to ciphers with more complicated linear layers. Section 4 gives some applications of MILP-aided bit-based division property. We conclude this paper in Section 5. 2 Preliminary 2.1 Notations In this section, we present the notations used throughout this paper. For an n -bit string , the ith element is expressed as , where the bit positions are labelled in big-endian, and the Hamming weight is calculated by . For any set , denotes the number of elements in . Let be an empty set. For any , the vectorial Hamming weight of is defined as . For any and , we define if for all i. Otherwise, . Definition 1.: (bit product function [6]): Assume and . The bit product function is defined as For , let be the input, the bit product function is defined as 2.2 Division property and bit-based division property Traditional integral distinguisher is usually constructed by evaluating the propagation of integral properties such as ALL and BALANCE properties. Division property, which was first proposed in [6], is a generalisation of integral property. It can precisely depict the inherent properties between ALL and BALANCE properties, which makes division property an efficient tool to construct integral distinguisher. Bit-based division property [9] handles a particular case of division property, where the space under consideration is restricted to the direct product of a series of binary fields. Comparing to traditional division property, bit-based division property traced the division property at the bit level and showed its power by finding longer integral distinguisher for SIMON32. In this section, we will briefly review division property and bit-based division property and list some propagation rules of bit-based division property. Definition 2.(division property [6]): Let be a multi-set whose elements take values from . When the multi-set has the division property , where denotes a set of m -dimensional vectors whose ith element takes a value between 0 and ; it fulfils the following conditions: Remark 1.Note that are restricted to 1 when we consider bit-based division property. 2.2.1 Propagation rules of bit-based division property Todo [6] proved some propagation rules for general division property and these rules were summarised into five rules in [7], which were Substitution, Copy, XOR, Split, and Concatenation, respectively. Among the five rules, only Copy and XOR are necessary for bit-based division property. They are restated in a bit-based look as follows: Rule 1 (Copy [7]): Let F be a Copy function, where the input x takes a value of and the output is calculated as . Let and be the input multi-set and output multi-set, respectively. Assuming that has the division property , the division property of is . There are only two possible cases for the propagation Rule 2 (XOR [7]) : Let F be a function composed of XOR operation, where the input takes a value of and the output is calculated as . Let and be the input multi-set and output multi-set, respectively. Assuming that has division property , the division property of is . There are only three possible cases for the propagation For some bit-oriented block ciphers such as SIMON, AND is another non-linear operation. The propagation for AND is given in [9], and we summarise it as follows. Rule 3 (AND [9]) : Let F be a function composed of AND operation, where the input takes a value of and the output is calculated as . Let and be the input multi-set and output multi-set, respectively. Assuming that has division property , the division property of is . There are only two possible cases for the propagation Propagating the bit-based division property of S-box: There are many different methods [11, 12, 15] to propagate bit-based division property through S-box. By analysing the algebraic normal form, the propagation can be summed up as a propagation table. The table has two columns. The first column is filled with input division property while the second column is filled with output division property corresponding to . Then, the propagation of bit-based division property for S-box becomes a simple look-up table. 2.3 MILP-aided bit-based division property Although bit-based division property is proved to be a powerful tool to find integral distinguishers, the complexity of utilising this method is roughly for an n -bit block cipher. Owing to this restriction, searching integral distinguishers for some primitives whose sizes are more significant than 32 bits is almost impossible. At ASIACRYPT 2016, Xiang et al. [15] proposed the method of describing the bit-based division property with the MILP model. With the help of some openly available MILP optimisers such as Gurobi [http://www.gurobi.com/. ], the complexities of employing bit-based division property can dramatically decrease, and the workload of designers and cryptanalysts is significantly reduced. In this section, we will give a brief review of MILP-aided bit-based division property. The main idea of MILP-aided bit-based division property is modelling the propagation rules of bit-based division property with a series of linear inequalities [We do not distinguish linear equality and linear inequality in this paper since MILP model can include linear inequality as well as linear equality.]. 2.3.1 Modelling Copy, AND, XOR, and S-box Corresponding to Rule 1–Rule 3, the following models are proposed to describe three basic bit-wise operations with linear inequalities. Model 1.: (Copy [15]): Denote as a division trail of Copy function, and the following inequalities are sufficient to describe the division propagation of Copy: Model 2.: (AND [15]): Denote as a division trail of AND function, and the following linear inequalities are sufficient to describe the division propagation of AND: Model 3.: (XOR [15]): Denote as a division trail through XOR function, and the following inequalities can describe the division trail through XOR function: Modelling S-box: To deduce the linear inequality system of S-box, we first generate its propagation table. After that, by invoking the inequality_generator() function in the Sage [http://www.sagemath.org/. ] software, a set of linear inequalities will be returned. Sometimes, the number of linear inequalities in the set is substantial such that adding all these inequalities into the MILP model will make the problem computationally infeasible. Thus, Sun et al. [27] proposed an algorithm called the greedy algorithm (Algorithm 1 in [15]) to reduce this set. Since the greedy algorithm is not deterministic, the resulting linear inequality systems are not unique for one S-box. Up to now, for block ciphers based on the three operations and (or) S-box, we can construct a set of linear inequalities characterising one round division property propagation. Iterating this process r times, we can get a linear inequality system describing r rounds division property propagation. All feasible solutions of correspond to all r -round division trails, which are defined below. Definition 3.: (division trail [15]): Denote as a chain of division property propagation through r rounds of encryption. For any vector , there must exist a vector such that can propagate to by division property propagation rules. Furthermore, for , if can propagate to for all , we call an r -round division trail. 2.3.2 Initial division property and stopping rule Denote as an r -round division trail is a linear inequality system defined on variables and some auxiliary variables. Let denote the initial input division property with , we need to add into , and all feasible solutions of are division trails which start from vector . By applying the definition of division property, the existence of any vector with Hamming weight larger than two indicates that all bits of the state satisfy the zero-sum property. Moreover, the presence of a unit vector tells that the bit located at the position of the unique non-zero element does not follow the zero-sum property. Thus, the objective function is set as Let denote the output division property after i rounds of encryption and the input division property is denoted by . If contains all the n unit vectors for the first time, the division property propagation should stop, and an r -round distinguisher can be derived from . Note that we only recall some key points here. For more details, please see [6, 7, 9, 11, 12, 15]. 3 MILP-aided bit-based division property for primitives with non-bit-permutation linear layers Even though MILP-aided bit-based division property illustrated by Xiang et al. handles the enormous complexities of bit-based division property, the primitives with non-bit-permutation linear layers are not considered. To settle this problem, the critical point is to transform the complex linear layer to an equivalent representation with only Copy and XOR operations and to generalise the original Copy and XOR models to handle it. The invocations of the generalised models introduce some intermediate variables, which are reorganised according to the equivalent representation, and the linear inequality system for the division property propagation of linear layer is obtained. Finally, MILP-aided bit-based division property becomes more powerful and can be applied to more primitives with relatively complicated linear layers. 3.1 Generalising Copy and XOR models Note that we have many different ways to define a linear transformation. However, we always can represent the linear transformation as a matrix over . We call this kind of representation the primitive representation as in [28] and always denote the primitive representation of a linear transformation. A simple observation implies the following claim. Claim 1.No matter how complicated the linear layer is, it can always be split into Copy and XOR operations according to the primitive representation. To work for more complicated linear layers, we generalise Model 1 and Model 3 in Section 2.3 to fit for more output branches and input elements, respectively. Model 4.: (generalised Copy): Denote as a division trail of a Copy function, and the following inequalities are sufficient to describe the division propagation of Copy: Model 5.: (Generalised XOR): Denote as a division trail through XOR function, and the following inequalities can describe the division trail through XOR function: With Model 4 and Model 5, we can depict the division property propagation of any linear layer by introducing some intermediate variables according to the primitive representation of the linear layer. 3.2 Modelling the primitive representation of a linear layer Let be an matrix, which is the primitive representation of a (or a part of) linear layer, and denote where . We suppose that the Hamming weight of the ith column of is , and the Hamming weight of the jth row is . Let be the number of non-zero elements in . By analysing the primitive representation, the ith input bit occurs in output branches and the ith input bit of needs to be copied times. Thus, intermediate variables need to be introduced to represent the division properties of these copies. To propagate the division properties for all input bits, intermediate variables are required in total. Denote as a division trail of . We may allocate the first intermediate variables to , and allocate the next variables to , and so forth. Then, by utilising Model 4, we list the linear inequalities to describe the Copy operations for all input bits as follows: (1)To propagate the XOR operations, those intermediate variables should be allocated according to the arrangement of non-zero elements in . For example, since are assigned to depict the division properties of the output copies for the first input bit, they are put in those positions of the first column's non-zero elements in order. Let be the index set of the ith row, whose elements are the indexes of intermediate variables in the ith row. According to Model 5, the linear inequalities to describe the XOR operations for all output bits are obtained, that is (2)Combining (1) and (2), we construct the linear inequality system used to trace the division property propagation of the linear operation . 3.3 Application to the MixColumns of LED To illustrate the above model, we take the MixColumns operation of LED [20] as an example. MixColumns is a part of linear operations for LED's round function, and it works like the MixColumn operation for AES [22]. It multiplies each column of the internal state by the same maximum distance separable matrix over the field , where The underlying polynomial for the field multiplication is . The primitive representation of is given by (3)Note that there are four columns in the internal state of the LED, and operates on each column, independently. Thus, we list the linear inequalities for one column as follows. Denote as a division trail of . There are 124 non-zero elements in . So that 124 intermediate variables are introduced, and they are arranged according to the positions of '1's in . Please see the equation below: (4)On the one hand, the variables located in the same column are precisely the variables used to describe the Copy operation for the corresponding input bit. Thus, the linear inequality system (5) is sufficient to describe the Copy operations. On the other hand, the variables located in the same row are involved in the XOR operation of the corresponding output bit. So the propagations of the XOR operations turn into linear inequality system (6). Thereby, we combine linear inequality systems (5) and (6) as a whole linear inequality system, which can trace the propagation of division property for . 3.4 Sketch of MILP-aided bit-based division property for primitives with complicated linear layers In the remaining of this section, we give an overview of applying the MILP-aided bit-based division property to primitives with complicated linear layers. All the analyses of primitives provided in Section 4 follow the procedures given below: Generating the linear inequality system for S-box: (a) We deduce the propagation table of the S-box. (b) All the elements in the propagation table are put into inequality_generator() to generate the linear inequalities used to describe the S-box. (c) Greedy algorithm is invoked to simplify the above linear inequality system. Generating the linear inequality system for linear layer: (a) The linear layer is transformed into the primitive representation. (b) The intermediate variables are introduced and arranged according to the non-zero elements in the primitive representation of the linear layer, and the linear inequality system is obtained. Constructing the linear inequality system for rounds division property propagation: (a) The linear inequality system used to propagate r rounds division property is constructed by combining the above two linear inequality systems following the structure of the specific cipher. Searching integral distinguishers with different initial division properties: (a) To obtain various distinguishers, we can change the initial division property of the MILP model (5) (6) 4 Applications of MILP-aided bit-based division property In this section, we show some applications of MILP-aided bit-based division property. First, we present the applications of MILP-aided bit-based division property to some word-oriented block ciphers such as Midori64, LED, Joltik-BC, and AES. Then, we evaluate some bit-oriented block ciphers including Serpent and Noekeon. At last, the bit-based division properties of the internal permutations used in some hash functions are concerned. We do not list the details for space limitation, and please see the full version of this paper [29] for more information. 4.1 Applications to word-oriented block ciphers 4.1.1 Application to Midori64 A brief introduction of Midori64 [19]: Midori64 is a block cipher with the 64 b block and the 128 b key. The 64 b state S is arranged in a matrix of 4 b cells Our searching algorithm related to the data processing part , which is a 16-round substitution permutation-network, and each round takes the following four operations, and the final round omits ShuffleCell and MixColumn operations. Before the first round, there is a key whitening operation. For more details, please see [19]. • SubCell: A 4 b S-box is applied to each cell of the state S. • ShuffleCell: Each cell of the state is permuted as follows: • MixColumn: Multiplying each column by a matrix over , where • KeyAdd: The ith 64 b round key is XORed to the state S. Since KeyAdd operation does not affect the propagation of division property, we do not consider it in our analysis. Thus, the key schedule is omitted. For more details, please see [19]. Applying MILP-aided bit-based division property to Midori64 [19]: • Generating the linear inequality system for S-box: The propagation table for has 48 vectors, and 54 linear inequalities are returned by invoking inequality_generator(). After using the greedy algorithm, only five linear inequalities are left. • Generating the linear inequality system for MixColumns operation: There are 48 non-zero elements in the primitive representation of . Thus, intermediate variables are required for one round of enc