Integral cryptanalysis on two block ciphers Pyjamask and uBlock

IET Information SecurityVolume 14, Issue 5 p. 572-579 Research ArticleFree Access Integral cryptanalysis on two block ciphers Pyjamask and uBlock Wenqiang Tian, Corresponding Author Wenqiang Tian wchtien@126.com orcid.org/0000-0002-2501-0972 PLA SSF Information Engineering University, 62 Kexue Road, Zhengzhou, 450001 People's Republic of ChinaSearch for more papers by this authorBin Hu, Bin Hu PLA SSF Information Engineering University, 62 Kexue Road, Zhengzhou, 450001 People's Republic of ChinaSearch for more papers by this author Wenqiang Tian, Corresponding Author Wenqiang Tian wchtien@126.com orcid.org/0000-0002-2501-0972 PLA SSF Information Engineering University, 62 Kexue Road, Zhengzhou, 450001 People's Republic of ChinaSearch for more papers by this authorBin Hu, Bin Hu PLA SSF Information Engineering University, 62 Kexue Road, Zhengzhou, 450001 People's Republic of ChinaSearch for more papers by this author First published: 01 September 2020 https://doi.org/10.1049/iet-ifs.2019.0624AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract The integral cryptanalysis is a powerful cryptanalytic technique for the security evaluation of block cipher. However, when using the MILP-aided division property to search the integral distinguishers, many candidates of initial division properties need to be tested, so that the computations are unbearable in practice. This study takes advantage of the division property propagation of S-box to improve the optimal integral distinguisher searching algorithm, and further reduce its time complexity. Whereafter, the improved algorithm is used to give 8- and 9-round integral distinguishers of uBlock-128 and uBlock-256, and 10- and 9-round integral distinguishers of Pyjamask-96 and Pyjamask-128. On this basis, utilising the partial sums technique, the authors perform 9- and 11-round key-recovery attacks on uBlock-128 and Pyjamask-96, respectively. The data complexities are and , and the time complexities are less than times of 9-round uBlock-128 encryption and times of 11-round Pyjamask-96 encryption. The results given in this study are the best integral attacks available of the two ciphers presently. 1 Introduction The integral cryptanalysis was first proposed by Daemen et al. [1] in 1997 for the analysis of the Square cipher, so it is also called the square attack. In 2002, Knudsen and Wagner [2] extended it to other ciphers. Integral cryptanalysis is another powerful cryptanalysis method after differential cryptanalysis and linear cryptanalysis. It has pretty attack results for many ciphers, such as AES [3], ARIA [4], and PRESENT [5]. At EUROCRYPT 2015, Todo proposed a new property called the division property [6], which is the generalisation of the integral property. It can effectively and more accurately construct integral characteristics. With this new technique, he achieved the first theoretical cryptanalysis on full MISTY1 [7]. In order to exploit the concrete structures of specific cryptographic primitives, the Bit-based Division Property (BDP) was introduced by Todo and Morii at FSE 2016 [8], and a 14-round integral distinguisher of SIMON32 [9] was presented. However, it requires too much time and memory complexities to evaluate ciphers by using the BDP, so that the application is limited to block ciphers with small block length (less than 32 bits). At CRYPTO 2016, Boura and Canteaut [10] gave another view of the division property, named 'parity set'. Exploiting further properties of the S-box and linear layer, the parity set could find more accurate integral characteristics. However, it also requires a huge time and memory. At ASIACRYPT 2016, Xiang et al. [11] creatively showed how to characterise the BDP propagation with the mixed-integer linear programming (MILP) model, which successfully overcomes the limit of huge time and memory complexities of utilising the BDP in security evaluation. Whereafter, they applied the method on six lightweight block ciphers and found better integral distinguishers. Subsequently, Sun et al. [12, 13] extended the MILP method to block ciphers with non-bit-permutation linear layers and ARX ciphers. Besides, Zhang and Rijmen found that the model solutions in [11] contained some impossible division trails, which may lead the integral trail to a premature end. Then they gave a new way to describe the division property propagation of linear diffusion layers by the smallest amount of inequalities so that the model is accurate and compact [14]. In order to characterise the propagation of bit-based division property more precisely, Hu and Wang presented a new model automatically searching for a variant division property using three subsets with STP solver in [15]. In [16], Wang et al. applied a MILP method to searching integral distinguishers based on division property using three subsets, and presented better results for several ciphers. Recently, Eskandari et al. [17] provided a framework to automatically find integral distinguishers, which solely requires a description of cryptographic primitive. When we use the MILP-aided division property to search the integral distinguishers, one of the pivotal steps is to set initial division property. To obtain an optimal integral distinguisher, many candidates of initial division properties need to be tested, so that the computations cannot afford in practice. In [13], the authors proposed the embedded property and used it to give an algorithm to restrict the search scope. However, the experimental complexity is still huge in many cases. Pyjamask [18] is one of the candidate ciphers for the Authenticated Encryption with Associated Data (henceforth AEAD) standard of the NIST (National Institute of Standards and Technology). It has the typical SPN (Substitution Permutation Network) structure, including Pyjamask-96 and Pyjamask-128. There is currently no open literature for its integral cryptanalysis. uBlock [19] was proposed by Wu et al. in 2019, and is the shortlisted block cipher for China's National Cipher Designing Competition. The cipher has two versions, uBlock-128 and uBlock-256, according to the block length. Utilising the conventional division property, the designer gave a 7-round integral distinguisher of uBlock-128 and an 8-round integral distinguisher of uBlock-256, with the data complexity of and , respectively. Our contribution: Although the method in [13] has greatly reduced the search space, the experimental complexity is still huge in many cases. In this paper, we take advantage of the division property propagation of S-box to improve the optimal integral distinguisher searching algorithm, and further reduce its time complexity. To prove the feasibility of the algorithm, we use it to evaluate the security of uBlock and Pyjamask under the integral attack with the partial sums technique [20]. For the uBlock, we find the 8-round integral distinguisher of uBlock-128 and the 9-round integral distinguisher of uBlock-256. For the Pyjamask, we present the 10-round integral distinguisher of Pyjamask-96 and the 9-round integral distinguisher of Pyjamask-128 for the first time. Finally, we perform the key-recovery attack on uBlock-128 and Pyjamask-96 by the found distinguishers. The data complexity is and , and the time complexity is less than times of 9-round uBlock-128 encryption and times of 11-round Pyjamask-96 encryption. The results given in this paper are the best integral attacks available of the two ciphers presently. It is worth mentioning that we can also use the distinguishers in our paper to perform key recovery attacks on Pyjamask-128 and uBlock-256, and can also get better results than exhaustion. Since the principles and methods of attacks are the same, they will not be repeated in this paper. 2 Preliminaries 2.1 Notations We use as the binary finite field and as the n degree extension of . For any , the ith element is expressed in , and the Hamming weight is calculated as . For any , the vectorial Hamming weight of a is defined as . For any and , we denote if for all i. Otherwise, . Then, let be the concatenation, and let be the number of elements. For any and , the bit product function is defined as For any and , the bit product function is defined as 2.2 Integral property and division property The integral cryptanalysis is a chosen-plaintext attack. The basic idea is to choose plaintexts with a specific form, in which some bits are fixed to constant values, and the remaining bits are traversed all values. The attacker encrypts the plaintext in several rounds to obtain the ciphertext. If the sum of all the values on some bits in the ciphertext is always zero, the attacker can use this information leakage to solve the key. Therefore, the integral distinguisher is also called the zero-sum distinguisher. In the input, the traversed bits are called active bits, denoted as , and the fixed bits are denoted as . In the output, the bit whose sum is always 0 is called the balanced bit, denoted as , and the remaining bits are called the unknown bit and is denoted as . The division property is more precise in characterising the integral property and can be used to construct an integral distinguisher. Definition 1.Division property : Let be a multiset whose elements take a value of . When the multiset has the division property , where denotes a set of m -dimensional vectors whose ith element takes a value between 0 and , it fulfils the following conditions [8]: Definition 2.Division trail : Let f be the round function of an iterated block cipher. Assume that the input multiset has division property , and the internal state after i rounds has division property . Thus we have the following chain of division property propagations [11]: Moreover, for any vector , there must exist a vector such that can propagate to by propagation rules. Furthermore, for , if can propagate to for all , we call an r -round division trail. The following proposition is the stopping rule in search of integral distinguishers based on division property. Proposition 1.Set without integral property [11]: Assume is a multiset satisfying division property , then does not have integral property if and only if contains all vectors with vectorial Hamming weight 1. Our paper mainly uses the following rules of division property: Rule 1.Substitution: Let F be a function that consists of m S-boxes, where the bit length and the algebraic degree of the ith S-box are and , respectively. The input and output take a value of , and and denote the input multiset and output multiset, respectively. Assuming that the multiset has the division property , the division property of the multiset is as Here, when the ith S-box is bijective and , the also [8]. Rule 2..Concatenation [6]: Let F be a concatenation function, where the input takes a value of and the output is calculated as . Let and be the input multiset and output multiset, respectively. Assuming that the multiset has the division property , the division property of the multiset is as Rule 3.Partition : Let F be a split function, where the input x takes a value of and the output is calculated as , where takes a value of . Let and be the input multiset and output multiset, respectively. Assuming that the multiset has the division property , the division property of the multiset is , where any in as [6]. More rules are detailed in [7]. 2.3 Pyjamask cipher The block cipher family Pyjamask is one of the candidate ciphers for the AEAD standard of the NIST, including Pyjamask-96 and Pyjamask-128. The parameters of the two instances are given in Table 1, where the Rows and Columns refer to the number of rows and columns of the internal state, respectively. Table 1. Parameters of Pyjamask block ciphers. All the sizes are in bits Instance State size Rows Columns Key size Rounds — n r k — Pyjamask-96 96 3 32 128 14 Pyjamask-128 128 4 32 128 14 The ciphers rely on a Substitution-Permutation Network (SPN) structure that transforms the initial plaintext to a ciphertext through several applications of a key-dependent round function. Each round key is derived from the secret key through an iterated key schedule algorithm. In detail, one round is composed of the following transformations (see also Fig. 1). Fig. 1Open in figure viewerPowerPoint Round function of Pyjamask-128 AddRoundKey. Bitwise addition of the first n bits of the key state into the internal state. For Pyjamask-128, the full key state is XORed to the internal state. For Pyjamask-96, the three first rows of the key state are XORed to the internal state. SubBytes. The same S-box is applied to each of the 32 columns of the internal state. For Pyjamask-96, the S-box is and for Pyjamask-128, the S-box is . MixRows. Each row of the internal state, with for Pyjamask-96 and for Pyjamask-128 is seen as a column vector and is replaced by . The matrices are constant circulant binary matrices defined below: 2.4 uBlock cipher uBlock cipher adopts the PX(Pshufb-Xor) structure, which is a refinement structure of SP structure. It has a 128- or 256-bit block size and a 128- or 256-bit key size, denoted as uBlock-128/128, uBlock-128/256 and uBlock-256/256. The rounds of the three versions are 16, 24 and 24, respectively. For convenience, uBlock-256/256 is abbreviated as uBlock-256, and uBlock-128/128 and uBlock-128/256 are collectively referred to as uBlock-128. The encrypt round function is shown in Fig. 2, where indicates the left circular shift by b bits in a 32-bit word. Fig. 2Open in figure viewerPowerPoint Round function of uBlock S-box Layer. The S-box layer consists of same 4-bit S-boxes. The S-box is as follows: and . Both of them are vector permutations of bytes. Details are shown in Table 2. For example, the expression of is Table 2. Vector permutations of uBlock 3 Optimal integral distinguisher search algorithm 3.1 Existing search algorithm Xiang et al. [11] provided an algorithm for searching the r -round integral distinguisher. For a certain cipher, given the number of rounds r and the input division property, the MILP model can be established to determine whether there is an r -round integral distinguisher, and in the case of existence, the division property of the r th round output can be solved. However, this method can only rely on exhaustive to determine the max number of rounds that the distinguisher can reach, and cannot determine the input division property with the least number of active bits, so it is not always possible to get the optimal distinguisher. A method for searching the optimal integral distinguisher is given in [13], which is composed of two algorithms. The first one restricts the search scope of initial division property and detects the number of rounds of the optimal distinguisher. The second one detects the concrete optimal distinguishers based on the first algorithm's output. The method is based on the embedded property. Proposition 2.Embedded property : Suppose that the input and the output take values from , and are two initial division properties with . If the output multiset under does not have integral property, then the output multiset under has no integral property [13]. Therefore, for a cipher with an n -bit block size, it is only necessary to successively select an initial division property with a weight of , which is denoted as , to detect whether the rth round output has a balance bit. If there is a balance bit in the rth round output, it means that there is an r -round integral distinguisher, and we continue to detect round; otherwise, the max number of rounds of the integral distinguisher is considered to be . When the maximum number of rounds is determined, the index i of the corresponding leading to the longest distinguisher is stored in a set . Then if any bit whose index belongs to is set to '0' in the initial division property, according to Proposition 2, the division property after -round propagation will have no integral property. In this way, the search scope of the initial division property is reduced. See [13] for the specific algorithm. This method can find the distinguisher with the longest rounds and the least plaintexts, and the complexity is much lower than the exhaustive one (the maximum is ). However, when is large, the time complexity is still not practical. 3.2 Improved search algorithm For the cipher of the SPN structure, utilising the division property propagation of S-box, the search algorithm can be improved to further reduce its complexity. In Section 2.2, the propagation rule of the word division property of the S-box is given. In practice, the substitution layers are generally composed of the same S-boxes. So, the above rule can be simplified to Rule 4. Rule 4.Substitution : Let F be a function that consists of m S-boxes, where the bit length and the algebraic degree of all S-boxes are l and d, respectively. The input and output take a value of , and and denote the input multiset and output multiset, respectively. Assuming that the multiset has the division property , the division property of the multiset is as Here, when the ith S-box is bijective and , the also [6]. For an S-box, let its input BDP is , and the output BDP is . Firstly, we study the word-based division property of the S-box (as shown in Fig. 3). According to the propagation rule of word-based division property It is obvious that, when , i.e. the output division vectors are unit vectors. Since the unit vectors will not change in weight during the subsequent propagation, they will inevitably result in at least one unit vector in the output division vectors. Therefore, it can be considered that the input division vectors of weights from 1 to d have an equivalent effect on the propagation of division property. As a result, when searching for the optimal integral distinguisher, it is not necessary to traverse each of the initial division vectors. For the input bits belonging to the same S-box, only the division vectors of weights need to be test. In the general cipher, the algebraic degree of the S-box usually reaches its maximum, i.e. . At this point, we only need to test the division vectors with weights of 0, 1, l. Fig. 3Open in figure viewerPowerPoint Word-based division property propagation of the S-box Besides, it is found in the experiment that when we set the weight of the input division vector of an S-box as either 0 or 1, and the rest are the same; there is generally no significant difference between the two outputs. Further, we approximate the division vectors of weights 0 and 1, i.e. only the two-division vectors of weights 0 and l are considered. Based on this, we improved Sun's method and presented a new optimal integral distinguisher search algorithm(Algorithm 1 (see Fig. 4)). It is applicable to all SPN structure ciphers with S-boxes of the highest algebraic degree. Fig. 4Open in figure viewerPowerPoint Algorithm 1: Detecting the optimal distinguisher We explain Algorithm 1 (Fig. 4) line-by-line: Lines 1-2: n is the block size of E, t is the number of S-boxes whose input division bits are 0. Lines 3–16: Detect the maximum number of 0 bits in the initial division vector that can generate a -round integral distinguisher. Lines 3–5: Gradually increase the number of 0 bits in the initial division vector. Lines 6–11: Set initial division vector according to the selected 0 bits. Lines 12–16: Check if there is a -round integral distinguisher. If it exists, continue to increase the number of 0 bits in the initial division vector, otherwise we conclude that the number of 0 bits is reach a maximum of . Lines 17–32: Detect the -round optimal integral distinguisher. Line 17: Select bits arbitrarily. Lines 18–24: Set initial division vector according to the selected 0 bits. Lines 25–32: Detect the balance bits in the -round output to get the -round optimal integral distinguisher. The time complexity of the algorithm is at most , and m is significantly less than , so the complexity is significantly lower than the method in [13]. Now we explain why our method yields better results. Through the method in [13], we can calculate the maximum number of rounds , which can be guaranteed to be the maximum number of rounds of distinguishers obtained using BDP. And we get an initial division vector that can generate a distinguisher of rounds. Of all the longest distinguishers, we always want to find the ones that require as few chosen plaintexts as possible. As we know, however, the fewer chosen plaintexts required(i.e. the fewer '1's in the initial division vector), the shorter the generated distinguisher length is likely to be. Previously, researchers could only use the exhaustive method to determine the number and positions of '1's in the initial division vector. Limited by computing power, it is impossible to exhaust all cases, and therefore the results obtained are most likely not optimal. As a result, if the scope of exhaustion can be narrowed down, there is a higher probability of finding the optimal result. In [13], Sun et al. proposed the embedded property to reduce the scope of exhaustion. In our paper, we further restrict the exhaustive cases to a relatively small range by using the division propagation characteristics of the S-box, so the probability that we find better results has increased significantly. Since we make some approximations and left out some of the cases in the search, there is still a possibility that the optimal result is not in our exhaustive scope. However, our approximations fit most practical situations, so this probability is quite small. And it turns out that our trade-off between computational complexity and accuracy is correct because our method did find the best distinguishers so far. And from the experimental results, in most cases, our results are the same as the optimal results with the existing method. In addition, our method does not take advantage of the characteristics of any specific cipher, but only requires the S-boxes of the cipher to reach the highest algebraic degree, and therefore applies to all eligible ciphers. 4 Integral cryptanalysis of Pyjamask 4.1 Integral distinguishers of Pyjamask The designers gave the 5- and 6-round differential distinguishers of Pyjamask-96 and Pyjamask-128 in the design report, but did not give the integral distinguisher. Using Algorithm 1 (Fig. 4) proposed in Section 3.2, we search the integral distinguishers of the Pyjamask family. There are integral distinguishers we obtain in Table 3. In fact, more integral distinguishers have been founded, while only some of them are listed here. Equivalent distinguishers and lower round distinguishers are of little significance and are not listed. Table 3. Integral distinguishers of the Pyjamask family Instance Rounds Integral distinguishers Data Complexity Pyjamask-96 8 9 10 Pyjamask-128 7 8 9 4.2 11-round integral attack of Pyjamask-96 With the 10-round integral distinguisher given in Section 4.1, we can perform an 11-round integral attack on Pyjamask-96. Fig. 5 shows the 11-round encryption diagram of Pyjamask-96. Fig. 5Open in figure viewerPowerPoint 11-round encryption of Pyjamask-96 Let is the output of the 10th round, is the output of the 11th round, is the round key of the 11th round. Let the 0, 32, 64 bits of inputs fixed, and the remaining bits are active, then all the bits in the 10th round output are balanced. After the SubBytes of the 11th round, all bits become unknown, and after the AddRoundKey of the 11th round, all bits are still unknown. The last transformation is Then the output of the 10th round is (1)where . Attack steps Step 1: Choose plaintexts, where 0th columns, i.e. 0, 32, 64 bits are fixed, and other bits traverse . After 11 rounds of encryption, ciphertexts are obtained. Step 2: Exhaust the 0th column of the 11th round key , i.e. , and calculate the 10th round outputs corresponding to ciphertexts according to step 1. Then calculate . Step 3: If is true, save the corresponding key as a candidate key, otherwise, eliminating it. Step 4: Repeat the above steps to obtain the candidate key of and verify the candidate key. The complexities Consider data complexity first. The probability that an error column key makes zero is , and the number of keys that can pass the above filtration in error keys is . Since the correct key must pass the filtration, the expectation of candidate keys of each column key is 2. The number of chosen plaintexts is , which means the data complexity is . And there are 32 columns of the key, so the memory complexity is bytes. The running time is mainly consumed in the first and second steps. The exhaustive number of each column key is , and the time complexity of calculating each are XORs and table lookups. One round of encryption includes 32 table lookups and more than 32 XORs. Therefore, the time complexity is less than times of 11-round encryption. The time complexity of exhaustive attack is , while the time complexity with our method is less than to attack 11-round Pyjamask-96. This is the best integral attack so far. 5 Integral cryptanalysis of uBlock 5.1 Integral distinguishers of uBlock The designers gave a 7-round integral distinguisher of uBlock-128 and an 8-round integral distinguisher of uBlock-256, with data complexities of and , respectively. Applying Algorithm 1 (Fig. 4) to uBlock, we present several better integral distinguishers, which is longer or need fewer chosen plaintexts. In Table 4, we present the best integral distinguishers of uBlock family so far, which is longer or needs fewer chosen plaintexts. Certainly, more integral distinguishers have been founded, while only some of them are listed here. Equivalent distinguishers and lower round distinguishers are of little significance and are not listed. Table 4. Integral distinguishers of the uBlock family Instance Rounds Integral distinguishers Data Complexity Reference uBlock-128 6 Section 5.1 7 [19] Section 5.1 8 Section 5.1 uBlock-256 8 [19] Section 5.1 9 Section 5.1 5.2 9-round integral attack of uBlock-128 Fig. 6 shows a 9-round encryption diagram of uBlock-128. Let is the input of the 9th round, is the output of the S-layer of the 9th round, is the round key of the 9th round, and is the output of the 9th round. Let the 0 3 bits of the input fixed, and the remaining bits are active. Then all the bits with indexes and in the 8th round output are balanced, and the remaining bits are unknown. After the 9th round encryption, all bits become unknown. Fig. 6Open in figure viewerPowerPoint 9-round encryption of uBlock-128 According to the inverse transformation of the linear transformation, can be expressed as a linear expression for and . Take as an example Attack steps Step 1: Choose plaintexts, where 0–3 bits are fixed, and other bits traverse . After nine rounds of encryption, ciphertexts are obtained. Step 2: Exhaust the XOR sum values of key bits contained in the 4-bit output of the first S-box, that is the values of : So that we can calculate the value of . Then according to , we can calculate . Step 3: If is true, save the corresponding values of , otherwise, eliminate them. Step 4: Repeat the second and third steps to obtain the values of . According to the expression of about and , we can construct 128 linear equations for all key bits. Solve the linear equations, get the values of all key bits and verify them. The complexities The number of chosen plaintexts is , which means the data complexity is . There are possibilities for each group of XOR sum values of key bits on average, and there are 32 groups of XOR sums of key bits. Therefore, the memory complexity is bytes. The running time is mainly consumed in the first and second steps. The exhaustive number of each group of XOR sum values of key bits is , and the time complexity of calculating every is . Therefore, the time complexity is less than times of 9-round encryption. Using the integral distinguisher given by the designer, we could only perform an 8-round key-recovery attack, with a high time complexity. Our integral distinguishers and method allow us to perform a 9-round key-recovery attack, with a time complexity of less than . 6 Conclusion In this paper, we use the division property propagation rule of S-box to improve the algorithm of searching for the optimal integral distinguisher in [13]. Under the premise of ensuring the max number of rounds, the time complexity of the algorithm is reduced. Whereafter, using this method to study the security of Pyjamask cipher and uBlock cipher under integral attack, the longest integral distinguishers of two ciphers are obtained: 10- and 9-round integral distinguishers for Pyjamask-96 and − 128, 8- and 9-round integral distinguishers for uBlock-128 and − 256. Finally, 11- and 9-round key-recovery attacks are performed on Pyjamask-96 and uBlock-128, respectively. For the attack of Pyjamask-96, the data complexity is and the time complexity is less than times of 11-round Pyjamask-96 encryption. For the attack of uBlock-128, the data complexity is and time complexity is less than times of 9-round uBlock-128 encryption. In the next step, we will try to theoretically prove the rationality of the improved algorithm, and study whether the ciphers with a Feistel structure have a similar rule. Besides, with SMT (Satisfiability Modulo Theories) [21] or division property using three subsets, longer distinguishers may be found, which is also worth trying. 7 References 1Daemen, J., Knudsen, L., Rijmen, V.: 'The block cipher square'. Proc. Int. Conf. FSE 1997, Haifa, Israel, January 1997, pp. 149– 165 2Knudsen, L., Wagner, D.: 'Integral cryptanalysis'. Proc. Int. Conf. FSE 2002, Leuven, Belgium, February 2002, pp. 112– 127 3Galice, S., Minier, M.: 'Improving integral attacks against rijndael-256 up to 9 rounds'. Proc. Int. Conf. AFRICACRYPT 2008, Casablanca, Morocco, June 2008, pp. 1– 15 4Li, P., Sun, B., Li, C.: 'Integral cryptanalysis of ARIA'. Proc. Int. Conf. ICISC 2010, Seoul, Korea, December 2010, pp. 1– 14 5Bogdanov, A., Knudsen, L., Leander, G. et al: 'PRESENT: an ultra-lightweight block cipher'. Proc. Int. Conf. CHES 2007, Vienna, Austria, September 2007, pp. 450– 466 6Todo, Y.: 'Structural evaluation by generalized integral property'. Proc. Int. Conf. EUROCRYPT 2015, Sofia, Bulgaria, April 2015, pp. 287– 314 7Todo, Y.: 'Integral cryptanalysis in full MISTY1'. Proc. Int. Conf. CRYPTO 2015, Santa Barbara, CA, USA, August 2015, pp. 158– 178 8Todo, Y., Morri, M.: 'Bit-based division property and application to simon family'. Proc. Int. Conf. FSE 2016, Bochum, Germany, March 2016, pp. 357– 377 9Beaulieu, R., Shors, D., Smith, J. et al: 'The SIMON and SPECK families of lightweight block ciphers'. Proc. Int. Conf. Design Automation Conf. 2015, San Francisco, CA, USA, June 2015, pp. 1– 6 10Boura, C., Canteaut, A.: 'Another view of the division property'. Proc. Int. Conf. CRYPTO 2016, Santa Barbara, CA, USA, August 2016, pp. 654– 682 11Xiang, Z., Zhang, W., Bao, Z. et al: 'Applying MILP method to searching integral distinguishers based on division property for 6 lightweight block ciphers'. Proc. Int. Conf. ASIACRYPT 2016, Hanoi, Vietnam, December 2016, pp. 648– 678 12Sun, L., Wang, W., Wang, M.: 'MILP-aided bit-based division property for primitives with non-bit-permutation linear layers', Cryptol. ePrint Archive, 2016, 811, pp. 1– 41 13Sun, L., Wang, W., Wang, M.: 'Automatic search of bit-based division property for ARX ciphers and word-based division property'. Proc. Int. Conf. ASIACRYPT 2017, Hong Kong, China, December 2017, pp. 128– 157 14Zhang, W., Rijmen, V.: 'Division cryptanalysis of block ciphers with a binary diffusion layer', IET Inf. Sec., 2018, 13, (2), pp. 87– 95 15Hu, K., Wang, M.: 'Automatic search for a variant of division property using three subsets'. Proc. Int. Conf. CT-RSA 2019, San Francisco, CA, USA, March 2019, pp. 412– 432 16Wang, S., Hu, B., Guan, J. et al: 'MILP method of searching integral distinguishers based on division property using three subsets', Cryptol. ePrint Archive, 2018, 1186, pp. 1– 30 17Eskandari, Z., Kidmose, A.B., Kölbl, S. et al: 'Finding integral distinguishers with ease'. Proc. Int. Conf. Selected Areas in Cryptography 2018, Pau, France, April 2018, pp. 115– 138 18 Pyjamask v1.0: https://csrc.nist.gov/CSRC/media/Projects/Lightweight-Cryptography/documents/round-1/spec-doc/Pyjamask-spec.pdf, accessed 26 November 2019 19 'Detailed design of the block cipher uBlock (in Chinese)',, http://sfjs.cacrnet.org.cn/site/content/387.html, accessed 26 November 2019 20Tunstall, M.: 'Improved 'partial sums'-based square attack on AES'. Proc. Int. Conf. SECRYPT 2012, Rome, Italy, July 2012, pp. 24– 27 21Moura, L., Bjørner, N.: 'Satisfiability modulo theories: an Appetizer', Lect. Notes Comput. Sci., 2009, 5902, pp. 23– 36 Volume14, Issue5September 2020Pages 572-579 FiguresReferencesRelatedInformation