# Zero-Correlation Linear Cryptanalysis on SPARX-64

Authors: Dawei Zhou; Huaifeng Chen; Rui Zong; Ningning Song
Journal: Journal of Sensors
 (2021)

---

## Abstract

SPARX is a family of ARX-based block ciphers designed according to the long-trail strategy, which has 32-bit ARX-based SBoxes and has provable bounds against single-differential and single-linear cryptanalysis. Since its proposation, some third-party cryptanalysis methods have been presented. As far as we know, the best attacks against SPARX-64 covered 16 (out of 24) rounds. In this paper, we propose zero-correlation linear attacks on SPARX-64. At first, we construct some new zero-correlation linear distinguishers covering 14-round and 15-round SPARX-64. Then, 15,16,17 and 18-round versions can be attacked using multidimensional or multiple zero-correlation linear attack models, under DKP(distinct known plaintexts) settings. These are the best attacks against SPARX-64 up to now, regarding to the number of attacked rounds. Finally, we transform the zero-correlation distinguishers into integral ones using existing methods, which are also longer than the ones proposed by the designers.


---

## Body

## 1. Introduction

SPARX [1], introduced by Dinu et al. at ASIACRYPT’16, is the first ARX based family of block ciphers with the aim of providing provable security against single-trail differential and linear cryptanalysis. To achieve this target, the designers developed the long trail strategy which is different from the well-studied wide trail strategy [2] used in the design of AES. The long trail strategy advocates the use of large and comparatively expensive SBoxes in conjunction with cheaper and weaker linear layers. All the instances of SPARX, (SPARX-64/128, SPARX-128/128 and SPARX-128/128) use three or four rounds of SPECK [3] with subkeys as the big SBox, which can be specified using three simple operations: addition modulo 216 (⊞), 16-bit rotations (≪<2 and ≫>7) and 16-bit Xor (⊕).There have been some cryptanalysis results on the family of SPARX. The designers gave the provable bounds on the probability of differential characteristic and the bias of linear trail. There is no differential or linear trail with significant probability for 5 (or more) steps. Also, they made integral attacks with the help of Todo’s division property [4]. For SPARX-64/128, the attack covers 15 rounds and recovers the key in time 2101 using 237 chosen plaintexts. Morever, the integral attacks cover 22-round SPARX-128/128 and 24-round SPARX-128/256. Then Abdelkhalek et al. [5] attacked 16-round SPARX64-128 using impossible differential attack, with the help of one 13-round distinguisher and the dependencies between the subkeys. Later, Tolba et al. [6] proposed multidimensional zero-correlation linear attacks on up to 25 rounds of SPARX-128/256 and 22 rounds of SPARX-128/128. Recently, Ankele and List [7] presented chosen-ciphertext differential attacks on 16-round SPARX-64/128. Previous attack results on SPARX-64/128 are compared in Table 1.Table 1
Attacks on SPARX-64/128.
#roundsAttack typesDataTimeRef.15Integral237CP2101.0[1]15Impossible differential251.0CP294.1[5]16Impossible differential261.5KP294.0[5]16Truncated differential232CC293[7]16Rectangle259.6CC2122[7]16Yoyo264CP2126[7]15Multidimensional zero-correlation258.6DKP2106Sect.4.116Multidimensional zero-correlation262.5DKP2101Sect.4.217Zero-correlation263.6DKP2127Sect.5.118Zero-correlation263.6DKP2127.2Sect.5.2∗ CP: Chosen Plaintext; KP: Known Plaintext; ∗ CC: Chosen Ciphertext; DKP: Distinct Known Plaintext. ∗ In KP settings, the samples are obtained randomly while in DKP settings there is a restriction that the plaintext-ciphertext samples are non-repeating.There is no zero-correlation cryptanalysis results on SPARX-64/128 from the literatures and we focus on this method in this paper. Zero-correlation [8] is one powerful tool in the cryptanalysis of block ciphers. Similar to that the impossible differential distinguisher uses a differential with probability zero, the zero-correlation distinguisher uses a linear hull with correlation zero. Then this technique develops a lot and some new models have been proposed, such as the multiple zero-correlation linear cryptanalysis [9], the multidimensional zero-correlation linear cryptanalysis [10] and some improved versions [11, 12]. In particular, Sun et al. [12] removed the approximation from the χ2-distribution to the normal distribution during the construction of multiple and multidimensional zero-correlation linear attack (MPZC and MDZC) models, which released the restriction on the number ‘ℓ’ of zero-correlation linear hulls, i.e., ‘ℓ’ sholud be large enough. The new models were called χ2-MPZC and χ2-MDZC.To improve the time complexity of linear attacks usingalgorithm 2, FFT technique was proposed in [13]. When the target bit for the linear distinguisher is a function of x⊕k where x,k are both n-bit values, the time can be improved from 22·n to 3·n·2n simple calculations.Our Contributions. We evaluate the security of SPARX-64/128 using the zero-correlation cryptanalysis in this paper:
(1)
We find some new zero-correlation distinguishers. By extending the existing simple zero-correlation distinguisher proposed in [6], we construct several multidimensional zero-correlation distinguishers covering 14-round SPARX-64. Morever, with careful selection of the input mask, we can extend some distinguishers by one more round and get three 15-round zero-correlation distinguishers. These are the longest zero-correlation linear distinguishers of SPARX-64 as we know(2)
Using the new zero-correlation distinguishers, we make zero-correlation linear attacks with the help of multiple/multidimensional zero-correlation linear cryptanalysis model in [12]. The multidimensional zero-correlation attack covers 15-round and 16-round using 14-round distinguishers. Then the zero-correlation attack with one single 15-round linear hull covers 17-round. What’s more, with the help of FFT technique, we also can attack 18-round SPARX-64. These are the best attacks from the view of number of rounds attacked(3)
Also, we transform the zero-correlation linear distinguishers into integral distinguishers. As a result, we can get some 14-round and 15-round integral distinguishers with balanced properties. The balanced property means that the numbers of each value in the output sets are equal for the integral distinguisher, while the zero-sum property means the Xor-sum is zeroOutline. First, we describe the target block cipher SPARX-64/128 and the zero-correlation linear attack models in Sect.2. In Sect.3, we show how to construct the 14-round and 15-round zero-correlation linear distinguishers for SPARX-64. Then we give the multidimensional zero-correlation and multiple zero-correlation linear cryptanalysis against SPARX in Sect.4 and 5. Sect.6 describes some new integral distinguishers and finally, Sect.7 concludes this paper.


## 2. Preliminaries

### 2.1. Notations

The following symbols and notations are used throughout this paper:(i)
⊞: addition modulo 216(ii)
⊕: bit-wise Xor(iii)
≪<: 16-bit rotation to the left(iv)
≫>: 16-bit rotation to the right(v)
‖: concatenation of two bit strings(vi)
xL: left half (16-bit) of the word x (32-bit).(vii)
xR: right half (16-bit) of the word x (32-bit).(viii)
SPECKEY-3R: three rounds of SPECKEY(ix)
K2i, K2i+1: the subkeys used in the left and, respectively, right SPECKEY-3R of the i-th step of SPARX-64. Each has three 32-bit words K∗,1,K∗,2,K∗,3, used in three rounds of SPECKEY-3R, respectively(x)
1bx(0bx,?bx): x-bit of ‘1’(‘0’,’?’).’?’ is one undetermined bit(xi)
xi: the i-th bit of bit string x. x0 is the least significant bit(xii)
xj~i: the concatenation of xj,xj−1,⋯,xi, j>i


### 2.2. Brief Description of SPARX-64/128

SPARX-64/128 is the lightest instance of the SPARX family. It operates on two 32-bit words and uses a 128-bit key. There are 8 steps and 3 rounds per step. A high level view of SPARX-64/128 and the general structure of a step is shown in Figure1. Both branches have non-linear operations SPECKEY-3R, which means three rounds of SPECKEY, involving three 32-bit subkeys. SPECKEY splits the state into two 16-bit branches and xor the left and right half key bits, i.e.,KLi,j and KRi,j, in each branch before the non-linear operations. The linear layer L operates 32-bit value as follows,
(1)Lx=xL⊕xL⊕xR≪<8xR⊕xL⊕xR≪<8.Figure 1
(a) The SPECKEY function; (b) The linear layerL; (c) SPECKEY-3R; (d) The i-th step of SPARX-64.
(a)
SPECKEY(b)
L(c)
SPECKEY-3R(d)
Thei-th step of SPARX-64In thei-th step of SPARX-64, six 32-bit subkeys K2i,1,K2i,2,K2i,3,K2i+1,1,K2i+1,2,K2i+1,3 are involved. In particular, K2i,1,K2i,2,K2i,3 are used in the left SPECKEY-3R and K2i+1,1,K2i+1,2,K2i+1,3 are used in the right SPECKEY-3R.The 128-bit permutation used in the key schedule is simple, which is shown in Algorithm1. For more details, please refer to [1].Algorithm 1: Key schedule of SPARX-64/128
Input:MK=k1,k2,k3,k4Output:SKi=SKi,1,SKi,2,SKi,3,i=0,1,⋯,16SK0=k1,k2,k3,r⟵0Fori⟵1to16dor=r+1k1=SPECKEYk1kL2=kL2⊞kL1kR2=kR2⊞kR1kR4=kR4⊞rk1,k2,k3,k4⟵k4,k1,k2,k3SKi=k1,k2,k3


### 2.3.χ2− Multiple/Multidimensional Zero-Correlation Cryptanalysis

We start this section with the introduction of MPZC and MDZC models. Suppose that there areN plaintext-ciphertext samples and ℓ zero-correlation linear approximations for an n-bit block cipher. For the i-th approximation, the adversary counts the samples which make the linear approximation hold and gets the corresponding counter Ti. Under the model of MPZC cryptanalysis, the adversary evaluates the following statistic:
(2)TMP=N∑i=1ℓ2TiN−12.For MDZC model, theℓ zero-correlation linear approximations form a linear space (considering the zero vector in) with dimension m and then ℓ=2m−1. For each plaintext-ciphertext sample, the adversary evaluates the m base linear approximation and obtains an m-bit value z. By iterating all N samples, the adversary would get a counter vector Vz with z=0,1,⋯,2m−1. The statistic used in MDZC is:
(3)TMD=∑z=02m−1Vz−N2−m2N2−m.To estimate the data complexity and success probability, researchers [14] considered two sampling models, i.e., KP and DKP. In KP settings, the samples are obtained randomly while in DKP settings there is a restriction that the plaintext-ciphertext samples are non-repeating. In [14], Blondeau and Nyberg proved TMP and TMD followed the same distribution when the same sampling method are applied. They gave the estimation method of data complexity under these two sampling models for MPZC and MDZC. Later, Sun et al. proposed the χ2-MPZC and MDZC, in which they use the χ2-distributions to model the statistics [12], instead of the normal distributions.Considering two types of errors:(i)
Type-1 error: made by wrongfully discarding the cipher (false negative) and suppose the probability is α0. This is related to the success probability PS and PS=1−α0(ii)
Type-2 error: made by wrongfully accepting a randomly chosen permutation as the cipher (false positive) and suppose the probability is α1. This is related to the time complexity TS of the exhaustive search phase and TS=2k·α1 where k is the length of the main keyThen theχ2-MPZC and MDZC evaluate the data complexity as follows.where χ1−α0l and χα1l are the respective quantiles of the χ2-distribution with l degrees of freedom evaluated on the points 1−α0 and α1.In the attacks, the threshold value to distinguisher the cipher and randomly chosen permutation is calculated as τ=χ1−α0l.Theorem 1.
in ([12])
Suppose that the linear approximations involved satisfy the hypotheses in [14]. The number NKP of KPs requires in a MPZC or MDZC linear attack is
(4)NKP≈2nχ1−α0l−χα1lχα1l,and the number NDKP of DKPs required in a MPZC or MDZC linear attack is
(5)NDKP≈2nχ1−α0l−χα1lχ1−α0l,


## 2.1. Notations

The following symbols and notations are used throughout this paper:(i)
⊞: addition modulo 216(ii)
⊕: bit-wise Xor(iii)
≪<: 16-bit rotation to the left(iv)
≫>: 16-bit rotation to the right(v)
‖: concatenation of two bit strings(vi)
xL: left half (16-bit) of the word x (32-bit).(vii)
xR: right half (16-bit) of the word x (32-bit).(viii)
SPECKEY-3R: three rounds of SPECKEY(ix)
K2i, K2i+1: the subkeys used in the left and, respectively, right SPECKEY-3R of the i-th step of SPARX-64. Each has three 32-bit words K∗,1,K∗,2,K∗,3, used in three rounds of SPECKEY-3R, respectively(x)
1bx(0bx,?bx): x-bit of ‘1’(‘0’,’?’).’?’ is one undetermined bit(xi)
xi: the i-th bit of bit string x. x0 is the least significant bit(xii)
xj~i: the concatenation of xj,xj−1,⋯,xi, j>i


## 2.2. Brief Description of SPARX-64/128

SPARX-64/128 is the lightest instance of the SPARX family. It operates on two 32-bit words and uses a 128-bit key. There are 8 steps and 3 rounds per step. A high level view of SPARX-64/128 and the general structure of a step is shown in Figure1. Both branches have non-linear operations SPECKEY-3R, which means three rounds of SPECKEY, involving three 32-bit subkeys. SPECKEY splits the state into two 16-bit branches and xor the left and right half key bits, i.e.,KLi,j and KRi,j, in each branch before the non-linear operations. The linear layer L operates 32-bit value as follows,
(1)Lx=xL⊕xL⊕xR≪<8xR⊕xL⊕xR≪<8.Figure 1
(a) The SPECKEY function; (b) The linear layerL; (c) SPECKEY-3R; (d) The i-th step of SPARX-64.
(a)
SPECKEY(b)
L(c)
SPECKEY-3R(d)
Thei-th step of SPARX-64In thei-th step of SPARX-64, six 32-bit subkeys K2i,1,K2i,2,K2i,3,K2i+1,1,K2i+1,2,K2i+1,3 are involved. In particular, K2i,1,K2i,2,K2i,3 are used in the left SPECKEY-3R and K2i+1,1,K2i+1,2,K2i+1,3 are used in the right SPECKEY-3R.The 128-bit permutation used in the key schedule is simple, which is shown in Algorithm1. For more details, please refer to [1].Algorithm 1: Key schedule of SPARX-64/128
Input:MK=k1,k2,k3,k4Output:SKi=SKi,1,SKi,2,SKi,3,i=0,1,⋯,16SK0=k1,k2,k3,r⟵0Fori⟵1to16dor=r+1k1=SPECKEYk1kL2=kL2⊞kL1kR2=kR2⊞kR1kR4=kR4⊞rk1,k2,k3,k4⟵k4,k1,k2,k3SKi=k1,k2,k3


## 2.3.χ2− Multiple/Multidimensional Zero-Correlation Cryptanalysis

We start this section with the introduction of MPZC and MDZC models. Suppose that there areN plaintext-ciphertext samples and ℓ zero-correlation linear approximations for an n-bit block cipher. For the i-th approximation, the adversary counts the samples which make the linear approximation hold and gets the corresponding counter Ti. Under the model of MPZC cryptanalysis, the adversary evaluates the following statistic:
(2)TMP=N∑i=1ℓ2TiN−12.For MDZC model, theℓ zero-correlation linear approximations form a linear space (considering the zero vector in) with dimension m and then ℓ=2m−1. For each plaintext-ciphertext sample, the adversary evaluates the m base linear approximation and obtains an m-bit value z. By iterating all N samples, the adversary would get a counter vector Vz with z=0,1,⋯,2m−1. The statistic used in MDZC is:
(3)TMD=∑z=02m−1Vz−N2−m2N2−m.To estimate the data complexity and success probability, researchers [14] considered two sampling models, i.e., KP and DKP. In KP settings, the samples are obtained randomly while in DKP settings there is a restriction that the plaintext-ciphertext samples are non-repeating. In [14], Blondeau and Nyberg proved TMP and TMD followed the same distribution when the same sampling method are applied. They gave the estimation method of data complexity under these two sampling models for MPZC and MDZC. Later, Sun et al. proposed the χ2-MPZC and MDZC, in which they use the χ2-distributions to model the statistics [12], instead of the normal distributions.Considering two types of errors:(i)
Type-1 error: made by wrongfully discarding the cipher (false negative) and suppose the probability is α0. This is related to the success probability PS and PS=1−α0(ii)
Type-2 error: made by wrongfully accepting a randomly chosen permutation as the cipher (false positive) and suppose the probability is α1. This is related to the time complexity TS of the exhaustive search phase and TS=2k·α1 where k is the length of the main keyThen theχ2-MPZC and MDZC evaluate the data complexity as follows.where χ1−α0l and χα1l are the respective quantiles of the χ2-distribution with l degrees of freedom evaluated on the points 1−α0 and α1.In the attacks, the threshold value to distinguisher the cipher and randomly chosen permutation is calculated as τ=χ1−α0l.Theorem 1.
in ([12])
Suppose that the linear approximations involved satisfy the hypotheses in [14]. The number NKP of KPs requires in a MPZC or MDZC linear attack is
(4)NKP≈2nχ1−α0l−χα1lχα1l,and the number NDKP of DKPs required in a MPZC or MDZC linear attack is
(5)NDKP≈2nχ1−α0l−χα1lχ1−α0l,


## 3. Zero-Correlation Linear Hulls of SPARX-64

The 12-round zero-correlation linear hull of SPARX-64 proposed in [6] is shown in Figure 2, which is α,0⟶0,β,α≠0,β≠0. α1,α2 are linear masks derived from the input mask α, while β1,β2 are linear masks derived from the output mask β. The contradiction appears in the second linear permutation L, where the corresponding input mask is zero while the output mask is non-zero value α2=β2 . This distinguisher is like the 5-round zero-correlation linear hull of Feistel structure [8] with bijected F functions, which only takes advantage of the properties of the structures. In the following subsections, we will study the detailed property of linear mask’s propogation in SPECKEY and construct longer zero-correlation linear hulls.Figure 2
12-Round Zero Correlation Linear Hull of SPARX64.Since there are only Xor (⊕), Modulo Addition (⊞), Branch (⊢) and Rotation (≪< or >≫), we review how the linear masks propogate through these operations. Let x,y,z be values and Γx,Γy,Γz be the corresponding masks. Suppose the position of the first bit ‘1’ from the MSB is MSB1x for x. Then the masks’ relations are shown in Table 2.Table 2
Linear Masks’ Relations among Some Simple Operations.
OperationValues’ relationMasks’ relation⊕z=x⊕yΓx=Γy=Γz⊢y=x,z=xΓx⊕Γy⊕Γz=0.≪<y=x≪<iΓy=Γx≪<i>≫y=x>≫iΓy=Γx>≫i⊞z=x⊞yMSB1Γx=MSB1Γy=MSB1ΓzOnly the Modulo Addition (’⊞’) is non-linear and the corresponding correlation may be not one. However, when Γx=Γy=Γz=0x0000 or Γx=Γy=Γz=0x0001, the correlation at’⊞’ is equal to 1.


### 3.1. Expand the Linear Hull with Input Maskα,0 Backward with Correlation One

In fact, by limiting the values ofα and β, we can expand the number of rounds of zero-correlation linear hull. The main idea is to make the input mask (or output mask) go back (or forward) one more round with correlation one. The only non-linear operation in one SPECK round is’⊞’, so we hope the corresponding input mask or output mask of’⊞’ is 0x0000 or 0x0001, which leads to linear approximations with correlation one.For the case of input maskα, we expect that Γ1,Γ2 be 0x0001 or 0x0000, where Γ1,Γ2 are the output masks of the ‘⊞’ in Figure 3. It’s easy to know that Γ2=αL⊕αR and Γ1=LTαL⊕LTαR where LT is the transform of the linear layer. So we can get the following four equations:
(6)1αL⊕αR=0x0000LTαL⊕LTαR=0x00002αL⊕αR=0x0000LTαL⊕LTαR=0x00013αL⊕αR=0x0001LTαL⊕LTαR=0x00004αL⊕αR=0x0001LTαL⊕LTαR=0x0001Figure 3
Expand the input mask (α, 0) by two more rounds. Red signals represent the variable names and the blue are the corresponding values.According toLTα=LTαL,LTαR=αL⊕αL⊕αR>≫8,αR⊕αL⊕αR>≫8, we know that only the first and forth equations have possible solutions.
(i)
Equation Equation (4). holds when αL=αR(ii)
Equation Equation (7) holds when αL=αR⊕0x0001We set the conditionαL=αR (See the left part of Figure 3) and then we can derive that the linear mask becomes
(7)Γ1in1,Γ2in1,Γ3in1,Γ4in1=0,αR>≫2,0,αR>≫2after one decrypted round. In a further step, there is Γ3=αR>≫2=Γ4. To expand one more round with correlation one, we hope the corresponding masks Γ3,Γ4 also be 0x0000 or 0x0001. Then we obtain the only non-zero solution αL=αR=0x0004. At last, we get the linear mask
(8)Γ1in0,Γ2in0,Γ3in0,Γ4in0=0x0080,0x4001,0x0080,0x4001.after two decrypted rounds.Similarly, when the condition isαL=αR⊕0x0001 (See right part of Figure 3), we can derive that
(9)Γ1in1,Γ2in1,Γ3in1,Γ4in1=0x0080,αR>≫2⊕0x0041,0,αR>≫2⊕0x0001Then there isΓ3=αR>≫2⊕0x00c1,Γ4=αR>≫2⊕0x0081. In this situation, there is no value of α satisfying Γ3,Γ4∈0x0000,0x0001 at the same time. This means that when αL=αR⊕0x0001, we can only expand the linear hull backward one more round and can not expand the linear hull two more rounds backward with correlation one.


### 3.2. Expand the Linear Hull with Output Mask0,β Forward with Correlation One

For the output linear mask0,β, we follow the similar method. See Figure 4. At first, we hope that the linear masks Γ5,Γ6 taking value 0x0000 or 0x0001. So we can list the following equations.
(10)1βL>≫7=0x0000LTβL>≫7=0x00002βL>≫7=0x0000LTβL>≫7=0x00013βL>≫7=0x0001LTβL>≫7=0x00004βL>≫7=0x0001LTβL>≫7=0x0001Figure 4
Expand the linear hull with output mask (0,β) by one more round. Red signals represent the variable names and the blue are the corresponding values.According toLTβ=LTβL,LTβR=βL⊕βL⊕βR>≫8,βR⊕βL⊕βR>≫8, we know that only the solutions are as follows.
(i)
Equation Equation (4). holds when βL=βR=0x0000(ii)
Equation Equation (5) holds when βL=0x0000,βR=0x8000(iii)
Equation Equation (7) holds when βL=0x0080,βR=0x8080(iv)
Equation Equation (8) holds when βL=0x0080,βR=0x0080Figure4 gives the detailed propogation of output linear mask 0,β when βL=0x0000,βR=0x8000 or βL=0x0080,βR=0x8080. The output mask after one more round is
(11)Γ1out0,Γ2out0,Γ3out0,Γ4out0=0x0002,0x0002,0x0207,0x0206,Γ1out0,Γ2out0,Γ3out0,Γ4out0=0x0207,0x0206,0x0002,0x0002,respectively. Otherwise, when βL=0x0080,βR=0x0080, there is
(12)Γ1out0,Γ2out0,Γ3out0,Γ4out0=0x0205,0x0204,0x0205,0x0204.We list the zero-correlation linear hulls in Table3. #R denotes the number of rounds of the distinguishers.Table 3
Zero Correlation Linear Hulls of SPARX.
#RInput mask(s)Rounds coveredOutput mask(s)12αL,αR,0,0SPECKEY−3R⏟4steps0,0,βL,βR140,γ,0,γ,0,γ,0,γ⊕0x0080,0x0040,0x0000,0x0000SPECKEY−1R,SPECKEY−3R⏟4steps,SPECKEY−1R0x0207,0x0206,0x0002,0x0002,0x0002,0x0002,0x0207,0x0206,0x0205,0x0204,0x0205,0x0204150x0080,0x4001,0x0080,0x4001SPECKEY−2R,SPECKEY−3R⏟4steps,SPECKEY−1R0x0207,0x0206,0x0002,0x0002,0x0002,0x0002,0x0207,0x0206,0x0205,0x0204,0x0205,0x0204γ: any 16-bit non-zero linear mask.


## 3.1. Expand the Linear Hull with Input Maskα,0 Backward with Correlation One

In fact, by limiting the values ofα and β, we can expand the number of rounds of zero-correlation linear hull. The main idea is to make the input mask (or output mask) go back (or forward) one more round with correlation one. The only non-linear operation in one SPECK round is’⊞’, so we hope the corresponding input mask or output mask of’⊞’ is 0x0000 or 0x0001, which leads to linear approximations with correlation one.For the case of input maskα, we expect that Γ1,Γ2 be 0x0001 or 0x0000, where Γ1,Γ2 are the output masks of the ‘⊞’ in Figure 3. It’s easy to know that Γ2=αL⊕αR and Γ1=LTαL⊕LTαR where LT is the transform of the linear layer. So we can get the following four equations:
(6)1αL⊕αR=0x0000LTαL⊕LTαR=0x00002αL⊕αR=0x0000LTαL⊕LTαR=0x00013αL⊕αR=0x0001LTαL⊕LTαR=0x00004αL⊕αR=0x0001LTαL⊕LTαR=0x0001Figure 3
Expand the input mask (α, 0) by two more rounds. Red signals represent the variable names and the blue are the corresponding values.According toLTα=LTαL,LTαR=αL⊕αL⊕αR>≫8,αR⊕αL⊕αR>≫8, we know that only the first and forth equations have possible solutions.
(i)
Equation Equation (4). holds when αL=αR(ii)
Equation Equation (7) holds when αL=αR⊕0x0001We set the conditionαL=αR (See the left part of Figure 3) and then we can derive that the linear mask becomes
(7)Γ1in1,Γ2in1,Γ3in1,Γ4in1=0,αR>≫2,0,αR>≫2after one decrypted round. In a further step, there is Γ3=αR>≫2=Γ4. To expand one more round with correlation one, we hope the corresponding masks Γ3,Γ4 also be 0x0000 or 0x0001. Then we obtain the only non-zero solution αL=αR=0x0004. At last, we get the linear mask
(8)Γ1in0,Γ2in0,Γ3in0,Γ4in0=0x0080,0x4001,0x0080,0x4001.after two decrypted rounds.Similarly, when the condition isαL=αR⊕0x0001 (See right part of Figure 3), we can derive that
(9)Γ1in1,Γ2in1,Γ3in1,Γ4in1=0x0080,αR>≫2⊕0x0041,0,αR>≫2⊕0x0001Then there isΓ3=αR>≫2⊕0x00c1,Γ4=αR>≫2⊕0x0081. In this situation, there is no value of α satisfying Γ3,Γ4∈0x0000,0x0001 at the same time. This means that when αL=αR⊕0x0001, we can only expand the linear hull backward one more round and can not expand the linear hull two more rounds backward with correlation one.


## 3.2. Expand the Linear Hull with Output Mask0,β Forward with Correlation One

For the output linear mask0,β, we follow the similar method. See Figure 4. At first, we hope that the linear masks Γ5,Γ6 taking value 0x0000 or 0x0001. So we can list the following equations.
(10)1βL>≫7=0x0000LTβL>≫7=0x00002βL>≫7=0x0000LTβL>≫7=0x00013βL>≫7=0x0001LTβL>≫7=0x00004βL>≫7=0x0001LTβL>≫7=0x0001Figure 4
Expand the linear hull with output mask (0,β) by one more round. Red signals represent the variable names and the blue are the corresponding values.According toLTβ=LTβL,LTβR=βL⊕βL⊕βR>≫8,βR⊕βL⊕βR>≫8, we know that only the solutions are as follows.
(i)
Equation Equation (4). holds when βL=βR=0x0000(ii)
Equation Equation (5) holds when βL=0x0000,βR=0x8000(iii)
Equation Equation (7) holds when βL=0x0080,βR=0x8080(iv)
Equation Equation (8) holds when βL=0x0080,βR=0x0080Figure4 gives the detailed propogation of output linear mask 0,β when βL=0x0000,βR=0x8000 or βL=0x0080,βR=0x8080. The output mask after one more round is
(11)Γ1out0,Γ2out0,Γ3out0,Γ4out0=0x0002,0x0002,0x0207,0x0206,Γ1out0,Γ2out0,Γ3out0,Γ4out0=0x0207,0x0206,0x0002,0x0002,respectively. Otherwise, when βL=0x0080,βR=0x0080, there is
(12)Γ1out0,Γ2out0,Γ3out0,Γ4out0=0x0205,0x0204,0x0205,0x0204.We list the zero-correlation linear hulls in Table3. #R denotes the number of rounds of the distinguishers.Table 3
Zero Correlation Linear Hulls of SPARX.
#RInput mask(s)Rounds coveredOutput mask(s)12αL,αR,0,0SPECKEY−3R⏟4steps0,0,βL,βR140,γ,0,γ,0,γ,0,γ⊕0x0080,0x0040,0x0000,0x0000SPECKEY−1R,SPECKEY−3R⏟4steps,SPECKEY−1R0x0207,0x0206,0x0002,0x0002,0x0002,0x0002,0x0207,0x0206,0x0205,0x0204,0x0205,0x0204150x0080,0x4001,0x0080,0x4001SPECKEY−2R,SPECKEY−3R⏟4steps,SPECKEY−1R0x0207,0x0206,0x0002,0x0002,0x0002,0x0002,0x0207,0x0206,0x0205,0x0204,0x0205,0x0204γ: any 16-bit non-zero linear mask.


## 4. Multidimensional Zero-Correlation Cryptanalysis of SPARX-64 Using 14-round Distinguishers

In this section, we give 15-round and 16-round multidimensional attacks with 14-round zero-correlation distinguishers in DKP sampling setting.


### 4.1. 15-Round Multidimensional Zero-Correlation Attack with One 14-round Distinguisher

Wu use one 14-round multidimensional zero-correlation distinguisher(13)0,γ,0,γ⟶0x0207,0x0206,0x0002,0x0002to mount the attack. By adding one round at the top, the attack would cover 15 rounds. The symbols Xi,Yi denote the corresponding states derived from the plaintexts or ciphertexts (See Figure 5). For enough plaintext-ciphertext samples, we need to guess the corresponding subkeys and get the numbers of all possible values of
(14)X1,1⊕X1,3,0x0207,0x0206,0x0002,0x0002·Y1.Figure 5
15-Round Multidimensional Zero Correlation Linear Cryptanalysis on SPARX64.Since the MSB ofX1,1, i.e.,X1,115, is linear with KL2i,215 and KR2i,215, in the attack there is no need guessing these two key bits. For simplicity, we can set them as 0. Similarly, we can also set KL2i+1,215 and KR2i+1,215 as constant values. So in the round before the distinguisher, the keys need to be guessed are k1=KL2i,214~0,KR2i,214~0 and k2=KL2i+1,214~0,KR2i+1,214~0. Since Y1 is linear with K2i+10,2 and K2i+11,2, no key bits need to be guessed in the backward rounds.Suppose the number of samples in the attack isN, the attack procedure is as follows.
(i)
Step 1. ForN values of X0,Y0, suppose K2i+10,2,K2i+11,2=0, then Y0=Y1. We can compute(15)tout=0x0207,0x0206,0x0002,0x0002·Y0.We getN values of X0,tout.
(ii)
Step 2. Guess30 valid bits of k1, encrypt X0,0,X0,1 by one round and we can get X1,1. Store the numbers of X1,1,X0,2,X0,3,tout.(iii)
Step 3. Guess30 valid bits of k2, encrypt X0,2,X0,3 by one round and we can get X1,3. Store the numbers of X1,1⊕X1,3,tout.(iv)
Step 4. For each guessed key, compute the statistic value used in the multidimensional zero-correlation attack,i.e.,(16)T=∑X1,1⊕X1,3,toutVX1,1⊕X1,3,tout−N·2−m2N·2−m,where m=17. When T is smaller than the threshhold value τ, the key is supposed to be a right key candidate and can then be checked using two plaintext-ciphertext pairs.By settingα0=2−2.7 and α1=2−23, we can compute that the data complexity N≈258.616 and threshold τ=131593. The first three steps need
(17)N·115+N·230+249·230+30·115·12≈2105encryptions. The last step needs 2128·α1=2105 times encryption. So the total time complexity is about 2106 encryptions.


### 4.2. 16-Round Multidimensional Zero-Correlation Attack with One 14-round Distinguisher

We can append one more round at the bottom to attack 16 rounds (See Figure6). To control the time complexity, we use part of the above distinguisher. In detail, we only consider the input mask with form γ=016−t∗t, which means the distinguisher has dimension t+1. So k1=KL2i,2t−2~0,KR2i,2t−2~0,KL2i+1,2t−2~0,KR2i+1,2t−2~0 need to be guessed.Figure 6
16-Round Multidimensional Zero Correlation Linear Cryptanalysis on SPARX64.For the ouput mask0x0207,0x0206,0x0002,0x0002, we expand it by one round. The mask pattern at Y0 would become 021?13,021?1102,031?12,031?1002b. Only the non-linear key bits need to be guessed for the last round, which means we only consider k2=KL2i+10,312~0,KR2i+10,312~2,k3=(KL2i+11,311~0,KL2i+11,311~2).The attack proceudere is as follows.(1)
ForN values of X0,Y0, compress Y0 by one round and get Yst1=Y0,013~0,Y0,113~2 and Yst2=Y0,212~0,Y0,312~2.(2)
Guess4t−4 bits of k1, encrypt X0 by one round and get X1,1⊕X1,3. Store the numbers of X1,1⊕X1,3,Yst1,Yst2.(3)
Guess24 valid bits of k2, decrypt Yst1 by one round and we can get β1=0x0207,0x0206·Y2,0,Y2,1. Store the numbers of X1,1⊕X1,3,β1,Yst2.(4)
Guess22 valid bits of k3, decrypt Yst2 by one round and we can get βout=β1⊕0x0002,0x0002·Y2,2,Y2,3. Store the numbers of X1,1⊕X1,3,βout.(5)
For each guessed key, compute the statistic value used in the multidimensional zero-correlation attack,i.e.,(18)T=∑X1,1⊕X1,3,βoutVX1,1⊕X1,3,βout−N·2−m2N·2−m,where m=t+1. When T is smaller than the threshhold value τ, the key is supposed to be a right key candidate and can then be checked using two plaintext-ciphertext pairs.By settingt=8, α0=2−2.7 and α1=2−28, we can compute that the data complexity N≈262.531 and threshold τ=543. The first four steps need
(19)N⋅116+N⋅24t−4⋅116+24t−4⋅254⋅224+231⋅224+22⋅116⋅12≈2100encryptions. The last step needs 2128·α1=2100 times encryption. So the total time complexity is about 2101 encryptions.


## 4.1. 15-Round Multidimensional Zero-Correlation Attack with One 14-round Distinguisher

Wu use one 14-round multidimensional zero-correlation distinguisher(13)0,γ,0,γ⟶0x0207,0x0206,0x0002,0x0002to mount the attack. By adding one round at the top, the attack would cover 15 rounds. The symbols Xi,Yi denote the corresponding states derived from the plaintexts or ciphertexts (See Figure 5). For enough plaintext-ciphertext samples, we need to guess the corresponding subkeys and get the numbers of all possible values of
(14)X1,1⊕X1,3,0x0207,0x0206,0x0002,0x0002·Y1.Figure 5
15-Round Multidimensional Zero Correlation Linear Cryptanalysis on SPARX64.Since the MSB ofX1,1, i.e.,X1,115, is linear with KL2i,215 and KR2i,215, in the attack there is no need guessing these two key bits. For simplicity, we can set them as 0. Similarly, we can also set KL2i+1,215 and KR2i+1,215 as constant values. So in the round before the distinguisher, the keys need to be guessed are k1=KL2i,214~0,KR2i,214~0 and k2=KL2i+1,214~0,KR2i+1,214~0. Since Y1 is linear with K2i+10,2 and K2i+11,2, no key bits need to be guessed in the backward rounds.Suppose the number of samples in the attack isN, the attack procedure is as follows.
(i)
Step 1. ForN values of X0,Y0, suppose K2i+10,2,K2i+11,2=0, then Y0=Y1. We can compute(15)tout=0x0207,0x0206,0x0002,0x0002·Y0.We getN values of X0,tout.
(ii)
Step 2. Guess30 valid bits of k1, encrypt X0,0,X0,1 by one round and we can get X1,1. Store the numbers of X1,1,X0,2,X0,3,tout.(iii)
Step 3. Guess30 valid bits of k2, encrypt X0,2,X0,3 by one round and we can get X1,3. Store the numbers of X1,1⊕X1,3,tout.(iv)
Step 4. For each guessed key, compute the statistic value used in the multidimensional zero-correlation attack,i.e.,(16)T=∑X1,1⊕X1,3,toutVX1,1⊕X1,3,tout−N·2−m2N·2−m,where m=17. When T is smaller than the threshhold value τ, the key is supposed to be a right key candidate and can then be checked using two plaintext-ciphertext pairs.By settingα0=2−2.7 and α1=2−23, we can compute that the data complexity N≈258.616 and threshold τ=131593. The first three steps need
(17)N·115+N·230+249·230+30·115·12≈2105encryptions. The last step needs 2128·α1=2105 times encryption. So the total time complexity is about 2106 encryptions.


## 4.2. 16-Round Multidimensional Zero-Correlation Attack with One 14-round Distinguisher

We can append one more round at the bottom to attack 16 rounds (See Figure6). To control the time complexity, we use part of the above distinguisher. In detail, we only consider the input mask with form γ=016−t∗t, which means the distinguisher has dimension t+1. So k1=KL2i,2t−2~0,KR2i,2t−2~0,KL2i+1,2t−2~0,KR2i+1,2t−2~0 need to be guessed.Figure 6
16-Round Multidimensional Zero Correlation Linear Cryptanalysis on SPARX64.For the ouput mask0x0207,0x0206,0x0002,0x0002, we expand it by one round. The mask pattern at Y0 would become 021?13,021?1102,031?12,031?1002b. Only the non-linear key bits need to be guessed for the last round, which means we only consider k2=KL2i+10,312~0,KR2i+10,312~2,k3=(KL2i+11,311~0,KL2i+11,311~2).The attack proceudere is as follows.(1)
ForN values of X0,Y0, compress Y0 by one round and get Yst1=Y0,013~0,Y0,113~2 and Yst2=Y0,212~0,Y0,312~2.(2)
Guess4t−4 bits of k1, encrypt X0 by one round and get X1,1⊕X1,3. Store the numbers of X1,1⊕X1,3,Yst1,Yst2.(3)
Guess24 valid bits of k2, decrypt Yst1 by one round and we can get β1=0x0207,0x0206·Y2,0,Y2,1. Store the numbers of X1,1⊕X1,3,β1,Yst2.(4)
Guess22 valid bits of k3, decrypt Yst2 by one round and we can get βout=β1⊕0x0002,0x0002·Y2,2,Y2,3. Store the numbers of X1,1⊕X1,3,βout.(5)
For each guessed key, compute the statistic value used in the multidimensional zero-correlation attack,i.e.,(18)T=∑X1,1⊕X1,3,βoutVX1,1⊕X1,3,βout−N·2−m2N·2−m,where m=t+1. When T is smaller than the threshhold value τ, the key is supposed to be a right key candidate and can then be checked using two plaintext-ciphertext pairs.By settingt=8, α0=2−2.7 and α1=2−28, we can compute that the data complexity N≈262.531 and threshold τ=543. The first four steps need
(19)N⋅116+N⋅24t−4⋅116+24t−4⋅254⋅224+231⋅224+22⋅116⋅12≈2100encryptions. The last step needs 2128·α1=2100 times encryption. So the total time complexity is about 2101 encryptions.


## 5. Zero-Correlation Cryptanalysis of SPARX-64 Using 15-round Distinguisher

In this section, we give 17-round and 18-round attacks with 15-round zero-correlation distinguisher in DKP sampling setting. Notice that there is only one single zero-correlation linear hull. However, we also can use the multiple zero-correlation linear attack model to estimate the data complexity, as shown in [12].


### 5.1. 17-Round Zero-Correlation Attack with One 15-round Distinguisher

We use the 15-round zero-correlation distinguisher(20)0x0080,0x4001,0x0080,0x4001⟶0x0207,0x0206,0x0002,0x0002to attack 17-round SPARX64/128.We add one round at the top and one round at the bottom to make the attack which is similar to the 16-round attack, except that the distinguisher here is 15-round (See Figure7). The key bits involved in this attack are k1=KL2i,115~7,4~0,KR2i,113~0,KL2i+1,115~7,4~0,KR2i+1,113~0 and k2=KL2i+10,312~0,KR2i+10,312~2,k3=KL2i+11,311~0,KL2i+11,311~2.Figure 7
17-Round Multidimensional Zero Correlation Linear Cryptanalysis on SPARX64.The attack procedure is as follows.(1)
ForN values of X0,Y0, compress Y0 by one round and get Yst1=Y0,013~0,Y0,113~2 and Yst2=Y0,212~0,Y0,312~2.(2)
Guess56 bits of k1, encrypt X0 by one round and get β0=0x0080,0x4001,0x0080,0x4001·X1. Calculate the numbers of Yst1,Yst2 according to the sign of β0 (+1 if β0=0, −1 if β0=1).(3)
Guess24 valid bits of k2, decrypt Yst1 by one round and we can get β1=0x0207,0x0206·Y2,0,Y2,1. Calculate the numbers of Yst2 according to the sign of β1(4)
Guess22 valid bits of k3, decrypt Y′st2 by one round and we can get β2=0x0002,0x0002·Y2,2,Y2,3. Calculate the final counter C according to the sign of β2(5)
For each guessed key, compute the statistic value used in the multiple zero-correlation attack,i.e.,(21)T=NCN2.WhenT is smaller than the threshhold value τ, the key is supposed to be a right key candidate and can then be checked using two plaintext-ciphertext pairs.By settingα0=2−2.7 and α1=2−1, we can compute that the data complexity N≈263.634 and threshold τ=2. The first four steps need
(22)N·117+N·256·117+256·246·224+222·224+22·117·12≈2121.15encryptions. The last step needs 2128·α1=2127 times encryption. So the total time complexity is T≈2127 encryptions.


### 5.2. 18-Round Zero-Correlation Attack with One 15-round Distinguisher

By adding one more round before the 17-round attack, we can extend the attack to 18 rounds. The key bits involved in the first round areK2i−2,3 and K2i−1,3. According to the key schedule, we know that
(23)K2i−2,3=K2i,1,K2i−1,3=K2i+1,1.LetP,Y0 be the plaintext-ciphertext pair. The attack proceudere is as follows.
(1)
ForN values of P,Y0, guess 64 bits of K2i−2,3, K2i−1,3 and encrypt P by two rounds and get(24)β0=0x0080,0x4001,0x0080,0x4001·X1⊕Y0,013⊕Y0,113⊕Y0,212⊕Y0,312.Calculate the numbers ofY′ according to the value of β0 (+1 if β0=0, −1 if β0=1), where
(25)Y′=Y0,012~0,Y0,112~2,Y0,211~0,Y0,311~2.(2)
It’s clear that the target bit,i.e., is a function of Y′⊕k, where k=KL2i+10,312~0,KR2i+10,312~2,KL2i+11,311~0,KL2i+11,311~2. So the target counter C can be computed using FFT techniques for all possible keys(3)
For each guessed key, compute the statistic value used in the multiple zero-correlation attack,i.e.,(26)T=NCN2.WhenT is smaller than the threshhold value τ, the key is supposed to be a right key candidate and can then be checked using two plaintext-ciphertext pairs.By settingα0=2−2.7 and α1=2−1, we can compute that the data complexity N≈263.634 and threshold τ=2. The first step needs N·264·2/18=2124.464 encryptions. The second step needs 264·3·46·246=2117.109 simple calculations. The last step needs 2128·α1=2127 times encryption. So the total time complexity is T≈2127.2 encryptions.


## 5.1. 17-Round Zero-Correlation Attack with One 15-round Distinguisher

We use the 15-round zero-correlation distinguisher(20)0x0080,0x4001,0x0080,0x4001⟶0x0207,0x0206,0x0002,0x0002to attack 17-round SPARX64/128.We add one round at the top and one round at the bottom to make the attack which is similar to the 16-round attack, except that the distinguisher here is 15-round (See Figure7). The key bits involved in this attack are k1=KL2i,115~7,4~0,KR2i,113~0,KL2i+1,115~7,4~0,KR2i+1,113~0 and k2=KL2i+10,312~0,KR2i+10,312~2,k3=KL2i+11,311~0,KL2i+11,311~2.Figure 7
17-Round Multidimensional Zero Correlation Linear Cryptanalysis on SPARX64.The attack procedure is as follows.(1)
ForN values of X0,Y0, compress Y0 by one round and get Yst1=Y0,013~0,Y0,113~2 and Yst2=Y0,212~0,Y0,312~2.(2)
Guess56 bits of k1, encrypt X0 by one round and get β0=0x0080,0x4001,0x0080,0x4001·X1. Calculate the numbers of Yst1,Yst2 according to the sign of β0 (+1 if β0=0, −1 if β0=1).(3)
Guess24 valid bits of k2, decrypt Yst1 by one round and we can get β1=0x0207,0x0206·Y2,0,Y2,1. Calculate the numbers of Yst2 according to the sign of β1(4)
Guess22 valid bits of k3, decrypt Y′st2 by one round and we can get β2=0x0002,0x0002·Y2,2,Y2,3. Calculate the final counter C according to the sign of β2(5)
For each guessed key, compute the statistic value used in the multiple zero-correlation attack,i.e.,(21)T=NCN2.WhenT is smaller than the threshhold value τ, the key is supposed to be a right key candidate and can then be checked using two plaintext-ciphertext pairs.By settingα0=2−2.7 and α1=2−1, we can compute that the data complexity N≈263.634 and threshold τ=2. The first four steps need
(22)N·117+N·256·117+256·246·224+222·224+22·117·12≈2121.15encryptions. The last step needs 2128·α1=2127 times encryption. So the total time complexity is T≈2127 encryptions.


## 5.2. 18-Round Zero-Correlation Attack with One 15-round Distinguisher

By adding one more round before the 17-round attack, we can extend the attack to 18 rounds. The key bits involved in the first round areK2i−2,3 and K2i−1,3. According to the key schedule, we know that
(23)K2i−2,3=K2i,1,K2i−1,3=K2i+1,1.LetP,Y0 be the plaintext-ciphertext pair. The attack proceudere is as follows.
(1)
ForN values of P,Y0, guess 64 bits of K2i−2,3, K2i−1,3 and encrypt P by two rounds and get(24)β0=0x0080,0x4001,0x0080,0x4001·X1⊕Y0,013⊕Y0,113⊕Y0,212⊕Y0,312.Calculate the numbers ofY′ according to the value of β0 (+1 if β0=0, −1 if β0=1), where
(25)Y′=Y0,012~0,Y0,112~2,Y0,211~0,Y0,311~2.(2)
It’s clear that the target bit,i.e., is a function of Y′⊕k, where k=KL2i+10,312~0,KR2i+10,312~2,KL2i+11,311~0,KL2i+11,311~2. So the target counter C can be computed using FFT techniques for all possible keys(3)
For each guessed key, compute the statistic value used in the multiple zero-correlation attack,i.e.,(26)T=NCN2.WhenT is smaller than the threshhold value τ, the key is supposed to be a right key candidate and can then be checked using two plaintext-ciphertext pairs.By settingα0=2−2.7 and α1=2−1, we can compute that the data complexity N≈263.634 and threshold τ=2. The first step needs N·264·2/18=2124.464 encryptions. The second step needs 264·3·46·246=2117.109 simple calculations. The last step needs 2128·α1=2127 times encryption. So the total time complexity is T≈2127.2 encryptions.


## 6. Integral Distinguishers on SPARX

Zero-correlation linear distinguishers can be transformed into integral distinguishers according to the known results in [10, 15]. Theorem 6 describes the result given in [15].Theorem 2.
(Corollary 4, [15])
LetF:F2n⟶F2n be a function on F2n, and let A be a subspace of F2n and b∈F2n\0. Suppose that A⟶b is a zero correlation linear hull of F, then for any λ∈F2n, b·Fx⊕λ is balanced on A⊥.As a result, we can transform the linear hulls in Table3 to some integral distinguishers. Partial integral distinguisher are geven in Table 4.Table 4
Integral Distinguishers of SPARX.
#RInput sets(x0,x1,x2,x3∈S)Rounds covered(f)Active bit(s)(y0,y1,y2,y3∈fS)12C0,C1,A0,A1SPECKEY−3R⏟4steps∗,∗,A3,A414A0,A1,A2,A1⊕CSPEKEY−1R,SPECKEY−3R⏟4steps,SPECKEY−1R0x0207·y0⊕0x0206·y1⊕0x0002·y2⊕0x0002·y3150x0080·x0⊕0x4001·x1⊕0x0080·x2⊕0x4001·x3=‘0’(or =‘1’)SPECKEY−2R,SPECKEY−3R⏟4steps,SPECKEY−1R0x0207·y0⊕0x0206·y1⊕0x0002·y2⊕0x0002·y3Suppose the state of SPARX64/128 is represented asx0,x1,2,x3 where xi is a 16-bit word. The 12-round integral distinguisher means if we set the value at x0 and x1 to consts and let the value at x2,x3 take all possible values, the values at x2,x3 after 4 steps (minus the last linear layer) will take all possible values. This is the same with that proposed in [1].The 14-round distinguisher means that when letting the values atx0,x1,x2 take all possible values and setting x3=x1, after one SPECKEY round, four full steps and one SPECKEY round, the one bit result of 0x0207·y0⊕0x0206·y1⊕0x0002·y2⊕0x0002·y3 will be active, where y0,y1,y2,y3 means the value after 14-round encryption. We can expand this distinguisher one more round forward with probability 1 to get one 15-round distinguisher. The input set has 263 elements x0,x1,x2,x3 which satisfy 0x0080·x0⊕0x4001·x1⊕0x0080·x2⊕0x4001·x3=‘0’ (or = ‘1’).


## 7. Conclusion

We have given zero-correlation cryptanalysis results against SPARX-64/128 in this paper. 14 and 15-round zero-correlation linear distinguishers have been proposed, which are the longest distinguishers as far as we know. Then, with the help ofχ2-MTZD and MPZC models, we have given 15, 16, 17 and 18-round key recovery attacks of SPARX-64/128 with post-whitening key. Our attacks cover the most rounds, while the existing attack on SPARX-64/128 covers 16 rounds. Also, we have transformed the new zero-correlation linear distinguishers into integral distinguishers. The longest one is 15-round, which is three rounds longer than the existing 12-round zero-correlation distinguisher.



---

*Source: 2193543-2021-12-27.xml*