# Differential Cryptanalysis on Block Cipher Skinny with MILP Program

Authors: Pei Zhang; Wenying Zhang
Journal: Security and Communication Networks
 (2018)

---

## Abstract

With the widespread use of RFID technology and the rapid development of Internet of Things, the research of lightweight block cipher has become one of the hot issues in cryptography research. In recent years, lightweight block ciphers have emerged and are widely used, and their security is also crucial. Skinny-64/192 can be used to protect data security such as the applications of wireless multimedia and wireless sensor networks. In this paper, we use the new method to verify the security of Skinny-64/192. The method is called mixed-integer linear programming (MILP) which can characterize precisely the linear operation and nonlinear operation in a round function. By applying MILP program, we can automatically find a 11-round differential characteristic for Skinny-64/192 with the minimum number of active s-boxes. The probability of differential trail is2-147, that is, far greater than 2-192 which is the probability of success for an exhaustive search. In addition, comparing this method with the one proposed by Sun et al., we also have a great improvement; that is, no new variables will be added in ShiftRows operation. It can reduce greatly the number of variables and improve the running speed of the computer. Besides, the experimental result proves that Skinny-64/192 is safe on 11-round differential analysis and validates the effectiveness of the MILP method.


---

## Body

## 1. Introduction

Nowadays, with the development of big data and artificial intelligence technology, data security problem becomes increasingly serious. The problem of data security exists in the whole life cycle of data, from data collection and transfer to data usage, with the focus on data confidentiality [1, 2], integrity, and availability. Due to the continuous occurrence and intensification of data leakage events on the Internet, the confidentiality of data is particularly important. The confidentiality of data, on the one hand, is the direct protection of data and, on the other hand, is providing further privacy protection on the basis of leaks. From a technical point of view, to ensure the confidentiality of data without hindering the availability of data, the general approach is to encrypt the data by encryption algorithms.The traditional encryption algorithms are DES [3] and AES [4]; they are widely used in the field of hardware and software. The hardware applications include data security in radio frequency IC card and encryption of hard disk data. And the software applications include voice, video information encryption, and database data encryption. The most classic applications are security applications on wireless network: one is the IEEE 803.11 protocol for WLAN and the IEEE 803.16 protocol for WMAN, and the other is the ZigBee protocol. The application of these encryption algorithms ensures the security of data effectively.At present, the traditional cryptographic algorithm for encrypting wireless multimedia data faces a lot of challenges, such as fast resource consumption, high implementation cost, and other disadvantages. In this context, lightweight block cipher emerged. Compared with traditional cryptographic algorithms, lightweight block ciphers run faster and have lower resource consumption and implementation costs while ensuring data security. They are more suitable for radio frequency identification (RFID) tags, wireless sensor network (WSN) [5], wireless multimedia, and other micro devices. In recent years, many lightweight block ciphers have been proposed, such as PRESENT [6], PRINCE [7], Midori [8], and Skinny [9, 10], many of which have been defined as ISO standards and widely used in various fields.Skinny is a family of tweakable lightweight block ciphers proposed by Beierle et al. at CRYPTO in 2016. It is a Substitution Permutation Network (SPN) [11, 12] structure. It supports two block lengths n=64 or 128 bits and for each of them, the tweakey t can be either n, 2n, or 3n. Skinny has been analyzed by many methods since it was proposed, such as impossible differential cryptanalysis [10] and related-key impossible differential attack [13].Differential cryptanalysis [3, 13, 14] was firstly introduced by Biham and Shamir to analyze DES block cipher in 1990. Differential analysis is one of the most effective attack methods in block ciphers. Differential analysis is a selective plaintext attack, and its basic idea is to study the probability of differential propagation of specific plaintext differential values in the encryption process. We separate the block cipher from the permutation area and then carry out the key recovery attack on this basis. In other words, we find a high probability differential trail. Finally, by adding several rounds before and after the differential characteristic, guessing Round-keys used in these rounds, encrypting plaintexts, and decrypting ciphertexts, we can determine the right key of block cipher.Mixed-integer linear programming (MILP) [14, 15] is a mathematical optimization or feasibility scheme, where some or all variables are limited to integers. In many cases, the term refers to an integer linear program (ILP), which is linear in terms of objective function and constraint except for the integer constraint. MILP is frequently used in business and economics to solve problems of optimization.In [14], Mouha et al. proposed an automatic search method based on MILP. However, the drawback of this method is that the proposed constraint cannot describe the trail of the differential propagation of the linear diffusion layer. Besides, Sun et al. [15] perfected the MILP method, then combined the MILP method and differential analysis into PRESENT, and finally obtained satisfactory experimental results. In this paper, we apply the new MILP method to obtain a lower bound on the number of active s-boxes for differential cryptanalysis. Then, we use the maximum differential probability of the s-boxes to derive an upper bound for the probability of the best characteristic.The Organizational of the Paper.The paper is organized as follows: In Section 2, we introduce some basic properties and definitions and describe how to construct a MILP program by constraints to get the minimum number of active s-boxes and the corresponding trail of differential propagation. In Section 3, the MILP program is constructed to search the differential trail of Skinny-64/192. Through specific instances, the optimal solution of the minimum number of active s-boxes is obtained for 11-round differential characteristic of Skinny-64/192. We conclude the paper and look forward to the future work in Section 4. The auxiliary materials are given in Appendix.Our Contributions.In this paper, we apply a method proposed recently for obtaining a high probability of differential characteristic in Skinny-64/192 called MILP method, which is used to search the minimum number of active s-boxes automatically. Its minimum number of active s-boxes is 54 of 11-round differential characteristic. The number of active s-boxes is one of the commonly used methods for evaluating the security of symmetric key encryption schemes against differential attack. As far as we know, this is the first time to combine differential analysis with MILP method to be applied to Skinny-64/192.MILP can characterize accurately the linear operation and nonlinear operation in the round function. Then a high probability of 11-round differential characteristic is automatically searched. The probability of differential trail is2-147, that is, far greater than 2-192 which is the probability of success for an exhaustive search. This experimental result proves that 11-round differential analysis of Skinny-64/192 is safe, which can provide a safe reference for data encryption on wireless devices. At the same time, we also verified the effectiveness of MILP method through this experiment. In addition, we also have an improvement on MILP program; that is, no new variables can be added in ShiftRows operation, which can reduce the number of total variables greatly and improve the running speed of the computer.


## 2. The Minimum Number of Active S-Boxes for Differential Cryptanalysis

In this section, we will describe how to construct the MILP program to calculate the number of active s-boxes for differential analysis. This requires an accurate description of the nonlinear layers and linear layers in order to ensure the number of active s-boxes is minimum. In general, if a large number of active s-boxes exist, which indicates that the differential diffusion is fast, this suggests that the cryptographic algorithm is not vulnerable to attacks and has a high security. The core theorem for constructing the MILP program will be described in detail in the following.


### 2.1. Differential Cryptanalysis

Definition 1.
For every input bit-level difference, a 0-1 variablexi is introduced such that xi=1 if and only if the difference at this bit is nonzero, as(1)xi=0,the  differences  do  not  exist,1,otherwise.


### 2.2. Constraints for Nonlinear and Linear Operation

Generally, the SPN-structured encryption algorithm consists of s-box, XOR, ShiftRows, and MixColumn operations. In this subsection, we describe these four basic operations by constraints. Based on this, we can construct an r-round inequality model for a specific encryption algorithm. This model can describe the trail of differential propagation accurately. Then by selecting the appropriate objective function, we can convert this model into a MILP program, using this MILP program to search automatically for the objective function.Constraints Describing the S-Box Operation [15].Suppose (xi0,…,xiw-1) and yj0,…,yjv-1 are the input and output bit-level differences of a w×v s-box marked by St. Firstly, to ensure that St=1 holds if and only if (xi0,…,xiw-1) are not all zero, we require the following.(2)St–xik≥0,k∈0,…,w-1xi0+xi1+⋯+xiw-St≥0For bijective s-boxes, nonzero input difference must result in nonzero output difference and vice versa.(3)wyj0+wyj1+⋯+wyjv-1-xi0+xi1+⋯+xiw-1≥0vxj0+vxj1+⋯+vxjw-1-yi0+yi1+⋯+yiv-1≥0Constraints Describing the XOR Operation.The bit-wise input difference is (xi,xi+1) and the corresponding bit-wise output difference is y for the XOR operation. The following linear constraints describe the relation between the input and output difference.(4)xi+xi+1-y≥0xi-xi+1+y≥0-xi+xi+1+y≥0xi+xi+1+y≤2Constraints Describing the ShiftRows or ShuffleCell Operation.For every ShuffleCell operation, its input difference (y0,y1,…,yi-1,yi) and output difference (z0,z1,…,zi-1,zi) are based on bit. If (z0=y2,z1=yi,…,zi-1=y0,zi=y1), the constraints include the following.(5)z0-y2=0z1-yi=0⋮zi-1-y0=0zi-y1=0Constraints Describing the MixColumn Operation.Let (z0,z1,…,zj-1,zj) and (x0,x1,…,xj-1,xj) be the input and output bit-wise differences for the MixColumn operation. Suppose xi=zj-2+zj-1+zj; it is essential to set an intermediate variable u and let u=zj-2+zj-1 to get xi=u+zj, so the constraints can be described as follows.(6)zj-2+zj-1-u≥0zj-2-zj-1+u≥0-zj-2+zj-1+u≥0zj-2+zj-1+u≤2u+zj-x0≥0u-zj+x0≥0-u+zj+x0≥0u+zj+x0≤2Definition 2 (the objective function [16]).
Some notations for differential are used in the model; e.g.,Sj denotes the activity of an s-box and the objective function is as follows.(7)min∑jSjs.t.Sj=0,thesboxisnotactive,1,othersise.The smaller the number of active s-boxes is, the slower the differential diffusion is. This illustrates that the encryption algorithm will be attacked in more rounds, and this will threaten its security.


## 2.1. Differential Cryptanalysis

Definition 1.
For every input bit-level difference, a 0-1 variablexi is introduced such that xi=1 if and only if the difference at this bit is nonzero, as(1)xi=0,the  differences  do  not  exist,1,otherwise.


## 2.2. Constraints for Nonlinear and Linear Operation

Generally, the SPN-structured encryption algorithm consists of s-box, XOR, ShiftRows, and MixColumn operations. In this subsection, we describe these four basic operations by constraints. Based on this, we can construct an r-round inequality model for a specific encryption algorithm. This model can describe the trail of differential propagation accurately. Then by selecting the appropriate objective function, we can convert this model into a MILP program, using this MILP program to search automatically for the objective function.Constraints Describing the S-Box Operation [15].Suppose (xi0,…,xiw-1) and yj0,…,yjv-1 are the input and output bit-level differences of a w×v s-box marked by St. Firstly, to ensure that St=1 holds if and only if (xi0,…,xiw-1) are not all zero, we require the following.(2)St–xik≥0,k∈0,…,w-1xi0+xi1+⋯+xiw-St≥0For bijective s-boxes, nonzero input difference must result in nonzero output difference and vice versa.(3)wyj0+wyj1+⋯+wyjv-1-xi0+xi1+⋯+xiw-1≥0vxj0+vxj1+⋯+vxjw-1-yi0+yi1+⋯+yiv-1≥0Constraints Describing the XOR Operation.The bit-wise input difference is (xi,xi+1) and the corresponding bit-wise output difference is y for the XOR operation. The following linear constraints describe the relation between the input and output difference.(4)xi+xi+1-y≥0xi-xi+1+y≥0-xi+xi+1+y≥0xi+xi+1+y≤2Constraints Describing the ShiftRows or ShuffleCell Operation.For every ShuffleCell operation, its input difference (y0,y1,…,yi-1,yi) and output difference (z0,z1,…,zi-1,zi) are based on bit. If (z0=y2,z1=yi,…,zi-1=y0,zi=y1), the constraints include the following.(5)z0-y2=0z1-yi=0⋮zi-1-y0=0zi-y1=0Constraints Describing the MixColumn Operation.Let (z0,z1,…,zj-1,zj) and (x0,x1,…,xj-1,xj) be the input and output bit-wise differences for the MixColumn operation. Suppose xi=zj-2+zj-1+zj; it is essential to set an intermediate variable u and let u=zj-2+zj-1 to get xi=u+zj, so the constraints can be described as follows.(6)zj-2+zj-1-u≥0zj-2-zj-1+u≥0-zj-2+zj-1+u≥0zj-2+zj-1+u≤2u+zj-x0≥0u-zj+x0≥0-u+zj+x0≥0u+zj+x0≤2Definition 2 (the objective function [16]).
Some notations for differential are used in the model; e.g.,Sj denotes the activity of an s-box and the objective function is as follows.(7)min∑jSjs.t.Sj=0,thesboxisnotactive,1,othersise.The smaller the number of active s-boxes is, the slower the differential diffusion is. This illustrates that the encryption algorithm will be attacked in more rounds, and this will threaten its security.


## 3. Constructing the MILP Program to Calculate the Minimum Number of Active S-Boxes of Skinny-64/192

It is well known that the security of an encryption algorithm must be evaluated before being put into use. In this section, we use the newly proposed MILP method to evaluate the security of Skinny-64/192 on differential analysis. This is the first time to combine differential analysis with MILP method to be applied to Skinny-64/192; the method is called MILP program. The MILP program can automatically obtain the minimum number of active s-boxes on the 11-round differential analysis. And MILP program consists of inequalities which can describe precisely the linear and nonlinear operation.


### 3.1. Description of Skinny-64/192

Skinny is a family of tweakable lightweight block ciphers proposed by Beierle et al. at CRYPTO in 2016. The specifications for Skinny was given in [9]. Skinny-64/192 provides 64-bit block length and 192-bit key length. We now give a short description of Skinny-64/192. Skinny-64/192 uses the SPN structure with Midori-64-like state. The state is arranged in a 4 × 4 matrix.(8)P=p0p1p2p3p4p5p6p7p8p9p10p11p12p13p14p15Every cell Pi is a nibble, i∈0,1,…,15.The round function consists of SubCell, AddConstants, AddRoundTweakey, ShiftRows, and MixColumn. Since SubCell, ShiftRows, and MixColumn operations have an effect on differential diffusion, we only illustrate these operations in the paper. For more details, please refer to [9].SubCells (SC).The 4×4 s-box defined in Table 1 is applied to each nibble in the state.Table 1
S-box of Skinny-64/192.
x 0x0 0x1 0x2 0x3 0x4 0x5 0x6 0x7 0x8 0x9 0xa 0xb 0xc 0xd 0xe 0xf  s(x) 0xc 0x6 0x9 0x0 0x1 0xa 0x2 0xb 0x3 0x8 0x5 0xd 0x4 0xe 0x7 0xfShiftRows (SR).The rows of the state are rotated as in AES but to the right, i.e., the cell permutation is specified as follows.(9)0123456789101112131415→0123745610118913141512MixColumn (MC).Each column in the state is multiplied by a binary matrix MC. MC is given as follows.(10)MC=1011100001101010Tweakey Schedule.Skinny-64/192 tweakey is updated through tweakey schedule. K=TK1∥TK2∥TK3=192 bits, and TK1 = TK2 = TK3 = 64 bits which be permuted by PT. Then, each cell in the first and second rows of TK2, TK3 is updated using LFSR operations shown in [10].In Figure1, Xi,Yi,Zi represent the i-th round state, respectively. Xj,Yj,Zj represent a nibble of the state, respectively. Let (x0,x1,…,x63) and (z0,z1,…,z63) be the input and output bit-wise differences in a round for Skinny-64/192, and Xj,Yj,Zj,j∈0,1,…,15, and xk,yk,zk,k∈0,1,…,63.Figure 1
The i-th round function of Skinny-64/192.From the overall design of Skinny-64/192, its structure is compact and has the advantages of low delay, high throughput, and low number of gate circuits in hardware implementation. Therefore, Skinny-64/192 is more suitable for wireless multimedia and other micro device applications. Now, we apply the new MILP method to get the lower limit of the number of active s-boxes for the differential analysis of Skinny-64/192. Then, we use the maximum difference probability of the s-box to derive the upper bound of the best characteristic probability. Finally, the experimental results are used to determine whether Skinny-64/192 is safe on differential analysis.


### 3.2. Employing MILP’s Method for Specific Operation

#### 3.2.1. Compact Constraints for DDT of S-Box

In Skinny-64/192, combined with the Table2, y = s(x), (y0,y1,y2,y3)=s1(x0,x1,x2,x3), it is possible to list the following vectors according to the input differential of 0001: 0,0,0,1,1,0,0,0, 0,0,0,1,1,0,0,1, 0,0,0,1,1,0,1,0, 0,0,0,1,1,0,1,1. Similarly, we can get all the differential vectors, so we get the input of SageMath [17].(11)points=0,0,0,0,0,0,0,0,0,0,0,1,1,0,0,0,0,0,0,1,1,0,0,1,0,0,0,1,1,0,1,0,0,0,0,1,1,0,1,1,0,0,1,0,0,0,0,1,0,0,1,0,0,0,1,1,0,0,1,0,0,1,0,1,0,0,1,0,0,1,1,0,0,0,1,1,1,0,0,0,0,0,1,1,1,0,0,1,0,0,1,1,1,0,1,0,0,0,1,1,1,0,1,1,0,0,1,1,1,1,0,0,0,0,1,1,1,1,0,1,0,0,1,1,1,1,1,0,0,0,1,1,1,1,1,1,0,1,0,0,0,0,1,0,0,1,0,0,0,1,1,0,0,1,0,0,0,1,1,1,0,1,0,0,1,0,1,1,0,1,0,0,1,1,0,0,0,1,0,0,1,1,0,1,0,1,0,1,0,0,1,0,0,1,0,1,0,1,1,0,0,1,0,1,0,1,1,1,0,1,0,1,1,0,1,0,0,1,0,1,1,1,0,0,0,1,0,1,1,1,0,1,0,1,1,0,0,0,0,1,0,1,1,0,0,0,1,1,0,1,1,0,0,1,0,0,0,1,1,0,0,1,1,1,0,1,1,0,1,0,0,0,0,1,1,0,1,0,1,0,0,1,1,0,1,1,0,1,0,1,1,0,1,1,1,0,0,1,1,1,0,0,0,1,0,1,1,1,0,0,1,1,0,1,1,1,0,1,0,0,0,1,1,1,0,1,1,1,0,1,1,1,1,0,0,1,0,1,1,1,1,0,1,1,0,1,1,1,1,1,0,0,0,1,1,1,1,1,1,1,1,0,0,0,0,1,0,0,1,0,0,0,0,1,0,1,1,0,0,0,1,1,0,0,1,0,0,0,1,1,0,1,1,0,0,0,1,1,1,0,1,0,0,0,1,1,1,1,1,0,0,1,0,1,0,0,1,0,0,1,0,1,0,1,1,0,0,1,1,1,0,0,1,0,0,1,1,1,0,1,1,0,0,1,1,1,1,0,1,0,0,1,1,1,1,1,1,0,1,0,0,1,0,1,1,0,1,0,0,1,1,0,1,0,1,0,1,0,0,0,1,0,1,0,1,0,0,1,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,1,1,0,1,1,0,0,0,1,1,0,1,1,0,0,1,1,1,0,1,1,1,1,0,0,1,0,1,1,1,1,0,1,,1,0,1,1,1,1,1,0,1,0,1,1,1,1,1,1,1,1,0,0,0,0,1,0,1,1,0,0,0,1,1,0,1,1,0,0,0,1,1,1,1,1,0,0,1,0,0,0,1,1,0,0,1,1,1,0,1,1,0,0,1,1,1,1,1,1,0,1,0,0,1,0,1,1,0,1,0,1,1,0,1,1,0,1,0,1,1,1,1,1,0,1,1,0,0,1,1,1,0,1,1,1,1,0,1,1,0,1,1,1,1,1,1,1,1,0,0,0,0,1,1,1,1,0,0,0,1,1,1,1,1,0,0,1,0,0,1,1,1,0,0,1,1,1,1,1,1,0,1,0,0,1,1,1,1,0,1,0,1,1,1,1,1,0,1,1,0,1,,1,1,1,0,1,1,1,0,1,1,1,1,0,0,0,1,1,1,1,1,0,0,1,1,1,1,1,1,0,1,0,0,1,1,1,1,0,1,1,1,1,1,1,1,1,0,0,0,1,1,1,1,1,0,1,0,1,1,1,1,1,1,0,0,1,1,1,1,1,1,1,1Running SageMath will output 202 inequalities. Then, the redundant inequalities are eliminated through a specific streamlined procedure (Appendix). Finally, the s1-box can be accurately characterized with 24 inequalities. The inequality of describing s1 is shown as follows.(12)-2x0+3x1-3x2-2x3+5y0+4y1+y2+7y3>=0-x0+x1+2x2+x3+y0+3y1-2y3>=04x0+3x1+2x2+3x3-y0-y1-y2-y3>=02x0-x1+2x2+3y0-y1+3y2-y3>=0x0+3x1+x2-2x3+2y0-y1-2y2>=-2-3x0+2x1+x2-2x3-y0+3y1+y3>=-3x1-2x2+2x3-y0-2y1+y2+y3>=-3-2x0-3x1+2x2+x3+y0-y1+3y2-y3>=-4-x1-2x2-x3+y0-y1-2y2+2y3>=-5-x1-x2-x3+y0-2y1+2y2-2y3>=-52x0+x1+3x2+4x3-3y0+2y1-y2+3y3>=0x0-2x1+2x2-2x3-y0+y1-y2-2y3>=-6x1-2x2+2x3-y0-2y1-y2-y3>=-5x0-x1-x3+y0+2y1+2y2+2y3>=0x0-x2+x3-y0+y1-y3>=-2-x0-x2-x3-y0+y1-y3>=-4-x0-x1-x2+x3+y1+y3>=-23x0+x1+x2-2x3+2y0-y1+2y2-y3>=-1x1+x2+y0-y2>=0x0-x1-2x2-x3+y0-2y2+2y3>=-4x0+x1+x2+2x3-2y0+y1+y2>=0-x0-x1+x2-y1+y2>=-2x0+x1+x2-y1>=0x0+x2-y0-y1-y2>=-2A round of 16 s-boxes can be characterized by 384 linear inequalities accurately. x0,x1,x2,x3∈X0,y0,y1,y2,y3∈Y0. X0, Y0 represent 4 bits. X0 and Y0 are input and output of s1, respectively.Table 2
The input and output differential distribution of Skinny-64/192’s s-box.
Input difference Output difference (x0, x1, x2, x3) (y0, y1, y2, y3) 0000 0000 0001 1000 1001 1010 1011 0010 0001 0011 0101 0110 0011 1000 1001 1010 1011 1100 1101 1110 1111 0100 0010 0110 0111 1011 1100 1101 0101 0010 0110 0111 1010 1100 1101 0110 0001 0011 0100 0111 1000 1010 1101 1110 0111 0001 0011 0100 0111 1001 1011 1100 1111 1000 0100 0101 1100 1101 1110 1111 1001 0100 0101 1100 1101 1110 1111 1010 0101 0110 1000 1001 1010 1011 1011 0001 0011 1100 1101 1110 1111 1100 0010 0110 0111 1000 1110 1111 1101 0010 0110 0111 1001 1110 1111 1110 0001 0011 0100 0111 1001 1011 1101 1110 1111 0001 0011 0100 0111 1000 1010 1100 1111In contrast, it is simple to construct constrains for the ShiftRows operation of Skinny-64/192. Referring to (5), the ShiftRows operation can be characterized precisely by the next 64 constraint equations. yi∈Y,zi∈Z,i∈0,1,…,63.(13)z0-y0=0z1-y1=0z2-y2=0z3-y3=0⋮⋮z60-y48=0z61-y49=0z62-y50=0z63-y51=0In the ShiftRows operation, comparing with the method in [15], we also make a great improvement in which no new variables will be added. It reduces the number of variables greatly and improves the running speed of the computer. In this case, we can reduce the use of 64 variables in one round. Therefore, the variable Z can be omitted.


#### 3.2.2. Compact Constraints for the Linear Transform

In linear layer, MixColumn operations are the most difficult to be described utilizing the novel technique, but in this work, we can introduce an intermediate variable U to solve the problems. This operation is broken down into the following steps.Step 1.
Convert the matrix MC4×4 to MC16×16 of Skinny-64/192.(14)MC=1000000010001000010000000100010000100000001000100001000000010001100000000000000001000000000000000010000000000000000100000000000000001000100000000000010001000000000000100010000000000001000100001000000010000000010000000100000000100000001000000001000000010000Step 2.
After the MixColumn, we can get the valuexs of Xi+1, in which s∈64,65,…,127. For example x64=y0+y40+y52.Step 3.
We introduce the intermediate variable U, u0 = y40 + y52, and then x64 = y0 + u0. Combining (4) and (6), the constraints between them can be expressed as follows.(15)y40+y52-u0>=0y40-y52+u0>=0-y40+y52+u0>=0y40+y52+u0<=2u0+y0-x64>=0u0-y0+x64>=0-u0+y0+x64>=0u0+y0+x64<=2In a round, we need to use 16 intermediate variables, ui∈U, i∈0,1,…,15.


### 3.3. Calculate the Minimum Number of Active S-Boxes

In the MILP program, we must add a linear constraint to ensure that at least one s-box is active. The setting of objective function refers to (7). And all variables must be binary variable. In order to optimize the MILP model, we also need CPLEX [18] tool. Finally, we obtain the minimum number of active s-boxes which is 54 for 11-round differential analysis of Skinny-64/192. In Table 3, the differential distribution table of s-box of Skinny-64/192 is presented.Table 3
The DDT of s-box for Skinny-64/192.
0x0 0x1 0x2 0x3 0x4 0x5 0x6 0x7 0x8 0x9 0xa 0xb 0xc 0xd 0xe 0xf 0x0 16 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x1 0 0 0 0 0 0 0 0 4 4 4 4 0 0 0 0 0x2 0 4 0 4 0 4 4 0 0 0 0 0 0 0 0 0 0x3 0 0 0 0 0 0 0 0 2 2 2 2 2 2 2 2 0x4 0 0 4 0 0 0 2 2 0 0 0 4 2 2 0 0 0x5 0 0 4 0 0 0 2 2 0 0 4 0 2 2 0 0 0x6 0 2 0 2 2 0 0 2 2 0 2 0 0 2 2 0 0x7 0 2 0 2 2 0 0 2 0 2 0 2 2 0 0 2 0x8 0 0 0 0 4 4 0 0 0 0 0 0 2 2 2 2 0x9 0 0 0 0 4 4 0 0 0 0 0 0 2 2 2 2 0xa 0 0 0 0 0 4 4 0 2 2 2 2 0 0 0 0 0xb 0 4 0 4 0 0 0 0 0 0 0 0 2 2 2 2 0xc 0 0 4 0 0 0 2 2 4 0 0 0 0 0 2 2 0xd 0 0 4 0 0 0 2 2 0 4 0 0 0 0 2 2 0xe 0 2 0 2 2 0 0 2 0 2 0 2 0 2 2 0 0xf 0 2 0 2 2 0 0 2 2 0 2 0 2 0 0 2First, the s1-box of Skinny-64/192 is set as an active s-box with the input difference of 1001(9). And the probability of obtaining the second round of input difference is 2−2, and the number of active s-boxes is 3. By analogy, the output difference of the 11th round has an active s-box which is 1000(8). The total probability of the 11- round differential characteristic is 2−147. The minimum number of the active s-boxes is 54 for 11 rounds of Skinny-64/192. The details are shown in Table 4.Table 4
11-round differential trail.
Rounds Input difference Probability Active s-boxes 1st 9000 0000 0000 0000 2 - 2 1 2nd 5505 0000 0000 0000 2 - 8 3 3rd cc0c 00a0 0000 d000 2 - 1 3 5 4th 6606 0060 0000 096f 2 - 2 1 7 5th aaff 8008 f000 a077 2 - 2 6 10 6th 0505 0f40 bff0 c505 2 - 3 0 10 7th c00d 00d0 0d7d 2700 2 - 2 3 8 8th 0f00 f000 0000 0196 2 - 1 3 5 9th 0090 0400 7000 0000 2 - 9 3 10th 0000 0000 0d00 0000 2 - 2 1 11th 0000 0000 0000 0800 -- 1According to Table4, we can get a specific probability for each round of 11-round differential characteristic for Skinny-64/192 in Figure 2. The probability of differential trail is 2−147, that is, far greater than 2−192 which is the probability of success for an exhaustive search.Figure 2
11-round differential characteristic of Skinny-64/192.The experimental result leads us to obtain the minimum number of active s-boxes which is 54 for the 11-round differential trail. Since the same number of rounds is attacked, the minimum active s-boxes number of the Skinny-64/192 is bigger than that of ENOCORO-128v2, PRESENR-80. This not only illustrates that Skinny-64/192 is relatively safe, but also can be implemented in hardware to protect the safety of data. The bigger the number of active s-boxes, the faster the differential diffusion; the security of cryptographic algorithm is relatively higher.The MILP program corresponding to Skinny-64/192’s 11-round differential trail consists of 7440 constraints and 1680 binary variables including 1520 continuous variables and 160 intermediate variables. Compared with Sun et al., our improvement reduced the use of 640 continuous variables in total and improved the speed of the computer. The experiments are implemented on a 64-bit operating system, Intel Core i7-7700 CPU @ 3.60GHz, with 16GB of RAM.


## 3.1. Description of Skinny-64/192

Skinny is a family of tweakable lightweight block ciphers proposed by Beierle et al. at CRYPTO in 2016. The specifications for Skinny was given in [9]. Skinny-64/192 provides 64-bit block length and 192-bit key length. We now give a short description of Skinny-64/192. Skinny-64/192 uses the SPN structure with Midori-64-like state. The state is arranged in a 4 × 4 matrix.(8)P=p0p1p2p3p4p5p6p7p8p9p10p11p12p13p14p15Every cell Pi is a nibble, i∈0,1,…,15.The round function consists of SubCell, AddConstants, AddRoundTweakey, ShiftRows, and MixColumn. Since SubCell, ShiftRows, and MixColumn operations have an effect on differential diffusion, we only illustrate these operations in the paper. For more details, please refer to [9].SubCells (SC).The 4×4 s-box defined in Table 1 is applied to each nibble in the state.Table 1
S-box of Skinny-64/192.
x 0x0 0x1 0x2 0x3 0x4 0x5 0x6 0x7 0x8 0x9 0xa 0xb 0xc 0xd 0xe 0xf  s(x) 0xc 0x6 0x9 0x0 0x1 0xa 0x2 0xb 0x3 0x8 0x5 0xd 0x4 0xe 0x7 0xfShiftRows (SR).The rows of the state are rotated as in AES but to the right, i.e., the cell permutation is specified as follows.(9)0123456789101112131415→0123745610118913141512MixColumn (MC).Each column in the state is multiplied by a binary matrix MC. MC is given as follows.(10)MC=1011100001101010Tweakey Schedule.Skinny-64/192 tweakey is updated through tweakey schedule. K=TK1∥TK2∥TK3=192 bits, and TK1 = TK2 = TK3 = 64 bits which be permuted by PT. Then, each cell in the first and second rows of TK2, TK3 is updated using LFSR operations shown in [10].In Figure1, Xi,Yi,Zi represent the i-th round state, respectively. Xj,Yj,Zj represent a nibble of the state, respectively. Let (x0,x1,…,x63) and (z0,z1,…,z63) be the input and output bit-wise differences in a round for Skinny-64/192, and Xj,Yj,Zj,j∈0,1,…,15, and xk,yk,zk,k∈0,1,…,63.Figure 1
The i-th round function of Skinny-64/192.From the overall design of Skinny-64/192, its structure is compact and has the advantages of low delay, high throughput, and low number of gate circuits in hardware implementation. Therefore, Skinny-64/192 is more suitable for wireless multimedia and other micro device applications. Now, we apply the new MILP method to get the lower limit of the number of active s-boxes for the differential analysis of Skinny-64/192. Then, we use the maximum difference probability of the s-box to derive the upper bound of the best characteristic probability. Finally, the experimental results are used to determine whether Skinny-64/192 is safe on differential analysis.


## 3.2. Employing MILP’s Method for Specific Operation

### 3.2.1. Compact Constraints for DDT of S-Box

In Skinny-64/192, combined with the Table2, y = s(x), (y0,y1,y2,y3)=s1(x0,x1,x2,x3), it is possible to list the following vectors according to the input differential of 0001: 0,0,0,1,1,0,0,0, 0,0,0,1,1,0,0,1, 0,0,0,1,1,0,1,0, 0,0,0,1,1,0,1,1. Similarly, we can get all the differential vectors, so we get the input of SageMath [17].(11)points=0,0,0,0,0,0,0,0,0,0,0,1,1,0,0,0,0,0,0,1,1,0,0,1,0,0,0,1,1,0,1,0,0,0,0,1,1,0,1,1,0,0,1,0,0,0,0,1,0,0,1,0,0,0,1,1,0,0,1,0,0,1,0,1,0,0,1,0,0,1,1,0,0,0,1,1,1,0,0,0,0,0,1,1,1,0,0,1,0,0,1,1,1,0,1,0,0,0,1,1,1,0,1,1,0,0,1,1,1,1,0,0,0,0,1,1,1,1,0,1,0,0,1,1,1,1,1,0,0,0,1,1,1,1,1,1,0,1,0,0,0,0,1,0,0,1,0,0,0,1,1,0,0,1,0,0,0,1,1,1,0,1,0,0,1,0,1,1,0,1,0,0,1,1,0,0,0,1,0,0,1,1,0,1,0,1,0,1,0,0,1,0,0,1,0,1,0,1,1,0,0,1,0,1,0,1,1,1,0,1,0,1,1,0,1,0,0,1,0,1,1,1,0,0,0,1,0,1,1,1,0,1,0,1,1,0,0,0,0,1,0,1,1,0,0,0,1,1,0,1,1,0,0,1,0,0,0,1,1,0,0,1,1,1,0,1,1,0,1,0,0,0,0,1,1,0,1,0,1,0,0,1,1,0,1,1,0,1,0,1,1,0,1,1,1,0,0,1,1,1,0,0,0,1,0,1,1,1,0,0,1,1,0,1,1,1,0,1,0,0,0,1,1,1,0,1,1,1,0,1,1,1,1,0,0,1,0,1,1,1,1,0,1,1,0,1,1,1,1,1,0,0,0,1,1,1,1,1,1,1,1,0,0,0,0,1,0,0,1,0,0,0,0,1,0,1,1,0,0,0,1,1,0,0,1,0,0,0,1,1,0,1,1,0,0,0,1,1,1,0,1,0,0,0,1,1,1,1,1,0,0,1,0,1,0,0,1,0,0,1,0,1,0,1,1,0,0,1,1,1,0,0,1,0,0,1,1,1,0,1,1,0,0,1,1,1,1,0,1,0,0,1,1,1,1,1,1,0,1,0,0,1,0,1,1,0,1,0,0,1,1,0,1,0,1,0,1,0,0,0,1,0,1,0,1,0,0,1,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,1,1,0,1,1,0,0,0,1,1,0,1,1,0,0,1,1,1,0,1,1,1,1,0,0,1,0,1,1,1,1,0,1,,1,0,1,1,1,1,1,0,1,0,1,1,1,1,1,1,1,1,0,0,0,0,1,0,1,1,0,0,0,1,1,0,1,1,0,0,0,1,1,1,1,1,0,0,1,0,0,0,1,1,0,0,1,1,1,0,1,1,0,0,1,1,1,1,1,1,0,1,0,0,1,0,1,1,0,1,0,1,1,0,1,1,0,1,0,1,1,1,1,1,0,1,1,0,0,1,1,1,0,1,1,1,1,0,1,1,0,1,1,1,1,1,1,1,1,0,0,0,0,1,1,1,1,0,0,0,1,1,1,1,1,0,0,1,0,0,1,1,1,0,0,1,1,1,1,1,1,0,1,0,0,1,1,1,1,0,1,0,1,1,1,1,1,0,1,1,0,1,,1,1,1,0,1,1,1,0,1,1,1,1,0,0,0,1,1,1,1,1,0,0,1,1,1,1,1,1,0,1,0,0,1,1,1,1,0,1,1,1,1,1,1,1,1,0,0,0,1,1,1,1,1,0,1,0,1,1,1,1,1,1,0,0,1,1,1,1,1,1,1,1Running SageMath will output 202 inequalities. Then, the redundant inequalities are eliminated through a specific streamlined procedure (Appendix). Finally, the s1-box can be accurately characterized with 24 inequalities. The inequality of describing s1 is shown as follows.(12)-2x0+3x1-3x2-2x3+5y0+4y1+y2+7y3>=0-x0+x1+2x2+x3+y0+3y1-2y3>=04x0+3x1+2x2+3x3-y0-y1-y2-y3>=02x0-x1+2x2+3y0-y1+3y2-y3>=0x0+3x1+x2-2x3+2y0-y1-2y2>=-2-3x0+2x1+x2-2x3-y0+3y1+y3>=-3x1-2x2+2x3-y0-2y1+y2+y3>=-3-2x0-3x1+2x2+x3+y0-y1+3y2-y3>=-4-x1-2x2-x3+y0-y1-2y2+2y3>=-5-x1-x2-x3+y0-2y1+2y2-2y3>=-52x0+x1+3x2+4x3-3y0+2y1-y2+3y3>=0x0-2x1+2x2-2x3-y0+y1-y2-2y3>=-6x1-2x2+2x3-y0-2y1-y2-y3>=-5x0-x1-x3+y0+2y1+2y2+2y3>=0x0-x2+x3-y0+y1-y3>=-2-x0-x2-x3-y0+y1-y3>=-4-x0-x1-x2+x3+y1+y3>=-23x0+x1+x2-2x3+2y0-y1+2y2-y3>=-1x1+x2+y0-y2>=0x0-x1-2x2-x3+y0-2y2+2y3>=-4x0+x1+x2+2x3-2y0+y1+y2>=0-x0-x1+x2-y1+y2>=-2x0+x1+x2-y1>=0x0+x2-y0-y1-y2>=-2A round of 16 s-boxes can be characterized by 384 linear inequalities accurately. x0,x1,x2,x3∈X0,y0,y1,y2,y3∈Y0. X0, Y0 represent 4 bits. X0 and Y0 are input and output of s1, respectively.Table 2
The input and output differential distribution of Skinny-64/192’s s-box.
Input difference Output difference (x0, x1, x2, x3) (y0, y1, y2, y3) 0000 0000 0001 1000 1001 1010 1011 0010 0001 0011 0101 0110 0011 1000 1001 1010 1011 1100 1101 1110 1111 0100 0010 0110 0111 1011 1100 1101 0101 0010 0110 0111 1010 1100 1101 0110 0001 0011 0100 0111 1000 1010 1101 1110 0111 0001 0011 0100 0111 1001 1011 1100 1111 1000 0100 0101 1100 1101 1110 1111 1001 0100 0101 1100 1101 1110 1111 1010 0101 0110 1000 1001 1010 1011 1011 0001 0011 1100 1101 1110 1111 1100 0010 0110 0111 1000 1110 1111 1101 0010 0110 0111 1001 1110 1111 1110 0001 0011 0100 0111 1001 1011 1101 1110 1111 0001 0011 0100 0111 1000 1010 1100 1111In contrast, it is simple to construct constrains for the ShiftRows operation of Skinny-64/192. Referring to (5), the ShiftRows operation can be characterized precisely by the next 64 constraint equations. yi∈Y,zi∈Z,i∈0,1,…,63.(13)z0-y0=0z1-y1=0z2-y2=0z3-y3=0⋮⋮z60-y48=0z61-y49=0z62-y50=0z63-y51=0In the ShiftRows operation, comparing with the method in [15], we also make a great improvement in which no new variables will be added. It reduces the number of variables greatly and improves the running speed of the computer. In this case, we can reduce the use of 64 variables in one round. Therefore, the variable Z can be omitted.


### 3.2.2. Compact Constraints for the Linear Transform

In linear layer, MixColumn operations are the most difficult to be described utilizing the novel technique, but in this work, we can introduce an intermediate variable U to solve the problems. This operation is broken down into the following steps.Step 1.
Convert the matrix MC4×4 to MC16×16 of Skinny-64/192.(14)MC=1000000010001000010000000100010000100000001000100001000000010001100000000000000001000000000000000010000000000000000100000000000000001000100000000000010001000000000000100010000000000001000100001000000010000000010000000100000000100000001000000001000000010000Step 2.
After the MixColumn, we can get the valuexs of Xi+1, in which s∈64,65,…,127. For example x64=y0+y40+y52.Step 3.
We introduce the intermediate variable U, u0 = y40 + y52, and then x64 = y0 + u0. Combining (4) and (6), the constraints between them can be expressed as follows.(15)y40+y52-u0>=0y40-y52+u0>=0-y40+y52+u0>=0y40+y52+u0<=2u0+y0-x64>=0u0-y0+x64>=0-u0+y0+x64>=0u0+y0+x64<=2In a round, we need to use 16 intermediate variables, ui∈U, i∈0,1,…,15.


## 3.2.1. Compact Constraints for DDT of S-Box

In Skinny-64/192, combined with the Table2, y = s(x), (y0,y1,y2,y3)=s1(x0,x1,x2,x3), it is possible to list the following vectors according to the input differential of 0001: 0,0,0,1,1,0,0,0, 0,0,0,1,1,0,0,1, 0,0,0,1,1,0,1,0, 0,0,0,1,1,0,1,1. Similarly, we can get all the differential vectors, so we get the input of SageMath [17].(11)points=0,0,0,0,0,0,0,0,0,0,0,1,1,0,0,0,0,0,0,1,1,0,0,1,0,0,0,1,1,0,1,0,0,0,0,1,1,0,1,1,0,0,1,0,0,0,0,1,0,0,1,0,0,0,1,1,0,0,1,0,0,1,0,1,0,0,1,0,0,1,1,0,0,0,1,1,1,0,0,0,0,0,1,1,1,0,0,1,0,0,1,1,1,0,1,0,0,0,1,1,1,0,1,1,0,0,1,1,1,1,0,0,0,0,1,1,1,1,0,1,0,0,1,1,1,1,1,0,0,0,1,1,1,1,1,1,0,1,0,0,0,0,1,0,0,1,0,0,0,1,1,0,0,1,0,0,0,1,1,1,0,1,0,0,1,0,1,1,0,1,0,0,1,1,0,0,0,1,0,0,1,1,0,1,0,1,0,1,0,0,1,0,0,1,0,1,0,1,1,0,0,1,0,1,0,1,1,1,0,1,0,1,1,0,1,0,0,1,0,1,1,1,0,0,0,1,0,1,1,1,0,1,0,1,1,0,0,0,0,1,0,1,1,0,0,0,1,1,0,1,1,0,0,1,0,0,0,1,1,0,0,1,1,1,0,1,1,0,1,0,0,0,0,1,1,0,1,0,1,0,0,1,1,0,1,1,0,1,0,1,1,0,1,1,1,0,0,1,1,1,0,0,0,1,0,1,1,1,0,0,1,1,0,1,1,1,0,1,0,0,0,1,1,1,0,1,1,1,0,1,1,1,1,0,0,1,0,1,1,1,1,0,1,1,0,1,1,1,1,1,0,0,0,1,1,1,1,1,1,1,1,0,0,0,0,1,0,0,1,0,0,0,0,1,0,1,1,0,0,0,1,1,0,0,1,0,0,0,1,1,0,1,1,0,0,0,1,1,1,0,1,0,0,0,1,1,1,1,1,0,0,1,0,1,0,0,1,0,0,1,0,1,0,1,1,0,0,1,1,1,0,0,1,0,0,1,1,1,0,1,1,0,0,1,1,1,1,0,1,0,0,1,1,1,1,1,1,0,1,0,0,1,0,1,1,0,1,0,0,1,1,0,1,0,1,0,1,0,0,0,1,0,1,0,1,0,0,1,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,1,1,0,1,1,0,0,0,1,1,0,1,1,0,0,1,1,1,0,1,1,1,1,0,0,1,0,1,1,1,1,0,1,,1,0,1,1,1,1,1,0,1,0,1,1,1,1,1,1,1,1,0,0,0,0,1,0,1,1,0,0,0,1,1,0,1,1,0,0,0,1,1,1,1,1,0,0,1,0,0,0,1,1,0,0,1,1,1,0,1,1,0,0,1,1,1,1,1,1,0,1,0,0,1,0,1,1,0,1,0,1,1,0,1,1,0,1,0,1,1,1,1,1,0,1,1,0,0,1,1,1,0,1,1,1,1,0,1,1,0,1,1,1,1,1,1,1,1,0,0,0,0,1,1,1,1,0,0,0,1,1,1,1,1,0,0,1,0,0,1,1,1,0,0,1,1,1,1,1,1,0,1,0,0,1,1,1,1,0,1,0,1,1,1,1,1,0,1,1,0,1,,1,1,1,0,1,1,1,0,1,1,1,1,0,0,0,1,1,1,1,1,0,0,1,1,1,1,1,1,0,1,0,0,1,1,1,1,0,1,1,1,1,1,1,1,1,0,0,0,1,1,1,1,1,0,1,0,1,1,1,1,1,1,0,0,1,1,1,1,1,1,1,1Running SageMath will output 202 inequalities. Then, the redundant inequalities are eliminated through a specific streamlined procedure (Appendix). Finally, the s1-box can be accurately characterized with 24 inequalities. The inequality of describing s1 is shown as follows.(12)-2x0+3x1-3x2-2x3+5y0+4y1+y2+7y3>=0-x0+x1+2x2+x3+y0+3y1-2y3>=04x0+3x1+2x2+3x3-y0-y1-y2-y3>=02x0-x1+2x2+3y0-y1+3y2-y3>=0x0+3x1+x2-2x3+2y0-y1-2y2>=-2-3x0+2x1+x2-2x3-y0+3y1+y3>=-3x1-2x2+2x3-y0-2y1+y2+y3>=-3-2x0-3x1+2x2+x3+y0-y1+3y2-y3>=-4-x1-2x2-x3+y0-y1-2y2+2y3>=-5-x1-x2-x3+y0-2y1+2y2-2y3>=-52x0+x1+3x2+4x3-3y0+2y1-y2+3y3>=0x0-2x1+2x2-2x3-y0+y1-y2-2y3>=-6x1-2x2+2x3-y0-2y1-y2-y3>=-5x0-x1-x3+y0+2y1+2y2+2y3>=0x0-x2+x3-y0+y1-y3>=-2-x0-x2-x3-y0+y1-y3>=-4-x0-x1-x2+x3+y1+y3>=-23x0+x1+x2-2x3+2y0-y1+2y2-y3>=-1x1+x2+y0-y2>=0x0-x1-2x2-x3+y0-2y2+2y3>=-4x0+x1+x2+2x3-2y0+y1+y2>=0-x0-x1+x2-y1+y2>=-2x0+x1+x2-y1>=0x0+x2-y0-y1-y2>=-2A round of 16 s-boxes can be characterized by 384 linear inequalities accurately. x0,x1,x2,x3∈X0,y0,y1,y2,y3∈Y0. X0, Y0 represent 4 bits. X0 and Y0 are input and output of s1, respectively.Table 2
The input and output differential distribution of Skinny-64/192’s s-box.
Input difference Output difference (x0, x1, x2, x3) (y0, y1, y2, y3) 0000 0000 0001 1000 1001 1010 1011 0010 0001 0011 0101 0110 0011 1000 1001 1010 1011 1100 1101 1110 1111 0100 0010 0110 0111 1011 1100 1101 0101 0010 0110 0111 1010 1100 1101 0110 0001 0011 0100 0111 1000 1010 1101 1110 0111 0001 0011 0100 0111 1001 1011 1100 1111 1000 0100 0101 1100 1101 1110 1111 1001 0100 0101 1100 1101 1110 1111 1010 0101 0110 1000 1001 1010 1011 1011 0001 0011 1100 1101 1110 1111 1100 0010 0110 0111 1000 1110 1111 1101 0010 0110 0111 1001 1110 1111 1110 0001 0011 0100 0111 1001 1011 1101 1110 1111 0001 0011 0100 0111 1000 1010 1100 1111In contrast, it is simple to construct constrains for the ShiftRows operation of Skinny-64/192. Referring to (5), the ShiftRows operation can be characterized precisely by the next 64 constraint equations. yi∈Y,zi∈Z,i∈0,1,…,63.(13)z0-y0=0z1-y1=0z2-y2=0z3-y3=0⋮⋮z60-y48=0z61-y49=0z62-y50=0z63-y51=0In the ShiftRows operation, comparing with the method in [15], we also make a great improvement in which no new variables will be added. It reduces the number of variables greatly and improves the running speed of the computer. In this case, we can reduce the use of 64 variables in one round. Therefore, the variable Z can be omitted.


## 3.2.2. Compact Constraints for the Linear Transform

In linear layer, MixColumn operations are the most difficult to be described utilizing the novel technique, but in this work, we can introduce an intermediate variable U to solve the problems. This operation is broken down into the following steps.Step 1.
Convert the matrix MC4×4 to MC16×16 of Skinny-64/192.(14)MC=1000000010001000010000000100010000100000001000100001000000010001100000000000000001000000000000000010000000000000000100000000000000001000100000000000010001000000000000100010000000000001000100001000000010000000010000000100000000100000001000000001000000010000Step 2.
After the MixColumn, we can get the valuexs of Xi+1, in which s∈64,65,…,127. For example x64=y0+y40+y52.Step 3.
We introduce the intermediate variable U, u0 = y40 + y52, and then x64 = y0 + u0. Combining (4) and (6), the constraints between them can be expressed as follows.(15)y40+y52-u0>=0y40-y52+u0>=0-y40+y52+u0>=0y40+y52+u0<=2u0+y0-x64>=0u0-y0+x64>=0-u0+y0+x64>=0u0+y0+x64<=2In a round, we need to use 16 intermediate variables, ui∈U, i∈0,1,…,15.


## 3.3. Calculate the Minimum Number of Active S-Boxes

In the MILP program, we must add a linear constraint to ensure that at least one s-box is active. The setting of objective function refers to (7). And all variables must be binary variable. In order to optimize the MILP model, we also need CPLEX [18] tool. Finally, we obtain the minimum number of active s-boxes which is 54 for 11-round differential analysis of Skinny-64/192. In Table 3, the differential distribution table of s-box of Skinny-64/192 is presented.Table 3
The DDT of s-box for Skinny-64/192.
0x0 0x1 0x2 0x3 0x4 0x5 0x6 0x7 0x8 0x9 0xa 0xb 0xc 0xd 0xe 0xf 0x0 16 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x1 0 0 0 0 0 0 0 0 4 4 4 4 0 0 0 0 0x2 0 4 0 4 0 4 4 0 0 0 0 0 0 0 0 0 0x3 0 0 0 0 0 0 0 0 2 2 2 2 2 2 2 2 0x4 0 0 4 0 0 0 2 2 0 0 0 4 2 2 0 0 0x5 0 0 4 0 0 0 2 2 0 0 4 0 2 2 0 0 0x6 0 2 0 2 2 0 0 2 2 0 2 0 0 2 2 0 0x7 0 2 0 2 2 0 0 2 0 2 0 2 2 0 0 2 0x8 0 0 0 0 4 4 0 0 0 0 0 0 2 2 2 2 0x9 0 0 0 0 4 4 0 0 0 0 0 0 2 2 2 2 0xa 0 0 0 0 0 4 4 0 2 2 2 2 0 0 0 0 0xb 0 4 0 4 0 0 0 0 0 0 0 0 2 2 2 2 0xc 0 0 4 0 0 0 2 2 4 0 0 0 0 0 2 2 0xd 0 0 4 0 0 0 2 2 0 4 0 0 0 0 2 2 0xe 0 2 0 2 2 0 0 2 0 2 0 2 0 2 2 0 0xf 0 2 0 2 2 0 0 2 2 0 2 0 2 0 0 2First, the s1-box of Skinny-64/192 is set as an active s-box with the input difference of 1001(9). And the probability of obtaining the second round of input difference is 2−2, and the number of active s-boxes is 3. By analogy, the output difference of the 11th round has an active s-box which is 1000(8). The total probability of the 11- round differential characteristic is 2−147. The minimum number of the active s-boxes is 54 for 11 rounds of Skinny-64/192. The details are shown in Table 4.Table 4
11-round differential trail.
Rounds Input difference Probability Active s-boxes 1st 9000 0000 0000 0000 2 - 2 1 2nd 5505 0000 0000 0000 2 - 8 3 3rd cc0c 00a0 0000 d000 2 - 1 3 5 4th 6606 0060 0000 096f 2 - 2 1 7 5th aaff 8008 f000 a077 2 - 2 6 10 6th 0505 0f40 bff0 c505 2 - 3 0 10 7th c00d 00d0 0d7d 2700 2 - 2 3 8 8th 0f00 f000 0000 0196 2 - 1 3 5 9th 0090 0400 7000 0000 2 - 9 3 10th 0000 0000 0d00 0000 2 - 2 1 11th 0000 0000 0000 0800 -- 1According to Table4, we can get a specific probability for each round of 11-round differential characteristic for Skinny-64/192 in Figure 2. The probability of differential trail is 2−147, that is, far greater than 2−192 which is the probability of success for an exhaustive search.Figure 2
11-round differential characteristic of Skinny-64/192.The experimental result leads us to obtain the minimum number of active s-boxes which is 54 for the 11-round differential trail. Since the same number of rounds is attacked, the minimum active s-boxes number of the Skinny-64/192 is bigger than that of ENOCORO-128v2, PRESENR-80. This not only illustrates that Skinny-64/192 is relatively safe, but also can be implemented in hardware to protect the safety of data. The bigger the number of active s-boxes, the faster the differential diffusion; the security of cryptographic algorithm is relatively higher.The MILP program corresponding to Skinny-64/192’s 11-round differential trail consists of 7440 constraints and 1680 binary variables including 1520 continuous variables and 160 intermediate variables. Compared with Sun et al., our improvement reduced the use of 640 continuous variables in total and improved the speed of the computer. The experiments are implemented on a 64-bit operating system, Intel Core i7-7700 CPU @ 3.60GHz, with 16GB of RAM.


## 4. Conclusion

In this paper, a new result is obtained on the differential analysis of lightweight block cipher Skinny-64/192. We get a 11-round differential characteristic with minimum active s-boxes. The minimum number of active s-boxes is 54. The probability of 11-round differential trail is 2−147, that is, far greater than 2−192 which is the probability of success for an exhaustive search.The experimental result not only proves that Skinny-64/192 cannot resist 11-round differential analysis and validates the effectiveness of MILP method, but also has other important reference values. First, the lightweight block cipher Skinny-64/192 is relatively secure and can be used on wireless multimedia devices to protect data security. Second, Skinny-64/192 can resist 11-round differential analysis, so it can be used as a candidate encryption algorithm for differential privacy protection technology. Finally, by verifying the effectiveness of MILP method on differential analysis, the method can significantly reduce the workload of cryptanalysts. Besides, MILP method can be applied to more cryptanalysis, such as related-key differential analysis, impossible differential analysis, and related-key impossible differential analysis. We believe that there will be greater gains.



---

*Source: 3780407-2018-10-04.xml*