# Related-Key Differential Attacks on COSB-128

Authors: Song Dat Phuc Tran; Changhoon Lee
Journal: International Journal of Distributed Sensor Networks
 (2015)

---

## Abstract

COSB-128 (Moldovyan et al., 2002) is a block cipher with 128-bit and 256-bit secret keys, which use key and data-dependent operational substitutions in fast controllable permutation blocks (CPB) concept. It is designed with a simple key schedule to ensure a high speed of data transformation by fast block encryption algorithms and expected to be high stability to all known methods of cryptanalysis, especially differential and linear attacks. In this paper, we show that the COSB-128 block cipher still remains weaknesses to differential related-key cryptanalysis, by constructing two full 10-round related-key differential characteristics (DCs) of COSB-128 with high probabilities, and thence propose our two related-key differential attacks. The attacks require about 224 data and time complexities to recover 63-bit key information and 222 data and time complexities to recover 6-bit key information. This study is the first known cryptanalytic result on COSB-128 until now. From this study, the new potential for the cryptanalysis on these types of block cipher will be further revealed.


---

## Body

## 1. Introduction

Recently, the use of network-based devices and services has increased gradually. Thence, the security becomes an essential interest, which is required not only to be strong with most known attacks but also to be optimized on software-hardware implementations [1, 2] or specialized applications. With these criteria, designing cipher using in which data-dependent controllable operations is a cryptographic primitive approach in modern applied cryptography.When the best known algorithms using controllable permutations (RC5, RC6, etc. [3]) showed their limitations in protective transformation, the operational substitutions offer promise for fast block encryption algorithms with better performance.Recently, there are some designs of block ciphers which are presented, such as CIKS-1 [4], CIKS-128 [5], Cobra-H64, Cobra-H128 [6], SCO-1, SCO-2, and SCO-3 [7] which aim to enhance the security of the DDP- (data-dependent permutation-) based ciphers structure. Although there are many well-known ciphers, with different specifications and characteristics, the security of them is still under consideration. All of them use a very simple key scheduling for high speed encryption algorithms, which enables the cryptanalysis exploit by applying related-key attacks concept.COSB-128 [8] is a 128-bit block cipher with a 256-bit key; the number of round is 10. It uses controlled operational substitution (COS) with the concept of fast controllable permutation blocks (CPB) [9]. This cipher is expected to have high performance in hardware-software implementations and high stability to all known cryptanalysis, especially differential attacks and linear attacks.Related-key differential cryptanalysis was introduced in 1994 by Biham [1, 2] and has become an effective and popular method for attacking many types of block ciphers. This attack researched on CIKS-cipher family [10], Cobra-cipher family [11], or SCO-cipher family [12]… has given a reasonable result with better performance.In this paper, we show that this type of block cipher is still vulnerable to related-key differential attack, by constructing two full 10-round differential characteristics (DCs) of COSB-128 with high probabilities; thence, we present our two related-key differential attacks on it. The attack allows us to recover 63-bit key information with about 224 data related-key chosen plaintexts and 224 encryptions and 6-bit key information with about 222 data related-key chosen plaintexts and 222 encryptions. This study is the first known cryptanalytic result on COSB-128 so far.This paper is organized as follows: in Section2, we present the COSB-128 block cipher; in Section 3, the related-key differential characteristics and our related-key differential attack on COSB-128 are proposed. Finally, we give the conclusion of this paper in Section 4.


## 2. Description of COSB-128 Block Cipher

In this section, the structure of COSB-128 block cipher is reviewed. Firstly, we notice some notations using through the whole paper. The cipherA=(a1,a2,…,an) is assigned with a1 and an being the most significant bit and the least significant bit, respectively:(i)
ΔXr: the input difference in round r;(ii)
ΔKr: the round-key difference in round r;(iii)
ΔYr: the output difference in round r;(iv)
ei,j: the ith bit and jth bit are ones; the others are zeros within a cipher (e.g., e2,5=(0,1,0,0,1,0,…,0)).COSB-128 [8] is a 128-bit block cipher using 256-bit secret key; the number of round is 10. The ciphers do the same iterative structure with the round function Crypt(e) (e=0: encryption, e=1: decryption).The round functionCrypt(e) consists of basic arithmetical operations: ×, multiplication, ⊕, modulo 2 addition, a transformation of control vector H, a substitution transformation G, and two CPB-Boxes, F64/192 and F64/192-1.The encryption procedure of COSB-128 is as follows.(1)
128-bit plaintext is divided into two 64-bit subblocksA and B:(1)X=A,B.Perform initial transformation as follows:(2)A0,B0=A⊕z1,B⊕z2.(2)
Forr=1 to 9 do the following:(3)a(Ar,Br)=Crypt0Ar-1,Br-1,Kr0bAr,Br=Br,Ar.(3)
Perform transformation(A10,B10) as follows:(4)(A10,B10)=Crypt0(A9,B9,K10(0)).(4)
Perform final transformation as follows:(5)Y=(A′,B′)=(A10⊕z3,B10⊕z4).The round function Crypt(0) is given in Figures 1 and 2. For more detailed description of COSB-128, see [8].Figure 1
Round functionCrypt(0) of COSB-128.
(a)
(b)Figure 2
(a)F64/192 and F64/192-1, (b) F8/12, (c) F8/12-1, (d) F4/4, (e) F4/4-1, and (f) F2/1.
(a)
(b)
(c)
(d)
(e)
(f)The control ciphersV1,V2∈GF(2)192 are performed through the transformation of control vector H, with the ciphers Vi,  i=1,2. Consider the following:(6)Vi=W1i∣W2i∣W3i∣W4i∣W5i∣W6i.The output values of Wji are defined as (7)W11=Al,W21=Ah⋘1,W31=A⊕K1h⋘18,W41=A⊕K1l⋘4,W51=A⊕K2l⋘8,W61=A⊕K2h⋘16,W12=Al,W22=Ah⋘1,W32=A⊕K4h⋘18,W42=A⊕K4l⋘4,W52=A⊕K3l⋘8,W61=A⊕K3h⋘16,where Wj(i)∈GF232, l is 32 lower-order digits, and h is 32 higher-order digits.The substitution functionG uses output vector Ψ(A,Q), in which Q depends on round cycles; Q=K1⊕K3 for odd rounds and Q=K2⊕K4 for even rounds; A, Q∈GF264. Consider the following:(8)ΨA,Q=(A1×A3×Q2×A5×A6×A8)⊕(A1×A3×A6×A8)⊕(A1×Q2×A5×A8)⊕(A3×Q2×A5×A6)⊕(A1×Q2×A6)⊕(A3×A5×A8)⊕(A1×A3×Q2)⊕(A5×A6×A8)⊕(A1×A4)⊕(Q1×A6)⊕(A2×A8)⊕(A3×Q3)⊕(Q2×A7)⊕(A5×Q4)⊕A0⊕Q0,where(9)A0=(a1,a1,…,an),A1=(an,a1,…,an-1),⋮Aj=(an-j+1,…,an,a1,…,an-j),Q0=(q1,q1,…,qn),Q1=qn,q1,…,qn-1,⋮Qj=(qn-j+1,…,qn,q1,…,qn-j).The key schedule of COSB-128 is constructed in such a simple way, where 256-bit secret key Z is split into four 64-bit subkeys; Z=(z1,z2,z3,z4). The procedure of key scheduling is specified as in Table 1.Table 1
Key schedule of COSB-128.
Key
O
1
O
2
O
3
O
4
O
5
O
6
O
7
O
8
O
9
O
10
K
1
z
1
z
4
z
3
z
2
z
4
z
3
z
1
z
2
z
3
z
1
K
2
z
2
z
1
z
4
z
3
z
2
z
4
z
3
z
1
z
2
z
3
K
3
z
3
z
2
z
1
z
4
z
1
z
2
z
4
z
3
z
4
z
2
K
4
z
4
z
3
z
2
z
1
z
3
z
1
z
2
z
4
z
1
z
4


## 3. Key Recovery Attacks on COSB-128

In this section, we construct a full 10-round related-key differential characteristic (DC) of COSB-128 with high probabilities using some properties ofCrypt(e) function and thence propose our related-key differential attack on COSB-128 block cipher.


### 3.1. Properties of COSB-128

We obtain some appropriate properties ofCrypt(e) function of COSB-128 that enable us to construct related-key differential characteristics.


#### 3.1.1. Properties withF2/1

We assumePr⁡(F2/1)(ΔY/ΔX,ΔV) is a probability to have the output difference ΔY of F2/1, with ΔXand ΔV being the input difference and the controlling vector difference, respectively. Then we can calculate the probability as the following.(a)
Pr⁡(F2/1)((0,0)/(0,0),0)=1.(b)
Pr⁡(F2/1)((0,1)/(0,1),0)=Pr⁡(F2/1)((1,1)/(0,1),0)=2-1.(c)
Pr⁡(F2/1)((1,0)/(1,0),0)=Pr⁡(F2/1)((1,1)/(1,0),0)=2-1.(d)
Pr⁡(F2/1)((1,0)/(1,1),0)=Pr⁡(F2/1)((0,1)/(1,1),0)=2-1.(e)
Pr⁡(F2/1)((0,0)/(0,0),1)=Pr⁡(F2/1)((1,1)/(0,0),1)=2-2.(f)
Pr⁡(F2/1)((0,0)/(1,1),1)=Pr⁡(F2/1)((1,1)/(1,1),1)=2-2.(g)
Pr⁡(F2/1)(ΔY/ΔX,ΔV)=2-2,where ΔY = {(0,1),(1,0)}, ΔX={(0,1),(1,0)}, and ΔV=1.


#### 3.1.2. Properties withFn/m

Extensively, we letPr⁡(Fn/m)(ΔY/ΔX,ΔV) be a probability to have the output difference ΔY of Fn/m, with ΔX being the input difference and ΔV being the controlling vector difference. We have the following.(a)
Pr⁡(Fn/m)((0)/(0),ei)=Pr⁡(Fn/m-1)((0)/(0),ei)=2-2.(b)
Pr⁡(Fn/m(V)(X))=Pr⁡(Fn/m(V⊕ei)(X))=2-2, with X∈0,1n.(c)
Pr⁡(Fn/mV-1(X))=Pr⁡(Fn/m(V⊕ei)-1(X))=2-2, with X∈0,1n.


#### 3.1.3. Properties withF64/192(e)

Similarly, we can get the probabilityPr⁡(F64/192(e))(ΔY/ΔX,ΔV) of F64/192(0), F64/192(1), with ΔY-output difference, ΔX-input difference, and ΔV-controlling vector difference. Consider the following.(a)
Pr⁡(F64/192)(0/0,0)=Pr⁡(F64/192-1)(0/0,0)=1.(b)
Pr⁡(F64/192)(0/0,ei)=Pr⁡(F64/192-1)(0/0,ei)=2-2.(c)
Pr⁡(F64/192)(ej/ei,0)=Pr⁡(F64/192-1)(ej/ei,0)=2-12, for any fixed i, j.(bothF64/192 and F64/192-1 have 6 active layers F2/1 within structure)(d)
Pr⁡(F64/192)(ej/ei,ei)=Pr⁡(F64/192-1)(ej/ei,ei)=2-12, for any fixed i, j.(bothF64/192 and F64/192-1 have 6 active layers F2/1 within structure).


#### 3.1.4. Properties with TransformationH and G

(a)
LetA, A′, and A′′ be the inputs of transformation H, respectively: (10)Vi=W1∣W2∣W3∣W4∣W5∣W6=HA,A′,A′′;i=1,2.
With the control vectorV1 of F64/192, we have H(A,A′,A′′)⊕(A,A′⊕e16,A′′)=e94 and H(A,A′,A′′)⊕(A,A′,A′′⊕e16)=e192. Similarly, H(A,A′,A′′)⊕(A,A′⊕e16,A′′)=e126 and H(A,A′,A′′)⊕(A,A′,A′′⊕e16)=e32 of the control vector V2 of F64/192-1.
(b)
LetA be the input of G with key-dependent metric Q; then we can get the probability Pr⁡(GQ(A)⊕GQ(A)=0)=1 and Pr⁡(GQ⊕e64(A)⊕GQ⊕e64(A)=0)=1.


### 3.2. Related-Key Differential Characteristics of COSB-128

With the properties defined in Section3.1 combined with such a simple key schedule of COSB-128 structure, we are able to construct the related-key differential characteristics (DCs) for COSB-128 with high probability.We assume that the plaintext pairs(P,P*) are encrypted under the key pairs (K,K*), respectively, in which α=ΔP=P⊕P*=(0,e16) and ΔK=K⊕K*=(0,e16,0,0), to get the corresponding ciphertext pairs (C,C*).Then, as Table2 shows, we can construct a 10-round related-key differential characteristic α→β, where β=(e16,ej), (1≤j≤64) for rounds 1~10 of COSB-128 with probability 2-22.Table 2
Related-key differential characteristics (DCs) of a full 10-round COSB-128.
Round(r)
Δ
X
r
(ΔKr)
E
1
/
E
2
/
E
3
Probability
IT
(0,e16) = α
(0,e16)
1
1
(0, 0)
(0,e16, 0, 0)
2−2/1/1
2−2
Z
1
2
(0, 0)
(0, 0,e16, 0)
1/1/2−2
2−2
Z
2
3
(0, 0)
(0, 0, 0,e16)
1/1/2−2
2−2
Z
3
4
(0, 0)
(e16, 0, 0, 0)
2−2/1/1
2−2
Z
4
5
(0, 0)
(0,e16, 0, 0)
2−2/1/1
2−2
Z
1
6
(0, 0)
(0, 0,e16, 0)
1/1/2−2
2−2
Z
2
7
(0, 0)
(0, 0, 0,e16)
1/1/2−2
2−2
Z
3
8
(0, 0)
(e16, 0, 0, 0)
2−2/1/1
2−2
Z
4
9
(0, 0)
(0,e16, 0, 0)
2−2/1/1
2−2
Z
1
10
(0, 0)
(0, 0,e16, 0)
1/1/2−4
2−4
Z
2
′
FT
(0,ej)
(e16, 0)
1
Output (ΔY)
(e16, ej) = β
Total
2−22We describe the way to construct the DCs in detail as follows.(Z1)
The first rounds with the input and round key differences are(0,0) and (0,e16,0,0), respectively, so the output difference of the first H is e192 with probability 1 (Section 3.1.4(a)). Thence, since the input difference and the control vector difference of F64/192 are 0 and e192, the output difference of F64/192 is 0 with probability E1=2-2 (Section 3.1.3(b)). The output difference of G is 0 with probability E2=1 when the input and the round key differences are 0 and 0, respectively (odd round cycle, Q=K1⊕K3). Plus, the output difference of F64/192-1 is 0 with probability E3=1 since output difference of the secondH is 0 with probability 1 (Section 3.1.4(b)). Finally, we can get that the output difference of function Crypt(e) is 0 with probability 2-2 in case the input differences are (0,0) under the round key differences which are (0,e16,0,0). Apply the method (Z1) for the fifth round and ninth round to find the DC of them.(Z2)
The second round with the input and round key differences are(0,0) and (0,0,e16,0), respectively; so the output difference of the first H is 0 with probability 1. Thence, since the input difference and the control vector difference of F64/192 are 0 and 0, the output difference of F64/192 is 0 with probability E1=1 (Section 3.1.3(a)). The output difference of G is 0 with probability E2=1 when the input and the round key differences are 0 and 0, respectively (even round cycle, Q=K2⊕K4). Plus, the output difference of F64/192-1 is 0 with probability E3=2-2 (Section 3.1.3(b)) since output difference of the second H is e32 with probability 1 (Section 3.1.4(b)). Finally, we can get that the output difference of function Crypt(e) is 0 with probability 2-2 in case the input differences are (0,0) under the round key differences which are (0,0,e16,0). Apply the method (Z2) for the sixth round to find the DC of it.Similarly, we can get the methods (Z3) and (Z4) with probabilities 2-2 since the input is (0,0) and round key differences are (0,0,0,e16), (e16,0,0,0), respectively.With the last round, we change a little the difference characteristics for the output ofF64/192-1 support to our related-key differential attacks. The input and round key differences of Crypt(e) are (0,0) and (0,0,e16,0). The output difference of F64/192 is 0 with probability E1=1 (the output difference of the first H is 0). Thus, the output difference of G with the input and the round key differences being 0 and 0 is 0 with probability E2=1 (Section 3.1.4(b)). Plus the output difference of the second H is e32 with probability 1 (Section 3.1.4(a)); in this case, the input difference and the control vector differences of F64/192-1 are 0 and e32; we get that the output difference F64/192-1 is ej with probability 2-4 (Section 3.1.1). Finally, for the last round, the related-key differential characteristic holds the probability 2-4.See the Appendix for more description.


### 3.3. The First Related-Key Differential Attack on COSB-128

Based on the related-key DC we have constructed, we can recover a part of master key of COSB-128.At first, we encrypt 223 plaintext pairs (P,P*) and ΔP=P⊕P*=(0,e16) to get 223 corresponding ciphertext pairs (C,C*) under an unknown key K=(K1,K2,K3,K4) and an unknown related key (K1,K2⊕e16,K3,K4). While the probability of related-key differential characteristics of COSB-128 is 2-22, we expect there are at least 2 ciphertext pairs (C,C*) with the difference (e16,ej) for each j, where 1≤j≤64. So, with the DC described in Table 2, we can infer the jth one-bit difference where the ciphertext pairs (C,C*) are given from the output differences of F1/2V6′32 in F64/192-1 at the last round (refer to Figure 3). Thence, it can be expected that the differential route given is unique and we are able to retrieve 6 bits of controlling vectors for this route.Figure 3
The possible routes of theF64/192-1 on the last round.The related-key differential attack on the full-round COSB-128 is as follows.(1)
Choose a pool of 223 plaintext pairs (Pi,Pi*) with difference ΔP=α=P⊕P*=(0,e16). Then, with the chosen plaintext attack, we encrypt the plaintext pairs using (K,K*) to get the ciphertext pairs (Ci,Ci*), in which ΔK=K⊕K*=(0,e16,0,0).(2)
For eachi and j, check if Ci⊕Ci*=(e16,ej), where 1≤i,j≤64.(3)
We assignj-BPO the bit-one positions of j. Then, with the number of ciphertext pairs satisfying the conditions at (2), we can extract some bits of the control vector through the difference route of the j-BPOs and the position of the 64th input bit of F64/192-1 (see Figure 3). From this point, because the control vector V2 of F64/192-1 in last round is in form of CL⊕K3, CL⊕K3⊕K4, and CL, we are able to find some corresponding bits of K3 and K3⊕K4.The data complexity of this attack is 224 related-key chosen plaintexts. The time complexity of (1) is about 224 full round COSB-128 encryptions and the time complexities of (2) and (3) are much less than that of (1). Also, each ciphertext pair passes (2) with probability of at least 2-22; thence, the ciphertext pairs with (e16,ej) difference are expected to be at least 2. It means, for each j (1≤j≤64), we have at least one ciphertext pair meets the (e16,ej) difference. So, we expect to retrieve 56-bit keys information of F64/192-1 and 7-bit keys information of F64/192 with the data and time complexities of 224.


### 3.4. The Second Related-Key Differential Attack on COSB-128

For increasing the differential probability, we propose the second attack by constructing another related-key differential characteristic on COSB-128 with probability2-20. In fact, we assume the probability of differential patterns of the 2nd, 3rd, 4th, 5th, and 6th layers in the box F64/192-1 at the last round is 1. It means the bit-one input difference of the 32th F2/1 always gets the direction to the j-bit output difference of the 6th layer. Also, the probability is 1 because when the input difference is (0,1) and controlling vector difference is 0 of F2/1, the corresponding hamming weight of output difference is always 1. Then, we can recover a 6-bit key with data complexity being about 222 related-key chosen plaintexts with time complexity of about 222 full round COSB-128 encryptions.The second related-key differential attack on COSB-128 is as follows.(1)
This step is same as the algorithm applied on the Step (1) of the first related-key differential attack on COSB-128 in Section3.3.(2)
For eachi, check if Ci⊕Ci*=(e16,ej), where 1≤j≤64.Thus, we can extent this attack to retrieve the whole of master key pair(K,K′) by applying an exhaustive search for the remaining keys. The exhaustive search takes a running time of 2250 encryptions and recovers the full key with the same data complexity and time complexity of about 2250 full-round COSB-128 encryptions.


## 3.1. Properties of COSB-128

We obtain some appropriate properties ofCrypt(e) function of COSB-128 that enable us to construct related-key differential characteristics.


### 3.1.1. Properties withF2/1

We assumePr⁡(F2/1)(ΔY/ΔX,ΔV) is a probability to have the output difference ΔY of F2/1, with ΔXand ΔV being the input difference and the controlling vector difference, respectively. Then we can calculate the probability as the following.(a)
Pr⁡(F2/1)((0,0)/(0,0),0)=1.(b)
Pr⁡(F2/1)((0,1)/(0,1),0)=Pr⁡(F2/1)((1,1)/(0,1),0)=2-1.(c)
Pr⁡(F2/1)((1,0)/(1,0),0)=Pr⁡(F2/1)((1,1)/(1,0),0)=2-1.(d)
Pr⁡(F2/1)((1,0)/(1,1),0)=Pr⁡(F2/1)((0,1)/(1,1),0)=2-1.(e)
Pr⁡(F2/1)((0,0)/(0,0),1)=Pr⁡(F2/1)((1,1)/(0,0),1)=2-2.(f)
Pr⁡(F2/1)((0,0)/(1,1),1)=Pr⁡(F2/1)((1,1)/(1,1),1)=2-2.(g)
Pr⁡(F2/1)(ΔY/ΔX,ΔV)=2-2,where ΔY = {(0,1),(1,0)}, ΔX={(0,1),(1,0)}, and ΔV=1.


### 3.1.2. Properties withFn/m

Extensively, we letPr⁡(Fn/m)(ΔY/ΔX,ΔV) be a probability to have the output difference ΔY of Fn/m, with ΔX being the input difference and ΔV being the controlling vector difference. We have the following.(a)
Pr⁡(Fn/m)((0)/(0),ei)=Pr⁡(Fn/m-1)((0)/(0),ei)=2-2.(b)
Pr⁡(Fn/m(V)(X))=Pr⁡(Fn/m(V⊕ei)(X))=2-2, with X∈0,1n.(c)
Pr⁡(Fn/mV-1(X))=Pr⁡(Fn/m(V⊕ei)-1(X))=2-2, with X∈0,1n.


### 3.1.3. Properties withF64/192(e)

Similarly, we can get the probabilityPr⁡(F64/192(e))(ΔY/ΔX,ΔV) of F64/192(0), F64/192(1), with ΔY-output difference, ΔX-input difference, and ΔV-controlling vector difference. Consider the following.(a)
Pr⁡(F64/192)(0/0,0)=Pr⁡(F64/192-1)(0/0,0)=1.(b)
Pr⁡(F64/192)(0/0,ei)=Pr⁡(F64/192-1)(0/0,ei)=2-2.(c)
Pr⁡(F64/192)(ej/ei,0)=Pr⁡(F64/192-1)(ej/ei,0)=2-12, for any fixed i, j.(bothF64/192 and F64/192-1 have 6 active layers F2/1 within structure)(d)
Pr⁡(F64/192)(ej/ei,ei)=Pr⁡(F64/192-1)(ej/ei,ei)=2-12, for any fixed i, j.(bothF64/192 and F64/192-1 have 6 active layers F2/1 within structure).


### 3.1.4. Properties with TransformationH and G

(a)
LetA, A′, and A′′ be the inputs of transformation H, respectively: (10)Vi=W1∣W2∣W3∣W4∣W5∣W6=HA,A′,A′′;i=1,2.
With the control vectorV1 of F64/192, we have H(A,A′,A′′)⊕(A,A′⊕e16,A′′)=e94 and H(A,A′,A′′)⊕(A,A′,A′′⊕e16)=e192. Similarly, H(A,A′,A′′)⊕(A,A′⊕e16,A′′)=e126 and H(A,A′,A′′)⊕(A,A′,A′′⊕e16)=e32 of the control vector V2 of F64/192-1.
(b)
LetA be the input of G with key-dependent metric Q; then we can get the probability Pr⁡(GQ(A)⊕GQ(A)=0)=1 and Pr⁡(GQ⊕e64(A)⊕GQ⊕e64(A)=0)=1.


## 3.1.1. Properties withF2/1

We assumePr⁡(F2/1)(ΔY/ΔX,ΔV) is a probability to have the output difference ΔY of F2/1, with ΔXand ΔV being the input difference and the controlling vector difference, respectively. Then we can calculate the probability as the following.(a)
Pr⁡(F2/1)((0,0)/(0,0),0)=1.(b)
Pr⁡(F2/1)((0,1)/(0,1),0)=Pr⁡(F2/1)((1,1)/(0,1),0)=2-1.(c)
Pr⁡(F2/1)((1,0)/(1,0),0)=Pr⁡(F2/1)((1,1)/(1,0),0)=2-1.(d)
Pr⁡(F2/1)((1,0)/(1,1),0)=Pr⁡(F2/1)((0,1)/(1,1),0)=2-1.(e)
Pr⁡(F2/1)((0,0)/(0,0),1)=Pr⁡(F2/1)((1,1)/(0,0),1)=2-2.(f)
Pr⁡(F2/1)((0,0)/(1,1),1)=Pr⁡(F2/1)((1,1)/(1,1),1)=2-2.(g)
Pr⁡(F2/1)(ΔY/ΔX,ΔV)=2-2,where ΔY = {(0,1),(1,0)}, ΔX={(0,1),(1,0)}, and ΔV=1.


## 3.1.2. Properties withFn/m

Extensively, we letPr⁡(Fn/m)(ΔY/ΔX,ΔV) be a probability to have the output difference ΔY of Fn/m, with ΔX being the input difference and ΔV being the controlling vector difference. We have the following.(a)
Pr⁡(Fn/m)((0)/(0),ei)=Pr⁡(Fn/m-1)((0)/(0),ei)=2-2.(b)
Pr⁡(Fn/m(V)(X))=Pr⁡(Fn/m(V⊕ei)(X))=2-2, with X∈0,1n.(c)
Pr⁡(Fn/mV-1(X))=Pr⁡(Fn/m(V⊕ei)-1(X))=2-2, with X∈0,1n.


## 3.1.3. Properties withF64/192(e)

Similarly, we can get the probabilityPr⁡(F64/192(e))(ΔY/ΔX,ΔV) of F64/192(0), F64/192(1), with ΔY-output difference, ΔX-input difference, and ΔV-controlling vector difference. Consider the following.(a)
Pr⁡(F64/192)(0/0,0)=Pr⁡(F64/192-1)(0/0,0)=1.(b)
Pr⁡(F64/192)(0/0,ei)=Pr⁡(F64/192-1)(0/0,ei)=2-2.(c)
Pr⁡(F64/192)(ej/ei,0)=Pr⁡(F64/192-1)(ej/ei,0)=2-12, for any fixed i, j.(bothF64/192 and F64/192-1 have 6 active layers F2/1 within structure)(d)
Pr⁡(F64/192)(ej/ei,ei)=Pr⁡(F64/192-1)(ej/ei,ei)=2-12, for any fixed i, j.(bothF64/192 and F64/192-1 have 6 active layers F2/1 within structure).


## 3.1.4. Properties with TransformationH and G

(a)
LetA, A′, and A′′ be the inputs of transformation H, respectively: (10)Vi=W1∣W2∣W3∣W4∣W5∣W6=HA,A′,A′′;i=1,2.
With the control vectorV1 of F64/192, we have H(A,A′,A′′)⊕(A,A′⊕e16,A′′)=e94 and H(A,A′,A′′)⊕(A,A′,A′′⊕e16)=e192. Similarly, H(A,A′,A′′)⊕(A,A′⊕e16,A′′)=e126 and H(A,A′,A′′)⊕(A,A′,A′′⊕e16)=e32 of the control vector V2 of F64/192-1.
(b)
LetA be the input of G with key-dependent metric Q; then we can get the probability Pr⁡(GQ(A)⊕GQ(A)=0)=1 and Pr⁡(GQ⊕e64(A)⊕GQ⊕e64(A)=0)=1.


## 3.2. Related-Key Differential Characteristics of COSB-128

With the properties defined in Section3.1 combined with such a simple key schedule of COSB-128 structure, we are able to construct the related-key differential characteristics (DCs) for COSB-128 with high probability.We assume that the plaintext pairs(P,P*) are encrypted under the key pairs (K,K*), respectively, in which α=ΔP=P⊕P*=(0,e16) and ΔK=K⊕K*=(0,e16,0,0), to get the corresponding ciphertext pairs (C,C*).Then, as Table2 shows, we can construct a 10-round related-key differential characteristic α→β, where β=(e16,ej), (1≤j≤64) for rounds 1~10 of COSB-128 with probability 2-22.Table 2
Related-key differential characteristics (DCs) of a full 10-round COSB-128.
Round(r)
Δ
X
r
(ΔKr)
E
1
/
E
2
/
E
3
Probability
IT
(0,e16) = α
(0,e16)
1
1
(0, 0)
(0,e16, 0, 0)
2−2/1/1
2−2
Z
1
2
(0, 0)
(0, 0,e16, 0)
1/1/2−2
2−2
Z
2
3
(0, 0)
(0, 0, 0,e16)
1/1/2−2
2−2
Z
3
4
(0, 0)
(e16, 0, 0, 0)
2−2/1/1
2−2
Z
4
5
(0, 0)
(0,e16, 0, 0)
2−2/1/1
2−2
Z
1
6
(0, 0)
(0, 0,e16, 0)
1/1/2−2
2−2
Z
2
7
(0, 0)
(0, 0, 0,e16)
1/1/2−2
2−2
Z
3
8
(0, 0)
(e16, 0, 0, 0)
2−2/1/1
2−2
Z
4
9
(0, 0)
(0,e16, 0, 0)
2−2/1/1
2−2
Z
1
10
(0, 0)
(0, 0,e16, 0)
1/1/2−4
2−4
Z
2
′
FT
(0,ej)
(e16, 0)
1
Output (ΔY)
(e16, ej) = β
Total
2−22We describe the way to construct the DCs in detail as follows.(Z1)
The first rounds with the input and round key differences are(0,0) and (0,e16,0,0), respectively, so the output difference of the first H is e192 with probability 1 (Section 3.1.4(a)). Thence, since the input difference and the control vector difference of F64/192 are 0 and e192, the output difference of F64/192 is 0 with probability E1=2-2 (Section 3.1.3(b)). The output difference of G is 0 with probability E2=1 when the input and the round key differences are 0 and 0, respectively (odd round cycle, Q=K1⊕K3). Plus, the output difference of F64/192-1 is 0 with probability E3=1 since output difference of the secondH is 0 with probability 1 (Section 3.1.4(b)). Finally, we can get that the output difference of function Crypt(e) is 0 with probability 2-2 in case the input differences are (0,0) under the round key differences which are (0,e16,0,0). Apply the method (Z1) for the fifth round and ninth round to find the DC of them.(Z2)
The second round with the input and round key differences are(0,0) and (0,0,e16,0), respectively; so the output difference of the first H is 0 with probability 1. Thence, since the input difference and the control vector difference of F64/192 are 0 and 0, the output difference of F64/192 is 0 with probability E1=1 (Section 3.1.3(a)). The output difference of G is 0 with probability E2=1 when the input and the round key differences are 0 and 0, respectively (even round cycle, Q=K2⊕K4). Plus, the output difference of F64/192-1 is 0 with probability E3=2-2 (Section 3.1.3(b)) since output difference of the second H is e32 with probability 1 (Section 3.1.4(b)). Finally, we can get that the output difference of function Crypt(e) is 0 with probability 2-2 in case the input differences are (0,0) under the round key differences which are (0,0,e16,0). Apply the method (Z2) for the sixth round to find the DC of it.Similarly, we can get the methods (Z3) and (Z4) with probabilities 2-2 since the input is (0,0) and round key differences are (0,0,0,e16), (e16,0,0,0), respectively.With the last round, we change a little the difference characteristics for the output ofF64/192-1 support to our related-key differential attacks. The input and round key differences of Crypt(e) are (0,0) and (0,0,e16,0). The output difference of F64/192 is 0 with probability E1=1 (the output difference of the first H is 0). Thus, the output difference of G with the input and the round key differences being 0 and 0 is 0 with probability E2=1 (Section 3.1.4(b)). Plus the output difference of the second H is e32 with probability 1 (Section 3.1.4(a)); in this case, the input difference and the control vector differences of F64/192-1 are 0 and e32; we get that the output difference F64/192-1 is ej with probability 2-4 (Section 3.1.1). Finally, for the last round, the related-key differential characteristic holds the probability 2-4.See the Appendix for more description.


## 3.3. The First Related-Key Differential Attack on COSB-128

Based on the related-key DC we have constructed, we can recover a part of master key of COSB-128.At first, we encrypt 223 plaintext pairs (P,P*) and ΔP=P⊕P*=(0,e16) to get 223 corresponding ciphertext pairs (C,C*) under an unknown key K=(K1,K2,K3,K4) and an unknown related key (K1,K2⊕e16,K3,K4). While the probability of related-key differential characteristics of COSB-128 is 2-22, we expect there are at least 2 ciphertext pairs (C,C*) with the difference (e16,ej) for each j, where 1≤j≤64. So, with the DC described in Table 2, we can infer the jth one-bit difference where the ciphertext pairs (C,C*) are given from the output differences of F1/2V6′32 in F64/192-1 at the last round (refer to Figure 3). Thence, it can be expected that the differential route given is unique and we are able to retrieve 6 bits of controlling vectors for this route.Figure 3
The possible routes of theF64/192-1 on the last round.The related-key differential attack on the full-round COSB-128 is as follows.(1)
Choose a pool of 223 plaintext pairs (Pi,Pi*) with difference ΔP=α=P⊕P*=(0,e16). Then, with the chosen plaintext attack, we encrypt the plaintext pairs using (K,K*) to get the ciphertext pairs (Ci,Ci*), in which ΔK=K⊕K*=(0,e16,0,0).(2)
For eachi and j, check if Ci⊕Ci*=(e16,ej), where 1≤i,j≤64.(3)
We assignj-BPO the bit-one positions of j. Then, with the number of ciphertext pairs satisfying the conditions at (2), we can extract some bits of the control vector through the difference route of the j-BPOs and the position of the 64th input bit of F64/192-1 (see Figure 3). From this point, because the control vector V2 of F64/192-1 in last round is in form of CL⊕K3, CL⊕K3⊕K4, and CL, we are able to find some corresponding bits of K3 and K3⊕K4.The data complexity of this attack is 224 related-key chosen plaintexts. The time complexity of (1) is about 224 full round COSB-128 encryptions and the time complexities of (2) and (3) are much less than that of (1). Also, each ciphertext pair passes (2) with probability of at least 2-22; thence, the ciphertext pairs with (e16,ej) difference are expected to be at least 2. It means, for each j (1≤j≤64), we have at least one ciphertext pair meets the (e16,ej) difference. So, we expect to retrieve 56-bit keys information of F64/192-1 and 7-bit keys information of F64/192 with the data and time complexities of 224.


## 3.4. The Second Related-Key Differential Attack on COSB-128

For increasing the differential probability, we propose the second attack by constructing another related-key differential characteristic on COSB-128 with probability2-20. In fact, we assume the probability of differential patterns of the 2nd, 3rd, 4th, 5th, and 6th layers in the box F64/192-1 at the last round is 1. It means the bit-one input difference of the 32th F2/1 always gets the direction to the j-bit output difference of the 6th layer. Also, the probability is 1 because when the input difference is (0,1) and controlling vector difference is 0 of F2/1, the corresponding hamming weight of output difference is always 1. Then, we can recover a 6-bit key with data complexity being about 222 related-key chosen plaintexts with time complexity of about 222 full round COSB-128 encryptions.The second related-key differential attack on COSB-128 is as follows.(1)
This step is same as the algorithm applied on the Step (1) of the first related-key differential attack on COSB-128 in Section3.3.(2)
For eachi, check if Ci⊕Ci*=(e16,ej), where 1≤j≤64.Thus, we can extent this attack to retrieve the whole of master key pair(K,K′) by applying an exhaustive search for the remaining keys. The exhaustive search takes a running time of 2250 encryptions and recovers the full key with the same data complexity and time complexity of about 2250 full-round COSB-128 encryptions.


## 4. Conclusion

The network-environment devices and services have increased rapidly in recent years. It leads the cryptography to new way; it does not only offer protection for stability to all known attacks, but also needs to be optimized on software-hardware implementations and suitable for most constrained environment applications in communication networks nowadays. In order to construct fast block encryption algorithms for ensuring high speed encryption in data transformation, the data-dependent controllable operations have been highly used.While the operational permutation blocks (RC5, RC6, etc. [3]) still remain limitations in protective data transformation, COSB-128 [8] is a 128-bit block and 256-bit key, which uses the controllable operational substitutions in the concept of CPB [9], is proposed to give a good performance and be stable to most known cryptanalyses.In this paper, we constructed the two related-key differential characteristics of a full 10-round of COSB-128 cipher with high probabilities based on some differential properties combined with the simple key schedule within COSB-128 structure. Then, it enables us to propose the two related-key differential attacks on COSB-128. Our attacks require 224 and 222 related-key chosen plaintexts, respectively, with the time complexities of 224 and 222 full-round COSB-128 encryptions, to recover 63 bits and 6 bits key information, respectively. This research is the first known cryptanalytic result on COSB-128 so far. Furthermore, it is hoped it will extend a new potential with better performance for cryptanalysis on this algorithm with type of ciphers in further research.



---

*Source: 617972-2015-09-27.xml*