Applying MILP Method to Searching Integral Distinguishers Based on - - PowerPoint PPT Presentation

▶
applying milp method to searching integral distinguishers
SMART_READER_LITE
LIVE PREVIEW

Applying MILP Method to Searching Integral Distinguishers Based on - - PowerPoint PPT Presentation

Jan 28, 2023 736 likes •1.5k views

Applying MILP Method to Searching Integral Distinguishers Based on Division Property for 6 Lightweight Block Ciphers Zejun Xiang Wentao Zhang Zhenzhen Bao Dongdai Lin Institute of Information Engineering, CAS, Beijing, China December 7, 2016.

slide-1
SLIDE 1

Applying MILP Method to Searching Integral Distinguishers Based on Division Property for 6 Lightweight Block Ciphers

Zejun Xiang Wentao Zhang Zhenzhen Bao Dongdai Lin

Institute of Information Engineering, CAS, Beijing, China

December 7, 2016. Hanoi

1 / 74

slide-2
SLIDE 2

Overview

1

Division Property

2

Combining MILP with Division Property Further Study on Division Property Modeling Basic Operations Initial Division Property Objective Function

3

Search Algorithm and Applications Search Algorithm Applications

2 / 74

slide-3
SLIDE 3

Division Property

Preliminary

Definition (Bit-Product Function [Todo, EUROCRYPT 2015]) For any fixed u ∈ (Fn0

2 × Fn1 2 × · · · × F nm−1 2

), πu(x) :(Fn0

2 × Fn1 2 × · · · × F nm−1 2

) − →F2 (x0, x1, · · · , xm−1) − →

m−1

  • i=0

(

ni −1

  • j=0

xi[j]ui [j])

3 / 74

slide-4
SLIDE 4

Division Property

Preliminary

Definition (Bit-Product Function [Todo, EUROCRYPT 2015]) For any fixed u ∈ (Fn0

2 × Fn1 2 × · · · × F nm−1 2

), πu(x) :(Fn0

2 × Fn1 2 × · · · × F nm−1 2

) − →F2 (x0, x1, · · · , xm−1) − →

m−1

  • i=0

(

ni −1

  • j=0

xi[j]ui [j]) Example: n = 4, m = 2 u = (u0

0||u1 0||u2 0||u3 0, u0 1||u1 1||u2 1||u3 1) = (0||1||1||0, 1||0||1||1)

x = (x0

0||x1 0||x2 0||x3 0, x0 1||x1 1||x2 1||x3 1) = (0||1||1||1, 1||1||0||1)

πu(x) = (00111110)(11100111) = 0

4 / 74

slide-5
SLIDE 5

Division Property

Preliminary

Definition (Bit-Product Function [Todo, EUROCRYPT 2015]) For any fixed u ∈ (Fn0

2 × Fn1 2 × · · · × F nm−1 2

), πu(x) :(Fn0

2 × Fn1 2 × · · · × F nm−1 2

) − →F2 (x0, x1, · · · , xm−1) − →

m−1

  • i=0

(

ni −1

  • j=0

xi[j]ui [j]) Example: n = 4, m = 2 u = (u0

0||u1 0||u2 0||u3 0, u0 1||u1 1||u2 1||u3 1) = (0||1||1||0, 1||0||1||1)

x = (x0

0||x1 0||x2 0||x3 0, x0 1||x1 1||x2 1||x3 1) = (0||1||1||1, 1||1||0||1)

πu(x) = (00111110)(11100111) = 0 Definition ([Todo, EUROCRYPT 2015]) Define k k∗ if ki ≥ k∗

i holds for all i = 0, 1, · · · , m − 1. Otherwise we denote k k∗.

5 / 74

slide-6
SLIDE 6

Division Property

Definition

Division Property is introduced by Todo at EUROCRYPT 2015, it’s a generalized integral property.

6 / 74

slide-7
SLIDE 7

Division Property

Definition

Division Property is introduced by Todo at EUROCRYPT 2015, it’s a generalized integral property. Definition (Division Property [Todo, EUROCRYPT 2015]) Let X ⊂ (Fn

2)m, and k(i) ∈ {0, 1, · · · , n}m. X has the division property Dn,m k(0),k(1),··· ,k(q−1), if

  • x∈X πu(x) = 0 for any

u ∈

  • (u0, u1, · · · , um−1) ∈ (Fn

2)m|W (u) k(0), · · · , W (u) k(q−1)

, among which, W (u) = (wt(u0), wt(u1), · · · , wt(um−1)) .

7 / 74

slide-8
SLIDE 8

Division Property

Using Division Property

8 / 74

slide-9
SLIDE 9

Division Property

Using Division Property

1

Construct an input set with division property Dn,m

K0 .

9 / 74

slide-10
SLIDE 10

Division Property

Using Division Property

1

Construct an input set with division property Dn,m

K0 .

2

Propagate the initial division property r rounds to get the dividion property of r-round output Dn,m

Kr .

10 / 74

slide-11
SLIDE 11

Division Property

Using Division Property

1

Construct an input set with division property Dn,m

K0 .

2

Propagate the initial division property r rounds to get the dividion property of r-round output Dn,m

Kr .

3

Extract some useful integral property from Dn,m

Kr .

11 / 74

slide-12
SLIDE 12

Division Property

Propagations of Division Property

12 / 74

slide-13
SLIDE 13

Division Property

Propagations of Division Property

Copy [Todo, CRYPTO 2015] Fn

2

− → Fn

2 × Fn 2

x − → (x, x) X − → Copy(X) Dn

k

− → D2,n

(0,k),(1,k−1),··· ,(k,0)

Xor [Todo, CRYPTO 2015] Fn

2 × Fn 2

− → Fn

2

(x0, x1) − → x0 ⊕ x1 X − → Xor(X) Dn

(k0,k1)

− → Dn

k0+k1

And [Xiang, IWSEC 2016] Fn

2 × Fn 2

− → Fn

2

(x0, x1) − → x0&x1 X − → And(X) Dn

(k0,k1)

− → Dn

max(k0,k1)

13 / 74

slide-14
SLIDE 14

Division Property

Bit-based Division Property

The division property is defined and computed on (Fn

2)m. If n = 1, this is the

bit-based division property [Todo, FSE 2016].

14 / 74

slide-15
SLIDE 15

Division Property

Bit-based Division Property

The division property is defined and computed on (Fn

2)m. If n = 1, this is the

bit-based division property [Todo, FSE 2016]. Advantages Detailed division property Longer distinguishers Better results.

15 / 74

slide-16
SLIDE 16

Division Property

Bit-based Division Property

The division property is defined and computed on (Fn

2)m. If n = 1, this is the

bit-based division property [Todo, FSE 2016]. Advantages Detailed division property Longer distinguishers Better results. Disadvantages More computation Upper bounded by O(2n) Only small size cipher.

16 / 74

slide-17
SLIDE 17

Division Property

Bit-based Division Property

The division property is defined and computed on (Fn

2)m. If n = 1, this is the

bit-based division property [Todo, FSE 2016]. Advantages Detailed division property Longer distinguishers Better results. Disadvantages More computation Upper bounded by O(2n) Only small size cipher. How to compute bit-based division property efficiently?

17 / 74

slide-18
SLIDE 18

Combining MILP with Division Property

Basic Strategy

We will use Mixed Integer Linear Programming (MILP) method to characterize the division property propagations.

18 / 74

slide-19
SLIDE 19

Combining MILP with Division Property

Basic Strategy

We will use Mixed Integer Linear Programming (MILP) method to characterize the division property propagations.

Mixed Integer Linear Programming, MILP Minimize or (Maximize) : aT · x Subject To : Mx >= 0 part of or all the variables in x are restricted in integers.

19 / 74

slide-20
SLIDE 20

Combining MILP with Division Property

Basic Strategy

Two issues need to be addressed:

20 / 74

slide-21
SLIDE 21

Combining MILP with Division Property

Basic Strategy

Two issues need to be addressed:

1 Describe the division propagations by linear (in)equalities. 21 / 74

slide-22
SLIDE 22

Combining MILP with Division Property

Basic Strategy

Two issues need to be addressed:

1 Describe the division propagations by linear (in)equalities. 2 Convert search problem to estimate the minimal value of the objective

function.

22 / 74

slide-23
SLIDE 23

Combining MILP with Division Property Further Study on Division Property

Division Trail

Definition (Division Trail) Assume the input set to the block cipher has initial division property Dn,m

k

, and denote the division property after i-round encryption by Dn,m

Ki . Thus, we have the following chain

  • f division property propagations:

{k}

def

= K0

fr

− → K1

fr

− → K2

fr

− → · · · For (k0, k1, · · · , kr) ∈ K0 × K1 × · · · × Kr, if ki−1 can propagate to ki for all i ∈ {1, 2, · · · , r} by propagation rules, we call (k0, k1, · · · , kr) an r-round division trail.

23 / 74

slide-24
SLIDE 24

Combining MILP with Division Property Further Study on Division Property

Division Trail

Definition (Division Trail) Assume the input set to the block cipher has initial division property Dn,m

k

, and denote the division property after i-round encryption by Dn,m

Ki . Thus, we have the following chain

  • f division property propagations:

{k}

def

= K0

fr

− → K1

fr

− → K2

fr

− → · · · For (k0, k1, · · · , kr) ∈ K0 × K1 × · · · × Kr, if ki−1 can propagate to ki for all i ∈ {1, 2, · · · , r} by propagation rules, we call (k0, k1, · · · , kr) an r-round division trail. Proposition The set of the last vectors of all r-round division trails which start with k is equal to Kr.

24 / 74

slide-25
SLIDE 25

Combining MILP with Division Property Further Study on Division Property

Set without Integral Property

Proposition (Set without Integral Property) Assume X is a set with division property D1,n

K , then X does not have integral property if

and only if K contains all the n unit vectors.

25 / 74

slide-26
SLIDE 26

Combining MILP with Division Property Further Study on Division Property

Set without Integral Property

Proposition (Set without Integral Property) Assume X is a set with division property D1,n

K , then X does not have integral property if

and only if K contains all the n unit vectors. Given initial division property Dn,m

k

and round number r, there doesn’t exist r-round distinguisher if and only if there exists n division trails which start with the initial division property and ends up with the n different unit vectors.

26 / 74

slide-27
SLIDE 27

Combining MILP with Division Property Further Study on Division Property

Basic Strategy

Two issues need to be addressed:

1 Describe the division propagations by linear (in)equalities. 2 Convert search problem to estimate the minimal value of the objective

function.

27 / 74

slide-28
SLIDE 28

Combining MILP with Division Property Modeling Basic Operations

Modeling Copy

28 / 74

slide-29
SLIDE 29

Combining MILP with Division Property Modeling Basic Operations

Modeling Copy

General Rule: Dn

k −

→ D2,n

(0,k),(1,k−1),··· ,(k,0).

29 / 74

slide-30
SLIDE 30

Combining MILP with Division Property Modeling Basic Operations

Modeling Copy

General Rule: Dn

k −

→ D2,n

(0,k),(1,k−1),··· ,(k,0).

Bit Based: D1

k −

→ D2,1

(0,k),(1,k−1),··· ,(k,0), (k ∈ {0, 1}).

30 / 74

slide-31
SLIDE 31

Combining MILP with Division Property Modeling Basic Operations

Modeling Copy

General Rule: Dn

k −

→ D2,n

(0,k),(1,k−1),··· ,(k,0).

Bit Based: D1

k −

→ D2,1

(0,k),(1,k−1),··· ,(k,0), (k ∈ {0, 1}).

Division Trail: (0) − → (0, 0), (1) − → (0, 1), (1) − → (1, 0).

31 / 74

slide-32
SLIDE 32

Combining MILP with Division Property Modeling Basic Operations

Modeling Copy

General Rule: Dn

k −

→ D2,n

(0,k),(1,k−1),··· ,(k,0).

Bit Based: D1

k −

→ D2,1

(0,k),(1,k−1),··· ,(k,0), (k ∈ {0, 1}).

Division Trail: (0) − → (0, 0), (1) − → (0, 1), (1) − → (1, 0). Linear Inequality Description Denote (a) − → (b0, b1) a division trail of Copy operation, the following (in)equalities are sufficient to describe the division property propagations:    a − b0 − b1 = 0 a, b0, b1 ∈ {0, 1}

32 / 74

slide-33
SLIDE 33

Combining MILP with Division Property Modeling Basic Operations

Modeling Xor

33 / 74

slide-34
SLIDE 34

Combining MILP with Division Property Modeling Basic Operations

Modeling Xor

General Rule: Dn,2

(k0,k1) −

→ Dn

k0+k1.

34 / 74

slide-35
SLIDE 35

Combining MILP with Division Property Modeling Basic Operations

Modeling Xor

General Rule: Dn,2

(k0,k1) −

→ Dn

k0+k1.

Bit Based: D1,2

(k0,k1) −

→ D1

k0+k1, (k ∈ {0, 1}).

35 / 74

slide-36
SLIDE 36

Combining MILP with Division Property Modeling Basic Operations

Modeling Xor

General Rule: Dn,2

(k0,k1) −

→ Dn

k0+k1.

Bit Based: D1,2

(k0,k1) −

→ D1

k0+k1, (k ∈ {0, 1}).

Division Trail: (0, 0) − → (0), (0, 1) − → (1), (1, 0) − → (1), (1, 1)

abort

− → (2).

36 / 74

slide-37
SLIDE 37

Combining MILP with Division Property Modeling Basic Operations

Modeling Xor

General Rule: Dn,2

(k0,k1) −

→ Dn

k0+k1.

Bit Based: D1,2

(k0,k1) −

→ D1

k0+k1, (k ∈ {0, 1}).

Division Trail: (0, 0) − → (0), (0, 1) − → (1), (1, 0) − → (1), (1, 1)

abort

− → (2). Linear Inequality Description Denote (a0, a1) − → (b) a division trail of Xor operation, the following (in)equalities are sufficient to describe the division property propagations:    a0 + a1 − b = 0 a0, a1, b ∈ {0, 1}

37 / 74

slide-38
SLIDE 38

Combining MILP with Division Property Modeling Basic Operations

Modeling And

38 / 74

slide-39
SLIDE 39

Combining MILP with Division Property Modeling Basic Operations

Modeling And

General Rule: Dn,2

(k0,k1) −

→ Dn

max(k0,k1).

39 / 74

slide-40
SLIDE 40

Combining MILP with Division Property Modeling Basic Operations

Modeling And

General Rule: Dn,2

(k0,k1) −

→ Dn

max(k0,k1).

Bit Based: D1,2

(k0,k1) −

→ D1

max(k0,k1).

40 / 74

slide-41
SLIDE 41

Combining MILP with Division Property Modeling Basic Operations

Modeling And

General Rule: Dn,2

(k0,k1) −

→ Dn

max(k0,k1).

Bit Based: D1,2

(k0,k1) −

→ D1

max(k0,k1).

Division Trail: (0, 0) − → (0), (0, 1) − → (1), (1, 0) − → (1), (1, 1) − → (1).

41 / 74

slide-42
SLIDE 42

Combining MILP with Division Property Modeling Basic Operations

Modeling And

General Rule: Dn,2

(k0,k1) −

→ Dn

max(k0,k1).

Bit Based: D1,2

(k0,k1) −

→ D1

max(k0,k1).

Division Trail: (0, 0) − → (0), (0, 1) − → (1), (1, 0) − → (1), (1, 1) − → (1). Linear Inequality Description Denote (a0, a1) − → (b) a division trail of And operation, the following inequalities are sufficient to describe the division property propagations:                b − a0 ≥ 0 b − a1 ≥ 0 b − a0 − a1 ≤ 0 a0, a1, b ∈ {0, 1}

42 / 74

slide-43
SLIDE 43

Combining MILP with Division Property Modeling Basic Operations

Modeling Sbox — PRESENT Sbox

D1,4

(0,1,1,1)

43 / 74

slide-44
SLIDE 44

Combining MILP with Division Property Modeling Basic Operations

Modeling Sbox — PRESENT Sbox

D1,4

(0,1,1,1)

PRESENT Sbox ANF of PRESENT Sbox                y3 = 1 ⊕ x0 ⊕ x1 ⊕ x3 ⊕ x1x2 ⊕ x0x1x2 ⊕ x0x1x3 ⊕ x0x2x3 y2 = 1 ⊕ x2 ⊕ x3 ⊕ x0x1 ⊕ x0x3 ⊕ x1x3 ⊕ x0x1x3 ⊕ x0x2x3 y1 = x1 ⊕ x3 ⊕ x1x3 ⊕ x2x3 ⊕ x0x1x2 ⊕ x0x1x3 ⊕ x0x2x3 y0 = x0 ⊕ x2 ⊕ x3 ⊕ x1x2

44 / 74

slide-45
SLIDE 45

Combining MILP with Division Property Modeling Basic Operations

Modeling Sbox — PRESENT Sbox

D1,4

(0,1,1,1)

PRESENT Sbox ANF of PRESENT Sbox                y3 = 1 ⊕ x0 ⊕ x1 ⊕ x3 ⊕ x1x2 ⊕ x0x1x2 ⊕ x0x1x3 ⊕ x0x2x3 y2 = 1 ⊕ x2 ⊕ x3 ⊕ x0x1 ⊕ x0x3 ⊕ x1x3 ⊕ x0x1x3 ⊕ x0x2x3 y1 = x1 ⊕ x3 ⊕ x1x3 ⊕ x2x3 ⊕ x0x1x2 ⊕ x0x1x3 ⊕ x0x2x3 y0 = x0 ⊕ x2 ⊕ x3 ⊕ x1x2 D1,4

(0,1,1,1) =

⇒ only

x x2x1x0 and x x3x2x1x0 are unknow

45 / 74

slide-46
SLIDE 46

Combining MILP with Division Property Modeling Basic Operations

Modeling Sbox — PRESENT Sbox

D1,4

(0,1,1,1)

PRESENT Sbox ANF of PRESENT Sbox                y3 = 1 ⊕ x0 ⊕ x1 ⊕ x3 ⊕ x1x2 ⊕ x0x1x2 ⊕ x0x1x3 ⊕ x0x2x3 y2 = 1 ⊕ x2 ⊕ x3 ⊕ x0x1 ⊕ x0x3 ⊕ x1x3 ⊕ x0x1x3 ⊕ x0x2x3 y1 = x1 ⊕ x3 ⊕ x1x3 ⊕ x2x3 ⊕ x0x1x2 ⊕ x0x1x3 ⊕ x0x2x3 y0 = x0 ⊕ x2 ⊕ x3 ⊕ x1x2 D1,4

(0,1,1,1) =

⇒ only

x x2x1x0 and x x3x2x1x0 are unknow

46 / 74

slide-47
SLIDE 47

Combining MILP with Division Property Modeling Basic Operations

Modeling Sbox — PRESENT Sbox

D1,4

(0,1,1,1)

PRESENT Sbox ANF of PRESENT Sbox                y3 = 1 ⊕ x0 ⊕ x1 ⊕ x3 ⊕ x1x2 ⊕ x0x1x2 ⊕ x0x1x3 ⊕ x0x2x3 y2 = 1 ⊕ x2 ⊕ x3 ⊕ x0x1 ⊕ x0x3 ⊕ x1x3 ⊕ x0x1x3 ⊕ x0x2x3 y1 = x1 ⊕ x3 ⊕ x1x3 ⊕ x2x3 ⊕ x0x1x2 ⊕ x0x1x3 ⊕ x0x2x3 y0 = x0 ⊕ x2 ⊕ x3 ⊕ x1x2 D1,4

(0,1,1,1) =

⇒ only

x x2x1x0 and x x3x2x1x0 are unknow =

⇒

x y0, x y2 are zero

47 / 74

slide-48
SLIDE 48

Combining MILP with Division Property Modeling Basic Operations

Modeling Sbox — PRESENT Sbox

D1,4

(0,1,1,1)

PRESENT Sbox ANF of PRESENT Sbox                y3 = 1 ⊕ x0 ⊕ x1 ⊕ x3 ⊕ x1x2 ⊕ x0x1x2 ⊕ x0x1x3 ⊕ x0x2x3 y2 = 1 ⊕ x2 ⊕ x3 ⊕ x0x1 ⊕ x0x3 ⊕ x1x3 ⊕ x0x1x3 ⊕ x0x2x3 y1 = x1 ⊕ x3 ⊕ x1x3 ⊕ x2x3 ⊕ x0x1x2 ⊕ x0x1x3 ⊕ x0x2x3 y0 = x0 ⊕ x2 ⊕ x3 ⊕ x1x2 D1,4

(0,1,1,1) =

⇒ only

x x2x1x0 and x x3x2x1x0 are unknow =

⇒

x y0, x y2 are zero

Moreover, y0y2 does not contain x2x1x0 or x3x2x1x0 = ⇒

x y0y2 is zero

48 / 74

slide-49
SLIDE 49

Combining MILP with Division Property Modeling Basic Operations

Modeling Sbox — PRESENT Sbox

D1,4

(0,1,1,1) S

= ⇒ D1,4

(0,0,1,0),(1,0,0,0)

PRESENT Sbox ANF of PRESENT Sbox                y3 = 1 ⊕ x0 ⊕ x1 ⊕ x3 ⊕ x1x2 ⊕ x0x1x2 ⊕ x0x1x3 ⊕ x0x2x3 y2 = 1 ⊕ x2 ⊕ x3 ⊕ x0x1 ⊕ x0x3 ⊕ x1x3 ⊕ x0x1x3 ⊕ x0x2x3 y1 = x1 ⊕ x3 ⊕ x1x3 ⊕ x2x3 ⊕ x0x1x2 ⊕ x0x1x3 ⊕ x0x2x3 y0 = x0 ⊕ x2 ⊕ x3 ⊕ x1x2 D1,4

(0,1,1,1) =

⇒ only

x x2x1x0 and x x3x2x1x0 are unknow =

⇒

x y0, x y2 are zero

Moreover, y0y2 does not contain x2x1x0 or x3x2x1x0 = ⇒

x y0y2 is zero

49 / 74

slide-50
SLIDE 50

Combining MILP with Division Property Modeling Basic Operations

Modeling Sbox

Algorithm 1: Calculating Division Trails of Sbox Input : Input division property D1,n

k

  • f n-bit Sbox, with k = (kn−1, · · · , k0)

Output: K ⊂ {0, 1}n, such that the output division property is D1,n

K 1 begin 2

¯ S = {¯ k | ¯ k k}

3

F(X) = {π¯

k(x) | ¯

k ∈ ¯ S} // all unknown monomials

4

¯ K = ∅

5

for u ∈ (F2)n do

6

if πu(y) contains any monomial of F(X) then

7

¯ K= ¯ K ∪ {u}

8

end

9

end

10

K= SizeReduce(¯ K)

11

return K

12 end 50 / 74

slide-51
SLIDE 51

Combining MILP with Division Property Modeling Basic Operations

Modeling Sbox — our new way

PRESENT Sbox

Table: Division Trails of PRESENT Sbox

Input D1,4

k

Output D1,4

K

(0,0,0,0) (0,0,0,0) (0,0,0,1) (0,0,0,1) (0,0,1,0) (0,1,0,0) (1,0,0,0) (0,0,1,0) (0,0,0,1) (0,0,1,0) (0,1,0,0) (1,0,0,0) (0,0,1,1) (0,0,1,0) (0,1,0,0) (1,0,0,0) (0,1,0,0) (0,0,0,1) (0,0,1,0) (0,1,0,0) (1,0,0,0) (0,1,0,1) (0,0,1,0) (0,1,0,0) (1,0,0,0) (0,1,1,0) (0,0,0,1) (0,0,1,0) (1,0,0,0) (0,1,1,1) (0,0,1,0) (1,0,0,0) (1,0,0,0) (0,0,0,1) (0,0,1,0) (0,1,0,0) (1,0,0,0) (1,0,0,1) (0,0,1,0) (0,1,0,0) (1,0,0,0) (1,0,1,0) (0,0,1,0) (0,1,0,0) (1,0,0,0) (1,0,1,1) (0,0,1,0) (0,1,0,0) (1,0,0,0) (1,1,0,0) (0,0,1,0) (0,1,0,0) (1,0,0,0) (1,1,0,1) (0,0,1,0) (0,1,0,0) (1,0,0,0) (1,1,1,0) (0,1,0,1) (1,0,1,1) (1,1,1,0) (1,1,1,1) (1,1,1,1)

The tables show 47 division trails of PRESENT Sbox.

51 / 74

slide-52
SLIDE 52

Combining MILP with Division Property Modeling Basic Operations

Modeling Sbox — our new way

PRESENT Sbox

Table: Division Trails of PRESENT Sbox

Input D1,4

k

Output D1,4

K

(0,0,0,0) (0,0,0,0) (0,0,0,1) (0,0,0,1) (0,0,1,0) (0,1,0,0) (1,0,0,0) (0,0,1,0) (0,0,0,1) (0,0,1,0) (0,1,0,0) (1,0,0,0) (0,0,1,1) (0,0,1,0) (0,1,0,0) (1,0,0,0) (0,1,0,0) (0,0,0,1) (0,0,1,0) (0,1,0,0) (1,0,0,0) (0,1,0,1) (0,0,1,0) (0,1,0,0) (1,0,0,0) (0,1,1,0) (0,0,0,1) (0,0,1,0) (1,0,0,0) (0,1,1,1) (0,0,1,0) (1,0,0,0) (1,0,0,0) (0,0,0,1) (0,0,1,0) (0,1,0,0) (1,0,0,0) (1,0,0,1) (0,0,1,0) (0,1,0,0) (1,0,0,0) (1,0,1,0) (0,0,1,0) (0,1,0,0) (1,0,0,0) (1,0,1,1) (0,0,1,0) (0,1,0,0) (1,0,0,0) (1,1,0,0) (0,0,1,0) (0,1,0,0) (1,0,0,0) (1,1,0,1) (0,0,1,0) (0,1,0,0) (1,0,0,0) (1,1,1,0) (0,1,0,1) (1,0,1,1) (1,1,1,0) (1,1,1,1) (1,1,1,1)

The tables show 47 division trails of PRESENT Sbox.

52 / 74

slide-53
SLIDE 53

Combining MILP with Division Property Modeling Basic Operations

Modeling Sbox — continued

For any n-bit Sbox, compute all division trails.

53 / 74

slide-54
SLIDE 54

Combining MILP with Division Property Modeling Basic Operations

Modeling Sbox — continued

For any n-bit Sbox, compute all division trails. Treat the division trails as 2n-dimensional vectors.

54 / 74

slide-55
SLIDE 55

Combining MILP with Division Property Modeling Basic Operations

Modeling Sbox — continued

For any n-bit Sbox, compute all division trails. Treat the division trails as 2n-dimensional vectors. According to [Sun, eprint 2014], a set of linear inequalities can be computed with the help of Sage software whose feasible solutions are all the division trails.

55 / 74

slide-56
SLIDE 56

Combining MILP with Division Property Modeling Basic Operations

Modeling Sbox — continued

Linear Inequalities Description of PRESENT Sbox

L =                                                                    a3 + a2 + a1 + a0 − b3 − b2 − b1 − b0 ≥ 0 −a2 − a1 − 2a0 + b3 + b1 − b0 + 3 ≥ 0 −a2 − a1 − 2a0 + 4b3 + 3b2 + 4b1 + 2b0 ≥ 0 −2a3 − a2 − a1 + 2b3 + 2b2 + 2b1 + b0 + 1 ≥ 0 −2a3 − a2 − a1 + 3b3 + 3b2 + 3b1 + 2b0 ≥ 0 −b3 + b2 − b1 + b0 + 1 ≥ 0 −2a3 − 2a2 − 2a1 − 4a0 + b3 + 4b2 + b1 − 3b0 + 7 ≥ 0 a3 + a2 + a1 + a0 − 2b3 − 2b2 + b1 − 2b0 + 1 ≥ 0 −4a2 − 4a1 − 2a0 + b3 − 3b2 + b1 + 2b0 + 9 ≥ 0 −2a0 − b3 − b2 − b1 + 2b0 + 3 ≥ 0 a0 + b3 − b2 − 2b1 − b0 + 2 ≥ 0 a3, a2, a1, a0, b3, b2, b1, b0 ∈ {0, 1}

56 / 74

slide-57
SLIDE 57

Combining MILP with Division Property Initial Division Property

Modeling Initial Division Property

{k}

def

= K0

fr

− → K1

fr

− → K2

fr

− → · · ·

fr

− → Kr

57 / 74

slide-58
SLIDE 58

Combining MILP with Division Property Initial Division Property

Modeling Initial Division Property

{k}

def

= K0

fr

− → K1

fr

− → K2

fr

− → · · ·

fr

− → Kr

58 / 74

slide-59
SLIDE 59

Combining MILP with Division Property Initial Division Property

Modeling Initial Division Property

{k}

def

= K0

fr

− → K1

fr

− → K2

fr

− → · · ·

fr

− → Kr

Denote (a0

n−1, · · · , a0 0) → · · · → (ar n−1, · · · , ar 0) as an r-round division trail, let

k = (kn−1, · · · , k0), then, add a0

i = ki for all i = 0, 1, · · · , n − 1 into the model.

59 / 74

slide-60
SLIDE 60

Combining MILP with Division Property Initial Division Property

Modeling Initial Division Property

{k}

def

= K0

fr

− → K1

fr

− → K2

fr

− → · · ·

fr

− → Kr

Denote (a0

n−1, · · · , a0 0) → · · · → (ar n−1, · · · , ar 0) as an r-round division trail, let

k = (kn−1, · · · , k0), then, add a0

i = ki for all i = 0, 1, · · · , n − 1 into the model.

60 / 74

slide-61
SLIDE 61

Combining MILP with Division Property Initial Division Property

Basic Strategy

Two issues need to be addressed:

1 Describe the division propagations by linear (in)equalities. 2 Convert search problem to estimate the minimal value of the objective

function.

61 / 74

slide-62
SLIDE 62

Combining MILP with Division Property Objective Function

Objective Function

Condition: If Kr contains all the n unit vectors, r-round integral distinguisher doesn’t exist.

62 / 74

slide-63
SLIDE 63

Combining MILP with Division Property Objective Function

Objective Function

Condition: If Kr contains all the n unit vectors, r-round integral distinguisher doesn’t exist. Objective Function: Denote (a0

n−1, · · · , a0 0) → · · · → (ar n−1, · · · , ar 0) an r-round division

trail, set the objective function as: Obj : Min{ar

0 + ar 1 + · · · ar n−1}

63 / 74

slide-64
SLIDE 64

Search Algorithm and Applications Search Algorithm

Search Algorithm — Preparation

64 / 74

slide-65
SLIDE 65

Search Algorithm and Applications Search Algorithm

Search Algorithm — Preparation

L

65 / 74

slide-66
SLIDE 66

Search Algorithm and Applications Search Algorithm

Search Algorithm — Preparation

L Obj

66 / 74

slide-67
SLIDE 67

Search Algorithm and Applications Search Algorithm

Search Algorithm — Preparation

L Obj

67 / 74

slide-68
SLIDE 68

Search Algorithm and Applications Search Algorithm

Search Algorithm — Preparation

L Obj M

68 / 74

slide-69
SLIDE 69

Search Algorithm and Applications Search Algorithm

Search Algorithm

Algorithm 2: Return r-round Distinguishers Input : M = M(L, Obj). Output: A set S indicating balanced bit positions.

1 begin 2

S = {ar

0, · · · , ar n−1} 3

for i in range (0,n) do

4

if M has feasible solutions then

5

M.optimize()

6

if M.ObjVal = 1 then

7

p = the bit position taking a value 1 in the objective function.

8

S\{p}

9

Remove the unit vector from M

10

else

11

return S

12

end

13

else

14

return S

15

end

16

end

17

return S

18 end

69 / 74

slide-70
SLIDE 70

Search Algorithm and Applications Applications

Applications

Table: Results on Some Block Ciphers

Ciphers Block Size Round(Pre.) Round Data Balanced Bits Time SIMON32 32 15(Todo) 14 31 16 4.1s SIMON48 48 14(Zhang) 16 47 24 48.2s SIMON64 64 17(Zhang) 18 63 22 6.7m SIMON96 96 21(Zhang) 22 95 5 17.4m SIMON128 128 25(Zhang) 26 127 3 58.4m SIMECK32 32 15(Todo) 15 31 7 6.5s SIMECK48 48 12(Todo) 18 47 5 56.6s SIMECK64 64 12(Todo) 21 63 5 3.0m PRESENT 64 7(Wu) 9 60 1 3.4m RECTANGLE 64 7(Zhang) 9 60 16 4.1m LBlock 64 16(Zhang) 16 63 32 4.9m TWINE 64 16(Zhang) 16 63 32 2.6m

70 / 74

slide-71
SLIDE 71

Search Algorithm and Applications Applications

Applications

Table: Results on Some Block Ciphers

Ciphers Block Size Round(Pre.) Round Data Balanced Bits Time SIMON32 32 15(Todo) 14 31 16 4.1s SIMON48 48 14(Zhang) 16 47 24 48.2s SIMON64 64 17(Zhang) 18 63 22 6.7m SIMON96 96 21(Zhang) 22 95 5 17.4m SIMON128 128 25(Zhang) 26 127 3 58.4m SIMECK32 32 15(Todo) 15 31 7 6.5s SIMECK48 48 12(Todo) 18 47 5 56.6s SIMECK64 64 12(Todo) 21 63 5 3.0m PRESENT 64 7(Wu) 9 60 1 3.4m RECTANGLE 64 7(Zhang) 9 60 16 4.1m LBlock 64 16(Zhang) 16 63 32 4.9m TWINE 64 16(Zhang) 16 63 32 2.6m

71 / 74

slide-72
SLIDE 72

Search Algorithm and Applications Applications

Applications

Table: Results on Some Block Ciphers

Ciphers Block Size Round(Pre.) Round Data Balanced Bits Time SIMON32 32 15(Todo) 14 31 16 4.1s SIMON48 48 14(Zhang) 16 47 24 48.2s SIMON64 64 17(Zhang) 18 63 22 6.7m SIMON96 96 21(Zhang) 22 95 5 17.4m SIMON128 128 25(Zhang) 26 127 3 58.4m SIMECK32 32 15(Todo) 15 31 7 6.5s SIMECK48 48 12(Todo) 18 47 5 56.6s SIMECK64 64 12(Todo) 21 63 5 3.0m PRESENT 64 7(Wu) 9 60 1 3.4m RECTANGLE 64 7(Zhang) 9 60 16 4.1m LBlock 64 16(Zhang) 16 63 32 4.9m TWINE 64 16(Zhang) 16 63 32 2.6m

72 / 74

slide-73
SLIDE 73

Search Algorithm and Applications Applications

References

Todo Yosuke (2015) Structural Evaluation by Generalized Integral Property Advances in Cryptology–EUROCRYPT 2015 287–314 Todo Yosuke (2015) Integral Cryptanalysis on Full MISTY1 Annual Cryptology Conference–CRYPTO 2015 413–432 Todo Yosuke et al. (2016) Bit-Based Division Property and Application to Simon Family Fast Software Encryption–FSE 2016 To be appear. Christina Boura et al. (2016) Another View of Division Property Advances in Cryptology–CRYPTO 2016 To be appear. Siwei Sun et al. (2014) Automatic security evaluation and (related-key) differential characteristic search: application to SIMON, PRESENT, LBlcok, DES(L) and other bit-oriented block ciphers eprint–http://eprint.iacr.org/ Zejun Xiang et al. (2016) On the Division Property of Simon48 and Simon64 International Workshop on Security 2016

73 / 74

slide-74
SLIDE 74

Search Algorithm and Applications Applications

Thanks for Listening !

https://eprint.iacr.org/2016/857

74 / 74