Probabilistic Slide Cryptanalysis and Its Applications to LED-64 and - - PowerPoint PPT Presentation

▶
probabilistic slide cryptanalysis and its applications to
SMART_READER_LITE
LIVE PREVIEW

Probabilistic Slide Cryptanalysis and Its Applications to LED-64 and - - PowerPoint PPT Presentation

Nov 15, 2022 213 likes •718 views

Probabilistic Slide Cryptanalysis and Its Applications to LED-64 and Zorro Hadi Soleimany Department of Information and Computer Science, Aalto University School of Science, Finland FSE 2014 1 / 21 Outline Introduction Slide Cryptanalysis

slide-1
SLIDE 1

Probabilistic Slide Cryptanalysis and Its Applications to LED-64 and Zorro

Hadi Soleimany

Department of Information and Computer Science, Aalto University School of Science, Finland

FSE 2014

1 / 21

slide-2
SLIDE 2

Outline

Introduction Slide Cryptanalysis Even-Mansour Scheme with a Single Key Probabilistic Slide Cryptanalysis Applications on LED-64 and Zorro Conclusion

2 / 21

slide-3
SLIDE 3

Introduction Slide Cryptanalysis Even-Mansour Scheme with a Single Key Probabilistic Slide Cryptanalysis Applications on LED-64 and Zorro Conclusion

3 / 21

slide-4
SLIDE 4

Iterated Block Cipher

Block cipher: EK(P) : {0, 1}k × {0, 1}n → {0, 1}n Iterated block cipher: P Rk1 Rk2 Rk3 Rk4 · · · Rkn C Rkn−1 C = Rkn ◦ · · · ◦ Rk2 ◦ Rk1(P)

4 / 21

slide-5
SLIDE 5

Iterated Block Cipher with Periodic Subkeys

P Rk1 · · · Rkm Rk1 · · · Rkm · · · Rk1 · · · Rkm C

5 / 21

slide-6
SLIDE 6

Iterated Block Cipher with Periodic Subkeys

P Rk1 · · · Rkm Rk1 · · · Rkm · · · Rk1 · · · Rkm C

{

Fk

{

Fk

{

Fk

◮ The cipher can be presented as a cascade of identical

functions Fk.

5 / 21

slide-7
SLIDE 7

Slide Cryptanalysis [Biryukov Wagner 99]

P Fk Fk · · · Fk Fk C P′ Fk Fk · · · Fk Fk C′

6 / 21

slide-8
SLIDE 8

Slide Cryptanalysis [Biryukov Wagner 99]

P Fk Fk · · · Fk Fk C P′ Fk Fk · · · Fk Fk C′ P′ = Fk(P)

6 / 21

slide-9
SLIDE 9

Slide Cryptanalysis [Biryukov Wagner 99]

P Fk Fk · · · Fk Fk C P′ Fk Fk · · · Fk Fk C′ P′ = Fk(P) = ⇒ C′ = Fk(C) (Slid pair)

6 / 21

slide-10
SLIDE 10

Slide Cryptanalysis [Biryukov Wagner 99]

P Fk Fk · · · Fk Fk C P′ Fk Fk · · · Fk Fk C′ P′ = Fk(P) = ⇒ C′ = Fk(C) (Slid pair)

Pr[C = F −1

k

(C′), P′ = Fk(P)] = 2−n > 2−2n

Pr[P′ = Fk(P)] = 2−n = ⇒ 2n pairs ((P, C), (P′, C′)) are expected to find a slid pair.

6 / 21

slide-11
SLIDE 11

Slide Cryptanalysis [Biryukov Wagner 99]

P Fk Fk · · · Fk Fk C P′ Fk Fk · · · Fk Fk C′ P′ = Fk(P) = ⇒ C′ = Fk(C) (Slid pair)

Pr[C = F −1

k

(C′), P′ = Fk(P)] = 2−n > 2−2n

Pr[P′ = Fk(P)] = 2−n = ⇒ 2n pairs ((P, C), (P′, C′)) are expected to find a slid pair. Typical countermeasures: Key-schedule or round constants.

6 / 21

slide-12
SLIDE 12

Slide Cryptanalysis [Biryukov Wagner 99]

P Fk Fk · · · Fk Fk C P′ Fk Fk · · · Fk Fk C′ P′ = Fk(P) = ⇒ C′ = Fk(C) (Slid pair)

Pr[C = F −1

k

(C′), P′ = Fk(P)] = 2−n > 2−2n

Pr[P′ = Fk(P)] = 2−n = ⇒ 2n pairs ((P, C), (P′, C′)) are expected to find a slid pair. Typical countermeasures: Key-schedule or round constants.

This Work:

Probabilistic technique to overcome round constants in block ciphers based on the Even-Mansour scheme with a single key.

6 / 21

slide-13
SLIDE 13

Even-Mansour Scheme with a Single Key

K K K K K K P F1 · · · Fi · · · Fs C

7 / 21

slide-14
SLIDE 14

Even-Mansour Scheme with a Single Key

K K K K K K P F1 · · · Fi · · · Fs C RRCj Known as Step RRCj+1 · · · RRCj+m

◮ Block ciphers like LED-64, PRINCEcore, Zorro and

PRINTcipher.

7 / 21

slide-15
SLIDE 15

LED-64

⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕

S S S S S S S S S S S S S S S S AddConstants SubCells ShiftRows MixColumns ◮ Presented at CHES 2011 [Guo et al 11] ◮ 64-bit block cipher and supports 64-bit key ◮ 6 steps ◮ Each step consists of four rounds.

8 / 21

slide-16
SLIDE 16

Zorro

S S S S

⊕ ⊕ ⊕ ⊕

SubCells AddConstants ShiftRows MixColumns ◮ Presented at CHES 2013 [G´

erard et al 13]

◮ 128-bit block cipher and supports 128-bit key ◮ 6 steps ◮ Each step consists of four rounds

9 / 21

slide-17
SLIDE 17

Introduction Slide Cryptanalysis Even-Mansour Scheme with a Single Key Probabilistic Slide Cryptanalysis Applications on LED-64 and Zorro Conclusion

10 / 21

slide-18
SLIDE 18

Overview of Previous Attacks

◮ Slide cryptanalysis requires known plaintexts.

11 / 21

slide-19
SLIDE 19

Overview of Previous Attacks

◮ Slide cryptanalysis requires known plaintexts.

◮ But it is limited to the ciphers with identical rounds. 11 / 21

slide-20
SLIDE 20

Overview of Previous Attacks

◮ Slide cryptanalysis requires known plaintexts.

◮ But it is limited to the ciphers with identical rounds.

◮ Differential cryptanalysis is usually applicable on any round

functions [Biham Shamir 90].

11 / 21

slide-21
SLIDE 21

Overview of Previous Attacks

◮ Slide cryptanalysis requires known plaintexts.

◮ But it is limited to the ciphers with identical rounds.

◮ Differential cryptanalysis is usually applicable on any round

functions [Biham Shamir 90].

◮ But there exists a lower bound for active S-boxes and it

usually requires chosen plaintexts.

11 / 21

slide-22
SLIDE 22

Overview of Previous Attacks

◮ Slide cryptanalysis requires known plaintexts.

◮ But it is limited to the ciphers with identical rounds.

◮ Differential cryptanalysis is usually applicable on any round

functions [Biham Shamir 90].

◮ But there exists a lower bound for active S-boxes and it

usually requires chosen plaintexts.

◮ Related-key differential usually has less active S-boxes

and applicable on more rounds [Kelsey et al 97].

11 / 21

slide-23
SLIDE 23

Overview of Previous Attacks

◮ Slide cryptanalysis requires known plaintexts.

◮ But it is limited to the ciphers with identical rounds.

◮ Differential cryptanalysis is usually applicable on any round

functions [Biham Shamir 90].

◮ But there exists a lower bound for active S-boxes and it

usually requires chosen plaintexts.

◮ Related-key differential usually has less active S-boxes

and applicable on more rounds [Kelsey et al 97].

◮ But usually it is not a realistic model. 11 / 21

slide-24
SLIDE 24

Overview of Previous Attacks

◮ Slide cryptanalysis requires known plaintexts.

◮ But it is limited to the ciphers with identical rounds.

◮ Differential cryptanalysis is usually applicable on any round

functions [Biham Shamir 90].

◮ But there exists a lower bound for active S-boxes and it

usually requires chosen plaintexts.

◮ Related-key differential usually has less active S-boxes

and applicable on more rounds [Kelsey et al 97].

◮ But usually it is not a realistic model.

◮ Probabilistic reflection attack is applicable on block ciphers

with almost symmetric rounds [Soleimany et al 13].

11 / 21

slide-25
SLIDE 25

Overview of Previous Attacks

◮ Slide cryptanalysis requires known plaintexts.

◮ But it is limited to the ciphers with identical rounds.

◮ Differential cryptanalysis is usually applicable on any round

functions [Biham Shamir 90].

◮ But there exists a lower bound for active S-boxes and it

usually requires chosen plaintexts.

◮ Related-key differential usually has less active S-boxes

and applicable on more rounds [Kelsey et al 97].

◮ But usually it is not a realistic model.

◮ Probabilistic reflection attack is applicable on block ciphers

with almost symmetric rounds [Soleimany et al 13].

◮ But its application is limited to involutional block ciphers. 11 / 21

slide-26
SLIDE 26

Overview of Previous Attacks

◮ Slide cryptanalysis requires known plaintexts.

◮ But it is limited to the ciphers with identical rounds.

◮ Differential cryptanalysis is usually applicable on any round

functions [Biham Shamir 90].

◮ But there exists a lower bound for active S-boxes and it

usually requires chosen plaintexts.

◮ Related-key differential usually has less active S-boxes

and applicable on more rounds [Kelsey et al 97].

◮ But usually it is not a realistic model.

◮ Probabilistic reflection attack is applicable on block ciphers

with almost symmetric rounds [Soleimany et al 13].

◮ But its application is limited to involutional block ciphers.

This Work

Exploit previous ideas to take advantage of the positive properties and overcome the negative aspects!

11 / 21

slide-27
SLIDE 27

Probabilistic Slide Distinguisher

K K K K K K P F1 F2 · · · Fs−1 Fs C K K K K K K P′ F1 F2 · · · Fs−1 Fs C′ ∆0 ∆1 ∆s-2 ∆s-1

◮ Assume there exists a sequence of differences

D = {∆0, . . . , ∆s−1} such that Pr[Fr(x) ⊕ Fr−1(x ⊕ ∆r−2) = ∆r−1] = 2−pr−1 where 0 ≤ pr.

◮ A differential-type characteristic with input difference

∆in = ∆0 and output difference ∆out = ∆s−1 can be

  • btained with probability 2−p = Πs−1

r=12−pr .

12 / 21

slide-28
SLIDE 28

Probabilistic Slide Distinguisher

K K K K K K P F1 F2 · · · Fs−1 Fs C K K K K K K P′ F1 F2 · · · Fs−1 Fs C′ ∆out ∆in P′ ⊕ F1(P ⊕ K) = ∆in

12 / 21

slide-29
SLIDE 29

Probabilistic Slide Distinguisher

K K K K K K P F1 F2 · · · Fs−1 Fs C K K K K K K P′ F1 F2 · · · Fs−1 Fs C′ ∆out ∆in P′ ⊕ F1(P ⊕ K) = ∆in = ⇒

probability 2−p

C ⊕ F −1

s

(C′ ⊕ K) = ∆out

12 / 21

slide-30
SLIDE 30

Probabilistic Slide Distinguisher

K K K K K K P F1 F2 · · · Fs−1 Fs C K K K K K K P′ F1 F2 · · · Fs−1 Fs C′ ∆out ∆in P′ ⊕ F1(P ⊕ K) = ∆in = ⇒

probability 2−p

C ⊕ F −1

s

(C′ ⊕ K) = ∆out Pr[P′ ⊕ F1(P ⊕ K) = ∆in] = 2−n Pr[C ⊕ F −1

s

(C′ ⊕ K) = ∆out, P′ ⊕ F1(P ⊕ K) = ∆in] = 2−n−p = ⇒ 2(n+p) pairs ((P, C), (P′, C′)) are expected to find a right slid pair

12 / 21

slide-31
SLIDE 31

Key Recovery

◮ The right slid pair satisfies the relation

C′ ⊕ Fs(C ⊕ ∆out) = K = P ⊕ F −1

1 (∆in ⊕ P′, )

13 / 21

slide-32
SLIDE 32

Key Recovery

◮ The right slid pair satisfies the relation

C′ ⊕ F −1

1 (∆in ⊕ P′) = P ⊕ Fs(C ⊕ ∆out).

13 / 21

slide-33
SLIDE 33

Key Recovery

◮ The right slid pair satisfies the relation

C′ ⊕ F −1

1 (∆in ⊕ P′) = P ⊕ Fs(C ⊕ ∆out).

For given 2(n+p)/2 known (P, C): Step 1 For all pairs (P, C) compute C ⊕ F −1

1 (P ⊕ ∆in) and store

the computed value with C in the hash table T1.

13 / 21

slide-34
SLIDE 34

Key Recovery

◮ The right slid pair satisfies the relation

C′ ⊕ F −1

1 (∆in ⊕ P′) = P ⊕ Fs(C ⊕ ∆out).

For given 2(n+p)/2 known (P, C): Step 1 For all pairs (P, C) compute C ⊕ F −1

1 (P ⊕ ∆in) and store

the computed value with C in the hash table T1. Step 2 For all pairs (P, C) compute P ⊕ Fs(∆out ⊕ C) and store the computed value with C in the hash table T2.

13 / 21

slide-35
SLIDE 35

Key Recovery

◮ The right slid pair satisfies the relation

C′ ⊕ F −1

1 (∆in ⊕ P′) = P ⊕ Fs(C ⊕ ∆out).

For given 2(n+p)/2 known (P, C): Step 1 For all pairs (P, C) compute C ⊕ F −1

1 (P ⊕ ∆in) and store

the computed value with C in the hash table T1. Step 2 For all pairs (P, C) compute P ⊕ Fs(∆out ⊕ C) and store the computed value with C in the hash table T2. Step 3 For each collision in T1 and T2 find corresponding ciphertexts C and C′ then compute a key candidate K = C′ ⊕ Fs(C ⊕ ∆out).

13 / 21

slide-36
SLIDE 36

More Output Differences

K K K K K K P F1 F2 · · · Fs−1 Fs C K K K K K K P′ F1 F2 · · · Fs−1 Fs C′ ∆i

  • ut

∆in P′ = F1(P ⊕ ∆in) Pr[P′ = F1(P ⊕ ∆in)] = 2−n C′ = Fs(C ⊕ ∆i

  • ut), 1 ≤ i ≤ L

Pr[P′ = F1(P ⊕ ∆in), C′ = Fs(C ⊕ ∆i

  • ut)] = 2−n L

i=1 2−pi

◮ Decrease the data requirement by increasing the total

probability.

◮ This comes with the cost of repeating the attack algorithm

L times.

14 / 21

slide-37
SLIDE 37

Introduction Slide Cryptanalysis Even-Mansour Scheme with a Single Key Probabilistic Slide Cryptanalysis Applications on LED-64 and Zorro Conclusion

15 / 21

slide-38
SLIDE 38

Slide Cryptanalysis of LED-64

0 2 5 0 0 6 0 b 3 3 0 1 0 7 0 0

16 / 21

slide-39
SLIDE 39

Slide Cryptanalysis of LED-64

0 2 5 0 0 6 0 b 3 3 0 1 0 7 0 0

AC SC SR MC

0 1 5 0 0 0 0 b 3 0 0 1 0 1 0 0 0 7 c 0 0 0 0 8 6 0 0 7 0 9 0 0 0 7 c 0 0 0 8 0 0 7 6 0 0 0 9 0 0 1 0 0 0 5 1 0 0 7 0 0 0 5 0 0

16 / 21

slide-40
SLIDE 40

Slide Cryptanalysis of LED-64

0 2 5 0 0 6 0 b 3 3 0 1 0 7 0 0

AC SC SR MC

0 1 5 0 0 0 0 b 3 0 0 1 0 1 0 0 0 7 c 0 0 0 0 8 6 0 0 7 0 9 0 0 0 7 c 0 0 0 8 0 0 7 6 0 0 0 9 0 0 1 0 0 0 5 1 0 0 7 0 0 0 5 0 0

AC SC SR MC

0 6 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 c 0 0 0 0 d 0 0 0 0 0 0 0 0 0 0 c 0 0 0 d 0 0 0 0 0 0 0 0 0 0 0 8 0 0 0 2 0 0 0 7 0 0 0 2 0 0

16 / 21

slide-41
SLIDE 41

Slide Cryptanalysis of LED-64

0 2 5 0 0 6 0 b 3 3 0 1 0 7 0 0

AC SC SR MC

0 1 5 0 0 0 0 b 3 0 0 1 0 1 0 0 0 7 c 0 0 0 0 8 6 0 0 7 0 9 0 0 0 7 c 0 0 0 8 0 0 7 6 0 0 0 9 0 0 1 0 0 0 5 1 0 0 7 0 0 0 5 0 0

AC SC SR MC

0 6 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 c 0 0 0 0 d 0 0 0 0 0 0 0 0 0 0 c 0 0 0 d 0 0 0 0 0 0 0 0 0 0 0 8 0 0 0 2 0 0 0 7 0 0 0 2 0 0

AC SC SR MC

0 f 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 4 0 0 0 8 0 0 0 b 0 0 0 2 0 0

16 / 21

slide-42
SLIDE 42

Slide Cryptanalysis of LED-64

0 2 5 0 0 6 0 b 3 3 0 1 0 7 0 0

AC SC SR MC

0 1 5 0 0 0 0 b 3 0 0 1 0 1 0 0 0 7 c 0 0 0 0 8 6 0 0 7 0 9 0 0 0 7 c 0 0 0 8 0 0 7 6 0 0 0 9 0 0 1 0 0 0 5 1 0 0 7 0 0 0 5 0 0

AC SC SR MC

0 6 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 c 0 0 0 0 d 0 0 0 0 0 0 0 0 0 0 c 0 0 0 d 0 0 0 0 0 0 0 0 0 0 0 8 0 0 0 2 0 0 0 7 0 0 0 2 0 0

AC SC SR MC

0 f 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 4 0 0 0 8 0 0 0 b 0 0 0 2 0 0

AC SC SR MC

0 2 0 0 0 c 0 0 0 d 0 0 0 6 0 0 0 5 0 0 0 5 0 0 0 2 0 0 0 b 0 0 0 5 0 0 5 0 0 0 0 0 0 2 0 0 b 0 5 7 5 4 d e 7 a 3 1 c 7 a e 9 d

16 / 21

slide-43
SLIDE 43

Slide Cryptanalysis of LED-64

0 2 5 0 0 6 0 b 3 3 0 1 0 7 0 0

AC SC SR MC

0 1 5 0 0 0 0 b 3 0 0 1 0 1 0 0 0 7 c 0 0 0 0 8 6 0 0 7 0 9 0 0 0 7 c 0 0 0 8 0 0 7 6 0 0 0 9 0 0 1 0 0 0 5 1 0 0 7 0 0 0 5 0 0

AC SC SR MC

0 6 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 c 0 0 0 0 d 0 0 0 0 0 0 0 0 0 0 c 0 0 0 d 0 0 0 0 0 0 0 0 0 0 0 8 0 0 0 2 0 0 0 7 0 0 0 2 0 0

AC SC SR MC

0 f 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 4 0 0 0 8 0 0 0 b 0 0 0 2 0 0

AC SC SR MC

0 2 0 0 0 c 0 0 0 d 0 0 0 6 0 0 0 5 0 0 0 5 0 0 0 2 0 0 0 b 0 0 0 5 0 0 5 0 0 0 0 0 0 2 0 0 b 0 5 7 5 4 d e 7 a 3 1 c 7 a e 9 d

◮ Thanks to cancellation, the characteristic has 13 active S-boxes

while normal differential characteristic has at least 25 S-boxes.

16 / 21

slide-44
SLIDE 44

Slide Cryptanalysis of LED-64

0 2 5 0 0 6 0 b 3 3 0 1 0 7 0 0

AC SC SR MC

0 1 5 0 0 0 0 b 3 0 0 1 0 1 0 0 0 7 c 0 0 0 0 8 6 0 0 7 0 9 0 0 0 7 c 0 0 0 8 0 0 7 6 0 0 0 9 0 0 1 0 0 0 5 1 0 0 7 0 0 0 5 0 0

AC SC SR MC

0 6 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 c 0 0 0 0 d 0 0 0 0 0 0 0 0 0 0 c 0 0 0 d 0 0 0 0 0 0 0 0 0 0 0 8 0 0 0 2 0 0 0 7 0 0 0 2 0 0

AC SC SR MC

0 f 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 4 0 0 0 8 0 0 0 b 0 0 0 2 0 0

AC SC SR MC

0 2 0 0 0 c 0 0 0 d 0 0 0 6 0 0 0 a1 0 0 0 a2 0 0 0 a3 0 0 0 a4 0 0 0 a1 0 0

a2 0 0 0

0 0 0 a3 0 0 a4 0 * * * * * * * * * * * * * * * *

◮ ai ∈ Ai where A1 = {3, 5, 6, a, c, d, e}, A2 = {2, 5, 7, 8, 9, a, e},

A3 = {1, 2, 3, 4, 7, a, b} and A4 = {2, 6, 8, b, c, f}

16 / 21

slide-45
SLIDE 45

Slide Cryptanalysis of Zorro

State Difference ∆in = X I

5 ⊕ P′

00000000d52c6f72120a92b50c8c2eee X S

5 ⊕ X ′S 1

00000000d52c6f72120a92b50c8c2eee X A

5 ⊕ X A 1

04040420d52c6f72120a92b50c8c2eee X R

5 ⊕ X ′R 1

040404202c6f72d592b5120aee0c8c2e . . . . . . X A

16 ⊕ X ′A 12

1c17980d447ad32bfbc96dc0a06a35cc X R

16 ⊕ X ′R 12

1c17980d7ad32b446dc0fbc9cca06a35 ∆out = X M

16 ⊕ X ′M 12

1720c72a9351b2f0f3a4e09fb071b7f0

◮ Differential characteristic for 3 steps (probability 2−119.24). ◮ Key-recovery cryptanalysis on 4 steps. ◮ This result improves the best cryptanalysis presented by

the designers one step (four rounds).

17 / 21

slide-46
SLIDE 46

Results

Cipher Attack Type Steps Data Time Memory Source Zorro Impossible differential 2.5 2115CP 2115 2115

[G´ erard et al 13]

Meet-in-the-middle 3 22KP 2104

  • [G´

erard et al 13]

Probabilistic slide 4 2123.62KP 2123.8 2123.62 This work Probabilistic slide 4 2121.59KP 2124.23 2121.59 This work Internal differential† 6 254.25CP 254.25 254.25

[Guo et al 13]

Differential 6 2112.4CP 2108

  • [Wang et al 13]

LED-64 Meet-in-the-middle 2 28CP 256 211

[Isobe et al 12]

Generic 2 245KP 260.1 260

[Dinur et al 13]

Meet-in-the-middle 2 216CP 248 217

[Dinur et al 14]

Meet-in-the-middle 2 248KP 248 248

[Dinur et al 14]

Probabilistic slide 2 245.5KP 246.5 246.5 This work Probabilistic slide 2 241.5KP 251.5 242.5 This work Generic 3 249KP 260.2 260

[Dinur et al 13]

† – this attack is applicable just on 264 keys (out of 2128), CP – Chosen Plaintexts, KP – Known Plaintext.

18 / 21

slide-47
SLIDE 47

Introduction Slide Cryptanalysis Even-Mansour Scheme with a Single Key Probabilistic Slide Cryptanalysis Applications on LED-64 and Zorro Conclusion

19 / 21

slide-48
SLIDE 48

Conclusion and Future Work

Conclusion

◮ Framework of probabilistic slide cryptanalysis on EMS

which requires known-plaintext in the single-key model.

◮ The relation between round constants should be taken into

account .

◮ Applications of the probabilistic slide cryptanalysis on

LED-64 and Zorro. Future Work

◮ Application on other EMS block ciphers. ◮ Improve the results on Zorro and LED-64 by exploiting

differential instead of differential characteristic.

20 / 21

slide-49
SLIDE 49

Thanks for your attention!

21 / 21