New zero-sum distinguishers on full 24-round Keccak-f using the division property
New zero-sum distinguishers on full 24-round Keccak-f using the division property
复制标题
DOI：
10.1049/iet-ifs.2018.5263
复制
发表时间：
2019-02
期刊：
影响因子：
--
通讯作者：
Hailun Yan;Xuejia Lai;Lei Wang;Yu Yu-Yu;Yiran Xing
中科院分区：
文献类型：
--
作者：
Hailun Yan;Xuejia Lai;Lei Wang;Yu Yu-Yu;Yiran Xing
分析了Keccak(SHA-3竞赛的获胜者)的安全性，重点分析了它的潜在排列(称为Keccak-f)的零和判别符。作者的分析是利用除法性质，这是一种最初用于对称密钥算法的积分密码分析的广义积分性质。继TODO在CRYPTO 2015上首创的工作之后，他们首先在假设S盒的规范为攻击者所知的假设下，形式化并证明了除法属性的更精细的传播规则。然后，他们将这一规则应用于Keccak-f中的逆S盒，并进一步研究了它的代数度的性质。他们发现，除法性质的下降速度比随机选择的S盒的下降速度要温和。同时，他们对Ascon置换中的S盒也得到了同样的结果。由于这一易受攻击的性质，它们可以在所需的选择明文数量方面改善针对Keccak-f的逆的高阶微分特性。作为应用，他们在大小为2 1573的全24轮Keccak-f上给出了新的零和判别器。据作者所知，这是目前全轮Keccak-f置换的最好的零和判别器。顺便说一句，他们给出了12轮Ascon排列的相应结果。
The authors analyse the security of Keccak (the winner in SHA-3 competition) by focusing on the zero-sum distinguishers of its underlying permutation (named Keccak- f ). The authors' analyses are developed by using the division property, a generalised integral property that was initially used in the integral cryptanalysis of symmetric-key algorithms. Following the work pioneered by Todo at CRYPTO 2015, they first formalise and prove a more delicate propagation rule of the division property under the assumption that the S-box's specification is known to attackers. Then, they apply this rule to the inverse S-box in Keccak- f with a further study on properties of its algebraic degree. They find that the rate of decline in the division property is gentler than that of a randomly chosen S-box. Meanwhile, they get the same results for the S-box in Ascon permutation. Thanks to this vulnerable property, they can improve the higher-order differential characteristics against the inverse of Keccak- f in terms of the required number of chosen plaintexts. As an application, they give new zero-sum distinguishers on full 24-round Keccak- f of size 2 1573 . To the authors' knowledge, this is currently the best zero-sum distinguishers of full-round Keccak- f permutation. Incidentally, they give the corresponding results for 12-round Ascon permutation.