New Division Property Propagation Table: Applications to Block Ciphers with Large S-boxes
New Division Property Propagation Table: Applications to Block Ciphers with Large S-boxes
复制标题
DOI：
10.1093/comjnl/bxaa203
复制
发表时间：
2021-02
期刊：
影响因子：
--
通讯作者：
Xichao Hu;Yongqiang Li;Lin Jiao;Mingsheng Wang
中科院分区：
文献类型：
--
作者：
Xichao Hu;Yongqiang Li;Lin Jiao;Mingsheng Wang
除法性质法是一种在分组密码上自动搜索整数区分符的技术。以前的方法仅使用基于字的除法属性来搜索具有大S盒的分组密码的积分区分符。由于使用基于位的划分属性可能会比基于字的划分属性找到更长的整数区分符，因此我们提出了一种针对具有大S盒的分组密码基于基于位的划分属性自动搜索整数区分符的方法。为了实现这一目标，我们提出了一个新的 S 盒除法属性传播表。理论上，我们证明使用新表和传统方法来描述S盒的基于位的除法属性传播规则将得到相同的积分区分符。从技术上讲，我们设计了一种基于混合整数线性规划的工具来根据新表搜索积分区分符，这有助于高效地为具有大S盒的分组密码搜索新的积分区分符。因此，我们应用我们的工具来导出新的积分区分符，并获得 ICEBERG、KHAZAD、Camellia、CS-Cipher、ITUbee 和 SMS4 不存在积分区分符的回合的严格约束。此外，为了显示我们积分区分器的可用性，我们以 ICEBERG 为例形成当前最好的五轮和第一个六轮积分攻击。
The division property method is a technique for automatic searching integral distinguishers on block ciphers. Previous methods only use word-based division property to search integral distinguishers for block ciphers with large S-boxes. Since using bit-based division property may find longer integral distinguishers than word-based division property, we propose a method to automatically search the integral distinguishers based on bit-based division property for block ciphers with large S-boxes. To achieve this goal, we propose a new division property propagation table for S-boxes. Theoretically, we prove that using both the new table and the traditional method to describe the bit-based division property propagation rule of S-box will lead to the same integral distinguishers. Technically, we design a mixed-integer linear programming-based tool to search the integral distinguisher based on the new table, which helps to search new integral distinguishers for block ciphers with large S-boxes efficiently. As a result, we apply our tool to derive new integral distinguishers and get the tight bound on the rounds that no integral distinguishers exist for ICEBERG, KHAZAD, Camellia, CS-Cipher, ITUbee and SMS4. Besides, to show the availability of our integral distinguishers, we form the present best five-round and the first six-round integral attack for ICEBERG as an example.