Abstract
We present a new algorithm for upper bounding the maximum average linear hull probability for SPNs, a value required to determine provable security against linear cryptanalysis. The best previous result (Hong et al. [9]) applies only when the linear transformation branch number (B) is M or (M + 1) (maximal case), where M is the number of s-boxes per round. In contrast, our upper bound can be computed for any value of B. Moreover, the new upper bound is a function of the number of rounds (other upper bounds known to the authors are not). When B = M, our upper bound is consistently superior to [9]. When B = (M + 1), our upper bound does not appear to improve on [9]. On application to Rijndael (128-bit block size, 10 rounds), we obtain the upper bound UB = 2−75, corresponding to a lower bound on the data complexity of \( \frac{8} {{UB}} = {\text{2}}^{{\text{78}}} \) (for 96.7% success rate). Note that this does not demonstrate the existence of a such an attack, but is, to our knowledge, the first such lower bound.
Keywords
References
E. Biham, On Matsui’s linear cryptanalysis, Advances in Cryptology—EUROCRYPT'94, Springer-Verlag, pp. 341–355, 1995.
E. Biham and A. Shamir, Differential cryptanalysis of DES-like cryptosystems, Journal of Cryptology, Vol. 4, No. 1, pp. 3–72, 1991.
J. Daemen, R. Govaerts, and J. Vandewalle, Correlation matrices, Fast Software Encryption: Second International Workshop, Springer-Verlag, pp. 275–285, 1995.
J. Daemen, L. Knudsen, and V. Rijmen, The block cipher SQUARE, Fast Software Encryption—FSE'97, Springer-Verlag, pp. 149–165, 1997.
J. Daemen and V. Rijmen, AES proposal: Rijndael, http://csrc.nist.gov/encryption/aes/round2/AESAlgs/Rijndael/Rijndael.pdf, 1999.
H. Feistel, Cryptography and computer privacy, Scientific American, Vol. 228, No. 5, pp. 15–23, May 1973.
C. Harpes, G. Kramer, and J. Massey, Agener alization of linear cryptanalysis and the applicability of Matsui’s piling-up lemma, Advances in Cryptology—EUROCRYPT'95, Springer-Verlag, pp. 24–38, 1995.
H.M. Heys and S.E. Tavares, Substitution-permutation networks resistant to differential and linear cryptanalysis, Journal of Cryptology, Vol. 9, No. 1, pp. 1–19, 1996.
S. Hong, S. Lee, J. Lim, J. Sung, and D. Cheon, Provable security against differential and linear cryptanalysis for the SPN structure, Fast Software Encryption (FSE 2000), Proceedings to be published by Springer-Verlag.
L.R. Knudsen, Practically secure Feistel ciphers, Fast Software Encryption, Springer-Verlag, pp. 211–221, 1994.
M. Matsui, Linear cryptanalysis method for DES cipher, Advances in Cryptology—EUROCRYPT'93, Springer-Verlag, pp. 386–397, 1994.
M. Matsui, On correlation between the order of s-boxes and the strength of DES, Advances in Cryptology—EUROCRYPT'94, Springer-Verlag, pp. 366–375, 1995.
W. Meier and O. Staffelbach, Nonlinearity criteria for cryptographic functions, Advances in Cryptology—EUROCRYPT'89, Springer-Verlag, pp. 549–562, 1990.
K. Nyberg, Linear approximation of block ciphers, Advances in Cryptology—EUROCRYPT'94, Springer-Verlag, pp. 439–444, 1995.
C.E. Shannon, Communication theory of secrecy systems, Bell System Technical Journal, Vol. 28, no. 4, pp. 656–715, 1949.
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2001 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Keliher, L., Meijer, H., Tavares, S. (2001). New Method for Upper Bounding the Maximum Average Linear Hull Probability for SPNs. In: Pfitzmann, B. (eds) Advances in Cryptology — EUROCRYPT 2001. EUROCRYPT 2001. Lecture Notes in Computer Science, vol 2045. Springer, Berlin, Heidelberg. https://doi.org/10.1007/3-540-44987-6_26
Download citation
DOI: https://doi.org/10.1007/3-540-44987-6_26
Published:
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-42070-5
Online ISBN: 978-3-540-44987-4
eBook Packages: Springer Book Archive