Estimating Differential-Linear Distinguishers and Applications to CTC2
At FSE 2014, Blondeau et al. proposed an exact expression of the bias of differential-linear approximation and a multidimensional generalization of differential-linear distinguisher. In this paper, we study the application of the theory to concrete designs. We first propose a meet-in-the-middle style searching-and-estimating process. Then, we show that the capacity of a multiple differential distinguisher using χ 2 statistical test can be written as the summation of squared correlations of several differential-linear distinguishers. This link provides us with another approach to estimating the theoretical capacity of multiple differential distinguisher.
We apply the above methods to CTC2. CTC2 was designed by Courtois to show the strength of algebraic cryptanalysis on block ciphers. For CTC2 with a 255-bit block size and key, we give a multiple differential attack against 11-round version, which to our knowledge is the best with respect to the number of attacked rounds. Experimental results firmly verify the correctness of the proposed method. The attack itself, and its potential to be further extended, reveals that the resistance of CTC2 against statistical attacks may be much weaker than expected before.
Keywordsblock cipher differential-linear cryptanalysis truncated differential multiple differential cryptanalysis CTC2
Unable to display preview. Download preview PDF.
- 3.Biham, E., Shamir, A.: Differential cryptanalysis of the full 16-round des. In: Brickell, E.F. (ed.) Advances in Cryptology - CRYPTO 1992. LNCS, vol. 740, pp. 487–496. Springer, Heidelberg (1993)Google Scholar
- 5.Blondeau, C., Leander, G., Nyberg, K.: Differential-linear cryptanalysis revisited. In: FSE 2012. LNCS. Springer, Heidelberg (2014) (to appear) Google Scholar
- 10.Courtois, N.T.: Ctc2 and fast algebraic attacks on block ciphers revisisted. Tech. rep., Cryptology ePrint Archive, Report 2007/152 (2007), http://eprint.iacr.org
- 12.Lallemand, V., Naya-Plasencia, M.: Cryptanalysis of klein. In: Fast Software Encryption (2014) (to appear)Google Scholar
- 13.Langford, S.K., Hellman, M.E.: Differential-linear cryptanalysis. In: Desmedt, Y.G. (ed.) Advances in Cryptology - CRYPTO 1994. LNCS, vol. 839, pp. 17–25. Springer, Heidelberg (1994)Google Scholar
- 16.Lu, J.: A methodology for differential-linear cryptanalysis and its applications. In: Designs, Codes and Cryptography pp. 1–38 (2014)Google Scholar
- 17.Matsui, M.: Linear cryptanalysis method for des cipher. In: Helleseth, T. (ed.) Advances in Cryptology - EUROCRYPT 1993. LNCS, vol. 765, pp. 386–397. Springer, Heidelberg (1994)Google Scholar
- 18.Matsui, M., Yamagishi, A.: A new method for known plaintext attack of feal cipher. In: Rueppel, R.A. (ed.) Advances in Cryptology - EUROCRYPT 1992. LNCS, vol. 658, pp. 81–91. Springer, Heidelberg (1993)Google Scholar