• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.6
• /
• pp.1259-1270
• /
• 2019

The upper bound of differential characteristic probability is mainly used to determine the number of rounds when constructing a block cipher. As the number of rounds affects the performance of block cipher, it is critical to evaluate the tight upper bound in the constructing process. In order to calculate the upper bound of differential characteristic probability, the previous searching methods for minimum number of active S-boxes constructed constraint equations for non-linear operations and linear operations, independently. However, in the case of BOGI design strategy, where linear operation is dependent on non-linear operation, the previous methods may present the less tight upper bound. In this paper, we exploit the properties of BOGI strategy to propose a new method to evaluate a tighter upper bound of differential characteristic probability than previous ones. Additionally, we mathematically proved the validity of our method. Our proposed method was applied to GIFT-64 and GIFT-128, which are based on BOGI strategy, and the upper bounds of differential characteristic probability were derived until 9 round. Previously, the upper bounds of differential characteristic probability for 7-round GIFT-64 and 9-round GIFT-128 were 2^-18.395 and 2^-26.885, respectively, while we show that the upper bounds of differential characteristic probability are more tight as 2^-19.81 and 2^-28.3, respectively.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.3
• /
• pp.349-356
• /
• 2020

GIFT is a PRESENT-like cryptographic algorithm proposed in CHES 2017 and used S-box that can be implemented through a bit-slice technique[1]. Since bit-permutation is used as a linear layer, it can be efficiently implemented in hardware, but bit-slice implementation in software requires a specific conversion process, which is costly. In this paper, we propose a new bit-permutation that enables efficient bit-slice implementation and GIFT-64-variant using it. GIFT-64-variant has better safety than the existing GIFT in terms of differential and linear cryptanalysis.

• Journal of Korea Multimedia Society
• /
• v.11 no.8
• /
• pp.1111-1120
• /
• 2008

Cellular automata(CA) is often applied to design cryptosystems because it has good diffusion and local interaction effects. Recently, a 128-bit CA-based block cipher, called CAB1, and a 64-bit reversible CA-based block cipher, called CAB2, were proposed in KMMS'02 and CEC'04, respectively. In this paper, we introduce cryptanalytic results on CAB1 and CAB2. Firstly, we propose a differential attack on CAB1, which requires $2^{31.41}$ chosen plaintexts with about $2^{13.41}$ encryptions. Secondly, we show that CAB2 has a security of 184 bits using the statistical weakness. Note that the designers of CAB2 insist that it has a security of 224 bits. These are the first known cryptanalytic results on them.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.19 no.1
• /
• pp.10-23
• /
• 1994

To transmit information efficiently and securely in On-line transmission, data compression, secrecy and authentication are required. In this paper, we propose LZWH4 which creates two compression strings with applying Hnageul to LZW. design HDES1 by extending S-box (S1-S16) which satsfies SAC and correlation coefficient as a partial countermeasure of Differential Cryptanalysis and implement LZWHDES1 which concatenates efficiently these for digital signature in On-line transmission. Also HDES1 is more in U.D.(Unicity Distance) than DES and HDES. We show that the proposed LZWHDES1 reduces processing times than LZWHDES which LZW is directly concatnated to DES and LZWHDES which LZWH1 is directly concatenated to HDES. LZWHDES1 can be used to digital signature system as conventional key cryptosystem.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.1
• /
• pp.15-24
• /
• 2018

In this paper, we explain a method of appproximating the differentials probability using a SAT solver. It is possible to increase the probability by constructing the differential characteristic which already known to differentials with a SAT solver. We apply our method to SPECK32 and SPECK48. As a result, we introduced a SPECK32's 10-round differentials with a probability of$2^{-30.39}$, and SPECK48's 12-round differentials with probability of $2^{-46.8}$. Both differentials are new and longer round and higher probability than previous ones. Using the differentials presented in this paper, we improved attacks of SPECK32/64 to 15 round, SPECK48/72 to 16 round, SPECK48/96 to 17 round, which attack 1 more rounds of previous works.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.15 no.6
• /
• pp.2148-2167
• /
• 2021

The proliferation of the Internet of Things (IoT) technologies and applications, especially the rapid rise in the use of mobile devices, from individuals to organizations, has led to the fundamental role of secure wireless networks in all aspects of services that presented with many opportunities and challenges. To ensure the CIA (confidentiality, integrity and accessibility) security model of the networks security and high efficiency of performance results in various resource-constrained applications and environments of the IoT platform, DDO-(data-driven operation) based constructions have been introduced as a primitive design that meet the demand of high speed encryption systems. Among of them, the TMN-family ciphers which were proposed by Tuan P.M., Do Thi B., etc., in 2016, are entirely suitable approaches for various communication applications of wireless mobile networks (WMNs) and advanced wireless sensor networks (WSNs) with high flexibility, applicability and mobility shown in two different algorithm selections, TMN64 and TMN128. The two ciphers provide strong security against known cryptanalysis, such as linear attacks and differential attacks. In this study, we demonstrate new probability results on the security of the two TMN construction versions - TMN64 and TMN128, by proposing efficient related-key recovery attacks. The high probability characteristics (DCs) are constructed under the related-key differential properties on a full number of function rounds of TMN64 and TMN128, as 10-rounds and 12-rounds, respectively. Hence, the amplified boomerang attacks can be applied to break these two ciphers with appropriate complexity of data and time consumptions. The work is expected to be extended and improved with the latest BCT technique for better cryptanalytic results in further research.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.5 no.1
• /
• pp.3-16
• /
• 1995

In this paper, we deal with the cryptographic properties of Boolean functions generated by recursively extended methods from the points of balancedness, nonlinearity and correlation properties. First, we propose a new concept 'Strict Uncorrelated Criterion(SUC)' for two Boolean functions as a necessary condition for constructing Boolean functions of S-box which can be guaranteed to be resistant against Differential cryptanalysis, then we show that the recurively extended Boolean functions with particular form preserve the SUC. We also examine the correlation properties of Boolean functions using Walsh-Hadamard transformations and apply them to discuss nonlinearity, correlation properties and SUC of semi-bent function which is defined over odd dimensional vector space. Finally, we compare semi-bent function with Boolean functions which are generated by other similar recursive methods.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.3
• /
• pp.27-35
• /
• 2011

Design of Sensor nodes in Wireless Sensor Network(WSN) should be considered some properties as electricity consumption, transmission speed, range, etc., and also be needed the protection against various attacks (e.g., eavesdropping, hacking, leakage of customer's secret data, and denial of services). The stream cipher Rabbit, selected for the final eSTREAM portfolio organized by EU ECRYPT and selected as algorithm in part of ISO/IEC 18033-4 Stream Ciphers on ISO Security Standardization recently, is a high speed stream cipher suitable for WSN. Since the stream cipher Rabbit was evaluated the complexity of side-channel analysis attack as 'Medium' in a theoretical approach, thus the method of power analysis attack to the stream cipher Rabbit and the verification of our method by practical experiments were described in this paper. We implemented the stream cipher Rabbit without countermeasures of power analysis attack on IEEE 802.15.4/ZigBee board with 8-bit RISC AVR microprocessor ATmega128L chip, and performed the experiments of power analysis based on difference of means and template using a Hamming weight model.

• Journal of the Institute of Electronics Engineers of Korea SD
• /
• v.46 no.11
• /
• pp.8-15
• /
• 2009

Side-channel attacks including the differential power analysis attack are often more powerful than classical cryptanalysis and have to be seriously considered by cryptographic algorithm's implementers. Various countermeasures have been proposed against such attacks. In this paper, we deal with the masking method, which is known to be a very effective countermeasure against the differential power analysis attack and propose new gate-level conversion methods between Boolean and arithmetic masks. The new methods require only 6n-5 XOR and 2n-2 AND gates with 3n-2 gate delay for converting n-bit masks. The basic idea of the proposed methods is that the carry and the sum bits in the ripple adder are manipulated in a way that the adversary cannot detect the relation between these bits and the original raw data. Since the proposed methods use only bitwise operations, they are especially useful for DPA-securely implementing cryptographic algorithms in hardware which use both Boolean and arithmetic operations. For example, we applied them to securely implement the block encryption algorithm SEED in hardware and present its detailed implementation result.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.8 no.1
• /
• pp.123-136
• /
• 2004

In this paper, complexity and regularity of polynomial multiplication over $GF({2^n})$ are defined by using Hamming weight of rows and columns of the matrix ever GF(2) which represents polynomial multiplication. It is shown experimentally that in order to construct the block cipher robust against differential cryptanalysis, polynomial multiplication of substitution layer and the permutation layer should have high complexity and high regularity. With result of the experiment, a way of constituting S box and G function is suggested in the block cipher whose structure is similar to SEED, which is KOREA standard of 128-bit block cipher. S box can be formed with a nonlinear function and an affine transform. Nonlinear function must be strong with differential attack and linear attack, and it consists of an inverse number over $GF({2^8})$ which has neither a fixed pout, whose input and output are the same except 0 and 1, nor an opposite fixed number, whose output is one`s complement of the input. Affine transform can be constituted so that the input/output correlation can be the lowest and there can be no fixed point or opposite fixed point. G function undergoes linear transform with 4 S-box outputs using the matrix of 4${\times}$4 over $GF({2^8})$. The components in the matrix of linear transformation have high complexity and high regularity. Furthermore, G function can be constituted so that MDS(Maximum Distance Separable) code can be formed, SAC(Strict Avalanche Criterion) can be met, and there can be no weak input where a fixed point an opposite fixed point, and output can be two`s complement of input. The primitive polynomials of nonlinear function affine transform and linear transformation are different each other. The S box and G function suggested in this paper can be used as a constituent of the block cipher with high security, in that they are strong with differential attack and linear attack with no weak input and they are excellent at diffusion.