• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제13권11호
• /
• pp.5773-5784
• /
• 2019

ARIA is an involutory SPN block cipher. Its block size is 128-bit and the master key sizes are 128/192/256-bit, respectively. Accordingly, they are called ARIA-128/192/256. As we all know, ARIA is a Korean Standard block cipher nowadays. This paper focuses on the security of ARIA against impossible differential attack. We firstly construct a new 4-round impossible differential of ARIA. Furthermore, based on this impossible differential, a new 7-round impossible differential attack on ARIA-256 is proposed in our paper. This attack needs 2¹¹⁸ chosen plaintexts and 2²¹⁰ 7-round encryptions. Comparing with the previous best result, we improve both the data complexity and time complexity. To our knowledge, it is the best impossible differential attack on ARIA-256 so far.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제15권10호
• /
• pp.3815-3833
• /
• 2021

MILP-based automatic search is the most common method in analyzing the security of cryptographic algorithms. However, this method brings many issues such as low efficiency due to the large size of the model, and the difficulty in finding the contradiction of the impossible differential distinguisher. To analyze the security of ESF algorithm, this paper introduces a simplified MILP-based search model of the differential distinguisher by reducing constrains of XOR and S-box operations, and variables by combining cyclic shift with its adjacent operations. Also, a new method to find contradictions of the impossible differential distinguisher is proposed by introducing temporary variables, which can avoid wrong and miss selection of contradictions. Based on a 9-round impossible differential distinguisher, 15-round attack of ESF can be achieved by extending forward and backward 3-round in single-key setting. Compared with existing results, the exact lower bound of differential active S-boxes in single-key setting for 10-round ESF are improved. Also, 2108 9-round impossible differential distinguishers in single-key setting and 14 12-round impossible differential distinguishers in related-key setting are obtained. Especially, the round of the discovered impossible differential distinguisher in related-key setting is the highest, and compared with the previous results, this attack achieves the highest round number in single-key setting.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제10권4호
• /
• pp.1944-1956
• /
• 2016

The Digital Video Broadcasting-Common Scrambling Algorithm is an ETSI-designated algorithm designed for protecting MPEG-2 signal streams, and it is universally used. Its structure is a typical hybrid symmetric cipher which contains stream part and block part within a symmetric cipher, although the entropy is 64 bits, there haven't any effective cryptanalytic results up to now. This paper studies the security level of CSA against impossible differential cryptanalysis, a 20-round impossible differential for the block cipher part is proposed and a flaw in the cipher structure is revealed. When we attack the block cipher part alone, to recover 16 bits of the initial key, the data complexity of the attack is O(2^44.5), computational complexity is O(2^22.7) and memory complexity is O(2^10.5) when we attack CSA-BC reduced to 21 rounds. According to the structure flaw, an attack on CSA with block cipher part reduced to 21 rounds is proposed, the computational complexity is O(2^21.7), data complexity is O(2^43.5) and memory complexity is O(2^10.5), we can recover 8 bits of the key accordingly. Taking both the block cipher part and stream cipher part of CSA into consideration, it is currently the best result on CSA which is accessible as far as we know.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제16권3호
• /
• pp.972-985
• /
• 2022

In the year 2020, a new lightweight block cipher µ² is proposed. It has both good software and hardware performance, and it is especially suitable for constrained resource environment. However, the security evaluation on µ² against impossible differential cryptanalysis seems missing from the specification. To fill this gap, an impossible differential cryptanalysis on µ² is proposed. In this paper, firstly, some cryptographic properties on µ² are proposed. Then several longest 7-round impossible differential distinguishers are constructed. Finally, an impossible differential cryptanalysis on µ² reduced to 10 rounds is proposed based on the constructed distinguishers. The time complexity for the attack is about 2^69.63 10-round µ² encryptions, the data complexity is O(2⁴⁸), and the memory complexity is 2^63.57 Bytes. The reported result indicates that µ² reduced to 10 rounds can't resist against impossible differential cryptanalysis.

• 정보보호학회논문지
• /
• 제14권3호
• /
• pp.107-115
• /
• 2004

SHACAL-2는 국제 표준 해쉬 알고리즘 SHA-2의 압축 함수에 기반을 둔 최대 512 비트 키 크기를 가지는 256 비트 블록 암호이다. 최근에 SHACAL-2는 NESSIE 프로젝트의 256 비트 블록 암호에 선정되었으며. 현재까지 SHACAL-2의 안전성에 대한 문제점은 제기되지 않았다. 본 논문에서는 불능 차분 공격에 대한 SHACAL-2의 안전성을 논의한다. 본 논문은 두 가지 형태의 14 라운드 불능 차분 특성을 구성한다. 이를 이용하여 512 비트 키를 사용하는 30 라운드 SHACAL-2의 공격을 소개한다. 공격 결과를 요약하면 744개의 선택 평문을 가지고 2$^{495.1}$ 30 라운드 SHACAL-2 암호화 과정의 시간 복잡도로 전수 조사 과정보다 빠른 30 라운드 SHACAL-2의 공격이 가능하다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제13권1호
• /
• pp.435-451
• /
• 2019

Impossible differential cryptanalysis is an essential cryptanalytic technique and its key point is whether there is an impossible differential path. The main factor of influencing impossible differential cryptanalysis is the length of the rounds of the impossible differential trail because the attack will be more close to the real encryption algorithm with the number becoming longer. We provide the upper bound of the longest impossible differential trails of several important block ciphers. We first analyse the national standard of the Russian Federation in 2015, Kuznyechik, which utilizes the 16-byte LFSR to achieve the linear transformation. We conclude that there is no any 3-round impossible differential trail of the Kuznyechik without the consideration of the specific S-boxes. Then we ascertain the longest impossible differential paths of several other important block ciphers by using the matrix method which can be extended to many other block ciphers. As a result, we show that, unless considering the details of the S-boxes, there is no any more than or equal to 5-round, 7-round and 9-round impossible differential paths for KLEIN, Midori64 and MIBS respectively.

• 정보보호학회논문지
• /
• 제27권3호
• /
• pp.427-437
• /
• 2017

불능 차분 특성은 해당 블록 암호를 랜덤 치환과 구별을 해주며, 키 복구 공격에도 사용될 수 있다. 최근 Cui 등이 ARX 기반 블록 암호에 대해 Mixed-Integer Linear Programming(MILP)를 이용해서 자동화된 불능 차분 특성 탐색 방법을 제안하였다. Cui 등이 제안한 방법을 개선하면 기존에 방법에 비해 더 적은 선형 제약식을 이용하여 기존 방식으로 찾지 못하는 불능 차분 특성까지 추가 되어 더 많은 불능 차분 특성을 찾아 낼 수 있다. 수정한 방법을 이용하여 SPECK family와 LEA에 적용하였다. SPECK32, SPECK48, SPECK64, SPECK96에 대해 7-라운드, SPECK128에 대해 8-라운드 불능 차분 특성을 찾아내었다. 이 불능 차분 특성은 모두 새롭게 발견된 것이다. LEA에 대해서는 기존의 10-라운드인 불능 차분 특성을 포함한 새로운 10-라운드 불능 차분 특성을 찾아내었다.

• 정보보호학회논문지
• /
• 제15권3호
• /
• pp.103-107
• /
• 2005

미 연방 표준 블록 암호 AES에 대한 불능 차분 공격은 $2^{91.5}$개의 선택 평문과 $2^{122}$번의 암호화 과정을 요구하는 6 라운드 공격이 제시되었다$^[4]$. 본 논문에서는 AES에 대한 여러 가지 4 라운드 불능 차분 특성을 소개하고. 이를 이용하여 6 라운드 AES에 대한 향상된 불능 차분 공격을 제시한다. 향상된 6 라운드불능 차분 공격은 $2^{83.4}$개의 선택 평문과 $2^{105.4}$번의 암호화 과정으로 첫 번째와 마지막 라운드 키의 11 바이트를 찾는다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제13권11호
• /
• pp.5717-5730
• /
• 2019

LBlock-s is the core block cipher of authentication encryption algorithm LAC, which uses the same structure of LBlock and an improved key schedule algorithm with better diffusion property. Using the differential properties of the key schedule algorithm and the cryptanalytic technique which combines impossible boomerang attacks with related-key attacks, a 15-round related-key impossible boomerang distinguisher is constructed for the first time. Based on the distinguisher, an attack on 22-round LBlock-s is proposed by adding 4 rounds on the top and 3 rounds at the bottom. The time complexity is about only 2^68.76 22-round encryptions and the data complexity is about 2⁵⁸ chosen plaintexts. Compared with published cryptanalysis results on LBlock-s, there has been a sharp decrease in time complexity and an ideal data complexity.

• 정보보호학회논문지
• /
• 제34권4호
• /
• pp.569-575
• /
• 2024

64비트 블록암호 IIoTBC는 산업용 IoT 기기의 보안을 목적으로 설계된 암호 알고리즘으로써 128비트의 비밀키를 사용한다. IIoTBC는 IoT에 사용되는 MCU 크기가 8비트인지 16비트인지에 따라 암호화 방식이 달라진다. 본 논문에서는 MCU의 크기가 8비트인 경우 IIoTBC에 대한 차분공격을 다룬다. IIoTBC의 14-라운드의 차분특성을 이용하여 전체 32-라운드 중 15-라운드를 공격한다. 이때 필요한 선택평문과 암호화 연산은 각각 2⁵⁷과 2^122.4이다. 본 논문에서 제시한 차분특성은 기존 13-라운드 불능차분 특성보다 긴 라운드를 가지며, 이를 이용한 공격은 IIoTBC에 대한 첫 키복구 공격 결과이다.