Please use this identifier to cite or link to this item: https://hdl.handle.net/10356/104754
Title: Boomerang connectivity table revisited. Application to SKINNY and AES
Authors: Hu, Lei
Song, Ling
Qin, Xianrui
Keywords: Block Cipher
DRNTU::Science::Mathematics
Boomerang Attack
Issue Date: 2019
Source: Song, L., Qin, X., & Hu, L. (2019). Boomerang connectivity table revisited. Application to SKINNY and AES. IACR Transactions on Symmetric Cryptology, 2019(1), 118-141. doi:10.13154/tosc.v2019.i1.118-141
Series/Report no.: IACR Transactions on Symmetric Cryptology
Abstract: The boomerang attack is a variant of differential cryptanalysis which regards a block cipher E as the composition of two sub-ciphers, i.e., E = E1o E0, and which constructs distinguishers for E with probability p2q2 by combining differential trails for E0 and E1 with probability p and q respectively. However, the validity of this attack relies on the dependency between the two differential trails. Murphy has shown cases where probabilities calculated by p2q2 turn out to be zero, while techniques such as boomerang switches proposed by Biryukov and Khovratovich give rise to probabilities greater than p2q2. To formalize such dependency to obtain a more accurate estimation of the probability of the distinguisher, Dunkelman et al. proposed the sandwich framework that regards E as Ẽ1o Em o Ẽ0, where the dependency between the two differential trails is handled by a careful analysis of the probability of the middle part Em. Recently, Cid et al. proposed the Boomerang Connectivity Table (BCT) which unifies the previous switch techniques and incompatibility together and evaluates the probability of Em theoretically when Em is composed of a single S-box layer. In this paper, we revisit the BCT and propose a generalized framework which is able to identify the actual boundaries of Em which contains dependency of the two differential trails and systematically evaluate the probability of Em with any number of rounds. To demonstrate the power of this new framework, we apply it to two block ciphers SKINNY and AES. In the application to SKINNY, the probabilities of four boomerang distinguishers are re-evaluated. It turns out that Em involves5 or 6 rounds and the probabilities of the full distinguishers are much higher than previously evaluated. In the application to AES, the new framework is used to exclude incompatibility and find high probability distinguishers of AES-128 under the related-subkey setting. As a result, a 6-round distinguisher with probability 2−109.42 is constructed. Lastly, we discuss the relation between the dependency of two differential trails in boomerang distinguishers and the properties of components of the cipher.
URI: https://hdl.handle.net/10356/104754
http://hdl.handle.net/10220/49464
DOI: 10.13154/tosc.v2019.i1.118-141
Rights: © 2019 The Author(s). All rights reserved. This paper was published by Ruhr University Bochum in IACR Transactions on Symmetric Cryptology and is made available with permission of The Author(s).
Fulltext Permission: open
Fulltext Availability: With Fulltext
Appears in Collections:SPMS Journal Articles

Files in This Item:
File Description SizeFormat 
Boomerang connectivity table revisited. Application to SKINNY and AES.pdf3.03 MBAdobe PDFThumbnail
View/Open

SCOPUSTM   
Citations 20

9
Updated on Mar 3, 2021

PublonsTM
Citations 20

7
Updated on Mar 7, 2021

Page view(s)

205
Updated on May 24, 2022

Download(s) 50

90
Updated on May 24, 2022

Google ScholarTM

Check

Altmetric


Plumx

Items in DR-NTU are protected by copyright, with all rights reserved, unless otherwise indicated.