The Construction and Application of (Related-Key) Conditional Differential Neural Distinguishers on KATAN

Abstract

At CRYPTO 2019, Ghor applied deep learning to the cryptanalysis of block ciphers and presented neural distinguishers instead of purely differential distinguishers, which improved key recovery attacks of Speck32/64 using Bayesian optimization. In this paper, the authors attempt to improve the performance of neural distinguishers (NDs) and apply new NDs to present practical key recovery attacks on KATAN ciphers. First, with the help of MILP model, we present a (related-key) conditional differential neural distinguishers ((RK)CDNDs) of KATAN ciphers. The (RK)CDNDs use a new data format, combining with conditions and multiple differences. Compared to previous work, we greatly improve the number of rounds and the accuracy of NDs in both single-key and related-key scenarios. Moreover, a related-key conditional differential cryptanalysis framework based on deep learning is proposed with the RKCDNDs, resulting in a significant improvement from the previous. We present a practical key recovery attack on the 125-round KATAN32. The data complexity is $2^{15.7}$ and the time complexity is $2^{19.9}$. We also present 106-round KATAN48 and 95-round KATAN64 practical key recovery attacks. The extension of key recovery attack improves the results for two more rounds by calculating the wrong key response profile in parallel. Our work not only increases the number of attack rounds and the recoverable key bits, but also reduces the computational complexity.

A Appendix

In, Sect. 3.3, we construct MILP Models for KATAN cipers. In Appendix, we present the vectors and sets of linear inequalities mentioned in page 9. When $a_t=0$, the difference state ($\varDelta l_t, \varDelta l_{t+5}, \varDelta l_{t+4}, \varDelta l_{t+7}, \varDelta k_{2t}$) can take on one of $2^5$ values. According to the equation (2), we get all 32 values of the 7-demensional vector ($\varDelta l_t, \varDelta l_{t+5}, \varDelta l_{t+4}, \varDelta l_{t+7}, \varDelta k_{2t}, \varDelta r_{t+19}, c$), which is shown in Table 9. We use SageMath to model vectors and obtain a set of linear inequalities. After a simple reduction, we get a set of linear inequalities (10).

Table 9. 32 vectors ($\varDelta l_t, \varDelta l_{t+5}, \varDelta l_{t+4}, \varDelta l_{t+7}, \varDelta k_{2t}, \varDelta r_{t+19}, c$)

$$\begin{aligned} {\left\{ \begin{array}{ll} -\varDelta l_{i+7}+c\ge 0,\\ -\varDelta l_{i+4}+c\ge 0,\\ \varDelta l_{i+4}+\varDelta l_{i+7}-c\ge 0,\\ \varDelta l_i+\varDelta l_{i+5}-\varDelta l_{i+4}-\varDelta l_{i+7}-\varDelta k_{2i}-\varDelta r_{i+19}+c+2\ge 0,\\ \varDelta l_i+\varDelta l_{i+5}+\varDelta k_{2i}-\varDelta r_{i+19}+c\ge 0,\\ \varDelta l_i+\varDelta l_{i+5}+\varDelta l_{i+7}-\varDelta k_{2i}+\varDelta r_{i+19}\ge 0,\\ -\varDelta l_i+\varDelta l_{i+5}+\varDelta k_{2i}+\varDelta r_{i+19}+c\ge 0,\\ \varDelta l_{i+5}+\varDelta l_{i+7}-\varDelta k_{2i}+\varDelta r_{i+19}-c+1\ge 0,\\ \varDelta l_i-\varDelta l_{i+5}+\varDelta k_{2i}+\varDelta r_{i+19}+c\ge 0,\\ -\varDelta l_i-\varDelta l_{i+5}+\varDelta k_{2i}-\varDelta r_{i+19}+c+2\ge 0,\\ -\varDelta l_i+\varDelta l_{i+5}+\varDelta l_{i+7}-\varDelta k_{2i}-\varDelta r_{i+19}+2\ge 0,\\ \varDelta l_i-\varDelta l_{i+5}-\varDelta k_{2i}-\varDelta r_{i+19}+c+2\ge 0,\\ -\varDelta l_i-\varDelta l_{i+5}-\varDelta k_{2i}+\varDelta r_{i+19}+c+2\ge 0,\\ \end{array}\right. } \end{aligned}$$

(10)

When $a_t=1$, the difference state ($\varDelta l_t, \varDelta l_{t+5}, \varDelta l_{t+4}, \varDelta l_{t+7}, \varDelta l_{t+9}, \varDelta k_{2t}$) can take on one of $2^6$ values. According to the Eq. (2), we get all 64 values of the 8-demensional vector ($\varDelta l_t, \varDelta l_{t+5}, \varDelta l_{t+4}, \varDelta l_{t+7}, \varDelta l_{t+9}, \varDelta k_{2t}, \varDelta r_{t+19}, c$), which is shown in Table 10. We use SageMath to model vectors and obtain a set of linear inequalities. After a simple reduction, we get a set of linear inequalities (11).

Table 10. 64 vectors ($\varDelta l_t, \varDelta l_{t+5}, \varDelta l_{t+4}, \varDelta l_{t+7}, \varDelta l_{t+9}, \varDelta k_{2t}, \varDelta r_{t+19}, c$)

$$\begin{aligned} {\left\{ \begin{array}{ll} -\varDelta l_{i+7}+c\ge 0,\\ -\varDelta l_{i+4}+c\ge 0,\\ -\varDelta l_i-\varDelta l_{i+5}-\varDelta l_{i+9}+\varDelta k_{2i}+\varDelta r_{i+19}+c+2\ge 0,\\ \varDelta l_i+\varDelta l_{i+5}-\varDelta l_{i+9}-\varDelta k_{2i}-\varDelta r_{i+19}+c+2\ge 0,\\ -2\varDelta l_i+\varDelta l_{i+5}+2\varDelta l_{i+7}-2\varDelta l_{i+9}-2\varDelta k_{2i}+\varDelta r_{i+19}-c+5\ge 0,\\ -\varDelta l_i+\varDelta l_{i+5}+\varDelta l_{i+4}+\varDelta l_{i+9}+\varDelta k_{2i}-\varDelta r_{i+19}+c\ge 0,\\ -\varDelta l_i-\varDelta l_{i+5}+\varDelta l_{i+9}-\varDelta k_{2i}+\varDelta r_{i+19}+c+2\ge 0,\\ \varDelta l_i+\varDelta l_{i+5}+\varDelta l_{i+4}+\varDelta l_{i+9}-\varDelta k_{2i}+\varDelta r_{i+19}\ge 0,\\ \varDelta l_i-\varDelta l_{i+5}-\varDelta l_{i+4}-\varDelta l_{i+7}+\varDelta l_{i+9}-\varDelta k_{2i}-\varDelta r_{i+19}+2c+2\ge 0,\\ \varDelta l_i+\varDelta l_{i+5}-\varDelta l_{i+9}+\varDelta k_{2i}+\varDelta r_{i+19}+c\ge 0,\\ \varDelta l_i-\varDelta l_{i+5}+\varDelta l_{i+9}+\varDelta k_{2i}+\varDelta r_{i+19}+c\ge 0,\\ \varDelta l_i-\varDelta l_{i+5}-\varDelta l_{i+9}-\varDelta k_{2i}+\varDelta r_{i+19}+c+2\ge 0,\\ \varDelta l_{i+4}+\varDelta l_{i+7}-c\ge 0,\\ \varDelta l_i-\varDelta l_{i+5}-\varDelta l_{i+9}+\varDelta k_{2i}-\varDelta r_{i+19}+c+2\ge 0,\\ -\varDelta l_i-\varDelta l_{i+5}-\varDelta l_{i+9}-\varDelta k_{2i}-\varDelta r_{i+19}+c+4\ge 0,\\ \end{array}\right. } \end{aligned}$$

(11)

According to the Eq. (3), the difference state ($\varDelta r_t, \varDelta r_{t+11}, \varDelta r_{t+6}, \varDelta r_{t+8}$, $\varDelta l_{t+10}, \varDelta r_{t+15}, \varDelta k_{2t+1}$) can take on one of $2^7$ values. We get all 128 values of the 9-demensional vector ($\varDelta r_t, \varDelta r_{t+11}, \varDelta r_{t+6}, \varDelta r_{t+8}$, $\varDelta l_{t+10}, \varDelta r_{t+15}, \varDelta k_{2t+1}, \varDelta l_{t+13}, c$), which is shown in Table 11. We use SageMath to model vectors and obtain a set of linear inequalities. After a simple reduction, we get a set of linear inequalities (12).

Table 11. 128 vectors ($\varDelta r_t, \varDelta r_{t+11}, \varDelta r_{t+6}, \varDelta r_{t+8}, \varDelta l_{t+10}, \varDelta r_{t+15}, \varDelta k_{2t+1}, \varDelta l_{t+13}, c$)

$$\begin{aligned} {\left\{ \begin{array}{ll} -\varDelta r_{i+6}+c\ge 0,\\ -\varDelta r_{i+8}+c\ge 0,\\ -\varDelta r_{i+10}+c\ge 0,\\ -\varDelta r_{i+15}+c\ge 0,\\ -\varDelta r_i-\varDelta r_{i+11}-\varDelta r_{i+6}-\varDelta r_{i+8}-\varDelta r_{i+10}+\varDelta r_{i+15}+\varDelta k_{2i+1}-\varDelta l_{i+13}+3c+2\ge 0,\\ -\varDelta r_i-\varDelta r_{i+11}-\varDelta r_{i+6}+\varDelta r_{i+8}-\varDelta r_{i+10}-\varDelta r_{i+15}+\varDelta k_{2i+1}+\varDelta l_{i+13}+2c+2\ge 0,\\ \varDelta r_{i+6}+\varDelta r_{i+8}+\varDelta r_{i+10}+\varDelta r_{i+15}-c\ge 0,\\ -\varDelta r_i-\varDelta r_{i+11}+\varDelta r_{i+6}+\varDelta r_{i+8}+\varDelta r_{i+15}-\varDelta k_{2i+1}+\varDelta l_{i+13}+2\ge 0,\\ -\varDelta r_i-\varDelta r_{i+11}+\varDelta r_{i+6}-\varDelta r_{i+8}+\varDelta r_{i+10}-\varDelta r_{i+15}+\varDelta k_{2i+1}-\varDelta l_{i+13}+2c+2\ge 0,\\ \varDelta r_i-\varDelta r_{i+11}-\varDelta k_{2i+1}+\varDelta l_{i+13}+2c\ge 0,\\ -\varDelta r_i+\varDelta r_{i+11}-\varDelta r_{i+6}+\varDelta r_{i+8}-\varDelta r_{i+10}-\varDelta r_{i+15}+\varDelta k_{2i+1}-\varDelta l_{i+13}+2c+2\ge 0,\\ -\varDelta r_i+\varDelta r_{i+11}+\varDelta k_{2i+1}+\varDelta l_{i+13}+c\ge 0,\\ \varDelta r_i-\varDelta r_{i+11}+\varDelta r_{i+8}+\varDelta r_{i+10}+\varDelta r_{i+15}+\varDelta k_{2i+1}-\varDelta l_{i+13}-c+2\ge 0,\\ \varDelta r_i+\varDelta r_{i+11}-\varDelta r_{i+6}-\varDelta r_{i+8}-\varDelta r_{i+10}+\varDelta r_{i+15}+\varDelta k_{2i+1}-\varDelta l_{i+13}+3c\ge 0,\\ \varDelta r_i+\varDelta r_{i+11}+\varDelta r_{i+6}-\varDelta r_{i+8}+\varDelta r_{i+10}-\varDelta r_{i+15}+\varDelta k_{2i+1}-\varDelta l_{i+13}+2c\ge 0,\\ \varDelta r_i+\varDelta r_{i+11}+\varDelta r_{i+8}+\varDelta r_{i+10}+\varDelta r_{i+15}+\varDelta k_{2i+1}+\varDelta l_{i+13}-c\ge 0,\\ -\varDelta r_i+\varDelta r_{i+11}-\varDelta k_{2i+1}-\varDelta l_{i+13}+c\ge 0,\\ \varDelta r_i-\varDelta r_{i+11}-\varDelta r_{i+6}+\varDelta r_{i+8}+\varDelta r_{i+10}-\varDelta r_{i+15}+\varDelta k_{2i+1}+\varDelta l_{i+13}+2c\ge 0,\\ -\varDelta r_i+\varDelta r_{i+11}+\varDelta r_{i+6}+\varDelta r_{i+8}+\varDelta r_{i+10}-\varDelta k_{2i+1}+\varDelta l_{i+13}-c+2\ge 0,\\ -\varDelta r_i+\varDelta r_{i+11}+\varDelta r_{i+6}+\varDelta r_{i+8}+\varDelta r_{i+15}+\varDelta k_{2i+1}-\varDelta l_{i+13}-c+2\ge 0,\\ -\varDelta r_i-\varDelta r_{i+11}-\varDelta r_{i+6}-\varDelta r_{i+8}-\varDelta r_{i+10}-\varDelta r_{i+15}-\varDelta k_{2i+1}-\varDelta l_{i+13}+3c+4\ge 0,\\ \end{array}\right. } \end{aligned}$$

(12)