Statistical integral distinguisher with multi-structure and its application on AES-like ciphers

Abstract

Integral attack is one of the most powerful tools in the field of symmetric ciphers. In order to reduce the time complexity of original integral one, Wang et al. firstly proposed a statistical integral distinguisher at FSE’16. However, they don’t consider the cases that there are several integral properties on output and multiple structures of data should be used at the same time. In terms of such cases, we put forward a new statistical integral distinguisher, which enables us to reduce the data complexity comparing to the traditional integral ones under multiple structures. As illustrations, we use it into the known-key distinguishers on AES-like ciphers including AES and the permutations of Whirlpool, PHOTON and Grøstl-256 hash functions based on the Gilbert’s work at ASIACRYPT’14. These new distinguishers are the best ones comparing with previous ones under known-key setting. Moreover, we propose a secret-key distinguisher on 5-round AES under chosen-ciphertext mode. Its data, time and memory complexities are 2^114.32 chosen ciphertexts, 2¹¹⁰ encryptions and 2^33.32 blocks. This is the best integral distinguisher on AES with secret S-box under secret-key setting so far.

Appendices

Appendix

A.1 Experimental results

In order to verify the theoretical model of statistical integral distinguisher in Section 3, we implement the distinguishing attack in Section 4.2 on a mini variant of AES with the block size 64-bit denoted as AES* here. The round function of AES* is similar to that of AES, including four operations, i.e.,SB,SR,MC and AK. 64-bit block is partitioned into 16 nibbles and SB uses S-box S₀ in LBlock. SR is same as that of AES, and the matrix used in MC is

$$M=\left( \begin{array}{llll} 1&1&4&9\\ 9&1&1&4\\ 4&9&1&1\\ 1&4&9&1 \end{array}\right), $$

which is defined over GF(2⁴). For the multiplication, each nibble and value in M are considered as a polynomial over GF(2) and then the nibble is multiplied modulo x⁴ + x + 1 by the value in M. The addition is simply XOR operation. The subkeys are XORed with the nibbles in AK operation.

There is similar known-key integral distinguisher for 8-round AES* since its similarity to AES, see Fig. 1. Given a set of data $\mathcal {Z}=\{(x,0,0,0) \oplus R(y,0,0,0)|x\in (0,1)^{16}\}$ for fixed y, i.e., the first column of $\mathcal {Z}$ takes all 2¹⁶ possible values and other columns are fixed to some constants, after S ◇ R ◇ S operation, each column of output v is active, i.e. that 2¹⁶ values are uniformly distributed on each column of ouput. Since $R^{-1}(\mathcal {Z})=\{R^{-1}(x,0,0,0)\oplus (y,0,0,0)\}$ has 2¹⁶ structures that each one takes all 2¹⁶ possible values on the first columns and constants on other columns, after (S ◇ R ◇ S)^− 1 operation, each column of output u is active.

In our experiment, we consider the distributions of four 8-bit values in v including the first and second nibble in each column of v. Here s = 16,t = 8 and b = 4. If we set α₀ = 0.2 and take different values for N and N _s , α₁ and τ can be computed using (8). By randomly choosing N _s values for y and N values for x, we proceed the experiment to compute the statistics C^′ for AES* and random permutations. With 2000 times of experiments, we can obtain the empirical error probabilities $\widehat {\alpha _{0}}$ and $\widehat {\alpha _{1}}$. The experimental results for $\widehat {\alpha _{0}}$ and $\widehat {\alpha _{1}}$ are compared with the theoretical values α₀ and α₁ in Fig. 4.

Fig. 4

Experimental results for AES* considering four input bytes. In detail, set the value of α₀ and change the values of N and N _s , the theoretical and empirical α₀ are shown in the left part of figure, corresponding α₁ calculated and tested by equation (5) are shown in the right part of figure

Moreover, we implement the second experiment where we set b= 4 including two bytes of u and two bytes of v. We set α₀ = 0.2 and let N = N _s , the empirical error probabilities are obtained from 1000 times of experiments. The experimental results for $\widehat {\alpha _{0}}$ and $\widehat {\alpha _{1}}$ are compared with the theoretical values α₀ and α₁ in Fig. 5.

Fig. 5

Experimental results for AES* considering two input and output bytes. In detail, set the theoretical α₀ = 0.2 and change the values of N, then the corresponding theoretical α₁ and empirical α₀ and α₁ are calculated and tested by equation (5) in this figure

Figures 4 and 5 show that the test results for the error probabilities are in good accordance with those for theoretical model.