Rigorous upper bounds on data complexities of block cipher cryptanalysis

1.1 Our contributions

The major motivation of this work is to derive rigorous upper bounds on the data complexity in terms of PS and a. In particular, we do not use any approximation in the statistical analysis^[1]. To show that this can indeed be done, we consider five basic cryptanalytic scenarios. These are single linear cryptanalysis, single differential cryptanalysis, multiple linear cryptanalysis, multiple differential cryptanalysis and the task of distinguishing between two probability distributions. In each case, we show that it is indeed possible to obtain rigorous upper bounds on the data complexity.

The theoretical work is supported by several computations. For the block cipher Serpent, we use the joint distribution of multiple linear approximations [15] to compute the approximate data complexity given by the analysis in [19] and also the upper bound on data complexity obtained in this work. The ratio of these two values turns out to be between 43 and 63. We further make detailed experimental comparisons of the upper bounds that we obtain to the previously best-known approximate values of data complexities by using simulated joint distributions. For the cases of single linear cryptanalysis, single differential cryptanalysis and distinguisher, the ratio of the upper bound to the approximate expression is around 10 or smaller. For multiple linear cryptanalysis, the ratio is between 4 and 200. These indicate that the upper bounds that we obtain are not too far away from the approximate values obtained earlier. From a practical point of view, we think it is better to use the upper bound to measure the strength of a cipher, since it may turn out that the approximate data complexities are actually underestimates.

For multiple differential cryptanalysis, however, the upper bound turns out to be much larger than the approximate estimate obtained earlier. The reason for this could be one or both of the following: the approximate value is an underestimate or the upper bound is an overestimate. Deciding the exact reason requires more work.

The data complexity expressions that we obtain are valid for all values of the success probability PS and advantage a. So, for example, these expressions can be evaluated to obtain data complexities for PS=0.1. Such an attack has a 10% chance of being successful and from a cryptanalytic point of view would be considered a valid attack. In earlier work on multiple linear cryptanalysis [19] for the data complexity expressions to be valid, the condition PS>0.5 is required. This is mentioned in [19] without any explanation. It turns out that the condition PS>0.5 is a consequence of using the normal approximation, and we refer to [32] for more details on this issue.

The hypothesis testing based approach is used to analyze the attacks. This requires obtaining the probabilities of type-I and type-II errors. In the approximate analysis, normal approximations are used to conveniently handle these probabilities. We use a different approach. The type-I and type-II error probabilities are essentially tail probabilities for a sum of some random variables. There are known rigorous methods for handling such tail probabilities, though, to the best of our knowledge, these methods have not been applied to the hypothesis testing setting.

For the cases of single linear and single differential cryptanalysis, it is required to bound the tail probabilities of a sum of independent Bernoulli distributed random variables. The usual method for handling this is to use the Chernoff bound. Using the Chernoff bound to upper bound the type-I and type-II error probabilities quite nicely leads to an expression for the data complexity.

In the cases of multiple linear or multiple differential cryptanalysis, the test statistic is no longer a sum of Bernoulli distributed random variables. As a result, the Chernoff bound does not apply. To tackle these cases, we take recourse to Hoeffding’s inequality. This inequality allows us to bound the required tail probabilities to obtain upper bounds on the type-I and type-II error probabilities. The case of distinguisher is tackled similarly.

The importance of our work is twofold. On the one hand, we bring an amount of rigor to the statistical treatment of basic block cipher cryptanalysis. More generally, the techniques that we apply have broad applicability and it should be possible to tackle data complexities of other attacks by using these techniques. From a practical point of view, our computations confirm that the upper bounds that we obtain are greater than the approximate data complexities reported earlier. Since it is not known whether the approximate values are under- or overestimates, we think it is better to use the upper bounds.

It is possible to simulate attacks on concrete block ciphers to determine the actual amount of data required to achieve a certain success probability and an advantage. For such an exercise to be meaningful, it has to be comprehensive. In particular, it needs to be conducted on a number of block ciphers representing different design approaches and different values of the block and key sizes. Since the attacks can be simulated only within certain limited computational resources, there is also a need to develop some method for extrapolating the experimental results to sizes of real interest. Convincingly carrying out these tasks is beyond the scope of the present work and is a possible future work.

1.2 Bounds on data complexity

We separately discuss the issue for key recovery attacks and distinguishing attacks.

Case of key recovery attacks. Let Nmin⁢(PS,a) be the minimum amount of data required to achieve success probability at least PS and advantage at least a, where the minimum is over all possible methods of statistical analysis. Any particular method of statistical analysis provides an expression for the data complexity that is required if the method is followed. Considering a statistical analysis as an algorithm 𝒜, let N𝒜⁢(PS,a) denote the data complexity expression obtained using 𝒜 to obtain success probability at least PS and advantage at least a. Clearly, N𝒜⁢(PS,a) is an upper bound on Nmin⁢(PS,a). It is also a lower bound in the sense that at least N𝒜⁢(PS,a) amount of data will be required to achieve the parameters PS and aif the method 𝒜 is followed.

A bound N𝒜⁢(PS,a) obtained using a statistical method 𝒜 is useful to a cryptanalyst. It tells the cryptanalyst that this amount of data is sufficient to attain success probability at least PS and advantage at least a. Put another way, an upper bound tells a cryptanalyst that no more data is required to achieve the attack parameters.

From a cipher designer’s point of view, a data complexity expression of the type N𝒜⁢(PS,a) is also useful. It tells the designer that if method 𝒜 is followed, then at least N𝒜⁢(PS,a) amount of data is required to attain the parameters PS and a. This provides useful information in quantifying the resistance of the cipher against a particular type of attack. This is particularly important if 𝒜 is the best-known method for carrying out the statistical analysis. It would be even more useful to a cipher designer to obtain Nmin⁢(PS,a). Unfortunately, to the best of our knowledge, there is no work in the literature which provides this information.

Case of distinguishing attacks. A distinguishing attack proceeds as a test of hypothesis to distinguish between two different probability distributions. In this case, the data complexity is considered to be a function of the error probability which is defined to be half the sum of the probabilities of type-I and type-II errors. Let Nmin⁢(Pe) be the minimum amount of data required to ensure that the error probability is at most Pe, where the minimum is over all possible methods of statistical analysis. For a particular statistical method 𝒜, let N𝒜⁢(Pe) be the data complexity required to ensure error probability at most Pe. Similar to the case of key recovery attacks, N𝒜⁢(Pe) is an upper bound on Nmin⁢(Pe) and at least N𝒜⁢(Pe) amount of data is required to ensure error probability at most Pe if the method 𝒜 is followed. Also, the usefulness of N𝒜⁢(Pe) to a cryptanalyst and to a cipher designer remains the same as in the case of key recovery attacks.

An asymptotic expression for Nmin⁢(Pe) has been described in [4]. The expression is given in terms of the Chernoff information which involves taking an infimum over all real numbers in (0,1). Consequently, the resulting expression cannot be computed and [4] provides approximations.

To the best of our knowledge, all previously proposed statistical methods either for key recovery attacks or for distinguishing attacks use approximations to obtain expressions for data complexity without detailed analysis of the approximation errors. Consequently, the obtained data complexities cannot be considered to be either lower or upper bounds. The present work provides upper bounds on the data complexities, and we write rigorous upper bound to emphasize that no approximations are used in our analysis.

1.3 How good are the bounds?

The bounds on data complexity that we obtain crucially depend on the bounds for tail probabilities that we use. We have used the Chernoff and the Hoeffding bounds. These are general bounds which apply to sums of independent random variables. This leads to the question of whether better bounds are known and whether these can be applied to the current context?

The theory of large deviations is concerned with the probability of rare events and so tail probabilities can be handled by this theory. It can be shown that the tail probability is upper bounded by an exponential in N times a function called the rate function. This rate function is the Legendre transform of the moment generating function of the corresponding random variable. In theory, it is indeed possible to express the tail probabilities in terms of the rate function. However, this does not automatically provide meaningful bounds for the data complexity. There are several difficulties involved. For a more detailed discussion of these difficulties, we refer to [33].

1.4 Previous and related works

Linear cryptanalysis. This was first proposed by Matsui in [26] to cryptanalyze the block cipher DES. Later Matsui [27] extended this idea by using two linear approximations. In an independent work, Kaliski and Robshaw [22] extended Matsui’s attack involving single linear approximation to ℓ (≥1) linear approximations. Their result, however, was restrictive as it is required for all ℓ linear approximations to have the same plaintext and ciphertext bits though the key bits could be different.

Biryukov et al. [8] further refined the idea of multiple linear cryptanalysis. The authors considered ℓ linear approximations without any assumption on their structure. This, though, also had a restriction. The analysis was valid only for ℓ independent linear approximations. Analysis under the independence assumption was separately done by Junod and Vaudenay [21]. Murphy [30] argued that the independence assumption need not be valid.

In a later work, Baignères et al. [2] used the log-likelihood ratio (LLR) statistic to build an optimal distinguisher between two distributions. This result did not require the independence assumption. The theme of obtaining optimal distinguishers was also investigated in [20, 3].

Selçuk [34] proposed an order statistics based ranking methodology for analyzing single linear and differential cryptanalysis. The paper provided expressions for the data complexity of these attacks. The order statistics based approach uses a well-known theorem from statistics to approximate the distribution of an order statistics using the normal distribution. Consequently, the data complexities obtained in [34] are approximate. The order statistics based approach was built upon by Hermelin et al. [19]. They combined the results obtained in [2, 30, 31, 34] to develop a multilinear cryptanalytic method without the independence assumption.

Differential cryptanalysis. This cryptanalytic method was first proposed by Biham and Shamir in [7]. It was used to successfully cryptanalyze reduced round variants (with up to 15 rounds) of DES using less than 256 operations. Later in [6], the authors further improved their attack by considering several differentials having the same output difference. Over time, several variants of differential cryptanalysis have been proposed. These include higher-order differentials [24], truncated differentials [23], cube attack [16], boomerang attack [36], impossible differential cryptanalysis [5] and improbable differential cryptanalysis [35].

The general approach to multiple differential cryptanalysis was considered in [10]. This work considered ℓ differentials having both unequal input and unequal output differences. The case of ℓ differentials having the same input differences but different output differences was analyzed in detail in [11]. The order statistics based framework was used to derive an expression for the data complexity. A general study of data complexity and success probability of statistical attacks was carried out in [12].

We note that a recent work [32] performs a concrete analysis of normal approximations used in symmetric key cryptanalysis by using the Berry–Esseen theorem. In particular, the work critiques the order statistics based approach advocated by Selçuk [34] and points out several shortcomings. More generally, the entire approach of using normal approximations (without consideration of the error) is questioned.

A related line of work is based on the key dependent behavior of linear and differential characteristics [1, 9, 13, 25] and uses approximations. The techniques introduced in this paper should also be applicable to this setting and can form the basis for future work.

2.1 Background for block cipher cryptanalysis

The description of block cipher cryptanalysis given here is tailored towards linear cryptanalysis. Differential cryptanalysis is separately considered later.

A block cipher is a function E:{0,1}k×{0,1}n→{0,1}n such that for each K∈{0,1}k the function

is a bijection from {0,1}n to itself. Here K is the secret key. The n-bit input to the block cipher is called the plaintext, and the n-bit output of the block cipher is called the ciphertext.

Practical constructions of block ciphers have an iterated structure consisting of several rounds. Each round consists of applying a round function parameterized by a round key. The round functions are bijections of {0,1}n. An expansion function, called the key scheduling algorithm, is applied to the secret key to obtain round keys. Let the round keys be k(0),k(1),…, and denote the round functions as Rk(0)(0),Rk(1)(1),…. We assume that each of the round keys consists of 𝔨 bits. Further, denote by K(i) the concatenation of the first i round keys, i.e., K(i)=||⁡k(0)⋯k(i-1), which consists of 𝔨⁢i bits. Let EK(i)(i) denote the composition of the first i round functions, i.e.,

A block cipher may have many rounds and a reduced round cryptanalysis may target only a few of these rounds. Suppose that an attack targets r+1 rounds. For a plaintext P, let C be the output after r+1 rounds and let B be the output after r rounds. So, B=EK(r)(r)⁢(P) and C=Rk(r)(r)⁢(B).

Relations between plaintext and the input to the last round. The basic step in block cipher cryptanalysis is to perform a detailed analysis of the structure of a block cipher. Such a study reveals one or more possible relations between the following quantities: a plaintext P, the input to the last round B and possibly K(r). Such relations can be in the form of a linear function or in the form of a differential as we explain later. Usually, such a relation holds only with some probability. The probability is taken over the uniform random choice of P. If there is more than one relation, then it is required to consider the joint distribution of the probabilities that these relations hold. Obtaining relations and their possibly joint distribution is a non-trivial task which requires a great deal of experience and ingenuity. These relations form the bedrock on which a statistical analysis of an attack can be carried out.

Target sub-key. A single relation between P and B will usually involve only a subset of the bits of B. If several (or multiple) relations between P and B are known, it is required to consider the subset of the bits of B which cover all the relations. Obtaining these bits from C will require a partial decryption of the last round. Such a partial decryption will involve a subset of the bits of secret key (or of the last round key). Obtaining the correct values of these key bits is the goal of the attack, and these bits will be called the target sub-key. The size of the target sub-key in bits will be denoted by m. So, m key bits are sufficient to partially decrypt C to obtain the bits of B which are involved in any of the relation between P and B. There are 2m possible choices of the target sub-key bits out of which one is correct and all others are incorrect. The goal is to pick out the correct key.

Setting of an attack. Suppose there are N plaintext-ciphertext pairs (Pj,Cj), j=1,…,N, which have been generated using the correct key and are available. For each choice κ of the last round key bits, it is possible to invert Cj to obtain the relevant bits of Bκ,j. The relevant bits are those which are required to evaluate the relations discovered in the prior analysis of the block cipher. Note that Bκ,j depends on κ even though Cj may not. If κ is the correct choice for the target sub-key, then Cj indeed depends on κ, otherwise Cj has no relation to κ.

Given Pj and the relevant bits of Bκ,j, it is possible to evaluate all the known relations. From the results of these evaluations, a test statistic Tκ is defined. Since there are a total of 2m possible values of κ, there are also 2m random variables Tκ. These random variables are assumed to be independent, and the distributions of these random variables depend on whether κ is correct or incorrect. It is also assumed that the distributions of Tκ for incorrect κ are identical. This assumption was considered in [17]. For an attack to be possible, it is required to obtain the two possible distributions of Tκ, one when κ is the correct choice and the other when κ is an incorrect choice.

2.2 Linear cryptanalysis

Assume that the analysis of the structure of the block cipher provides ℓ≥1 linear approximations. These are given by masks ΓP(i),ΓB(i) and ΓK(i) for i=1,…,ℓ. The subscript P denotes the plaintext mask, the subscript B denotes the mask after r rounds and the subscript K denotes the mask for K(r). So, ΓP(i) and ΓB(i) are in {0,1}n and ΓK(i) is in {0,1}𝔨⁢r. If ℓ>1, then the attack is called multiple linear cryptanalysis, and if ℓ=1, we will call the attack single linear cryptanalysis, or simply linear cryptanalysis. Define

Inner key bits. For a fixed but unknown key K(r), the quantity zi=〈ΓK(i),K(r)〉 is a single unknown bit. Denote by z=(z1,…,zℓ) the collection of the ℓ bits arising in this manner. The key masks ΓK(1),…,ΓK(ℓ) are known. So, z is determined only by the unknown key K(r). The bits represented by z are called the inner key bits. The key K(r) is unknown but fixed, and so there is no randomness in K(r). Correspondingly, z is also unknown but fixed and there is no randomness in z.

Consider a uniform random choice of P. The round functions are deterministic bijections, and so the uniform distribution on P induces a uniform distribution on B. Each Li is a random variable which can take the values 0 or 1. The randomness of Li arises solely from the randomness of P. Define the random variable X to be the following:

So, X is distributed over {0,1}ℓ and its distribution is determined by the distribution of the Li’s, which in turn is determined by the distribution of P.

Consider the event

Note that we are not assuming any randomness over the key K(r) and the bits zi’s have no randomness even though they are unknown. So, the distribution of Li⊕zi is determined completely by the distribution of Li. The relation in (2.1) holds with certain probability and the event is conventionally called a linear approximation of the underlying block cipher.

Joint distribution parameterized by inner key bits. A linear approximation of the type given by (2.1) holds with some probability over the uniform random choice of P. The random variables L1,…,Lℓ are not necessarily independent. The joint distribution of these variables is given as follows: for z=(z1,…,zℓ) and η=(η1,…,ηℓ)∈{0,1}ℓ, define

where -1/2ℓ≤ϵη⁢(z)≤1-1/2ℓ.

The vector

is a probability distribution, where the integers {0,…,2ℓ-1} are identified with the set {0,1}ℓ. For each choice of z, we obtain a different distribution. These distributions are, however, related to each other. Suppose z′=z⊕β for some β∈{0,1}ℓ. Then it is easy to verify that ϵη⁢(z′)=ϵη⊕β⁢(z). It follows that

Let p~ be the probability distribution

and under the usual identification of {0,1}ℓ and the integers in {0,…,2ℓ-1} write

so that for η∈{0,1}ℓ,

Notation. There are N plaintext-ciphertext pairs (Pj,Cj) for j=1,…,N. For a choice κ of the target sub-key, the Cj’s are partially decrypted to obtain the relevant bits of Bκ,j. For κ∈{0,…,2m-1}, j=1,…,N and i=1,…,ℓ, define

2.3 LLR statistics

Let p~=(p0,…,pν-1) and q~=(q0,…,qν-1) be two probability distributions over a finite alphabet of size ν>0. The Kullback–Leibler divergence between p~ and q~ is defined as follows:

The problem of distinguishing between the two distributions is the following: Let X1,…,XN be a sequence of independent and identically distributed random variables taking values in the set {0,…,ν-1}. It is known that all the Xi’s follow one of the distributions p~ or q~, but which one is not known.

The goal is to formulate a test of hypothesis to distinguish between these two distributions. This test takes the form where the null hypothesis

is tested against the alternate hypothesis

Note that p~ is a probability distribution on {0,…,ν-1} and the probability at a point η∈{0,…,ν-1} is written as pη. For 1≤j≤N, the random variable Xj takes values in the set {0,…,ν-1}. So, the derived random variable pXj is well defined. One may set Wj=pXj. The possible values of Wj are p0,p1,…,pν-1. If Xj follows p~, then for η∈{0,…,ν-1},

if Xj follows another distribution q~, then Pr⁡[Wj=pη]=Pr⁡[Xj=η]=qη.

For j=1,…,N, define

Let μ0 and σ02 be the mean and variance of Yj under hypothesis H0. Similarly, let μ1 and σ12 be the mean and variance of Yj under hypothesis H1. Then the expressions for μ0, μ1, σ02 and σ12 can be computed to be the following:

The LLR random variable is defined to be the following:

where Qη=#⁢{j:Xj=η}. By following the method described in [2], it is possible to define a test of hypothesis to distinguish between the two distributions p~ and q~ by using approximately

plaintext-ciphertext pairs, where Pe is half the sum of the probabilities of type-I and type-II errors and Φ is the standard normal distribution function. More details are given in Appendix B.