О некоторых подгруппах бернсайдовой группы B0(2, 5)

Пусть B0(2, 5) = {x,y) — наибольшая конечная двупорождённая бернсайдова группа периода 5, порядок которой равен 534. В работе изучена серия подгрупп Hi = {ai,bi) группы Bo(2, 5), где ao = x, bo = y, ai = Oi-ibi-i и bi = bi-iOi-i-1 для i G N. Получено, что группа H4 является абелевой, поэтому H5 — циклическая группа, и серия подгрупп прерывается. Показано, что элементы = = xy^xyx^y^x^yxy^x и b4 = yx^yxy^x^y^xyx^y длины 16 порождают в Bo(2, 5) абелеву подгруппу порядка 25, и никакие другие два групповых слова, длины которых меньше 16, не порождают нециклическую абелеву подгруппу в Bo(2, 5). Let В0(2,5) = (x,y) be the largest finite two generator Burnside group of exponent five and order 534. We study a series of subgroups Hi = (ai,bi) of the group B0(2, 5), where a0 = x, b0 = y, ai = ai-ibi-i and bi = bi-iai-i for i E N. It has been found that H4 is a commutative group. Therefore, H5 is a cyclyc group and the series of subgroups is broken. The elements a4 = xy2xyx2y2x2yxy2x and b4 = yx2yxy2x2y2xyx2y of length 16 generate an abelian subgroup of order 25 in B0(2, 5). Using computer calculations, we have found that there is no other pair of group words of length less than 16 that generate a noncyclic abelian subgroup in B0(2, 5)

Heuristic algorithm for obtaining permutations with given cryptographic properties using a generalized construction

Исследована возможность построения с помощью обобщённой конструкции подстановок с заданными криптографическими характеристиками, обеспечивающими стойкость алгоритмов шифрования к линейному и разностному методам криптоанализа. Предложен эвристический алгоритм поиска параметров обобщённой конструкции, полученных посредством умножения на транспозиции. Исполь-зуются идеи генетического алгоритма, спектрально-линейного и спектрально-разностного методов. Изучены вопросы оптимизации вычисления криптографических характеристик на каждой итерации алгоритма. Экспериментальные исследования наиболее интересных с практической точки зрения 8-битовых подстановок показали, что можно построить 6-равномерные подстановки с нелинейностью 108

Об эвристическом подходе к построению биективных векторных булевых функций с заданными криптографическими характеристиками

Предложен эвристический алгоритм построения биективных булевых функций с заданными криптографическими свойствами — нелинейностью и дифференциальной ^-равномерностью — на основе обобщённой конструкции. Производится поиск вспомогательных подстановок меньшей размерности в обобщённой конструкции с использованием идей спектрально-линейного и спектрально-разностного методов. Исследована возможность оптимизации вычисления криптографических характеристик на каждой итерации алгоритма. Экспериментально получены 8-битовые 6-равномерные подстановки с нелинейностью 108. Bijective vector Boolean functions (permutations) are used as nonlinear primitives of many symmetric ciphers. In this paper, we study a generalized construction of (2m, 2m)-functions using monomial and arbitrary m-bit permutations as constituent elements. A heuristic algorithm for obtaining bijective Boolean functions with given nonlinearity and differential uniformity, based on this construction, is proposed. For this, a search is carried out for auxiliary permutations of a lower dimension using the ideas of spectral-linear and spectral-difference methods. The proposed algorithm consists of iterative multiplication of the initial randomly generated 4-bit permutations by transposition, selecting the best ones in nonlinearity, the differential uniformity, and the corresponding values in the linear and differential spectra among the obtained 8-bit permutations. The possibility of optimizing the calculation of cryptographic properties at each iteration of the algorithm is investigated; 8-bit 6-uniform permutations with nonlinearity 108 are experimentally obtained

Correlations Between (Nonlinear) Combiners of Input and Output of Random Functions and Permutations

Linear cryptanalysis considers correlations between linear input and output combiners for block ciphers and stream ciphers. Daemen and Rijmen (2007) had obtained the distributions of the correlations between linear input and output combiners of uniform random functions and uniform random permutations. The present work generalises these results to obtain the distributions of the correlations between arbitrary input and output combiners of uniform random functions and uniform random permutations

Linear and differential cryptanalysis of small-sized random (n, m)-S-boxes

S-boxes are used in cryptography in order to provide non-linearity in the design of cryptographic primitives such as block ciphers and hash functions. Some cryptographic primitives use bijective S-boxes as in the Advanced Encryption Standard (AES), and others use surjective S-boxes as in the Data Encryption Standard (DES). That is, S-boxes can have inputs and outputs of the same length as in the (8,8)-S-box of AES, or alternatively the input length can be larger than the output as in the (6, 4)-S-boxes of DES. In this paper, we perform a statistical study of linear and differential properties of randomly generated (n, m)-S-boxes, where m ≤ n. We show that certain S-boxes with well-behaved linear and differential properties can be feasibly obtained via random search. We show further that certain types of S-boxes with specific desirable linear and differential properties are improbable

Another Look at Key Randomisation Hypotheses

In the context of linear cryptanalysis of block ciphers, let $p_0$ (resp. $p_1$) be the probability that a particular linear approximation holds for the right (resp. a wrong) key choice. The standard right key randomisation hypothesis states that $p_0$ is a constant $p\neq 1/2$ and the standard wrong key randomisation hypothesis states that $p_1=1/2$. Using these hypotheses, the success probability $P_S$ of the attack can be expressed in terms of the data complexity $N$. The resulting expression for $P_S$ is a monotone increasing function of $N$. Building on earlier work by Daemen and Rijmen (2007), Bogdanov and Tischhauser (2014) argued that $p_1$ should be considered to be a random variable. They postulated the adjusted wrong key randomisation hypothesis which states that $p_1$ follows a normal distribution. A non-intuitive consequence was that the resulting expression for $P_S$ is no longer a monotone increasing function of $N$. A later work by Blondeau and Nyberg (2017) argued that $p_0$ should also be considered to be a random variable and they postulated the adjusted right key randomisation hypothesis which states that $p_0$ follows a normal distribution. In this work, we revisit the key randomisation hypotheses. While the argument that $p_0$ and $p_1$ should be considered to be random variables is indeed valid, we consider the modelling of their distributions by normal to be inappropriate. Being probabilities, the support of the distributions of $p_0$ and $p_1$ should be subsets of $[0,1]$ which does not hold for normal distributions. We show that if $p_0$ and $p_1$ follow any distributions with supports which are subsets of $[0,1]$, and $E[p_0]=p$ and $E[p_1]=1/2$, then the expression for $P_S$ that is obtained is exactly the same as the one obtained using the standard key randomisation hypotheses. Consequently, $P_S$ is a monotone increasing function of $N$ even when $p_0$ and $p_1$ are considered to be random variables

Linear Hulls with Correlation Zero and Linear Cryptanalysis of Block Ciphers

Linear cryptanalysis, along with differential cryptanalysis, is an important tool to evaluate the security of block ciphers. This work introduces a novel extension of linear cryptanalysis: zero-correlation linear cryptanalysis, a technique applicable to many block cipher constructions. It is based on linear approximations with a correlation value of exactly zero. For a permutation on $n$ bits, an algorithm of complexity $2^{n-1}$ is proposed for the exact evaluation of correlation. Non-trivial zero-correlation linear approximations are demonstrated for various block cipher structures including AES, balanced Feistel networks, Skipjack, CLEFIA, and CAST256. As an example, using the zero-correlation linear cryptanalysis, a key-recovery attack is shown on 6 rounds of AES-192 and AES-256 as well as 13 rounds of CLEFIA-256

Security of the AES with a Secret S-box

How does the security of the AES change when the S-box is replaced by a secret S-box, about which the adversary has no knowledge? Would it be safe to reduce the number of encryption rounds? In this paper, we demonstrate attacks based on integral cryptanalysis which allows to recover both the secret key and the secret S-box for respectively four, five, and six rounds of the AES. Despite the significantly larger amount of secret information which an adversary needs to recover, the attacks are very efficient with time/data complexities of $2^{17}/2^{16}$, $2^{38}/2^{40}$ and $2^{90}/2^{64}$, respectively. Another interesting aspect of our attack is that it works both as chosen plaintext and as chosen ciphertext attack. Surprisingly, the chosen ciphertext variant has a significantly lower time complexity in the attacks on four and five round, compared to the respective chosen plaintext attacks

HARPOCRATES: An Approach Towards Efficient Encryption of Data-at-rest

This paper proposes a new block cipher called HARPOCRATES, which is different from traditional SPN, Feistel, or ARX designs. The new design structure that we use is called the substitution convolution network. The novelty of the approach lies in that the substitution function does not use fixed S-boxes. Instead, it uses a key-driven lookup table storing a permutation of all 8-bit values. If the lookup table is sufficiently randomly shuffled, the round sub-operations achieve good confusion and diffusion to the cipher. While designing the cipher, the security, cost, and performances are balanced, keeping the requirements of encryption of data-at-rest in mind. The round sub-operations are massively parallelizable and designed such that a single active bit may make the entire state (an 8 × 16 binary matrix) active in one round. We analyze the security of the cipher against linear, differential, and impossible differential cryptanalysis. The cipher’s resistance against many other attacks like algebraic attacks, structural attacks, and weak keys are also shown. We implemented the cipher in software and hardware; found that the software implementation of the cipher results in better throughput than many well-known ciphers. Although HARPOCRATES is appropriate for the encryption of data-at-rest, it is also well-suited in data-in-transit environments