General Diffusion Analysis: How to Find Optimal Permutations for Generalized Type-II Feistel Schemes

Type-II Generalized Feistel Schemes are one of the most popular versions of Generalized Feistel Schemes. Their round function consists in applying a classical Feistel transformation to p sub-blocks of two consecutive words and then shifting the k = 2p words cyclically. The low implementation costs it offers are balanced by a low diffusion, limiting its efficiency. Diffusion of such structures may however be improved by replacing the cyclic shift with a different permutation without any additional implementation cost. In this paper, we study ways to determine permutations with the fastest diffusion called optimal permutations. To do so, two ideas are used. First, we study the natural equivalence classes of permutations that preserve cryptographic properties; second, we use the representation of permutations as coloured trees. For both heuristic and historical reasons, we focus first on even-odd permutations, that is, those permutations for which images of even numbers are odd. We derive from their structure an upper bound on the number of their equivalence classes together with a strategy to perform exhaustive searches on classes. We performed those exhaustive searches for sizes k ≤ 24, while previous exhaustive searches on all permutations were limited to k ≤ 16. For sizes beyond the reach of this method, we use tree representations to find permutations with good intermediate diffusion properties. This heuristic leads to an optimal even-odd permutation for k = 26 and best-known results for sizes k = 64 and k = 128. Finally, we transpose these methods to all permutations. Using a new strategy to exhaust equivalence classes, we perform exhaustive searches on classes for sizes k ≤ 20 whose results confirmed the initial heuristic: there always exist optimal permutations that are even-odd and furthermore for k = 18 all optimal permutations are even-odd permutations

Direct construction of quasi-involutory recursive-like MDS matrices from 2-cyclic codes

A good linear diffusion layer is a prerequisite in the design of block ciphers. Usually it is obtained by combining matrices with optimal diffusion property over the Sbox alphabet. These matrices are constructed either directly using some algebraic properties or by enumerating a search space, testing the optimal diffusion property for every element. For implementation purposes, two types of structures are considered: Structures where all the rows derive from the first row and recursive structures built from powers of companion matrices. In this paper, we propose a direct construction for new recursive-like MDS matrices. We show they are quasi-involutory in the sense that the matrix-vector product with the matrix or with its inverse can be implemented by clocking a same LFSR-like architecture. As a direct construction, performances do not outperform the best constructions found with exhaustive search. However, as a new type of construction, it offers alternatives for MDS matrices design

Generalized Distinguishing Attack: A New Cryptanalysis of AES-like Permutations

We consider highly structured truncated differential paths to mount rebound attacks on hash functions based on AES-like permutations. We explain how such differential paths can be computed using a Mixed-Integer Linear Programming approach. Together with the SuperSBox description, this allows us to build a rebound attack with a $6$-round inbound phase whereas classical rebound attacks have $4$-round inbound phases. Non-square AES-like permutations seem to be more vulnerable than square ones. We illustrate this new technique by mounting the first distinguishing attack on a $11$-round version of Gr\o{}stl-$512$ internal permutation $P_{1024}$ with $\mathit{O}(2^{72})$ computational complexity and $\mathit{O}(2^{56})$ memory complexity, to be compared with the $\mathit{O} (2^{96})$ required computations of the corresponding generic attack. Previous best results on this permutation reached $10$ rounds with a computational complexity of $\mathit{O}(2^{392})$, to be compared with $\mathit{O}(2^{448})$ required by the corresponding generic attack

Linear diffusion layers from MDS matrices

Cette thèse s’intéresse à deux aspects de la cryptologie symétrique liés à l’utilisation de matrices MDS dans les couches de diffusion linéaires de primitives. Une première partie se fonde sur les conceptions de couches de diffusion linéaires de schémas de chiffrement symétrique à partir de matrices MDS. Les associations entre matrices récursives, respectivement circulantes, et polynômes sont calquées pour construire de nouvelles associations entre d’autres structures de matrices et des éléments d’anneaux de polynômes non commutatifs de Ore. À l’instar des matrices récursives et circulantes, ces structures bénéficient d’implémentations matérielles légères. Des codes de Gabidulin dérivent des méthodes de construction directe de telles matrices, optimales en termes de diffusion, proches d’involutions pour l’implémentation. La seconde partie développe une attaque par différenciation de permutations dont l’architecture s’inspire de l’AES. L’utilisation d’une couche de diffusion linéaire locale avec une matrice MDS induit une description macroscopique de la propagation de valeurs de différences à travers les étapes du chiffrement. Des chemins différentiels tronqués apparaissent, qui servent de point de départ à la conception d’attaques rebond. Les travaux présentés généralisent les attaques rebond connues à l’exploitation de chemins différentiels tronqués structurés non issus d’avalanches libres. Cette structure permet de ne pas consommer tous les degrés de libertés au cours d’une seule étape algorithmique mais de les répartir en trois étapes. Une attaque sur 11 tours d’une permutation de Grostl-512 est alors déployée.This thesis focuses on two aspects of symmetric cryptology related to the use of MDS matrices as building blocks of linear layers for symmetric primitives. A first part handles designs of linear layers for symmetric ciphers based upon MDS matrices. Associations between recursive, respectively circulant, matrices and polynomials are reproduced between other matrix structures and elements in non-commutative polynomial rings of Ore. As for recursive and circulant matrices, those structures come along with lightweight hardware implementations. From Gabidulin codes are derived direct constructions of MDS matrices with properties close to involution from hardware perspectives. The second part is about distinguishing attacks on an exemple of AES-like permutations. The use of some MDS matrix to build the linear layer induces a macroscopic description of differential trails through the different steps of the algorithm computing the permutation. Truncated differential path appears, from which rebound attack are built. Original work here generalizes rebound attack applied on permutations of GROSTL-512 from structured differential path not raised from free propagations of differences. This structure allows not to consume all degrees of freedom in a simple algorithmic step but to divide this comsumption into three algorithmic steps. An attack of a reduced-round version with 11 rounds of one permutation of GROSTL-512 can then be mounted

About Circulant Involutory MDS Matrices

International audienceWe give a new algebraic proof of the non-existence of circulant involutory MDS matrices with coefficients in fields of even characteristic. For odd characteristics we give parameters for the potential existence. If we relax circulancy to θ-circulancy, then there is no restriction to the existence of θ-circulant involutory MDS matrices even for fields of even characteristic. Finally, we relax further the involutory definition and propose a new direct construction of almost involutory θ-circulant MDS matrices. We show that they can be interesting in hardware implementations

On Circulant Involutory MDS Matrices

International audienceWe give a new algebraic proof of the non-existence of circulant involutory MDS matrices with coefficients in fields of characteristic 2. In odd characteristics we give parameters for the potential existence. If we relax circulancy to θ-circulancy, then there is no restriction to the existence of θ-circulant involutory MDS matrices even for fields of characteristic 2. Finally, we relax further the involutory definition and propose a new direct construction of almost involutory θ-circulant MDS matrices. We show that they can be interesting in hardware implementations

Grøstl Distinguishing Attack: A New Rebound Attack of an AES-like Permutation

We consider highly structured truncated differential paths to mount a new rebound attack on Grøstl-512, a hash functions based on two AES-like permutations, P1024 and Q1024, with non-square input and output registers. We explain how such differential paths can be computed using a Mixed-Integer Linear Programming approach. Together with a SuperSBox description, this allows us to build a rebound attack with a 6-round inbound phase whereas classical rebound attacks have 4-round inbound phases. This yields the first distinguishing attack on a 11-round version of P1024 and Q1024 with about 272 computations and a memory complexity of about 256 bytes, to be compared with the 296 computations required by the corresponding generic attack. Previous best results on this permutation reached 10 rounds with a computational complexity of about 2392 operations, to be compared with the 2448 computations required by the corresponding generic attack

Groestl Distinguishing Attack: A New Rebound Attack of an AES-like Permutation

International audienc

Grøstl Distinguishing Attack: A New Rebound Attack of an AES-like Permutation

We consider highly structured truncated differential paths to mount a new rebound attack on Grøstl-512, a hash functions based on two AES-like permutations, P1024 and Q1024, with non-square input and output registers. We explain how such differential paths can be computed using a Mixed-Integer Linear Programming approach. Together with a SuperSBox description, this allows us to build a rebound attack with a 6-round inbound phase whereas classical rebound attacks have 4-round inbound phases. This yields the first distinguishing attack on a 11-round version of P1024 and Q1024 with about 272 computations and a memory complexity of about 256 bytes, to be compared with the 296 computations required by the corresponding generic attack. Previous best results on this permutation reached 10 rounds with a computational complexity of about 2392 operations, to be compared with the 2448 computations required by the corresponding generic attack