The 128-bit block cipher TWIS was proposed by Ojha et al in
2009. It is a lightweight block cipher and its design is inspired
from CLEFIA. In this paper, we first study the properties of TWIS
structure, and as an extension we also considered the generalized
TWIS-type structure which can be called G-TWIS cipher, where the
block size and round number can be arbitrary values. Then we
present a series of 10-round differential distinguishers for TWIS
and a n-round differential distinguisher for G-TWIS whose
probabilities are all equal to 1. Therefore, by utilizing these
kinds of differential distinguishers, we can break the full
10-round TWIS cipher and n-round G-TWIS cipher

Bozhan Su

Lei Zhang

Wenling Wu

Yanjun Li

Cryptology ePrint Archive

Some Observations on TWIS Block CipherBozhan Su, Wenling Wu, Lei Zhang, Yanjun LiState Key Laboratory of Information Security,Institute of Software, Chinese Academy of Sciences, Beijing 100190, P. R. China{subozhan, wwl, zhanglei1015, liyanjun}@is.iscas.ac.cnAbstract. The 128-bit block cipher TWIS was proposed by Ojha et alin 2009. It is a lightweight block cipher and its design is inspired fromCLEFIA. In this paper, we first study the properties of TWIS structure,and as an extension we also considered the generalized TWIS-type struc-ture which can be called G-TWIS cipher, where the block size and roundnumber can be arbitrary values. Then we present a series of 10-round dif-ferential distinguishers for TWIS and a n-round differential distinguisherfor G-TWIS whose probabilities are all equal to 1. Therefore, by utilizingthese kinds of differential distinguishers, we can break the full 10-roundTWIS cipher and n-round G-TWIS cipher.Key words: Block Cipher, TWIS, G-TWIS, Differential Distinguisher,Differential Cryptanalysis.1 IntroductionRecently, researches on the design of lightweight cryptography have receivedlots of attention. Lightweight cryptography mainly deals with designing ciphersfor extremely resource constrained environments, such as applications of RFIDtags and sensor networks. Considering that conventional algorithms such as AESalthough quite secure, are not suitable for such environments, hence a numberof new symmetric lightweight block ciphers have been proposed in the openliterature, such as DESL [6], PRESENT [2], HIGHT [5], LCASE [10], Cobra [9]and TWIS [7] et al.TWIS is a lightweight block cipher designed by Ojha et al in 2009. Both ofits block size and key size are 128-bit and the total number of rounds is 10.The overall structure of TWIS is a 2-branch generalized Feistel structure whichemploys key whitening at the beginning and at the end of the cipher.In this paper, we first study the properties of TWIS structure, and as anextension we also considered the generalized TWIS-type structure which canbe called G-TWIS cipher, whose block size is 4m-bits and consists of n roundsencryption in all, where n and m are arbitrary positive integers. Then we evaluatethe security of TWIS and G-TWIS against differential cryptanalysis respectively.Our main results include: we present (23 − 1) differential distinguishers for 10-round TWIS cipher and a differential distinguisher for n-round G-TWIS cipherwhose probabilities are both equal to 1. Based on these distinguishers, we canbreak the full 10-round TWIS cipher and the full n-round G-TWIS cipher. Sinceour analysis does not depend on any weak-key or weak-subkey assumptions,these attacks can both be independent of the key schedule algorithm.The rest of this paper is organized as follows. Section 2 gives a brief de-scription of TWIS first and then gives the specification of the proposed cipherG-TWIS. Section 3 and Section 4 present the differential attack on the full TWIScipher and on the full G-TWIS cipher respectively. Finally, Section 5 summarizesthe paper.2 Descriptions of TWIS and G-TWISTWIS is a 128-bit block cipher which uses key of size 128-bit. It employs a 2-branch Generalized Feistel structure and consists of 10 rounds. Each round ofTWIS uses two rounds of Feistel network which involves a 64-bit round functioncalled 𝐺-function. Furthermore, key whitening layers are employed both at thebeginning and at the end of the encryption procedure. Since the key scheduling isnot involved in out attack, we will omit the description of key schedule algorithmhere and interested readers can refer to [7] for more details.As an extension of TWIS, we construct a generalized TWIS-type cipher calledG-TWIS. Its block size can be 4m-bit and consists of n rounds, where m and nare arbitrary positive integers. Similar to the round function of TWIS, in eachround of G-TWIS we also use two rounds of Feistel network which involves a2m-bit round function called 𝐺′-function. In the following, we will give detaileddescriptions of the encryption procedures of TWIS and G-TWIS.2.1 NotationIn this subsection, we first introduce the following notations which are usedthroughout this paper.− 𝑍𝑚2 : the set of 𝑚-bit words.− 𝑎⊕ 𝑏: bitwise XOR of a and b.− 𝑎 ∧ 𝑏: bitwise AND of a and b.− 𝑎∣𝑏: concatenation of a and b.−⋘ 𝑖: left rotation by i bits.−⋙ 𝑖: right rotation by i bits.2.2 Encryption Procedure of TWISFor the encryption procedure of TWIS, let 𝑃 = (𝑃0, 𝑃1, 𝑃2, 𝑃3) ∈ (𝑍322 )4 denotea 128-bit plaintext, and 𝐶 = (𝐶0, 𝐶1, 𝐶2, 𝐶3) ∈ (𝑍322 )4 denote the correspondingciphertext. Let 𝑅𝐾𝑖 ∈ 𝑍322 (𝑖 = 0, 1, . . . , 10) denote the round subkeys providedby the key scheduling part. First of all, two 32-bit whitening subkeys 𝑅𝐾0 and𝑅𝐾1 are XORed to 𝑃0 and 𝑃3 respectively, and the resulted intermediate valueis denoted as (𝑇0, 𝑇1, 𝑇2, 𝑇3). Then the same round transformation is iterated for10 times, and the operations in each round is defined as follows.For the 𝑖−th round, 1 ≤ 𝑖 ≤ 10a) 𝑋0∣𝑋1 ← 𝐺 𝑓𝑢𝑛𝑐𝑡𝑖𝑜𝑛(𝑅𝐾𝑖−1, 𝑇0∣𝑇1)b) 𝑇2 ← 𝑋0 ⊕ 𝑇2, 𝑇3 ← 𝑋1 ⊕ 𝑇3c) 𝑇1 ← 𝑇1 ⋘ 8, 𝑇3 ← 𝑇3 ⋙ 1d) 𝑇0∣𝑇1∣𝑇2∣𝑇3 ← 𝑇2∣𝑇3∣𝑇0∣𝑇1e) 𝑋0∣𝑋1 ← 𝐺 𝑓𝑢𝑛𝑐𝑡𝑖𝑜𝑛(𝑅𝐾𝑖, 𝑇0∣𝑇3)f) 𝑇1 ← 𝑋0 ⊕ 𝑇1, 𝑇2 ← 𝑋1 ⊕ 𝑇2g) 𝑇2 ← 𝑇2 ⋙ 1, 𝑇3 ← 𝑇3 ⋘ 8In the end, two whitening subkeys 𝑅𝐾2 and 𝑅𝐾3 are XORed to 𝑇0 and 𝑇3respectively, and the result is just the ciphertext 𝐶 = (𝐶0, 𝐶1, 𝐶2, 𝐶3). Thedetailed encryption procedure of TWIS is also illustrated in Fig. 1.P0 P1 P2 P3RK0 RK1T0 T1 T2 T3Initial KeyWhiteningRKi-1G-func>>>1<<<8T0 T1 T2 T3G-funcRKi>>>1 <<<8Repeat for10 rounds T0 T1 T2 T3RK2 RK3C0 C1 C2 C3Final Key Whitening128-Bit Plaintext 128-Bit Ciphertext Fig. 1. The Encryption Process of TWISFor the 𝐺-function used in each round, it is defined as follows. It takes 64-bitdata and 32-bit round subkey as inputs and produces 64-bit output, and thistransformation can be written as the following expressions.1. 𝑇0∣𝑇1 ← 𝑋0∣𝑋12. 𝑇0 ← 𝑇1⊕ F function(𝑅𝐾,𝑇0)3. 𝑌0∣𝑌1 ← 𝑇1∣𝑇0Here it calls another transformation named 𝐹 𝑓𝑢𝑛𝑐𝑡𝑖𝑜𝑛 which takes 32-bit in-termediate state 𝑋 and 32-bit round subkey 𝑅𝐾 as inputs, and produces 32-bitoutput 𝑌 . The transformation of 𝐹 𝑓𝑢𝑛𝑐𝑡𝑖𝑜𝑛 is defined as follows:1. 𝑇0∣𝑇1∣𝑇2∣𝑇3 ← 𝑅𝐾 ⊕𝑋2. 𝑇0 ← 𝑆𝑏𝑜𝑥(𝑇0 ∧ 0𝑥3𝑓)𝑇1 ← 𝑆𝑏𝑜𝑥(𝑇1 ∧ 0𝑥3𝑓)𝑇2 ← 𝑆𝑏𝑜𝑥(𝑇2 ∧ 0𝑥3𝑓)𝑇3 ← 𝑆𝑏𝑜𝑥(𝑇3 ∧ 0𝑥3𝑓)3. 𝑌0∣𝑌1∣𝑌2∣𝑌3 ← 𝑇2∣𝑇3∣𝑇0∣𝑇1Note that the Sbox used in 𝐹 𝑓𝑢𝑛𝑐𝑡𝑖𝑜𝑛 takes 6-bit input and yields 8-bit output,and the specific Sbox table can be obtained in [7].2.3 Encryption Procedure of G-TWISAs an extension of TWIS, we construct a generalized TWIS-type cipher calledG-TWIS. Its block size can be 4m-bit and consists of n rounds, where m and n arearbitrary values. Let 𝑃 = (𝑃0, 𝑃1, 𝑃2, 𝑃3) ∈ (𝑍𝑚2 )4 and 𝐶 = (𝐶0, 𝐶1, 𝐶2, 𝐶3) ∈(𝑍𝑚2 )4 denote the plaintext and its corresponding ciphertext respectively. Let𝑅𝐾𝑖 ∈ 𝑍𝑚2 (𝑖 = 0, . . . , 𝑛 − 1) denote the round subkeys provided by the keyscheduling part. The key whitening layers at the beginning and at the end ofG-TWIS are exactly the same with TWIS, and the round transformation usedin each round is defined as follows. The encryption procedure of G-TWIS is alsoillustrated in Fig. 2.For the 𝑖−th round, 1 ≤ 𝑖 ≤ 𝑛a) 𝑋0∣𝑋1 ← 𝐺′ 𝑓𝑢𝑛𝑐𝑡𝑖𝑜𝑛(𝑅𝐾𝑖−1, 𝑇0∣𝑇1)b) 𝑇2 ← 𝑋0 ⊕ 𝑇2, 𝑇3 ← 𝑋1 ⊕ 𝑇3c) 𝑇1 ← 𝑇1 ⋘ 𝑟0, 𝑇3 ← 𝑇3 ⋙ 𝑟1d) 𝑇0∣𝑇1∣𝑇2∣𝑇3 ← 𝑇2∣𝑇3∣𝑇0∣𝑇1e) 𝑋0∣𝑋1 ← 𝐺′ 𝑓𝑢𝑛𝑐𝑡𝑖𝑜𝑛(𝑅𝐾𝑖, 𝑇0∣𝑇3)f) 𝑇1 ← 𝑋0 ⊕ 𝑇1, 𝑇2 ← 𝑋1 ⊕ 𝑇2g) 𝑇2 ← 𝑇2 ⋙ 𝑟2, 𝑇3 ← 𝑇3 ⋘ 𝑟3For the 𝐺′-function used in each round, it takes 2m-bit data and m-bitround subkey as inputs and produces 2m-bit output. Similar to the 𝐺-functionin TWIS, 𝐺′-function can be written as the following expressions.1. 𝑇0∣𝑇1 ← 𝑋0∣𝑋12. 𝑇0 ← 𝑇1 ⊕ 𝐹 ′ 𝑓𝑢𝑛𝑐𝑡𝑖𝑜𝑛(𝑅𝐾,𝑇0)3. 𝑌0∣𝑌1 ← 𝑇1∣𝑇0Here it calls 𝐹 ′ 𝑓𝑢𝑛𝑐𝑡𝑖𝑜𝑛 which takes m-bit intermediate state 𝑋 and m-bitround subkey 𝑅𝐾 as inputs, and produces m-bit output 𝑌 .𝐹 ′ 𝑓𝑢𝑛𝑐𝑡𝑖𝑜𝑛 ={{0, 1}𝑚 × {0, 1}𝑚 → {0, 1}𝑚,(𝑅𝐾,𝑋) 7→ 𝑌RKi-1RKiRepeat forn rounds Final Key WhiteningP0 P1 P2 P3RK0 RK1T0 T1 T2 T3Initial Key Whitening G`-func>>>r4i-3<<<r4(i-1)T0 T1 T2 T3G`-func>>>r4i-2 <<<r4i-1T0 T1 T2 T3RK2 RK3C0 C1 C2 C34m-Bit Plaintext 4m-Bit Ciphertext Fig. 2. The Encryption Process of G-TWIS3 10-Round Differential Distinguishers for TWISIn this section, we present (23−1) 10-round differential distinguishers for TWISwhose probabilities are all equal to 1. These differential distinguishers are mainlybased on the following one-round iterative differential characteristic with prob-ability 1.Fig. 3 illustrates this kind of one-round iterative differential characteristicin detail. Note here we choose both the input and output differences of the𝑖-th round as 𝛥𝑋 = (𝛥𝑋0,𝛥𝑋1,𝛥𝑋2,𝛥𝑋3) ∈ (𝑍322 )4 which denotes a 128-bit nonzero difference. Then the input and output differences of 𝐹0 𝑓𝑢𝑛𝑐𝑡𝑖𝑜𝑛are equal to 𝛥𝑋0 and 𝛥𝑋1 ⊕ (𝛥𝑋1 ⊕ (𝛥𝑋1 ⋘ 8)) ⋘ 1 ⊕𝛥𝑋3 respectively.Similarly, the input and output differences of 𝐹1 𝑓𝑢𝑛𝑐𝑡𝑖𝑜𝑛 are equal to 𝛥𝑋0 and𝛥𝑋0 ⊕ (𝛥𝑋2 ⋘ 1)⊕ (𝛥𝑋1 ⋘ 8) respectively. Furthermore, we can obtain thefollowing equations.𝛥𝑋1 ⋘ 16 = 𝛥𝑋3 (1)𝛥𝑋1 ⊕𝛥𝑋2 = 𝛥𝑋0 (2)If we set the input and output differences of 𝐹0 𝑓𝑢𝑛𝑐𝑡𝑖𝑜𝑛 and 𝐹1 𝑓𝑢𝑛𝑐𝑡𝑖𝑜𝑛 bezero, then we can obtain the following three equations.𝛥𝑋0 ∧ 0𝑥3𝑓3𝑓3𝑓3𝑓 = 0 (3)𝛥𝑋1 ⊕ (𝛥𝑋1 ⊕ (𝛥𝑋1 ⋘ 8)) ⋘ 1⊕𝛥𝑋3 = 0 (4)𝛥𝑋0 ⊕ (𝛥𝑋2 ⋘ 1)⊕ (𝛥𝑋1 ⋘ 8) = 0 (5)F0-func<<<8 >>>1<<<8>>>1X0 X1 X2 X3X0 X1 X2 X3F1-funcK0K1Fig. 3. one-round iterative differential characteristic of TWISBy solving the above system of equations (1)-(5), we find that there are(23 − 1) non-zero solutions in all. Since all these solutions satisfy that the inputand output differences of 𝐹0 𝑓𝑢𝑛𝑐𝑡𝑖𝑜𝑛 and 𝐹1 𝑓𝑢𝑛𝑐𝑡𝑖𝑜𝑛 equal to zero, we canconstruct (23 − 1) one-round iterative differential characteristics which all holdwith probability 1. Then by iterating this kind of one-round differential charac-teristic 10 times, we can obtain (23 − 1) 10-round differential distinguishers forTWIS whose probabilities are all equal to 1. Table 1 contains all the (23−1) = 7one-round iterative differential characteristics.Table 1. one-round iterative differential characteristics for TWISNo. 𝛥𝑋 = 𝛥𝑋0,𝛥𝑋1,𝛥𝑋2,𝛥𝑋3 Pr(𝛥𝑋 → 𝛥𝑋)1 (0𝑥𝑐0𝑐0𝑐0𝑐0, 0𝑥𝑐0𝑐0𝑐0𝑐0, 0𝑥00000000, 0𝑥𝑐0𝑐0𝑐0𝑐0) 12 (0𝑥80808080, 0𝑥80808080, 0𝑥00000000, 0𝑥80808080) 13 (0𝑥40404040, 0𝑥40404040, 0𝑥00000000, 0𝑥40404040) 14 (0𝑥40404040, 0𝑥𝑏𝑓𝑏𝑓𝑏𝑓𝑏𝑓, 0𝑥𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓, 0𝑥𝑏𝑓𝑏𝑓𝑏𝑓𝑏𝑓) 15 (0𝑥80808080, 0𝑥7𝑓7𝑓7𝑓7𝑓, 0𝑥𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓, 0𝑥7𝑓7𝑓7𝑓7𝑓) 16 (0𝑥𝑐0𝑐0𝑐0𝑐0, 0𝑥3𝑓3𝑓3𝑓3𝑓, 0𝑥𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓, 0𝑥3𝑓3𝑓3𝑓3𝑓) 17 (0𝑥00000000, 0𝑥𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓, 0𝑥𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓, 0𝑥𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓) 14 n-Round Differential Distinguisher for G-TWISIn this section, we present an 𝑛-round differential distinguisher for G-TWISwhose probability is also equal to 1. This 𝑛-round differential distinguisher isbased on the following one-round iterative differential characteristic with prob-ability 1.Similar to the analysis in Sect. 3, we also choose the input and output dif-ferences of the 𝑖-th round as 𝛥𝑋 = (𝛥𝑋0, 𝛥𝑋1,𝛥𝑋2,𝛥𝑋3) ∈ (𝑍𝑚2 )4, whichdenotes a 4m-bit nonzero difference. Then the input and output differences of𝐹 ′0 𝑓𝑢𝑛𝑐𝑡𝑖𝑜𝑛 are equal to (𝛥𝑋0, 𝛥𝑋1 ⊕ (𝛥𝑋1 ⊕ (𝛥𝑋1 ⋘ 𝑟0)) ⋘ 𝑟1 ⊕𝛥𝑋3),and the input and output differences of 𝐹 ′1 𝑓𝑢𝑛𝑐𝑡𝑖𝑜𝑛 are equal to (𝛥𝑋0, 𝛥𝑋0⊕(𝛥𝑋2 ⋘ 𝑟2)⊕(𝛥𝑋1 ⋘ 𝑟0)) respectively. Similarly, we can obtain the followingequations.𝛥𝑋1 ⋘ (𝑟0 + 𝑟3) = 𝛥𝑋3 (6)𝛥𝑋1 ⊕𝛥𝑋2 = 𝛥𝑋0 (7)Then by setting the input and output differences of 𝐹 ′0 𝑓𝑢𝑛𝑐𝑡𝑖𝑜𝑛 and 𝐹′1 𝑓𝑢𝑛𝑐𝑡𝑖𝑜𝑛as zero, we can obtain the following equations.𝛥𝑋0 = 0 (8)𝛥𝑋1 ⊕ (𝛥𝑋1 ⊕ (𝛥𝑋1 ⋘ 𝑟0)) ⋘ 𝑟1 ⊕𝛥𝑋3 = 0 (9)𝛥𝑋0 ⊕ (𝛥𝑋2 ⋘ 𝑟2)⊕ (𝛥𝑋1 ⋘ 𝑟0) = 0 (10)Considering the above system of equations (6)-(10), it is easy to see that(0, 𝛼, 𝛼, 𝛼) is a solution of the system, where 𝛼 = 2𝑚−1. Hence we can constructan iterative differential characteristic (0, 𝛼, 𝛼, 𝛼)→ (0, 𝛼, 𝛼, 𝛼) where 𝛼 = 2𝑚−1,and it holds with probability 1. Then by iterating this differential characteristic 𝑛times, we can obtain the following 𝑛-round differential distinguisher for G-TWISwhose probability is equal to 1.(0, 𝛼, 𝛼, 𝛼)𝑛 𝑅−→ (0, 𝛼, 𝛼, 𝛼). 𝛼 = 2𝑚 − 1The following Fig. 4 illustrates this one-round iterative differential characteristicof G-TWIS in detail.5 SummaryIn this paper, we first study the properties of TWIS structure, and as an ex-tension we also considered the generalized TWIS-type structure which can becalled G-TWIS cipher, where the block size and round number can be arbitraryvalues. Then we present (23 − 1) 10-round differential distinguishers for TWISand an 𝑛-round differential distinguisher for G-TWIS whose probabilities areall equal to 1. Therefore, by utilizing these kinds of differential distinguishers,the full-round TWIS and G-TWIS are distinguishable from an ideal cipher, andF0`-func<<<r0 >>> r1<<< r3>>> r2X0 X1 X2 X3X0 X1 X2 X3F1`-funcK0K1Fig. 4. one-round iterative differential characteristic of G-TWIShence we can break the full 10-round TWIS cipher and n-round G-TWIS ciphervery efficiently.Our results demonstrate that the design of TWIS-type structure has fatalweakness, and no matter how security the internal building blocks such as Sboxand diffusion matrix are used and even how many rounds are used, the overall ci-pher is still vulnerable to differential attack. Furthermore, the reuse of whiteningsubkeys as round subkeys may endanger the cipher, too. Therefore, we suggestthat this kind of TWIS-type cipher should be carefully used in a cryptographicsystem.References1. Biham, E., Shamir, A.: Differential Cryptanalysis of DES-like Cryptosystems. Jour-nal of Cryptology, Vol.4, No.1, pp. 3-72, 1991.2. Bogdanov, A., Knudsen, L.R., Leander, G., Paar, C., Poschmann, A., Robshaw,M.J.B., Seurin, Y., Vikkelsoe, C.: PRESENT: An Ultra-Lightweight Block Cipher.In: Paillier, P., Verbauwhede, I. (eds.) CHES 2007. LNCS, vol. 4727, pp. 450-466.Springer, Heidelberg (2007).3. Daemen, J.: Cipher and Hash Function Design Strategies Based on Linear andDifferential Cryptanalysis. Doctoral Dissertation, March 1995, K.U.Leuven.4. Daemen, J., Rijmen, V.: The Design of Rijndael- AES, the Advanced EncryptionStandard. Springer, 2002.5. Hong, D., Sung, J., Hong, S., Lim, J., Lee, S., Koo, B., Lee, C., Chang, D., Lee, J.,Jeong, K., Kim, H., Kim, J., Chee, S.: HIGHT: A New Block Cipher Suitable forLow-Resource Device. In: Goubin, L., Matsui, M. (eds.) CHES 2006. LNCS, vol.4249, pp. 46-59. Springer, Heidelberg (2006).6. Leander, G., Paar, C., Poschmann, A., Schramm, K.: New Lightweight DES Vari-ants. FSE 2007. LNCS, vol. 4539, pp. 196-210. Springer, Heidelberg (2007).7. Ojha, S., Kumar, N., Jain, K., Lal, S.: TWIS - A Lightweight Block Cipher. ICISS2009. LNCS, vol. 5905, pp. 280-291. Springer, 2009.8. Shirai, T., Shibutani, K., Akishita, T., Moriai, S., Iwata, T.: The 128-bit blockcipher CLEFIA. FSE 2007. LNCS, vol 4593, pp. 181-195. Springer, 2007.9. Sklavos, N., Moldovyan, N.A., Koufopavlou, O.: High Speed Networking Security:Design and Implementation of Two New DDP-Based Ciphers. Mobile Networksand Applications 10, pp. 219-231. Springer, Heidelberg (2005).10. Tripathy, S., Nandi, S.: LCASE: Lightweight Cellular Automata-based Symmet-rickey Encryption. International Journal of Network Security 8(2), 243-252 (2009).

Some Observations on TWIS Block Cipher

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive