Zero-correlation linear attack on reduced-round SKINNY

doi:10.1007/s11704-022-2206-2

Front. Comput. Sci.

2023, Vol. 17

Issue (4) : 174808 https://doi.org/10.1007/s11704-022-2206-2

RESEARCH ARTICLE

Zero-correlation linear attack on reduced-round SKINNY

Yi ZHANG, Ting CUI(

), Congjun WANG

Department of Applied Mathematics, PLA SSF Information Engineering University, Zhengzhou 450000, China

Download: PDF(7232 KB) HTML
Export: BibTeX | EndNote | Reference Manager | ProCite | RefWorks

Abstract

At ToSC 2019, Ankele et al. proposed a novel idea for constructing zero-correlation linear distinguishers in a related-tweakey model. This paper further clarifies this principle and gives a search model for zero-correlation distinguishers. As a result, for the first time, the authors construct 14-round and 16-round zero-correlation linear distinguishers for SKINNY- $n$ - $2 n$ and SKINNY- $n$ - $3 n$ , respectively, which are both two rounds longer than Anekele et al.’s. Based on these distinguishers, the paper presents related-tweakey zero-correlation linear attacks on 21-round SKINNY- $n$ - $2 n$ and 25-round SKINNY- $n$ - $3 n$ , respectively.

Keywords tweakable block cipher zero-correlation related-tweakey SKINNY

Corresponding Author(s): Ting CUI

About author:

^* These authors contributed equally to this work.

Just Accepted Date: 06 July 2022 Issue Date: 12 December 2022

Cite this article:

Yi ZHANG,Ting CUI,Congjun WANG. Zero-correlation linear attack on reduced-round SKINNY[J]. Front. Comput. Sci., 2023, 17(4): 174808.

URL:

https://academic.hep.com.cn/fcs/EN/10.1007/s11704-022-2206-2
https://academic.hep.com.cn/fcs/EN/Y2023/V17/I4/174808

Attacks on SKINNY-64-128
Attack type	Rounds	Time	Data	Memory	Ref.
ZC_SK	18	$2126$	$2 62.68$	$264$	[12]
ZC_RTK	20	$2 97.5$	$2 68.4$	$282$	[4]
ID_SK	20	$2 121.08$	$2 47.69$	$2 47.69$	[13]
ZC_RTK	21	$295$	$268$	$284$	This work
ID_RK	23	$2 125.9$	$2 62.5$	$2 124.0$	[14]
ID_RK	23	$279$	$2 71.4$	$264$	[15]
Rectangle_RK	24	$2 96.83$	$2 61.67$	$284$	[16]
Rectangle_RK	25	$2 118.43$	$2 61.67$	$2 64.26$	[17]
Attacks on SKINNY-64-192
Attack type	Rounds	Time	Data	Memory	Ref.
ID_SK	22	$2 183.97$	$2 47.84$	$2 74.84$	[13]
ZC_RTK	23	$2 155.6$	$2 73.2$	$2138$	[4]
ZC_RTK	25	$2184$	$276$	$2144$	This work
Rectangle_RK	27	$2 165.5$	$2 63.5$	$280$	[14]
Rectangle_RK	30	$2 163.11$	$2 62.87$	$2 68.5$	[16]
Rectangle_RK	31	$2 182.07$	$2 62.87$	$2 62.79$	[17]
Attacks on SKINNY-128-256
Attack type	Rounds	Time	Data	Memory	Ref.
ZC_RTK	21	$2185$	$2136$	$2168$	This work
ID_RK	23	$2 251.47$	$2 124.47$	$2248$	[14]
Rectangle_RK	25	$2 226.38$	$2 124.48$	$2168$	[16]
Rectangle_RK	26	$2 254.4$	$2 126.53$	$2 128.44$	[17]
Attacks on SKINNY-128-384
Attack type	Rounds	Time	Data	Memory	Ref.
ZC_RTK	25	$2326$	$2152$	$2288$	This work
Rectangle_RK	30	$2 341.11$	$2122$	$2 128.02$	[16]
Rectangle_RK	32	$2 354.99$	$2 123.54$	$2 123.54$	[17]

Tab.1 Attacks results of SKINNY

Tab.2 Zero-correlation linear distinguishers on SKINNY

Fig.1 Round function of SKINNY

Fig.2 Tweakey schedule of SKINNY

Fig.3 An example of evaluating mask propagation in the tweakey schedule

Fig.4 14-round distinguisher for SKINNY-

n

2 n

: the cells’ values are colored as the legeng shown; and the cells in red frame form the

Γ

sequence

Fig.5 16-round distinguisher for SKINNY-

n

3 n

: the cells’ values are colored as the legeng shown; and the cells in red frame form the

Γ

sequence

Version	Rounds	Time	Data	Memory
SKINNY-64-128	21	$295$	$268$	$284$
SKINNY-128-256	21	$2185$	$2136$	$2168$
SKINNY-64-192	25	$2184$	$276$	$2144$
SKINNY-128-384	25	$2326$	$2152$	$2288$

Tab.3 Result of Zero-Correlation Attacks on SKINNY

Fig.6 21-round key recovery attack: The red cells and green cells are used to compute

Z 15 [2]

, while the blue cells and green cells are used to compute

Z 15 [14]

Guessed key	Data ( $L o g 2$ )	Stored texts	Memory ( $L o g 2$ )	Time ( $L o g 2$ )
?	16 $c$	$X 21$ [0,4,12], $X 21$ [1,5,13], $X 21$ [2,6,10,14], $X 21$ [3,7,11,15], $Δ T K 21 [6]$ , $Δ T K 19 [4]$	16 $c$	16 $c$
$S T K 21$ [2,6]	13 $c$	$X 21$ [0,4,12], $X 21$ [1,5,13], $Y 20$ [6,14], $X 21$ [3,7,11,15], $Δ T K 19 [4]$	15 $c$	18 $c$
$S T K 21$ [1,5]	12 $c$	$X 21$ [0,4,12], $Y 20$ [1,13], $Y 20$ [6,14], $X 21$ [3,7,11,15], $Δ T K 19 [4]$	16 $c$	17 $c$
$S T K 21$ [3,7]	12 $c$	$X 21$ [0,4,12], $Y 20$ [1,13], $Y 20$ [6,14], $Y 20$ [3,7,11,15], $Δ T K 19 [4]$	18 $c$	18 $c$
$S T K 21$ [0,4]	12 $c$	$Y 20$ [0,8,12], $Y 20$ [1,13], $Y 20$ [6,14], $Y 20$ [3,7,11,15], $Δ T K 19 [4]$	20 $c$	20 $c$
?	12 $c$	$X 20$ [0,12], $X 20$ [1,5,9,13], $X 20$ [6,10,14], $X 20$ [3,15], $Δ T K 19 [4]$	?	?
$S T K 20$ [1,5]	10 $c$	$X 20$ [0,12], $Y 19$ [5,13], $X 20$ [6,10,14], $X 20$ [3,15], $Δ T K 19 [4]$	20 $c$	22 $c$
$S T K 20$ [3]	9 $c$	$X 20$ [0,12], $Y 19$ [5,13], $X 20$ [6,10,14], $Y 19$ [15], $Δ T K 19 [4]$	20 $c$	21 $c$
$S T K 20$ [0]	8 $c$	$Y 19$ [12], $Y 19$ [5,13], $X 20$ [6,10,14], $Y 19$ [15], $Δ T K 19 [4]$	20 $c$	21 $c$
$S T K 20$ [6]	8 $c$	$Y 19$ [12], $Y 19$ [5,13], $Y 19$ [2,6,10], $Y 19$ [15], $Δ T K 19 [4]$	21 $c$	21 $c$
?	8 $c$	$X 19$ [4,8,12], $X 19$ [5,13], $X 19$ [2,14], $Δ T K 19 [4]$	?	?
$S T K 19$ [4]	5 $c$	$Y 18$ [4], $X 19$ [5,13], $X 19$ [2,14]	19 $c$	22 $c$
$S T K 19$ [2]	4 $c$	$Y 18$ [4], $X 19$ [5,13], $Y 18$ [14]	19 $c$	20 $c$
$S T K 19$ [5]	3 $c$	$Y 18$ [4], $Y 18$ [9], $Y 18$ [14]	19 $c$	20 $c$
?	3 $c$	$X 18$ [7,11,15]	?	?
$S T K 18$ [7]	$c$	$Y 17$ [7]	18 $c$	20 $c$
?	$c$	$X 17$ [6]	?	?
$S T K 17$ [6]	$c$	$Y 16$ [2]	19 $c$	19 $c$
?	$c$	$X 16$ [2] = $Z 15$ [2]	?	?

Tab.4 Procedure for computing

Z 15 [2]

Guessed key	Data ( $L o g 2$ )	Stored texts	Memory ( $L o g 2$ )	Time ( $L o g 2$ )
?	17 $c$	$X 21$ [0,4,8,12], $X 21$ [1,5,9,13], $X 21$ [2,6,10,14], $X 21$ [3,7,15], $Δ T K 21 [6]$ , $Δ T K 19 [4]$	17 $c$	17 $c$
$S T K 21$ [2,6]	15 $c$	$X 21$ [0,4,8,12], $X 21$ [1,5,9,13], $Y 20$ [2,6,14], $X 21$ [3,7,15], $Δ T K 19 [4]$	17 $c$	19 $c$
$S T K 21$ [0,4]	13 $c$	$Y 20$ [4,12], $X 21$ [1,5,9,13], $Y 20$ [2,6,14], $X 21$ [3,7,15], $Δ T K 19 [4]$	17 $c$	19 $c$
$S T K 21$ [3,7]	12 $c$	$Y 20$ [4,12], $X 21$ [1,5,9,13], $Y 20$ [2,6,14], $Y 20$ [11,15], $Δ T K 19 [4]$	18 $c$	19 $c$
$S T K 21$ [1,5]	12 $c$	$Y 20$ [4,12], $Y 20$ [1,5,9,13], $Y 20$ [2,6,14], $Y 20$ [11,15], $Δ T K 19 [4]$	20 $c$	20 $c$
?	12 $c$	$X 20$ [4,12], $X 20$ [1,5,9,13], $X 20$ [2,14], $X 20$ [7,11,15], $Δ T K 19 [4]$	?	?
$S T K 20$ [1,5]	10 $c$	$X 20$ [4,12], $Y 19$ [5,13], $X 20$ [2,14], $X 20$ [7,11,15], $Δ T K 19 [4]$	20 $c$	22 $c$
$S T K 20$ [7]	9 $c$	$X 20$ [4,12], $Y 19$ [5,13], $X 20$ [2,14], $Y 19$ [3,7], $Δ T K 19 [4]$	20 $c$	21 $c$
$S T K 20$ [2]	8 $c$	$X 20$ [4,12], $Y 19$ [5,13], $Y 19$ [14], $Y 19$ [3,7], $Δ T K 19 [4]$	20 $c$	21 $c$
$S T K 20$ [4]	7 $c$	$Y 19$ [8], $Y 19$ [5,13], $Y 19$ [14], $Y 19$ [3,7], $Δ T K 19 [4]$	20 $c$	21 $c$
?	7 $c$	$X 19$ [4], $X 19$ [6,10,14], $X 19$ [3,15], $Δ T K 19 [4]$	?	?
$S T K 19$ [6]	5 $c$	$X 19$ [4], $Y 18$ [6], $X 19$ [3,15], $Δ T K 19 [4]$	19 $c$	21 $c$
$S T K 19$ [4]	4 $c$	$Y 18$ [0], $Y 18$ [6], $X 19$ [3,15],	19 $c$	20 $c$
$S T K 19$ [3]	3 $c$	$Y 18$ [0], $Y 18$ [6], $Y 18$ [15]	19 $c$	20 $c$
?	3 $c$	$X 18$ [0,12], $X 18$ [5]	?	?
$S T K 18$ [0]	2 $c$	$Y 17$ [12], $X 18$ [5]	19 $c$	20 $c$
$S T K 18$ [5]	2 $c$	$Y 17$ [12], $Y 17$ [1]	20 $c$	20 $c$
?	2 $c$	$X 17$ [1,13]	?	?
$S T K 17$ [1]	$c$	$Y 16$ [13]	20 $c$	21 $c$
?	$c$	$X 16$ [14]= $Z 15$ [14]	?	?

Tab.5 Procedure for computing

Z 15 [14]

Guessed key	Data ( $L o g 2$ )	Stored texts	Memory ( $L o g 2$ )	Time ( $L o g 2$ )
?	18 $c$	$X 25$ [0,4,8,12], $X 25$ [1,5,9,13], $X 25$ [2,6,10,14], $X 25$ [3,7,11,15], $Δ T K 25 [3]$ , $Δ T K 23 [5]$	18 $c$	18 $c$
$S T K 25$ [0,1,2,3,4,5,6,7]	17 $c$	$X 24$ [0,4,8,12], $X 24$ [1,5,9,13], $X 24$ [2,6,10,14], $X 24$ [3,7,11,15], $Δ T K 23 [5]$	25 $c$	26 $c$
$S T K 24$ [0,1,2,3,4,5,6,7]	15 $c$	$X 23$ [0,4,12], $X 23$ [1,5,13], $X 23$ [2,6,10,14], $X 23$ [3,7,11,15], $Δ T K 23 [5]$	31 $c$	33 $c$
?	15 $c$	$X 23$ [0,4,12], $X 23$ [1,5,13], $X 23$ [2,6,10,14], $X 23$ [3,7,11,15], $Δ T K 23 [5]$	?	?
$S T K 23$ [2,6]	13 $c$	$X 23$ [0,4,12], $X 23$ [1,5,13], $Y 22$ [6,14], $X 23$ [3,7,11,15], $Δ T K 23 [5]$	31 $c$	33 $c$
$S T K 23$ [1,5]	11 $c$	$X 23$ [0,4,12], $Y 22$ [1,13], $Y 22$ [6,14], $X 23$ [3,7,11,15]	31 $c$	33 $c$
$S T K 23$ [3,7]	11 $c$	$X 23$ [0,4,12], $Y 22$ [1,13], $Y 22$ [6,14], $Y 22$ [3,7,11,15]	33 $c$	33 $c$
$S T K 23$ [0,4]	11 $c$	$Y 22$ [0,8,12], $Y 22$ [1,13], $Y 22$ [6,14], $Y 22$ [3,7,11,15]	35 $c$	35 $c$
?	11 $c$	$X 22$ [0,12], $X 22$ [1,5,9,13], $X 22$ [6,10,14], $X 22$ [3,15]	?	?
$S T K 22$ [1,5]	9 $c$	$X 22$ [0,12], $Y 21$ [5,13], $X 22$ [6,10,14], $X 22$ [3,15]	35 $c$	37 $c$
$S T K 22$ [3]	8 $c$	$X 22$ [0,12], $Y 21$ [5,13], $X 22$ [6,10,14], $Y 21$ [15]	35 $c$	36 $c$
$S T K 22$ [0]	7 $c$	$Y 21$ [12], $Y 21$ [5,13], $X 22$ [6,10,14], $Y 21$ [15]	35 $c$	36 $c$
$S T K 22$ [6]	7 $c$	$Y 21$ [12], $Y 21$ [5,13], $Y 21$ [2,6,10], $Y 21$ [15]	36 $c$	36 $c$
?	7 $c$	$X 21$ [4,8,12], $X 21$ [5,13], $X 21$ [2,14]	?	?
$S T K 21$ [4]	5 $c$	$Y 20$ [4], $X 21$ [5,13], $X 21$ [2,14]	35 $c$	37 $c$
$S T K 21$ [2]	4 $c$	$Y 20$ [4], $X 21$ [5,13], $Y 20$ [14]	35 $c$	36 $c$
$S T K 21$ [5]	3 $c$	$Y 20$ [4], $Y 20$ [9], $Y 20$ [14]	35 $c$	36 $c$
?	3 $c$	$X 20$ [7,11,15]	?	?
$S T K 20$ [7]	$c$	$Y 19$ [7]	34 $c$	36 $c$
?	$c$	$X 19$ [6]	?	?
$S T K 19$ [6]	$c$	$Y 18$ [2]	35 $c$	35 $c$
?	$c$	$X 18$ [2]	?	?
$S T K 18$ [2]	$c$	$Z 17$ [2]	36 $c$	36 $c$

Table A1 Procedure for computing

Z 17 [2]

Guessed key	Data ( $L o g 2$ )	Stored texts	Memory ( $L o g 2$ )	Time ( $L o g 2$ )
?	19 $c$	$X 25$ [0,4,8,12], $X 25$ [1,5,9,13], $X 25$ [2,6,10,14], $X 25$ [3,7,11,15], $Δ T K 25 [3]$ , $Δ T K 23 [5]$ , $Δ T K 21 [6]$	19 $c$	19 $c$
$S T K 25$ [0,1,2,3,4,5,6,7]	18 $c$	$X 24$ [0,4,8,12], $X 24$ [1,5,9,13], $X 24$ [2,6,10,14], $X 24$ [3,7,11,15], $Δ T K 23 [5]$ , $Δ T K 21 [6]$	26 $c$	27 $c$
$S T K 24$ [0,1,2,3,4,5,6,7]	17 $c$	$X 23$ [0,4,8,12], $X 23$ [1,5,9,13], $X 23$ [2,6,10,14], $X 23$ [3,7,15], $Δ T K 23 [5]$ , $Δ T K 21 [6]$	33 $c$	34 $c$
?	17 $c$	$X 23$ [0,4,8,12], $X 23$ [1,5,9,13], $X 23$ [2,6,10,14], $X 23$ [3,7,15], $Δ T K 23 [5]$ , $Δ T K 21 [6]$	?	?
$S T K 23$ [0,4]	15 $c$	$Y 22$ [4,12], $X 23$ [1,5,9,13], $X 23$ [2,6,10,14], $X 23$ [3,7,15], $Δ T K 23 [5]$ , $Δ T K 21 [6]$	33 $c$	35 $c$
$S T K 23$ [1,5]	14 $c$	$Y 22$ [4,12], $Y 22$ [1,5,9,13], $X 23$ [2,6,10,14], $X 23$ [3,7,15], $Δ T K 21 [6]$	34 $c$	35 $c$
$S T K 23$ [3,7]	13 $c$	$Y 22$ [4,12], $Y 22$ [1,5,9,13], $X 23$ [2,6,10,14], $Y 22$ [11,15], $Δ T K 21 [6]$	35 $c$	36 $c$
$S T K 23$ [2,6]	12 $c$	$Y 22$ [4,12], $Y 22$ [1,5,9,13], $Y 22$ [2,6,14], $Y 22$ [11,15], $Δ T K 21 [6]$	36 $c$	37 $c$
?	12 $c$	$X 22$ [4,12], $X 22$ [1,5,9,13], $X 22$ [2,14], $X 22$ [7,11,15], $Δ T K 21 [6]$	?	?
$S T K 22$ [1,5]	10 $c$	$X 22$ [4,12], $Y 21$ [5,13], $X 22$ [2,14], $X 22$ [7,11,15], $Δ T K 21 [6]$	36 $c$	38 $c$
$S T K 22$ [7]	9 $c$	$X 22$ [4,12], $Y 21$ [5,13], $X 22$ [2,14], $Y 21$ [3,7], $Δ T K 21 [6]$	36 $c$	37 $c$
$S T K 22$ [2]	8 $c$	$X 22$ [4,12], $Y 21$ [5,13], $Y 21$ [14], $Y 21$ [3,7], $Δ T K 21 [6]$	36 $c$	37 $c$
$S T K 22$ [4]	7 $c$	$Y 21$ [8], $Y 21$ [5,13], $Y 21$ [14], $Y 21$ [3,7], $Δ T K 21 [6]$	36 $c$	37 $c$
?	7 $c$	$X 21$ [4], $X 21$ [6,10,14], $X 21$ [3,15], $Δ T K 21 [6]$	?	?
$S T K 21$ [6]	4 $c$	$X 21$ [4], $Y 20$ [6], $X 21$ [3,15]	34 $c$	37 $c$
$S T K 21$ [3]	3 $c$	$X 21$ [4], $Y 20$ [6], $Y 20$ [15]	34 $c$	35 $c$
$S T K 21$ [4]	3 $c$	$Y 20$ [0], $Y 20$ [6], $Y 20$ [15]	35 $c$	35 $c$
?	3 $c$	$X 20$ [0,12], $X 20$ [5]	?	?
$S T K 20$ [0]	2 $c$	$Y 19$ [12], $X 20$ [5]	35 $c$	36 $c$
$S T K 20$ [5]	2 $c$	$Y 19$ [12], $Y 19$ [1]	36 $c$	36 $c$
?	2 $c$	$X 19$ [1,13]	?	?
$S T K 19$ [1]	$c$	$Y 18$ [13]	36 $c$	37 $c$
?	$c$	$X 18$ [14]= $Z 17$ [14]	?	?

Table A2 Procedure for computing

Z 17 [14]

Fig.A1 25-round key recovery attack: The red cells and green cells are used to compute

Z 17 [2]

, while the blue cells and green cells are used to compute

Z 17 [14]

1	A, Bogdanov V Rijmen . Linear hulls with correlation zero and linear cryptanalysis of block ciphers. Designs, Codes and Cryptography, 2014, 70( 3): 369–383
2	A, Bogdanov M Wang . Zero correlation linear cryptanalysis with reduced data complexity. In: Proceedings of the 19th International Workshop on Fast Software Encryption. 2012, 29–48
3	A, Bogdanov G, Leander K, Nyberg M Wang . Integral and multidimensional linear distinguishers with correlation zero. In: Proceedings of the 18th International Conference on the Theory and Application of Cryptology and Information Security. 2012, 244–261
4	R, Ankele C, Dobraunig J, Guo E, Lambooij G, Leander Y Todo . Zero-correlation attacks on tweakable block ciphers with linear Tweakey expansion. IACR Transactions on Symmetric Cryptology, 2019, 2019( 1): 192–235 https://doi.org/10.13154/tosc.v2019.i1.192-235
5	Z, Gu H, Li S, Khan L, Deng X, Du M, Guizani Z Tian . IEPSBP: a cost-efficient image encryption algorithm based on parallel chaotic system for green IoT. IEEE Transactions on Green Communications and Networking, 2022, 6( 1): 89–106 https://doi.org/10.1109/TGCN.2021.3095707
6	H, Li Z, Gu L, Deng Y, Han C, Yang Z Tian . A fine-grained video encryption service based on the cloud-fog-local architecture for public and private videos. Sensors, 2019, 19( 24): 5366 https://doi.org/10.3390/s19245366
7	C, Beierle J, Jean S, Kölbl G, Leander A, Moradi T, Peyrin Y, Sasaki P, Sasdrich S M Sim . The SKINNY family of block ciphers and its low-latency variant MANTIS. In: Proceedings of the 36th Annual International Cryptology Conference. 2016, 123–153
8	M, Liskov R L, Rivest D Wagner . Tweakable block ciphers. Journal of Cryptology, 2011, 24( 3): 588–613
9	J, Jean I, Nikolić T Peyrin . Tweaks and keys for block ciphers: the TWEAKEY framework. In: Proceedings of the 20th International Conference on the Theory and Application of Cryptology and Information Security. 2014, 274–288
10	Iwata T, Khairallah M, Minematsu K, Peyrin T. Remus v1.0. Submission to NIST Lightweight Cryptography Project. See Csrc.nist.gov/projects/lightweight-cryptography/round-1-candidates website, 2019
11	Iwatas T, Khairallah M, Minematsu K, Peyrin T. Romulus v1.0. Submission to NIST Lightweight Cryptography Project. See Csrc.nist.gov/projects/lightweight-cryptography/round-1-candidates website, 2019
12	S, Sadeghi T, Mohammadi N Bagheri . Cryptanalysis of reduced round skinny block cipher. IACR Transactions on Symmetric Cryptology, 2018, 2018( 3): 124–162
13	M, Tolba A, Abdelkhalek A M Youssef . Impossible differential cryptanalysis of reduced-round SKINNY. In: Proceedings of the 9th International Conference on Cryptology in Africa. 2017, 117–134
14	G, Liu M, Ghosh L Song . Security analysis of skinny under related-Tweakey settings. IACR Transactions on Symmetric Cryptology, 2017, 2017( 3): 37–72
15	R, Ankele S, Banik A, Chakraborti E, List F, Mendel S M, Sim G Wang . Related-key impossible-differential attack on reduced-round SKINNY. In: Proceedings of the 15th International Conference on Applied Cryptography and Network Security. 2017, 208–228
16	L, Qin X, Dong X, Wang K, Jia Y Liu . Automated search oriented to key recovery on ciphers with linear key schedule: applications to boomerangs in SKINNY and ForkSkinny. IACR Transactions on Symmetric Cryptology, 2021, 2021( 2): 249–291
17	X, Dong L, Qin S, Sun X Wang . Key guessing strategies for linear key-schedule algorithms in rectangle attacks. In: Proceedings of the 41st Annual International Conference on the Theory and Applications of Cryptographic Techniques. 2022, 3–33
18	C, Niu M, Li S, Sun M Wang . Zero-correlation linear cryptanalysis with equal treatment for plaintexts and Tweakeys. In: Proceedings of Cryptographers’ Track at the RSA Conference. 2021, 126–147
19	J, Daemen R, Govaerts J Vandewalle . Correlation matrices. In: Proceedings of the 2nd International Workshop on Fast Software Encryption. 1994, 275–285
20	E Biham . On Matsui’s linear cryptanalysis. In: Proceedings of Workshop on the Theory and Application of of Cryptographic Techniques. 1994, 341–355
21	T, Kranz G, Leander F Wiemer . Linear cryptanalysis: key schedules and tweakable block ciphers. IACR Transactions on Symmetric Cryptology, 2017, 2017( 1): 474–505
22	Rijmen V. Cryptanalysis and design of iterated block ciphers. Doctoral Dissertation, KU Leuven, 1997
23	S, Galice M Minier . Improving integral attacks against rijndael-256 up to 9 rounds. In: Proceedings of the 1st International Conference on Cryptology in Africa. 2008, 1–15
24	B, Sun Z, Liu V, Rijmen R, Li L, Cheng Q, Wang H, AlKhzaimi C Li . Links among impossible differential, integral and zero correlation linear cryptanalysis. In: Proceedings of the 35th Annual Cryptology Conference. 2015, 95–115
25	H, Hadipour S, Sadeghi M Eichlseder . Finding the impossible: automated search for full impossible-differential, zero-correlation, and integral attacks. In: Proceedings of the 42nd Annual International Conference on the Theory and Applications of Cryptographic Techniques. 2023, 128–157

[1]

FCS-22206-OF-YZ_suppl_1

Download

Viewed

Full text

Abstract

Cited

Shared

Discussed