四分组类CLEFIA变换簇抵抗差分密码分析的安全性评估

差分密码分析是针对分组密码的强有力的攻击方法,估计分组密码抵抗差分密码分析的能力是分组密码安全性评估的重要内容之一.基于实际应用背景,提出了“四分组类CLEFIA变换簇”的概念,并利用变换簇中两种特殊分组密码结构的差分对应之间的关系,给出了变换簇中所有密码结构抵抗差分密码分析的安全性评估结果.     

两类动态密码结构抵抗不可能差分和零相关线性能力评估

动态密码的设计与分析是当前密码学领域研究的热点.本文针对类CLEFIA动态密码结构和四分组CLEFIA变换簇抵抗不可能差分和零相关线性分析的能力进行评估.当两类动态密码结构的轮函数为双射时,通过研究密码组件的可交换性质,证明了这两类动态密码结构各自置换等价于标准静态密码结构.利用建立的置换等价关系,通过构造静态密码结构不可能差分和零相关线性区分器,证明了4n轮类CLEFIA动态密码结构所有结构均存在8轮的不可能差分和零相关线性区分器,证明了4n轮四分组CLEFIA变换簇所有结构均存在9轮的不可能差分和零相关线性区分器.     

AC分组密码

本文推出了一个分组长度和密钥长度均为128bit的分组密码－－AC（acipher），它的整体结构是SP网络，加解密是相似的。AC分组密码的设计结合了宽轨迹策略和比特块技术，以确保算法对差分密码分析和线性密码分析的安全性。本文的目的是寻求公众对AC分组密码的测试、分析和评估。     

分组密码安全性研究的新进展

本文介绍了近期在分组密码(DES一类)安全性研究的进展情况,重点对差分密码分析和线性密码分析的方法和结果进行论述,对分组密码的安全性提出了展望。     

对八阵图算法的不可能差分密码分析和线性密码分析

该文对八阵图(ESF)算法抵抗不可能差分密码分析和线性密码分析的能力进行了研究。ESF算法是一种具有Feistel结构的轻量级分组密码算法，它的轮函数为代换置换(SP)结构。该文首先用新的不可能差分区分器分析了12轮ESF算法，随后用线性密码分析的方法分析了9轮ESF算法。计算得出12轮不可能差分分析的数据复杂度大约为O(267)，时间复杂度约为O(2110.7)，而9轮线性密码分析的数据复杂度仅为O(235)，时间复杂度不大于O(215.6)。结果表明ESF算法足够抵抗不可能差分密码分析，而抵抗线性密码分析的能力相对较弱。     

基于MISTY结构的可调分组密码的设计与分析

对如何不借助于现有的分组密码来直接设计可调分组密码进行了研究.通过在MISTY结构的不同位置添加一个标号,分析了在4轮和5轮MISTY结构上设计可调分组密码的可行性.对4轮结构提出了攻击的方法;对5轮结构提供了安全性理论证明.结果表明,在选择明文攻击下,5轮MISTY结构才能提供安全的可调分组密码.     

用组合网络构造分组密码

本文提出了组合网络的概念，将此网络的输入、输出关系作加密变换，构造了一个秘密密钥分组密码，分析了其安全性。     

面向分组密码算法的程序设计语言研究

 本文提出了一种接近数学描述的面向分组密码算法的程序设计语言(Programming Language for the Block Cipher Algorithm,PLBCA).PLBCA能够以形式化方式方便地描述分组密码算法的结构.本文介绍了PLBCA的语法规范,以分组密码算法DES为例说明PLBCA应用方法,并借助ANTLR工具实现了PLBCA的解析器.利用PLBCA,密码学专家可以方便快捷地对密码算法进行算法正确性和安全性分析,以检验算法的设计.PLBCA有助于提高密码算法检验的效率,为密码算法的设计和自动检测分析提供了一种辅助工具.     

多重线性密码分析的改进

本文介绍一种有助于对分组密码作线性密码分析并能减少有效攻击所数据量的算法，给出了该算法成功率的计算公式，并与现有的线性密码分析方法作了比较。     

一种基于Feistel结构混沌分组密码的研究

混沌系统具有良好的伪随机性、混频特性、对初始状态的敏感性、复杂的映射参数等特性,这些特性与密码学要求的产生伪随机信号、混乱和扩散、加解密密钥的难以预测等属性十分吻合。文中针对一种较新的基于Feistel结构的混沌分组密码,应用线性密码分析方法,分别在固定S盒、动态S盒两种情况对该算法进行了分析,并进行了大量的仿真测试。分析测试结果表明,相比较于传统分组密码,该混沌分组密码能够更有效地抵抗线性密码攻击,性能良好。     

Information leakage of Feistel ciphers

We examine the information leakage between sets of plaintext and ciphertext bits in symmetric-key block ciphers. The paper demonstrates the effectiveness of information leakage as a measure of cipher security by relating information leakage to linear cryptanalysis and by determining a lower bound on the amount of data required in an attack from an upper bound on information leakage. As well, a model is developed which is used to estimate the upper bound on the information leakage of a general Feistel (1975) block cipher. For a cipher that fits the model well, the results of the analysis can be used as a measure in determining the number of rounds required for security against attacks based on information leakage. It is conjectured that the CAST-128 cipher fits the model well and using the model it is predicted that information leaked from 20 or fewer plaintext bits is small enough to make an attack on CAST-128 infeasible     

截断差分概率的上界估计与应用

截断差分分析是差分分析的一个变形。为说明一个密码算法能够抵抗截断差分分析,需要给出截断差分概率的上界。Masayuki Kanda等人就密码算法中S盒为GF(256)上的乘法逆变换和仿射双射变换复合而成时,提出了截断差分概率的上界一个猜想。该文就一般双射S盒给出了该概率上界问题的一个估计,Masayuki Kanda的猜想是该估计所考虑问题的一个特例,在一些情况下,该估计给出的上界与Masayuki Kanda的猜想接近。利用该结论可以衡量密码算法截断差分传递链概率的上界。该结论为分组密码抗截断差分分析的可证明安全性提供了理论依据。     

Attacks on Block Ciphers of Low Algebraic Degree

In this paper an attack on block ciphers is introduced, the interpolation attack. This method is useful for attacking ciphers that use simple algebraic functions (in particular quadratic functions) as S-boxes. Also, attacks based on higher-order differentials are introduced. They are special and important cases of the interpolation attacks. The attacks are applied to several block ciphers, the six-round prototype cipher by Nyberg and Knudsen, which is provably secure against ordinary differential cryptanalysis, a modified version of the block cipher SHARK, and a block cipher suggested by Kiefer. Received April 1999 and revised October 2000 Online publication 9 April 2001     

A Link Between Integrals and Higher‐Order Integrals of SPN Ciphers

Integral cryptanalysis, which is based on the existence of (higher‐order) integral distinguishers, is a powerful cryptographic method that can be used to evaluate the security of modern block ciphers. In this paper, we focus on substitution‐permutation network (SPN) ciphers and propose a criterion to characterize how an r‐round integral distinguisher can be extended to an (r+1)‐round higher‐order integral distinguisher. This criterion, which builds a link between integrals and higher‐order integrals of SPN ciphers, is in fact based on the theory of direct decomposition of a linear space defined by the linear mapping of the cipher. It can be directly utilized to unify the procedure for finding 4‐round higher‐order integral distinguishers of AES and ARIA and can be further extended to analyze higher‐order integral distinguishers of various block cipher structures. We hope that the criterion presented in this paper will benefit the cryptanalysts and may thus lead to better cryptanalytic results.     

An introduction to Block Cipher Cryptanalysis

Since the introduction of the Data Encryption Standard (DES) in the mid-1970s, block ciphers have played an ever-increasing role in cryptology. Because of the growing number of practical applications relying on their security,block ciphers have received, and are still receiving, a substantial amount of attention from academic cryptanalysts. This has led, over the last decades,to the development of several general techniques to analyze the security of block ciphers. This paper reviews the fundamental principles behind today's state of the art in block cipher cryptanalysis.     

一类非平衡Feistel网络的线性偏差分析

M.Matsui 1993年就指出线性密码分析是分组密码设计最重要的安全性能指标之一,所以有必要估计分组密码抵抗线性密码分析的能力.M.Kanda等人1999年讨论了传统Feistel密码的线性偏差,K.Nyberg和张如文等人对一类特殊的非平衡Feistel网络的线性偏差进行了研究.本文对一类m分组非平衡Feistel网络的线性偏差关系进行了深入的研究和分析,给出了任意轮线性偏差与轮函数F的线性偏差的数学关系,对其线性偏差的上界进行了讨论,并证明了有关线性偏差关于密钥的平方均值的两个特性.本文的研究推广了K.Nyberg和张如文等人的结论.     

Impossible Differential Cryptanalysis on Lai‐Massey Scheme

The Lai‐Massey scheme, proposed by Vaudenay, is a modified structure in the International Data Encryption Algorithm cipher. A family of block ciphers, named FOX, were built on the Lai‐Massey scheme. Impossible differential cryptanalysis is a powerful technique used to recover the secret key of block ciphers. This paper studies the impossible differential cryptanalysis of the Lai‐Massey scheme with affine orthomorphism for the first time. Firstly, we prove that there always exist 4‐round impossible differentials of a Lai‐Massey cipher having a bijective F‐function. Such 4‐round impossible differentials can be used to help find 4‐round impossible differentials of FOX64 and FOX128. Moreover, we give some sufficient conditions to characterize the existence of 5‐, 6‐, and 7‐round impossible differentials of Lai‐Massey ciphers having a substitution‐permutation (SP) F‐function, and we observe that if Lai‐Massey ciphers having an SP F‐function use the same diffusion layer and orthomorphism as a FOX64, then there are indeed 5‐ and 6‐round impossible differentials. These results indicate that both the diffusion layer and orthomorphism should be chosen carefully so as to make the Lai‐Massey cipher secure against impossible differential cryptanalysis.     

Decorrelation: A Theory for Block Cipher Security

Pseudorandomness is a classical model for the security of block ciphers. In this paper we propose convenient tools in order to study it in connection with the Shannon Theory, the Carter–Wegman universal hash functions paradigm, and the Luby–Rackoff approach. This enables the construction of new ciphers with security proofs under specific models. We show how to ensure security against basic differential and linear cryptanalysis and even more general attacks. We propose practical construction schemes.