A Link Between Integrals and Higher‐Order Integrals of SPN Ciphers

Integral cryptanalysis, which is based on the existence of (higher‐order) integral distinguishers, is a powerful cryptographic method that can be used to evaluate the security of modern block ciphers. In this paper, we focus on substitution‐permutation network (SPN) ciphers and propose a criterion to characterize how an r‐round integral distinguisher can be extended to an (r+1)‐round higher‐order integral distinguisher. This criterion, which builds a link between integrals and higher‐order integrals of SPN ciphers, is in fact based on the theory of direct decomposition of a linear space defined by the linear mapping of the cipher. It can be directly utilized to unify the procedure for finding 4‐round higher‐order integral distinguishers of AES and ARIA and can be further extended to analyze higher‐order integral distinguishers of various block cipher structures. We hope that the criterion presented in this paper will benefit the cryptanalysts and may thus lead to better cryptanalytic results.     

一类ARIA型扩散结构分支数的研究

分支数达到最大的二元矩阵被广泛应用到分组密码扩散层的设计中.本文针对ARIA算法的扩散层,首先给出了ARIA型扩散结构的定义,给出了16阶ARIA型扩散结构的分支数情况,进一步给出了分支数为8的16阶ARIA型扩散结构的充要条件,从而构造了一大批可供选择的分支数为8的16阶二元矩阵.其次,解决了16阶ARIA型扩散结构分支数为8的计数问题,最后,给出了分支数为8的16阶对合ARIA型扩散结构的构造方法.本文的研究成果为构造分支数达到最大的16阶对合二元方阵提供了一种新方法.     

对分组密码算法ARIA算法不可能差分分析的改进

依据ARIA的结构特性,基于Yu Sasaki和Yosuke Todo给出的4.5轮截断不可能差分路径,实现了对7轮ARIA-256的不可能差分分析,需要数据复杂度为2112和大约2217次7轮加密运算。与现有的研究成果对比,该分析在数据复杂度和时间复杂度上都有所减少。进一步研究8轮不可能差分分析,需要数据复杂度为2191和大约2319次8轮加密运算。虽然该结果超过了穷举搜索的攻击复杂度,但与已有的研究成果对比,减少了攻击复杂度。该方法改进了文献[12]的分析结果,降低了7轮攻击和8轮攻击的攻击复杂度。     

对7轮ARIA-192的不可能差分分析

ARIA密码是2003年由韩国学者提出的新的分组密码算法,该密码与AES的设计原理相类似,并在2004年被选为韩国的分组密码标准。该文根据ARIA密码的结构特征,提出ARIA密码的一种新的7轮不可能差分攻击路径,首次实现了对ARIA-192的不可能差分攻击,攻击的时间复杂度为2176.2。同时,利用扩散层的相关性质降低攻击ARIA-256的时间复杂度为2192.2。     

Integral fault analysis of the ARIA cipher

ARIA is a Korean standard block cipher,which is flexible to provide security for software and hardware implementation.Since its introduction,some research of fault analysis is devoted to attacking the last two rounds of ARIA.It is an open problem to know whether provoking faults at some former rounds of ARIA allowed recovering the secret key.An answer was given to solve this problem by showing a novel integral differential fault analysis on two rounds earlier of ARIA.The mathematical analysis and simulating experiments show that the attack can successfully recover its secret key by fault injections.The results in this study describe that the integral fault analysis is a strong threaten to the security of ARIA.The results are beneficial to the analysis of the same type of other block ciphers.     

Differential fault analysis on the ARIA algorithm

The ARIA algorithm is a Korean Standard block cipher, which is optimized for lightweight environments. On the basis of the byte-oriented model and the differential analysis principle, we propose a differential fault attack on the ARIA algorithm. Mathematical analysis and simulating experiment show that our attack can recover its 128-bit secret key by introducing 45 faulty ciphertexts. Simultaneously, we also present a fault detection technique for protecting ARIA against this proposed analysis. We believe that our results in this study will also be beneficial to the analysis and protection of the same type of other iterated block ciphers.     

不可能差分攻击中的明文对筛选方法

基于快速排序原理,提出用于筛选明文对的基本算法和改进算法,改进算法的计算复杂性可以将由直接检测方法的O(n2)降为O(nlogn)。基于上述结果以改进算法分析对ARIA等分组密码算法的几个不可能攻击的计算复杂性,证明ICISA2008上发表的某个针对对ARIA的不可能攻击的数据筛选过程的计算复杂性远高于密钥求解过程的计算复杂性。     

Efficient Masking Methods Appropriate for the Block Ciphers ARIA and AES

In this paper, we propose efficient masking methods for ARIA and AES. In general, a masked S‐box (MS) block can be constructed in different ways depending on the implementation platform, such as hardware and software. However, the other components of ARIA and AES have less impact on the implementation cost. We first propose an efficient masking structure by minimizing the number of mask corrections under the assumption that we have an MS block. Second, to make a secure and efficient MS block for ARIA and AES, we propose novel methods to solve the table size problem for the MS block in a software implementation and to reduce the cost of a masked inversion which is the main part of the MS block in the hardware implementation.     

对8轮ARIA算法的差分枚举攻击

给出了ARIA算法4轮差分性质,提出了对ARIA算法的差分枚举攻击。攻击了7轮和8轮ARIA-256算法,攻击的数据复杂度是256,攻击7轮时预计算的复杂度为2238.2次加密7轮ARIA算法,恢复密钥的计算复杂度是2124.2次加密7轮ARIA算法;攻击8轮时预计算的复杂度为2238次加密8轮ARIA算法,恢复密钥的计算复杂度是2253.6次加密8轮ARIA算法。