SPECK型算法的积分分析和不可能差分分析

SPECK系列算法是2013年由美国国家安全局提出的一类重要的轻量分组密码算法.算法整体采用变形的Feistel结构,轮函数是由模加,循环移位和异或组成的ARX模块,其中模加运算为算法主要的非线性部件.目前对于SPECK系列算法的研究主要分为两个方面:一是针对原始SPECK算法安全性的分析,主要的攻击方法包括差分分析、线性分析、积分分析和不可能差分分析等;二是对采用不同移位参数的SPECK型算法的分析,主要包含对它们抗差分分析能力的评估.本文在此基础上研究了采用不同移位参数的SPECK型算法的积分性质和不可能差分性质.我们先利用混合整数线性规划方法,基于可分性搜索了SPECK型算法的积分区分器;接着利用中间相错思想,基于模加运算的差分性质,搜索了SPECK型算法的不可能差分特征.结合已有的差分分析的结论,我们给出了不同分组长度下具有更强抵抗多种攻击能力的好的移位参数.特别的,在减轮情形下,当分组长度为32比特时,我们发现采用移位参数(9,2)的SPECK型算法比原始算法具有更强的抵抗差分分析、积分分析和不可能差分分析的能力.

Integral Cryptanalysis and Impossible Differential Cryptanalysis of SPECK-like Ciphers

SPECK is a family of important lightweight block ciphers proposed in 2013 by National Security Agency(NSA) of USA. The algorithm adopts a modified Feistel structure and the round function uses the ARX structure, which is a combination of modulo addition, rotation and XOR operation. At present, the research on SPECK is mainly in two aspects. First, the security of the original SPECK algorithm is analyzed with different techniques, including differential analysis, linear analysis, integral analysis and impossible differential analysis, etc. Second, analysis on SPECK-like algorithm with different rotational constants is presented, especially their ability to protect against differential analysis. Based on this, the integral and impossible differential analysis on these SPECKlike algorithms are further studied in this paper. Using the mixed integer linear programming method,some integral distinguishers based on division property of these SPECK-like algorithms are computed.Then some impossible differentials of these SPECK-like algorithms are also computed using the idea of miss-in-the-middle and the differential property of modular addition. Combined with known results with respect to differential attacks, some better rotational constants against all these attacks are presented. Particularly, considering the reduced-round version, when the block size is 32-bit, it is shown that the SPECK-like algorithm with rotational constants(9,2) has better resistance against differential analysis, integral analysis and impossible differential analysis than the original algorithm.