TY - JOUR
T1 - Zero-correlation attacks on tweakable block ciphers with linear tweakey expansion
AU - Ankele, Ralph
AU - Dobraunig, Christoph
AU - Guo, Jian
AU - Lambooij, Eran
AU - Leander, Gregor
AU - Todo, Yosuke
PY - 2019/3/19
Y1 - 2019/3/19
N2 - The design and analysis of dedicated tweakable block ciphers is a quite recent and very active research field that provides an ongoing stream of new insights. For instance, results of Kranz, Leander, and Wiemer from FSE 2017 show that the addition of a tweak using a linear tweak schedule does not introduce new linear characteristics. In this paper, we consider – to the best of our knowledge – for the first time the effect of the tweak on zero-correlation linear cryptanalysis for ciphers that have a linear tweak schedule. It turns out that the tweak can often be used to get zero-correlation linear hulls covering more rounds compared to just searching zero-correlation linear hulls on the data-path of a cipher. Moreover, this also implies the existence of integral distinguishers on the same number of rounds. We have applied our technique on round reduced versions of QARMA, MANTIS, and SkINNy. As a result, we can present – to the best of our knowledge – the best attack (with respect to number of rounds) on a round-reduced variant of QARMA.
AB - The design and analysis of dedicated tweakable block ciphers is a quite recent and very active research field that provides an ongoing stream of new insights. For instance, results of Kranz, Leander, and Wiemer from FSE 2017 show that the addition of a tweak using a linear tweak schedule does not introduce new linear characteristics. In this paper, we consider – to the best of our knowledge – for the first time the effect of the tweak on zero-correlation linear cryptanalysis for ciphers that have a linear tweak schedule. It turns out that the tweak can often be used to get zero-correlation linear hulls covering more rounds compared to just searching zero-correlation linear hulls on the data-path of a cipher. Moreover, this also implies the existence of integral distinguishers on the same number of rounds. We have applied our technique on round reduced versions of QARMA, MANTIS, and SkINNy. As a result, we can present – to the best of our knowledge – the best attack (with respect to number of rounds) on a round-reduced variant of QARMA.
KW - Integral cryptanalysis
KW - Mantis
KW - Qarma
KW - Skinny
KW - Symmetric-key cryptography
KW - Tweakable block ciphers
KW - Zero-correlation
UR - http://www.scopus.com/inward/record.url?scp=85063675215&partnerID=8YFLogxK
U2 - 10.13154/tosc.v2019.i1.192-235
DO - 10.13154/tosc.v2019.i1.192-235
M3 - Article
AN - SCOPUS:85063675215
SN - 2519-173X
VL - 2019
SP - 192
EP - 235
JO - IACR Transactions on Symmetric Cryptology
JF - IACR Transactions on Symmetric Cryptology
IS - 1
ER -