## Abstract

Resistance against differential cryptanalysis is an important design criteria

for any modern block cipher and most designs rely on finding some upper bound on probability of single differential characteristics. However, already at EUROCRYPT'91, Lai et al. comprehended that differential cryptanalysis rather uses differentials instead of single characteristics.

In this paper, we consider exactly the gap between these two approaches and

investigate this gap in the context of recent lightweight cryptographic primitives. This shows that for many recent designs like Midori, Skinny or Sparx one has to be careful as bounds from counting the number of active S-boxes only give an inaccurate evaluation of the best differential distinguishers. For several designs we found new differential distinguishers and show how this gap evolves. We found an 8-round differential distinguisher for Skinny-64 with a

probability of $2^{-56.93}$, while the best single characteristic only suggests a probability of $2^{-72}$. Our approach is integrated into publicly available

tools and can easily be used when developing new cryptographic primitives.

Moreover, as differential cryptanalysis is critically dependent on the

distribution over the keys for the probability of differentials, we provide

experiments for some of these new differentials found, in order to confirm that

our estimates for the probability are correct. While for Skinny-64 the distribution

over the keys follows a Poisson distribution, as one would expect, we noticed that Speck-64 follows a bimodal distribution, and the distribution of Midori-64 suggests a large class of weak keys.

for any modern block cipher and most designs rely on finding some upper bound on probability of single differential characteristics. However, already at EUROCRYPT'91, Lai et al. comprehended that differential cryptanalysis rather uses differentials instead of single characteristics.

In this paper, we consider exactly the gap between these two approaches and

investigate this gap in the context of recent lightweight cryptographic primitives. This shows that for many recent designs like Midori, Skinny or Sparx one has to be careful as bounds from counting the number of active S-boxes only give an inaccurate evaluation of the best differential distinguishers. For several designs we found new differential distinguishers and show how this gap evolves. We found an 8-round differential distinguisher for Skinny-64 with a

probability of $2^{-56.93}$, while the best single characteristic only suggests a probability of $2^{-72}$. Our approach is integrated into publicly available

tools and can easily be used when developing new cryptographic primitives.

Moreover, as differential cryptanalysis is critically dependent on the

distribution over the keys for the probability of differentials, we provide

experiments for some of these new differentials found, in order to confirm that

our estimates for the probability are correct. While for Skinny-64 the distribution

over the keys follows a Poisson distribution, as one would expect, we noticed that Speck-64 follows a bimodal distribution, and the distribution of Midori-64 suggests a large class of weak keys.

Original language | English |
---|---|

Title of host publication | Selected Areas in Cryptography 2018 |

Place of Publication | Calgary, Canada |

Publisher | Springer |

Pages | 163-190 |

Number of pages | 28 |

Volume | 11349 |

Edition | Lecture Notes in Computer Science |

ISBN (Electronic) | 978-3-030-10970-7 |

ISBN (Print) | 978-3-030-10969-1 |

DOIs | |

Publication status | E-pub ahead of print - 13 Jan 2019 |

Event | SAC 2018 - Calgary, Canada Duration: 15 Aug 2018 → 17 Aug 2018 |

### Publication series

Name | Lecture Notes in Computer Science |
---|---|

Volume | 11349 |

### Conference

Conference | SAC 2018 |
---|---|

Country/Territory | Canada |

City | Calgary |

Period | 15/08/18 → 17/08/18 |

## Keywords

- Symmetric-key cryptography
- differential cryptanalysis
- lightweight cryptography
- SAT/SMT solver
- IoT
- LBlock
- Midori
- Present
- Prince
- Rectangle
- Simon
- Skinny
- Sparx
- Speck
- Twine