**Mind the Gap - A Closer Look at the Security of Block Ciphers against Differential Cryptanalysis.** / Ankele, Ralph; Kölbl, Stefan.

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

E-pub ahead of print

**Mind the Gap - A Closer Look at the Security of Block Ciphers against Differential Cryptanalysis.** / Ankele, Ralph; Kölbl, Stefan.

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Ankele, R & Kölbl, S 2019, Mind the Gap - A Closer Look at the Security of Block Ciphers against Differential Cryptanalysis. in *Selected Areas in Cryptography 2018.* Lecture Notes in Computer Science edn, vol. 11349, Lecture Notes in Computer Science, vol. 11349, Springer, Calgary, Canada, pp. 163-190, SAC 2018, Calgary, Canada, 15/08/18. https://doi.org/10.1007/978-3-030-10970-7_8

Ankele, R., & Kölbl, S. (2019). Mind the Gap - A Closer Look at the Security of Block Ciphers against Differential Cryptanalysis. In *Selected Areas in Cryptography 2018 *(Lecture Notes in Computer Science ed., Vol. 11349, pp. 163-190). (Lecture Notes in Computer Science; Vol. 11349). Calgary, Canada: Springer. https://doi.org/10.1007/978-3-030-10970-7_8

Ankele R, Kölbl S. Mind the Gap - A Closer Look at the Security of Block Ciphers against Differential Cryptanalysis. In Selected Areas in Cryptography 2018. Lecture Notes in Computer Science ed. Vol. 11349. Calgary, Canada: Springer. 2019. p. 163-190. (Lecture Notes in Computer Science). https://doi.org/10.1007/978-3-030-10970-7_8

@inproceedings{459f3ce4105b489fa309d2b2fbd80e63,

title = "Mind the Gap - A Closer Look at the Security of Block Ciphers against Differential Cryptanalysis",

abstract = "Resistance against differential cryptanalysis is an important design criteriafor any modern block cipher and most designs rely on finding some upper bound on probability of single differential characteristics. However, already at EUROCRYPT'91, Lai et al. comprehended that differential cryptanalysis rather uses differentials instead of single characteristics.In this paper, we consider exactly the gap between these two approaches andinvestigate this gap in the context of recent lightweight cryptographic primitives. This shows that for many recent designs like Midori, Skinny or Sparx one has to be careful as bounds from counting the number of active S-boxes only give an inaccurate evaluation of the best differential distinguishers. For several designs we found new differential distinguishers and show how this gap evolves. We found an 8-round differential distinguisher for Skinny-64 with a probability of $2^{-56.93}$, while the best single characteristic only suggests a probability of $2^{-72}$. Our approach is integrated into publicly available tools and can easily be used when developing new cryptographic primitives.Moreover, as differential cryptanalysis is critically dependent on the distribution over the keys for the probability of differentials, we provideexperiments for some of these new differentials found, in order to confirm thatour estimates for the probability are correct. While for Skinny-64 the distribution over the keys follows a Poisson distribution, as one would expect, we noticed that Speck-64 follows a bimodal distribution, and the distribution of Midori-64 suggests a large class of weak keys.",

keywords = "Symmetric-key cryptography, differential cryptanalysis, lightweight cryptography, SAT/SMT solver, IoT, LBlock, Midori, Present, Prince, Rectangle, Simon, Skinny, Sparx, Speck, Twine",

author = "Ralph Ankele and Stefan K{\"o}lbl",

year = "2019",

month = "1",

day = "13",

doi = "10.1007/978-3-030-10970-7_8",

language = "English",

isbn = "978-3-030-10969-1",

volume = "11349",

series = "Lecture Notes in Computer Science",

publisher = "Springer",

pages = "163--190",

booktitle = "Selected Areas in Cryptography 2018",

edition = "Lecture Notes in Computer Science",

}

TY - GEN

T1 - Mind the Gap - A Closer Look at the Security of Block Ciphers against Differential Cryptanalysis

AU - Ankele, Ralph

AU - Kölbl, Stefan

PY - 2019/1/13

Y1 - 2019/1/13

N2 - Resistance against differential cryptanalysis is an important design criteriafor any modern block cipher and most designs rely on finding some upper bound on probability of single differential characteristics. However, already at EUROCRYPT'91, Lai et al. comprehended that differential cryptanalysis rather uses differentials instead of single characteristics.In this paper, we consider exactly the gap between these two approaches andinvestigate this gap in the context of recent lightweight cryptographic primitives. This shows that for many recent designs like Midori, Skinny or Sparx one has to be careful as bounds from counting the number of active S-boxes only give an inaccurate evaluation of the best differential distinguishers. For several designs we found new differential distinguishers and show how this gap evolves. We found an 8-round differential distinguisher for Skinny-64 with a probability of $2^{-56.93}$, while the best single characteristic only suggests a probability of $2^{-72}$. Our approach is integrated into publicly available tools and can easily be used when developing new cryptographic primitives.Moreover, as differential cryptanalysis is critically dependent on the distribution over the keys for the probability of differentials, we provideexperiments for some of these new differentials found, in order to confirm thatour estimates for the probability are correct. While for Skinny-64 the distribution over the keys follows a Poisson distribution, as one would expect, we noticed that Speck-64 follows a bimodal distribution, and the distribution of Midori-64 suggests a large class of weak keys.

AB - Resistance against differential cryptanalysis is an important design criteriafor any modern block cipher and most designs rely on finding some upper bound on probability of single differential characteristics. However, already at EUROCRYPT'91, Lai et al. comprehended that differential cryptanalysis rather uses differentials instead of single characteristics.In this paper, we consider exactly the gap between these two approaches andinvestigate this gap in the context of recent lightweight cryptographic primitives. This shows that for many recent designs like Midori, Skinny or Sparx one has to be careful as bounds from counting the number of active S-boxes only give an inaccurate evaluation of the best differential distinguishers. For several designs we found new differential distinguishers and show how this gap evolves. We found an 8-round differential distinguisher for Skinny-64 with a probability of $2^{-56.93}$, while the best single characteristic only suggests a probability of $2^{-72}$. Our approach is integrated into publicly available tools and can easily be used when developing new cryptographic primitives.Moreover, as differential cryptanalysis is critically dependent on the distribution over the keys for the probability of differentials, we provideexperiments for some of these new differentials found, in order to confirm thatour estimates for the probability are correct. While for Skinny-64 the distribution over the keys follows a Poisson distribution, as one would expect, we noticed that Speck-64 follows a bimodal distribution, and the distribution of Midori-64 suggests a large class of weak keys.

KW - Symmetric-key cryptography

KW - differential cryptanalysis

KW - lightweight cryptography

KW - SAT/SMT solver

KW - IoT

KW - LBlock

KW - Midori

KW - Present

KW - Prince

KW - Rectangle

KW - Simon

KW - Skinny

KW - Sparx

KW - Speck

KW - Twine

UR - https://link.springer.com/chapter/10.1007/978-3-030-10970-7_8

U2 - 10.1007/978-3-030-10970-7_8

DO - 10.1007/978-3-030-10970-7_8

M3 - Conference contribution

SN - 978-3-030-10969-1

VL - 11349

T3 - Lecture Notes in Computer Science

SP - 163

EP - 190

BT - Selected Areas in Cryptography 2018

PB - Springer

CY - Calgary, Canada

ER -