Related-Key Multiple Impossible Differential Cryptanalysis on Full-Round LiCi-2 Designed for IoT

Zhang, Kai; Lai, Xuejia; Wang, Lei; Guan, Jie; Hu, Bin; Wang, Senpeng; Shi, Tairong

doi:https://doi.org/10.1155/2022/3611840

Security and Communication Networks

On this page

Abstract Introduction Conclusion Appendix Data Availability Conflicts of Interest Acknowledgments References Copyright Related Articles

Research Article | Open Access

Volume 2022 | Article ID 3611840 | https://doi.org/10.1155/2022/3611840

Related-Key Multiple Impossible Differential Cryptanalysis on Full-Round LiCi-2 Designed for IoT

Kai Zhang,^1,2Xuejia Lai ,¹Lei Wang,¹Jie Guan,²Bin Hu,²Senpeng Wang,²and Tairong Shi²

Academic Editor: Marimuthu Karuppiah

Received15 Nov 2021

Revised12 Mar 2022

Accepted22 Mar 2022

Published25 May 2022

Abstract

LiCi-2 is an ultralightweight block cipher designed for constrained IoT devices. It is a successor of LiCi and has even better performance in both software and hardware implementation. In this paper, based on the idea of related-key multiple impossible differential cryptanalysis, a key recovery attack on full-round LiCi-2 is proposed. First, an interesting property is revealed that, with a single bit difference in the related key, a 10-round differential character with probability of 1 exists on LiCi-2. With an automatic approach, the boundaries of impossible differential distinguishers in terms of single-key setting and related-key setting are explored. Under our construction method, the longest length is 8 rounds for single-key setting and 18 rounds for related-key setting. Finally, based on these 18-round distinguishers, a 25-round key recovery attack is proposed with adding 3 rounds before and 4 rounds after the distinguisher. Our attack needs one related key. The time complexity for our attack is O(2^123.44), the memory complexity is O(2⁹⁴), and the data complexity is O(2^60.68). As far as we know, no full-round attack has previously been reported on LiCi-2.

1. Introduction

As a representative for the new information age, the Internet of things (IoT) has shown its strong vitality in many fields. It can be viewed as an expanded network based on the Internet and it combines various sensing devices to form a huge network, which enables a wider interconnection of people, machines, and things. However, the sensing devices in IoT usually have very limited resources such as computing resource, power resource, and hardware implementation resource. So, it is very essential to propose lightweight primitives and ensure the information security in IoT devices. In recent years, many good lightweight block ciphers are proposed such as PRESENT [1], GIFT [2], Midori [3], LBlock [4], RECTANGLE [5], SIMON, and SPECK [6]. In 2019, NIST (National Institute of Standards and Technology) proposed a standardization project LWC (LightWeight Cryptography) to enhance the development for lightweight ciphers. Among these lightweight block ciphers, LiCi (denoted as LiCi-1 in this paper to avoid confusion) is a lightweight block cipher proposed in 2017 [7]. The block size for LiCi-1 is 64-bit and the key size is 128-bit. It totally has 31 rounds. Up to now, the security margin on LiCi-1 is enough. To reach better performance, as a successor, LiCi-2 was proposed in 2018 [8]. For LiCi-2, it reduces the total rounds from 31 to 25, and half of the subkeys and a circular shift are omitted for better performance. LiCi-2 is designed for extremely constrained devices, such as 6LoWPAN. It shows good performance in memory requirement, power consumption, and hardware implementation.

Impossible differential cryptanalysis was originally proposed by Knudsen [9] and Biham et al. [10], respectively. It is one of the most effective cryptanalytic methods so far. The basic idea of impossible differential cryptanalysis is establishing an impossible differential distinguisher and filtering the wrong key candidates with this distinguisher until the correct key is recovered. Related-key impossible differential cryptanalysis is a variant of impossible differential cryptanalysis. This attack is based on the assumption that the attacker has access to the encryption oracle and can use related keys as input. This kind of attack has been applied to many block ciphers successfully, such as AES and LBlock [11–15].

Our Contributions: The main purpose of this paper is to evaluate the security level on LiCi-2 against related-key multiple impossible differential cryptanalysis. There are three main contributions which are listed as follows:(i)A 10-round differential distinguisher with probability of 1 is constructed. With this property, many differential-type distinguishers can be extended for better attack.(ii)The length and number of impossible differential distinguishers on LiCi-2 in single-key setting and related-key setting are explored in an automatic approach. In the single-key setting, the longest length of the distinguisher under our construction method is 9-round and there are altogether 240 such distinguishers discovered. In the related-key setting, the longest length of the distinguishers discovered is 18-round and 65 such distinguishers are presented.(iii)Based on twenty of these 18-round related-key distinguishers, a key recovery attack on full-round LiCi-2 is proposed with adding 3 rounds before and 4 rounds after the distinguisher. The summary of our result and prior results on LiCi-1 and LiCi-2 is presented in Table 1. This paper is organized as follows. Section 2 introduces the notations used throughout this paper. Section 3 gives a brief description on LiCi-2. Section 4 presents some observations and properties on LiCi-2. In Section 5, a key recovery attack on LiCi-2 is proposed, and Section 6 concludes the paper.

2. Notations

Suppose that E is an n-bit block cipher of R rounds; the following notations are used throughout this paper:(i) 128-bit master key, represents the value of the 128-bit key register at the t-th round and represents the i-th bit to the jth bit of K(ii) 32-bit round key at the i-th round(iii): input for the i-th round, represents the left branch, represents the right branch, and () represents the t1-th bit to the t2-th bit of ()(iv): output of the Sbox layer for the i-th round(v)“i”: left rotation with i bits(vi)“ XOR operation

3. Brief Description on LiCi-2

LiCi-2 is a lightweight block cipher that was proposed in 2018 [8]. It adopts a Feistel-type structure. The block size for LiCi-2 is 64-bit and the key size is 128-bit. It totally has 25 rounds. Each round consists of Sbox constitution, key addition, and circular shift. The round function is depicted in Figure 1 and the 4-bit Sbox used in LiCi-2 is depicted in Table 2.

Key Schedule: The scale of master key K is 128-bit. It can be denoted as K = k₁₂₇, k₁₂₆, k₁₂₅, …, k₂, k₁, k₀. First, the 128-bit key register is initialized with the master key. The register is rotated by 13 bits on the left. Every four of the eight least significant bits of the key register are substituted with the Sbox. XOR the binary form of the round number to the bits [k₆₃k₆₂k₆₁k₆₀k₅₉]. The 32 least significant bits are extracted as the round key . The mathematical form of this updating progress can be illustrated as follows:(1)[k₁₂₇k₁₂₆ ⋅⋅⋅ k₁k₀] 13(2)[k₃k₂k₁k₀] = S[k₃k₂k₁k₀](3)[k₇k₆k₅k₄] = S[k₇k₆k₅k₄](4)[k₆₃k₆₂k₆₁k₆₀k₅₉] = [k₆₃k₆₂k₆₁k₆₀k₅₉] ⊕ RCⁱ(5) = [k₃₁k₃₀ ⋅⋅⋅ k₁k₀]

4. Observations on LiCi-2

In this section, some new observations and properties on LiCi-2 are introduced. First, a 10-round differential character with probability one is constructed in Property 1. The boundaries of impossible differential distinguishers on LiCi-2 in single-key setting and related-key setting are discussed in Observation 1 and Observation 2. These distinguishers will be a foundation for our later attack.

Property 1 (a 10-Round Differential Character). Given two plaintext pairs whose difference is and a related key whose difference is , if , , and other differences are all zeros, the difference of the internal state at the beginning of the 11th round will have only two-bit difference with probability of 1.

Proof. The difference of the first subkey can be derived from , where and other bits are all zeros. According to the round function, the difference for the input of the second round can be calculated as follows:As = 0 and , we can derive . So, after several consecutive rounds, the difference of the internal state will remain zero until some bring in a new nonzero difference.
Let us consider the differential transfer property of the key schedule. According to the key schedule, the single-bit difference of the master key will go through the following positions of the key register (Table 3) at the first 10 rounds.
After analyzing these positions, the nonzero difference will not appear in the subkeys until the 10th round, that is, . So the differences of , … will all be zeros and, for , due to the difference of .
Former Observation 1 [17]. For the Sbox of LiCi-2, there are some differential characters for the input and output difference as indicated in Table 4.
This observation was proposed on LiCi-1. As the Sboxes for these two ciphers are identical, it can also be used on LiCi-2. It reveals the details of the differential transmission property for the Sbox. With this property, we can construct longer impossible differential distinguishers.
Observation 1 (Boundary of Single-Key Impossible Differential Distinguishers). For LiCi-2, in single-key setting, considering the details of the Sbox in Table 4, the maximum length of impossible differential distinguisher is 8 rounds and there are 544 such distinguishers in terms of one active bit input and output difference. If the numbers of active bits for the input and output difference are both limited to 2, the maximum length of single-key impossible differential distinguisher is 9 rounds and there are 240 such 9-round distinguishers. Summary of the statistics for these distinguishers is illustrated in Table 5.
As expected by the designers, this new version of LiCi has better diffusion property. The result in Observation 1 validates this improvement. For the original LiCi-1, for single-bit difference, the maximum length can reach 10 rounds and, for 1-bit input and 2-bit output difference, the maximum length can reach 11 rounds.
Observation 2 (Boundary of Related-Key Impossible Differential Distinguishers). For LiCi-2, in related-key setting, considering the details of the Sbox in Table 4, the maximum length of impossible differential distinguisher is 17 rounds and there are 64 such distinguishers in terms of one active bit in input, output, and key difference. If the number of active bits is 1 for input and key and 2 for output, the maximum length of related-key impossible differential distinguisher can reach 18 rounds and there are 65 such distinguishers (all these 65 distinguishers are presented in the Appendix). The summary of all these distinguishers is illustrated in Table 6.
According to Property 1, there are some long related-key differential characters. Thus, we added the condition of related key to our automatic searching algorithm and the result coincides with Property 1. The distinguishers are stretched for about 10 rounds as expected. Through Observation 2, it is found that, due to the existence of Property 1, many long related-key impossible differential distinguishers exist for LiCi-2 and the longest length under our searching strategy can cover about 72% of the total rounds.
For LiCi-1, a single 10-round impossible differential distinguisher is reported in [11], the hamming weight for the input difference is one, and output difference is two. According to our research on LiCi-2, there are two interesting contrary observations:(1)The security level for single-key impossible differential cryptanalysis on LiCi-2 is higher than that on LiCi-1(2)In related-key setting, the security level on LiCi-2 is much worse than that on LiCi-1Property 2 (an 18-Round Distinguisher). For LiCi-2 reduced to 18 rounds, the differences for the plaintexts, ciphertexts, and related keys are denoted as , and respectively. If , , , and other differences are all zeros, it is an 18-round impossible differential distinguisher.

Proof. The difference of the master key will lead to the following differences for the 18-round key registers: . According to the key schedule, the differences for the round keys are , and other differences are all zeros.
As , according to the round function, the difference of the output of the first round can be calculated as follows:So .
For , as the difference of the input is (0,0,0,1), according to Table 4, the difference of the output is of the form (1,,,). After calculation according to the round function, the form of the difference for is as follows:Similarly, the input differences for the 4th round and 5th round are as follows:In the direction of decryption, the output difference is expressed as follows:According to the key schedule, the round key has a single-bit difference in . After one-round decryption, the difference for the input of the 17th round is . As the differences for subkey to are all zeros, the difference for the input of the 9th round .
The subkey will bring in a new difference in ; thus the difference for the input of the 8th round is .
Similarly, the input differences for the 7th to 4th rounds calculated in the decryption direction are as follows:After comparing the two differences of derived in the encryption and decryption direction, there exists a contradiction in the position of (in the encryption direction, the difference is zero, while in the decryption direction, the difference is one, and the contradiction bit is marked in red in Figure 2). Thus, the constructed distinguisher is an 18-round impossible differential distinguisher. All the details for the construction of this 18-round distinguisher are depicted in Figure 2.

5. Key Recovery Attack on Full-Round LiCi-2

With the 18-round related-key impossible differential proposed in Property 2, we add three rounds before and four rounds after the distinguisher to launch a key recovery attack. There are two stages for the key recovery attack: data collection stage and key recovery stage.

Also, we use two approaches to reduce the data complexity. The first one is that more than one key is left in the candidate keys set and it will need to proceed to an exhaustive search among the remaining candidates; this strategy can be viewed as a tradeoff between the time complexity and data complexity. The second one is using multiple impossible differential distinguishers to reduce the data complexity. These two methods have been used and validated in ASIACRYPT 2014 [18] and Journal of Cryptology [19]. For simplicity, we will follow the framework proposed in [18].

5.1. Main Conclusions in [18]

5.1.1. Notations

(i) input (output) difference of the impossible differential distinguisher(ii) set of all the possible input (output) differences of the cipher(iii) number of rounds of the differential path (iv) number of rounds of the differential path (v) number of bit conditions that have to be verified to obtain from (vi) subset of subkey bits involved in the attack during the first rounds (vii) the dimension of the input space (output space)(viii) amount of input (or output) pairs needed for the attack(ix) the probability that a guessed wrong key is kept in the candidate key set(x) the number of equivalent impossible differential distinguishers with different input differences and same output differences(xi) the number of equivalent impossible differential distinguishers with same input difference and different output differences

Suppose that the block cipher we are dealing with is of block size and a key of size

5.1.2. Main Conclusions

The main conclusions are as follows.(1)The relationship between and P is as follows: The minimum value of , denoted by , is about .(2)The time complexity of the attack is approximated by where represents the data complexity needed to construct plaintext-ciphertext pairs, with and satisfying condition (2) above, represents the cost for one full-round encryption, and represents the ratio of the cost for the partial encryption to the full encryption. The memory complexity of the attack is determined by (3)To apply multiple impossible differential cryptanalysis, suppose that impossible differential distinguishers are derived from a single distinguisher. With more distinguishers, the time complexity of the attack can also be calculated with equation (8); however, previous and are replaced with and where and

5.2. Procedures of the Attack

5.2.1. Data Collection Stage

On one hand, construct 2^m data sets. For each data set, to make the difference of a plaintext pair satisfy in Figure 3, there are 34 bits that can be arbitrary value and other 30 bits are fixed to a constant for a data set. On the other hand, suppose that the difference for the output of the 25th round is , (4 bits).

5.2.2. Key Recovery Stage

In the key recovery stage, we guess the subkey bits in its smallest unit to reduce the complexity. This process is depicted in Figure 3 to make it more intuitive. The details for the key recovery stage are illustrated in the following steps:(i)Step 1. Sieve plaintext-ciphertext pairs according to the difference of the first round and last round. This process can be launched without the key.(i)Step 1.1. For each plaintext-ciphertext pair, sieve those pairs whose difference for the input and output of satisfies [,,, – 0,0,0,]. If the pairs can satisfy the condition, save the pair or discard it otherwise. There are 3 bit conditions for this step.(ii)Step 1.2. Sieve those pairs whose difference for the input and output of satisfies [,,, – ,1,,1]. If the pairs can satisfy the condition, save the pair or discard it otherwise (2 bit conditions).(iii)Step 1.3. Sieve those pairs whose difference for the input and output of satisfies [,,, – 0,0,0,]. If the pairs can satisfy the condition, save the pair or discard it otherwise (3 bit conditions).(iv)Step 1.4. Sieve those pairs whose difference for the input and output of satisfies [, , 1, – 0, 0, 1, 0]. If the pairs can satisfy the condition, save the pair or discard it otherwise. (3 bit conditions).(v)Step 1.5 Sieve those pairs whose difference for the input and output of satisfies [,,, – ,,,0]. If the pairs can satisfy the condition, save the pair or discard it otherwise (1 bit condition).(vi)Step 1.6. Sieve the remaining pairs with . If keep the pair (8 bit conditions).(vii)Step 1.7. Sieve those pairs whose difference for the input and output of satisfies [1,,, – ,,,]. If the pairs can satisfy the condition, save the pair or discard it otherwise (1 bit condition).(viii)Step 1.8. Sieve those pairs whose difference for the input and output of satisfies [0,,, – ,,,]. If the pairs can satisfy the condition, save the pair or discard it otherwise (1 bit condition).(ix)Step 1.9. Sieve those pairs whose difference for the input and output of satisfies [1,0,0,0 – ,,,1]. If the pairs can satisfy the condition, save the pair or discard it otherwise (3 bit conditions).(x)Step 1.10. Sieve those pairs whose difference for the input and output of satisfies [1,,, – ,,,]. If the pairs can satisfy the condition, save the pair or discard it otherwise (1 bit condition).(xi)Step 1.11. Sieve those pairs whose difference for the input and output of satisfies [1,0,0,0 – ,,,1]. If the pairs can satisfy the condition, save the pair or discard it otherwise (3 bit conditions).(xii)Step 1.12. Sieve the remaining pairs with . If keep the pair (9 bit conditions).(ii)Step 2. Sieve the plaintext-ciphertext pairs according to the difference of the second round.(i)Step 2.1. Guess and test whether the difference of satisfies the form [,,, – ,1,,0] for the remaining pairs. If the pairs can satisfy the condition, save the pair (2 bit conditions).(ii)Step 2.2. Guess and test whether the difference of satisfies the form [,,, – 0,0,0,] for the remaining pairs. If the pairs can satisfy the condition, save the pair (3 bit conditions).(iii)Step 2.3. Guess and test whether the difference of satisfies the form [,,1, – 0,0,1,0] for the remaining pairs. If the pairs can satisfy the condition, save the pair (3 bit conditions).(ivi)Step 2.4. Sieve the remaining pairs with . If keep the pair (3 bit conditions).(iii)Step 3. Sieve the plaintext-ciphertext pairs according to the difference of the 23th round.(i)Step 3.1. Guess and test whether the difference for the input and output of satisfies [0,,, – ,,,]. If the pairs can satisfy the condition, save the pair or discard it otherwise (1 bit condition).(ii)Step 3.2. Guess and test whether the difference for the input and output of satisfies [0,1,0,0 – ,,,1]. If the pairs can satisfy the condition, save the pair or discard it otherwise (3 bit conditions).(iii)Step 3.3. Guess and test whether the difference for the input and output of satisfies [1,0,0,0 – ,,,1]. If the pairs can satisfy the condition, save the pair or discard it otherwise (3 bit conditions).(iv)Step 3.4. Guess and test whether the difference for the input and output of satisfies [1,,, – ,,,]. If the pairs can satisfy the condition, save the pair or discard it otherwise (1 bit condition).(v)Step 3.5. Guess and test whether the difference for the input and output of satisfies [1,0,0,0 – ,,,1]. If the pairs can satisfy the condition, save the pair or discard it otherwise (3 bit conditions).(vi)Step 3.6. Sieve the remaining pairs with . If keep the pair. There are 2 m + 3 plaintext-ciphertext pairs left (11 bit conditions).(iv)Step 4. Sieve the plaintext-ciphertext pairs according to the difference of the 22th round.(i)Step 4.1. Guess and test whether the input and output differences of satisfy the form [0,1,0,0 – ,,,1] for the remaining pairs. If the pairs can satisfy the condition, save the pair (3 bit conditions).(ii)Step 4.2. Guess and and test whether the input and output differences of satisfy the form [1,0,0,0 – ,,,1] for the remaining pairs. If the pairs can satisfy the condition, save the pair (3 bit conditions).(iii)Step 4.3 Guess and test whether the input and output differences of satisfy the form [1,,, – ,,,] for the remaining pairs. If the pairs can satisfy the condition, save the pair (1 bit condition). It is noted that have already been guessed in Step 3.1 and these redundant related keys will not be listed in the rest of the steps for simplicity.(iv)Step 4.4. Sieve the remaining pairs with . If keep the pair (7 bit conditions).(v)Step 5. Sieve the plaintext-ciphertext pairs according to the difference of the 3rd round. Guess extra 4 subkey bits and calculate . If satisfies the form [,,1, – 0,0,1,0] for the remaining pairs and if the pairs can satisfy the condition, save the pair (3 bit conditions).(vi)Step 6. Sieve the incorrect subkey candidates according to the difference of the 21th round. Guess extra 4 subkey bits and test whether the input and output differences of satisfy the form [0,1,0,0 – ,,,1] and if (6 bit conditions) and if the pairs can satisfy the condition, it will lead to an impossible differential distinguisher; thus the guessed subkey candidate is false. Discard this key candidate and test another one, and iterate this process to reduce the space of key candidates.

5.3. Complexities of the Attack

According to our attack, the values are = 34, = 60, = 34, and = 60. As the data complexity for this attack always exceeds the full code book, it is infeasible to propose a valid impossible differential cryptanalysis with a single distinguisher. So, we will use multiple distinguishers to reduce this data complexity. Concretely speaking, twenty 18-round distinguishers with the following form are used (all the 65 18-round distinguishers can be found at the Appendix). Input difference: Key difference: Output difference:

So n_out = 20 and .

As there are altogether 23 active Sboxes (50 independent subkey bits) involved in the calculation, . According to the equations in Section 5.1, the data complexity, memory complexity, and time complexity for our attack are calculated as follows: Data complexity: . Memory complexity: plaintext pairs and corresponding ciphertext pairs. Time complexity: LiCi-2 encryption.

6. Conclusion

In this paper, based on the idea of related-key multiple impossible differential cryptanalysis, a full-round attack on LiCi-2 is proposed. As a first step, several properties and observations on LiCi-2 are proposed to give an overall estimation on LiCi-2 against single-key and related-key impossible differential cryptanalysis. Some 18-round related-key impossible differential distinguishers are proposed alongside. As a second step, based on the newly constructed 18-round impossible differential distinguishers, a full-round key recovery attack is presented with adding three rounds before and four rounds after the distinguisher. In the future, some modifications on LiCi-2 are needed to avoid the reported attack.

Appendix

All the 18-round related-key impossible differential distinguishers are based on the one-bit input and key difference, as well as 2-bit output difference.(i)e[i][j] represents a single-bit difference at the jth bit; if i = 0, the difference appears at the left branch; if i = 1, the difference appears at the right branch. No. 1: Input difference: e[1][0]. Output difference: e[0][10], e[1][10]. Key difference: e[6] No. 2: Input difference: e[1][0]. Output difference: e[0][12], e[1][12]. Key difference: e[8] No. 3: Input difference: e[1][1]. Output difference: e[0][10], e[1][10]. Key difference: e[6] No. 4: Input difference: e[1][1]. Output difference: e[0][12], e[1][12]. Key difference: e[8] No. 5: Input difference: e[1][2]. Output difference: e[0][10], e[1][10]. Key difference: e[6] No. 6: Input difference: e[1][2]. Output difference: e[0][12], e[1][12]. Key difference: e[8] No. 7: Input difference: e[1][3]. Output difference: e[0][10], e[1][10]. Key difference: e[6] No. 8: Input difference: e[1][3]. Output difference: e[0][12], e[1][12]. Key difference: e[8] No. 9: Input difference: e[1][6]. Output difference: e[0][12], e[1][12]. Key difference: e[8] No. 10: Input difference: e[1][7]. Output difference: e[0][12], e[1][12]. Key difference: e[8] No. 11: Input difference: e[1][14]. Output difference: e[0][10], e[1][10]. Key difference: e[6] No. 12: Input difference: e[1][14]. Output difference: e[0][11], e[1][11]. Key difference: e[7] No. 13: Input difference: e[1][15]. Output difference: e[0][10], e[1][10]. Key difference: e[6] No. 14: Input difference: e[1][15]. Output difference: e[0][11], e[1][11]. Key difference: e[7] No. 15: Input difference: e[1][18]. Output difference: e[0][12], e[1][12]. Key difference: e[8] No. 16: Input difference: e[1][19]. Output difference: e[0][12], e[1][12]. Key difference: e[8] No. 17: Input difference: e[1][21]. Output difference: e[0][0], e[1][0]. Key difference: e[110] No. 18: Input difference: e[1][21]. Output difference: e[0][1], e[1][1]. Key difference: e[110] No. 19: Input difference: e[1][21]. Output difference: e[0][2], e[1][2]. Key difference: e[110] No. 20: Input difference: e[1][21]. Output difference: e[0][3], e[1][3]. Key difference: e[110] No. 21: Input difference: e[1][21]. Output difference: e[0][4], e[1][4]. Key difference: e[110] No. 22: Input difference: e[1][21]. Output difference: e[0][5], e[1][5]. Key difference: e[110] No. 23: Input difference: e[1][21]. Output difference: e[0][6], e[1][6]. Key difference: e[110] No. 24: Input difference: e[1][21]. Output difference: e[0][7], e[1][7]. Key difference: e[110] No. 25: Input difference: e[1][21]. Output difference: e[0][8], e[1][8]. Key difference: e[110] No. 26: Input difference: e[1][21]. Output difference: e[0][9], e[1][9]. Key difference: e[110] No. 27: Input difference: e[1][21]. Output difference: e[0][10], e[1][10]. Key difference: e[110] No. 28: Input difference: e[1][21]. Output difference: e[0][15], e[1][15]. Key difference: e[110] No. 29: Input difference: e[1][21]. Output difference: e[0][16], e[1][16]. Key difference: e[110] No. 30: Input difference: e[1][21]. Output difference: e[0][17], e[1][17]. Key difference: e[110] No. 31: Input difference: e[1][21]. Output difference: e[0][18], e[1][18]. Key difference: e[110] No. 32: Input difference: e[1][21]. Output difference: e[0][27], e[1][27]. Key difference: e[110] No. 33: Input difference: e[1][21]. Output difference: e[0][28], e[1][28]. Key difference: e[110] No. 34: Input difference: e[1][21]. Output difference: e[0][29], e[1][29]. Key difference: e[110] No. 35: Input difference: e[1][21]. Output difference: e[0][30], e[1][30]. Key difference: e[110] No. 36: Input difference: e[1][21]. Output difference: e[0][31], e[1][31]. Key difference: e[110] No. 37: Input difference: e[1][22]. Output difference: e[0][0], e[1][0]. Key difference: e[111] No. 38: Input difference: e[1][22]. Output difference: e[0][1], e[1][1]. Key difference: e[111] No. 39: Input difference: e[1][22]. Output difference: e[0][2], e[1][2]. Key difference: e[111] No. 40: Input difference: e[1][22]. Output difference: e[0][3], e[1][3]. Key difference: e[111] No. 41: Input difference: e[1][22]. Output difference: e[0][5], e[1][5]. Key difference: e[111] No. 42: Input difference: e[1][22]. Output difference: e[0][7], e[1][7]. Key difference: e[111] No. 43: Input difference: e[1][22]. Output difference: e[0][8], e[1][8]. Key difference: e[111] No. 44: Input difference: e[1][22]. Output difference: e[0][9], e[1][9]. Key difference: e[111] No. 45: Input difference: e[1][22]. Output difference: e[0][10], e[1][10]. Key difference: e[6] No. 46: Input difference: e[1][22]. Output difference: e[0][10], e[1][10]. Key difference: e[111] No. 47: Input difference: e[1][22]. Output difference: e[0][11], e[1][11]. Key difference: e[7] No. 48: Input difference: e[1][22]. Output difference: e[0][31], e[1][31]. Key difference: e[111] No. 49: Input difference: e[1][23]. Output difference: e[0][10], e[1][10]. Key difference: e[6] No. 50: Input difference: e[1][23]. Output difference: e[0][11], e[1][11]. Key difference: e[7] No. 51: Input difference: e[1][24]. Output difference: e[0][10], e[1][10]. Key difference: e[6] No. 52: Input difference: e[1][24]. Output difference: e[0][12], e[1][12]. Key difference: e[8] No. 53: Input difference: e[1][25]. Output difference: e[0][10], e[1][10]. Key difference: e[6] No. 54: Input difference: e[1][25]. Output difference: e[0][12], e[1][12]. Key difference: e[8] No. 55: Input difference: e[1][26]. Output difference: e[0][10], e[1][10]. Key difference: e[6] No. 56: Input difference: e[1][26]. Output difference: e[0][12], e[1][12]. Key difference: e[8] No. 57: Input difference: e[1][27]. Output difference: e[0][10], e[1][10]. Key difference: e[6] No. 58: Input difference: e[1][27]. Output difference: e[0][12], e[1][12]. Key difference: e[8] No. 59: Input difference: e[1][28]. Output difference: e[0][12], e[1][12]. Key difference: e[8] No. 60: Input difference: e[1][30]. Output difference: e[0][10], e[1][10]. Key difference: e[6] No. 61: Input difference: e[1][30]. Output difference: e[0][11], e[1][11]. Key difference: e[7] No. 62: Input difference: e[1][30]. Output difference: e[0][12], e[1][12]. Key difference: e[8] No. 63: Input difference: e[1][31]. Output difference: e[0][10], e[1][10]. Key difference: e[6] No. 64: Input difference: e[1][31]. Output difference: e[0][11], e[1][11]. Key difference: e[7] No. 65: Input difference: e[1][31]. Output difference: e[0][12], e[1][12]. Key difference: e[8]

Data Availability

All data included in this study are available upon request by contact with the corresponding author.

Conflicts of Interest

The authors declare that they have no conflicts of interest.

Acknowledgments

This work was partially supported by the National Natural Science Foundation of China under Grants nos. 61802437, 62102448, 61972248, and 61902428 and China Postdoctoral Science Foundation under Grant no. 2020M681314.

References

A. Bogdanov, L. R. Knudsen, G. Leander et al., “PRESENT: An Ultra-lightweight Block cipher,” Cryptographic Hardware and Embedded Systems, Springer, Berlin, Heidelberg, 2007.
View at: Publisher Site | Google Scholar
S. Banik, S. K. Pandey, T. Peyrin, Y. Sasaki, S. M. Sim, and Y. Todo, “GIFT: a small present,” in Cryptographic Hardware and Embedded Systems, Springer Cham, Manhattan, NY, USA, 2017.
View at: Publisher Site | Google Scholar
S. Banik, A. Bogdanov, T. Isobe et al., “Midori: a block cipher for low energy,” Advances in Cryptology - ASIACRYPT 2015, Springer, Berlin, Heidelberg, 2015.
View at: Publisher Site | Google Scholar
W. Wu and L. Zhang, “A Lightweight Block cipher,” Cryptography and Network Security, Springer, Berlin, Heidelberg, 2011.
View at: Publisher Site | Google Scholar
W. Zhang, Z. Bao, D. Lin, V. Rijmen, B. Yang, and I. Verbauwhede, “RECTANGLE: a bit-slice lightweight block cipher suitable for multiple platforms,” Science China Information Sciences, vol. 58, no. 12, pp. 1–15, 2015.
View at: Publisher Site | Google Scholar
R. Beaulieu, S. Treatman-Clark, D. Shors, B. Weeks, J. Smith, and L. Wingers, “The SIMON and SPECK lightweight block ciphers,” in Proceedings of the 52nd ACM/EDAC/IEEE Design Automation Conference, pp. 1–6, San Francisco, CA, USA, June 2015.
View at: Publisher Site | Google Scholar
J. Patil, G. Bansod, and K. S. Kant, “LiCi: a new ultra-lightweight block cipher,” in Proceedings of the 2017 International Conference on Emerging Trends & Innovation in ICT (ICEI), pp. 40–45, IEEE, Pune, India, February 2017.
View at: Publisher Site | Google Scholar
S. Khairnar, G. Bansod, and V. Dahiphale, “A light weight cryptographic solution for 6LoWPAN protocol stack,” Advances in Intelligent Systems and Computing. Science and Information Conference, Springer Cham, Manhattan, NY, USA, 2018.
View at: Publisher Site | Google Scholar
L. R. Knudsen, “Deal - a 128-bit block cipher,” Complexity, vol. 258, no. 2, p. 216, 1998.
View at: Google Scholar
E. Biham, A. Biryukov, and A. Shamir, “Cryptanalysis of skipjack reduced to 31 rounds using impossible differentials,” Advances in Cryptology - EUROCRYPT '99. International Conference on the Theory and Applications of Cryptographic Techniques, Springer, Berlin, Heidelberg, 1999.
View at: Publisher Site | Google Scholar
E. Biham, O. Dunkelman, and N. Keller, “Related-key impossible differential attacks on 8-round AES-192,” Topics in Cryptology - CT-RSA 2006. In Cryptographers’ Track at the RSA Conference, Springer, Berlin, Heidelberg, 2006.
View at: Publisher Site | Google Scholar
W. Zhang, W. Wu, L. Zhang, and D. Feng, “Improved related-key impossible differential attacks on reduced-round AES-192,” in International Workshop on Selected Areas in Cryptography, Springer, Berlin, Heidelberg, (2006 August).
View at: Google Scholar
M. Xie, J. Li, and Y. Zang, “Related‐key impossible differential cryptanalysis of LBlock,” Chinese Journal of Electronics, vol. 26, no. 1, pp. 35–41, 2017.
View at: Publisher Site | Google Scholar
Y. Wei, C. Li, and B. Sun, “Related-key impossible differential cryptanalysis on crypton and crypton v1. 0,” in Proceedings of the 2011 World Congress on Internet Security (WorldCIS-2011), pp. 227–232, IEEE, London, UK, February 2011.
View at: Publisher Site | Google Scholar
Q. Yang, L. Hu, S. Sun, and L. Song, “Related-key impossible differential analysis of full Khudra,” in International Workshop on Security, Springer Cham, Manhattan, NY, USA, 2016.
View at: Publisher Site | Google Scholar
W. Xin, B. Sun, and C. Li, “Bit-based integral attack on LiCi algorithm,” Computer Engineering, vol. 46, no. 7, pp. 136–142, 2020.
View at: Google Scholar
Y. Wei, J. Shi, and L. Li, “Impossible differential cryptanalysis of LiCi block cipher,” Journal of Electronics and Information Technology, vol. 41, no. 7, pp. 1610–1617, 2019.
View at: Google Scholar
C. Boura, M. Naya-Plasencia, and V. Suder, “Scrutinizing and improving impossible differential attacks: applications to CLEFIA, Camellia, LBlock and Simon,” in International Conference on the Theory and Application of Cryptology and Information Security, Springer, Berlin, Heidelberg, 2014.
View at: Publisher Site | Google Scholar
C. Boura, V. Lallemand, M. Naya-Plasencia, and V. Suder, “Making the impossible possible,” Journal of Cryptology, vol. 31, no. 1, pp. 101–133, 2018.
View at: Publisher Site | Google Scholar

Copyright

Copyright © 2022 Kai Zhang et al. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

PDF Download Citation

Download other formats

Order printed copies

Views

186

Downloads

362

Citations