Improving Matsui's Search Algorithm For The Best Differential/Linear Trails And Its Applications For DES, DESL And GIFT. (4th August 2020)

• Record Type: Journal Article
• Authors: Ji, Fulei; Zhang, Wentao; Ding, Tianyou
• Is Part Of: Computer journal. Volume 64:Number 4(2021)
• Page Start: 610
• Page End: 627
• Publication Date: 2020-08-04
• Subjects: Matsui's search algorithm -- differential trail -- linear trail -- clustering effect -- DESL -- GIFT-128 -- GIFT-64 -- DES; Computers -- Periodicals; 005.1
• DOI: 10.1093/comjnl/bxaa090
• Languages: English
• ISSNs: 0010-4620

Abstract

Abstract: Automatic search methods have been widely used for cryptanalysis of block ciphers, especially for the most classic cryptanalysis methods—differential and linear cryptanalysis. However, the automatic search methods, no matter based on MILP, SMT/SAT or CP techniques, can be inefficient when the search space is too large. In this paper, we propose three new methods to improve Matsui's branch-and-bound search algorithm, which is known as the first generic algorithm for finding the best differential and linear trails. The three methods, named reconstructing DDT and LAT according to weight, executing linear layer operations in minimal cost and merging two 4-bit S-boxes into one 8-bit S-box, respectively, can efficiently speed up the search process by reducing the search space as much as possible and reducing the cost of executing linear layer operations. We apply our improved algorithm to DESL and GIFT, which are still the hard instances for the automatic search methods. As a result, we find the best differential trails for DESL (up to 14-round) and GIFT-128 (up to 19-round). The best linear trails for DESL (up to 16-round), GIFT-128 (up to 10-round) and GIFT-64 (up to 15-round) are also found. To the best of our knowledge, these security bounds for DESL and GIFT under single-key scenario are given for the first time. Meanwhile, it is the longest exploitable (differential or linear) trails for DESL and GIFT. Furthermore, benefiting from the efficiency of the improved algorithm, we do experiments to demonstrate that the clustering effect of differential trails for 13-round DES and DESL are both weak.