Design Strategies for ARX with Provable Bounds: SPARX and LAX Daniel - - PowerPoint PPT Presentation

▶
design strategies for arx with provable bounds sparx and
SMART_READER_LITE
LIVE PREVIEW

Design Strategies for ARX with Provable Bounds: SPARX and LAX Daniel - - PowerPoint PPT Presentation

Jun 17, 2023 166 likes •732 views

Design Strategies for ARX with Provable Bounds: SPARX and LAX Daniel Dinu 1 , Lo Perrin 1 , Aleksei Udovenko 1 , Vesselin Velichkov 1 , Johann Groschdl 1 , Alex Biryukov 1 1 SnT, University of Luxembourg https://www.cryptolux.org December

slide-1
SLIDE 1

Design Strategies for ARX with Provable Bounds: SPARX and LAX

Daniel Dinu1, Léo Perrin1, Aleksei Udovenko1, Vesselin Velichkov1, Johann Großschädl1, Alex Biryukov1

1SnT, University of Luxembourg

https://www.cryptolux.org

December 7, 2016 ASIACRYPT

slide-2
SLIDE 2

Block Cipher Design Pdifg ≤ (︃∆S 2b )︃# active S-Boxes Design of an S-Box based SPN (wide-trail strategy) Design of an ARX-cipher (allegory)

source: Wiki Commons

Can we use ARX and have provable bounds?

Cryptolux Team SPARX and LAX 1 / 24

slide-3
SLIDE 3

Block Cipher Design Pdifg ≤ (︃∆S 2b )︃# active S-Boxes Design of an S-Box based SPN (wide-trail strategy) Design of an ARX-cipher (allegory)

source: Wiki Commons

Can we use ARX and have provable bounds?

Cryptolux Team SPARX and LAX 1 / 24

slide-4
SLIDE 4

Block Cipher Design Pdifg ≤ (︃∆S 2b )︃# active S-Boxes Design of an S-Box based SPN (wide-trail strategy) Design of an ARX-cipher (allegory)

source: Wiki Commons

Can we use ARX and have provable bounds?

Cryptolux Team SPARX and LAX 1 / 24

slide-5
SLIDE 5

Talk Outline

Outline

1 The Long-Trail Strategy 2 The SPARX Family of LW-BC

Methodology Results

3 The LAX Approach 4 Conclusion

Cryptolux Team SPARX and LAX 2 / 24

slide-6
SLIDE 6

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Plan

1 The Long-Trail Strategy

The Wide Trail Strategy ARX-Boxes The Long Trail Strategy

2 The SPARX Family of LW-BC

Methodology Results

3 The LAX Approach 4 Conclusion

Cryptolux Team SPARX and LAX 2 / 24

slide-7
SLIDE 7

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

The Wide Trail Strategy (WTS)

Wide Trail Argument

MEDCP(F r) ≤ pS a(r) MEDCP(F r) = max (P[any trail covering r rounds of F]) P[S(x ⊕ c) ⊕ S(x) = d] ≤ pS #{active S-Boxes on r rounds} ≥ a(r) Used to design the AES!

Application to ARX

Can we use this to build an ARX-based cipher?

Cryptolux Team SPARX and LAX 3 / 24

slide-8
SLIDE 8

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

The Wide Trail Strategy (WTS)

Wide Trail Argument

MEDCP(F r) ≤ pS a(r) MEDCP(F r) = max (P[any trail covering r rounds of F]) P[S(x ⊕ c) ⊕ S(x) = d] ≤ pS #{active S-Boxes on r rounds} ≥ a(r) Used to design the AES!

Application to ARX

Can we use this to build an ARX-based cipher?

Cryptolux Team SPARX and LAX 3 / 24

slide-9
SLIDE 9

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

The Wide Trail Strategy (WTS)

Wide Trail Argument

MEDCP(F r) ≤ pS a(r) MEDCP(F r) = max (P[any trail covering r rounds of F]) P[S(x ⊕ c) ⊕ S(x) = d] ≤ pS #{active S-Boxes on r rounds} ≥ a(r) Used to design the AES!

Application to ARX

Can we use this to build an ARX-based cipher?

Cryptolux Team SPARX and LAX 3 / 24

slide-10
SLIDE 10

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

ARX-Boxes (1/2)

SPECKEY

1 Start from SPECK-32 2 XOR key in full state (Markov

assumption)

3 Find best trails

Parameter Search

Rotations 7 2 Second best crypto properties, lightest Indeed NSA design strategy (see DAC’15). ⊕ ≫ 7 ⊞ ≪ 2 ⊕ SPECKEY.

Cryptolux Team SPARX and LAX 4 / 24

slide-11
SLIDE 11

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

ARX-Boxes (1/2)

SPECKEY

1 Start from SPECK-32 2 XOR key in full state (Markov

assumption)

3 Find best trails

Parameter Search

Rotations 7, −2 Second best crypto properties, lightest Indeed NSA design strategy (see DAC’15). ⊕ ≫ 7 ⊞ ≪ 2 ⊕ SPECKEY.

Cryptolux Team SPARX and LAX 4 / 24

slide-12
SLIDE 12

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

ARX-Boxes (2/2)

Difgerential/Linear bounds r 1 2 3 4 5 6 7 8 9 10 MEDCP(Ar) −0 −1 −3 −5 −9 −13 −18 −24 −30 −34 MELCC(Ar) −0 −0 −1 −3 −5 −7 −9 −12 −14 −17 Maximum expected difgerential characteristic probabilities (MEDCP) and maximum expected absolute linear characteristic correlations (MELCC) of SPECKEY (log2 scale); r is the number of rounds.

Cryptolux Team SPARX and LAX 5 / 24

slide-13
SLIDE 13

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Notations

≫ 7 ⊞ ≪ 2 ⊕ A. ⊕ ⊕ A A ⊕ ⊕ k0

L

k0

R

kr−1

L

kr−1

R

Ar

k.

Cryptolux Team SPARX and LAX 6 / 24

slide-14
SLIDE 14

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Naive Approach

S-Box: A4 ; Linear layer: 128-bit MixColumns. MixColumns A4k A4k A4k A4k MixColumns A4k A4k A4k A4k 1 step Active ARX-Boxes: a 2s 5s, log2 MEDCP A4 5 log2 P difg. trail on 2s steps 5s MEDCP A4 log2 P difg. trail on 2s steps 25s Need 2 128 25 12 steps, i.e. 48 ARX rounds!

Cryptolux Team SPARX and LAX 7 / 24

slide-15
SLIDE 15

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Naive Approach

S-Box: A4 ; Linear layer: 128-bit MixColumns. MixColumns A4k A4k A4k A4k MixColumns A4k A4k A4k A4k 1 step Active ARX-Boxes: a(2s) ≥ 5s, log2 (︁ MEDCP(A4) )︁ = −5 log2 P difg. trail on 2s steps 5s MEDCP A4 log2 P difg. trail on 2s steps 25s Need 2 128 25 12 steps, i.e. 48 ARX rounds!

Cryptolux Team SPARX and LAX 7 / 24

slide-16
SLIDE 16

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Naive Approach

S-Box: A4 ; Linear layer: 128-bit MixColumns. MixColumns A4k A4k A4k A4k MixColumns A4k A4k A4k A4k 1 step Active ARX-Boxes: a(2s) ≥ 5s, log2 (︁ MEDCP(A4) )︁ = −5 log2(P[difg. trail on 2s steps]) ≤ 5s × MEDCP(A4) log2(P[difg. trail on 2s steps]) ≤ − 25s Need 2 128 25 12 steps, i.e. 48 ARX rounds!

Cryptolux Team SPARX and LAX 7 / 24

slide-17
SLIDE 17

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Naive Approach

S-Box: A4 ; Linear layer: 128-bit MixColumns. MixColumns A4k A4k A4k A4k MixColumns A4k A4k A4k A4k 1 step Active ARX-Boxes: a(2s) ≥ 5s, log2 (︁ MEDCP(A4) )︁ = −5 log2(P[difg. trail on 2s steps]) ≤ 5s × MEDCP(A4) log2(P[difg. trail on 2s steps]) ≤ − 25s Need 2⌈128/25⌉ = 12 steps, i.e. 48 ARX rounds!

Cryptolux Team SPARX and LAX 7 / 24

slide-18
SLIDE 18

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Drawbacks

The Wide Trail Strategy fails here

Two (bad) options:

1 design a very weak cipher, or 2 design a very slow cipher.

A New Hope

log2 MEDCP A4 5 log2 MEDCP A8 24 5 2

Cryptolux Team SPARX and LAX 8 / 24

slide-19
SLIDE 19

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Drawbacks

The Wide Trail Strategy fails here

Two (bad) options:

1 design a very weak cipher, or 2 design a very slow cipher.

A New Hope

log2 (︁ MEDCP(A4) )︁ = −5 log2 (︁ MEDCP(A8) )︁ = −24 ≪ −5 × 2

Cryptolux Team SPARX and LAX 8 / 24

slide-20
SLIDE 20

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Better Approach

New linear layer “chaining” ARX-Boxes. We can use MEDCP A8 instead of MEDCP A4

2.

If left half has zero difgerences, we can use MEDCP A12 instead of MEDCP A4

3.

A4k A4k A4k A4k ℓ ⊕ ⊕ A4k A4k A4k A4k ℓ ⊕ ⊕ A4k A4k A4k A4k

Cryptolux Team SPARX and LAX 9 / 24

slide-21
SLIDE 21

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Better Approach

New linear layer “chaining” ARX-Boxes. We can use MEDCP A8 instead of MEDCP A4

2.

If left half has zero difgerences, we can use MEDCP A12 instead of MEDCP A4

3.

A4k A4k A4k A4k ℓ ⊕ ⊕ A4k A4k A4k A4k ℓ ⊕ ⊕ A4k A4k A4k A4k

Cryptolux Team SPARX and LAX 9 / 24

slide-22
SLIDE 22

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Better Approach

New linear layer “chaining” ARX-Boxes. We can use MEDCP(A8) instead of (︁ MEDCP(A4) )︁2. If left half has zero difgerences, we can use MEDCP A12 instead of MEDCP A4

3.

A4k A4k A4k A4k ℓ ⊕ ⊕ A4k A4k A4k A4k ℓ ⊕ ⊕ A4k A4k A4k A4k

Cryptolux Team SPARX and LAX 9 / 24

slide-23
SLIDE 23

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Better Approach

New linear layer “chaining” ARX-Boxes. We can use MEDCP(A8) instead of (︁ MEDCP(A4) )︁2. If left half has zero difgerences, we can use MEDCP A12 instead of MEDCP A4

3.

A4k A4k A4k A4k ℓ ⊕ ⊕ A4k A4k A4k A4k ℓ ⊕ ⊕ A4k A4k A4k A4k

Cryptolux Team SPARX and LAX 9 / 24

slide-24
SLIDE 24

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Better Approach

New linear layer “chaining” ARX-Boxes. We can use MEDCP(A8) instead of (︁ MEDCP(A4) )︁2. If left half has zero difgerences, we can use MEDCP(A12) instead of (︁ MEDCP(A4) )︁3. A4k A4k A4k A4k ℓ ⊕ ⊕ A4k A4k A4k A4k ℓ ⊕ ⊕ A4k A4k A4k A4k

Cryptolux Team SPARX and LAX 9 / 24

slide-25
SLIDE 25

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

The Long Trail Argument (1/2)

Defjnition (Long Trail)

A Long Trail (LT) is a trail covering several ARX-Boxes without receiving any outside difgerence. Can be static (probability = 1) or dynamic (depends on the trail).

Defjnition (Truncated Trail)

A sequence of values in 0 1 4: 1 if ARX-Box i is active, else 0.

Cryptolux Team SPARX and LAX 10 / 24

slide-26
SLIDE 26

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

The Long Trail Argument (1/2)

Defjnition (Long Trail)

A Long Trail (LT) is a trail covering several ARX-Boxes without receiving any outside difgerence. Can be static (probability = 1) or dynamic (depends on the trail).

Defjnition (Truncated Trail)

A sequence of values in {0, 1}4: 1 if ARX-Box i is active, else 0.

Cryptolux Team SPARX and LAX 10 / 24

slide-27
SLIDE 27

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

The Long Trail Argument (2/2)

Bounding Difgerential Probability

For all truncated trails covering r rounds:

1 check if it is coherent with the linear layer, 2 decompose it into long trails (static and dynamic), 3 bound the probability of all trails following the truncated trail.

Deduce a bound on the probability of all trails.

Example of a LT bound

After 5 steps, the best trail for four 4-round ARX-Boxes + Feistel linear layer is 2

128.

5 12 steps

Cryptolux Team SPARX and LAX 11 / 24

slide-28
SLIDE 28

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

The Long Trail Argument (2/2)

Bounding Difgerential Probability

For all truncated trails covering r rounds:

1 check if it is coherent with the linear layer, 2 decompose it into long trails (static and dynamic), 3 bound the probability of all trails following the truncated trail.

= ⇒ Deduce a bound on the probability of all trails.

Example of a LT bound

After 5 steps, the best trail for four 4-round ARX-Boxes + Feistel linear layer is 2

128.

5 12 steps

Cryptolux Team SPARX and LAX 11 / 24

slide-29
SLIDE 29

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

The Long Trail Argument (2/2)

Bounding Difgerential Probability

For all truncated trails covering r rounds:

1 check if it is coherent with the linear layer, 2 decompose it into long trails (static and dynamic), 3 bound the probability of all trails following the truncated trail.

= ⇒ Deduce a bound on the probability of all trails.

Example of a LT bound

After 5 steps, the best trail for four 4-round ARX-Boxes + Feistel linear layer is < 2−128. 5 ≪ 12 steps

Cryptolux Team SPARX and LAX 11 / 24

slide-30
SLIDE 30

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

The Long Trail Strategy (LTS)

Defjnition (Design Principle)

When using large, weak S-Boxes, it is better to foster Long Trails than difgusion. Thus, the linear layer must be small.

Wide Trail Strategy

S-Box Small, cheap.

  • Lin. Layer Expensive, complex.

Long Trail Strategy

S-Box Large, expensive.

  • Lin. Layer Cheap, simple.

Cryptolux Team SPARX and LAX 12 / 24

slide-31
SLIDE 31

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

The Long Trail Strategy (LTS)

Defjnition (Design Principle)

When using large, weak S-Boxes, it is better to foster Long Trails than difgusion. Thus, the linear layer must be small.

Wide Trail Strategy

S-Box Small, cheap.

  • Lin. Layer Expensive, complex.

Long Trail Strategy

S-Box Large, expensive.

  • Lin. Layer Cheap, simple.

Cryptolux Team SPARX and LAX 12 / 24

slide-32
SLIDE 32

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

The Long Trail Strategy (LTS)

Defjnition (Design Principle)

When using large, weak S-Boxes, it is better to foster Long Trails than difgusion. Thus, the linear layer must be small.

Wide Trail Strategy

S-Box Small, cheap.

  • Lin. Layer Expensive, complex.

Long Trail Strategy

S-Box Large, expensive.

  • Lin. Layer Cheap, simple.

Cryptolux Team SPARX and LAX 12 / 24

slide-33
SLIDE 33

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Plan

1 The Long-Trail Strategy 2 The SPARX Family of LW-BC

High Level View Security Analysis Implementation

Methodology Results

3 The LAX Approach 4 Conclusion

Cryptolux Team SPARX and LAX 12 / 24

slide-34
SLIDE 34

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

High Level View

SPARX family of block ciphers

Designed using a long trail strategy. SPARX-n/k: n-bit block, k-bit key (k ≥ 128). Only need 16-bit operations: ≪ i, ⊕, ⊞. n k 64/128 128/128 128/256 # Rounds/Step 3 4 4 # Steps 8 8 10 Best Attack (# rounds) 15/24 22/32 24/40

Cryptolux Team SPARX and LAX 13 / 24

slide-35
SLIDE 35

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

High Level View

SPARX family of block ciphers

Designed using a long trail strategy. SPARX-n/k: n-bit block, k-bit key (k ≥ 128). Only need 16-bit operations: ≪ i, ⊕, ⊞. n/k 64/128 128/128 128/256 # Rounds/Step 3 4 4 # Steps 8 8 10 Best Attack (# rounds) 15/24 22/32 24/40

Cryptolux Team SPARX and LAX 13 / 24

slide-36
SLIDE 36

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Notations (reminder)

≫ 7 ⊞ ≪ 2 ⊕ A. ⊕ ⊕ A A ⊕ ⊕ k0

L

k0

R

kr−1

L

kr−1

R

Ar

k.

Cryptolux Team SPARX and LAX 14 / 24

slide-37
SLIDE 37

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

High level view

xs xs

1

Linear Layer ⊕ A A ⊕ ⊕ A A ⊕ ksw ksw

ra−1

ksw+w−1 ksw+w−1

ra−1

round step Round function of SPARX. kr kr

1

... kr

v−1

kv(r) kr+1 kr+1

1

... kr+1

v−1

Key schedule.

Cryptolux Team SPARX and LAX 15 / 24

slide-38
SLIDE 38

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

SPARX-64/128

xs xs

1

k2s k2s+1 A3 A3 ℒ ⊕ Step Function. ⊕ ⊕ ⊕ ≪ 8 ℒ.

Cryptolux Team SPARX and LAX 16 / 24

slide-39
SLIDE 39

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

SPARX-128/128 and SPARX-128/256

xs xs

1

xs

2

xs

3

k4s k4s+1 k4s+2 k4s+3 A4 A4 A4 A4 L′ ⊕ ⊕

Step Function. ⊕ ⊕ ⊕ ⊕ ⊕ ≪ 8 ℒ′.

Cryptolux Team SPARX and LAX 17 / 24

slide-40
SLIDE 40

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Security

Long Trail Argument

P[any difg. trail covering at least 5 steps] < 2−n

Integral Attacks

Todo’s division property: 4-5 steps for n 64-128, properties of modular addition: 1 round, best distinguishers cover 13-21 rounds for n 64-128. n k 64/128 128/128 128/256 rounds attacked/total 15/24 22/32 24/40 security margin 38 31 40

Cryptolux Team SPARX and LAX 18 / 24

slide-41
SLIDE 41

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Security

Long Trail Argument

P[any difg. trail covering at least 5 steps] < 2−n

Integral Attacks

Todo’s division property: 4-5 steps for n =64-128, properties of modular addition: +1 round, best distinguishers cover 13-21 rounds for n =64-128. n k 64/128 128/128 128/256 rounds attacked/total 15/24 22/32 24/40 security margin 38 31 40

Cryptolux Team SPARX and LAX 18 / 24

slide-42
SLIDE 42

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Security

Long Trail Argument

P[any difg. trail covering at least 5 steps] < 2−n

Integral Attacks

Todo’s division property: 4-5 steps for n =64-128, properties of modular addition: +1 round, best distinguishers cover 13-21 rounds for n =64-128. n/k 64/128 128/128 128/256 rounds attacked/total 15/24 22/32 24/40 security margin 38 % 31 % 40 %

Cryptolux Team SPARX and LAX 18 / 24

slide-43
SLIDE 43

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Benchmarking

https://www.cryptolux.org/index.php/FELICS Fair Evaluation of Lightweight Cryptographic Systems 8-bit ATMEL AVR ; 16-bit TI MSP ; 32-bit ARM Cortex-M3 Usage scenarios (e.g. CBC encryption of 128 bytes) Extracts RAM usage, ROM usage, # CPU cycles. Figure Of Merit aggregates: all metrics accross all platforms for the best implementations of one algorithm.

Cryptolux Team SPARX and LAX 19 / 24

slide-44
SLIDE 44

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Benchmarking

https://www.cryptolux.org/index.php/FELICS Fair Evaluation of Lightweight Cryptographic Systems 8-bit ATMEL AVR ; 16-bit TI MSP ; 32-bit ARM Cortex-M3 Usage scenarios (e.g. CBC encryption of 128 bytes) Extracts RAM usage, ROM usage, # CPU cycles. Figure Of Merit aggregates: all metrics accross all platforms for the best implementations of one algorithm.

Cryptolux Team SPARX and LAX 19 / 24

slide-45
SLIDE 45

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Effjciency of the SPARX Ciphers

Rank Cipher Block Key Scenario 1 Security size size FOM margin 1 Speck 64 128 5.0 27 % 2 Chaskey-LTS 128 128 5.0 42 % 3 Simon 64 128 6.9 32 % 4 RECTANGLE 64 128 7.8 28 % 5 LEA 128 128 8.0 33 % 6 Sparx 64 128 8.6 38 % 7 Sparx 128 128 12.9 31 % 8 HIGHT 64 128 14.1 19 % 9 AES 128 128 15.3 30 % 10 Fantomas 128 128 17.2 ?? % Gray: designers did not provide difgerential/linear bounds.

Cryptolux Team SPARX and LAX 20 / 24

slide-46
SLIDE 46

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Effjciency of the SPARX Ciphers

Rank Cipher Block Key Scenario 1 Security size size FOM margin – Speck 64 128 5.0 27 % – Chaskey-LTS 128 128 5.0 42 % – Simon 64 128 6.9 32 % 1 RECTANGLE 64 128 7.8 28 % – LEA 128 128 8.0 33 % 2 Sparx 64 128 8.6 38 % 3 Sparx 128 128 12.9 31 % – HIGHT 64 128 14.1 19 % 4 AES 128 128 15.3 30 % 5 Fantomas 128 128 17.2 ?? % Gray: designers did not provide difgerential/linear bounds.

Cryptolux Team SPARX and LAX 20 / 24

slide-47
SLIDE 47

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Plan

1 The Long-Trail Strategy 2 The SPARX Family of LW-BC

Methodology Results

3 The LAX Approach 4 Conclusion

Cryptolux Team SPARX and LAX 20 / 24

slide-48
SLIDE 48

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

An Alternative Strategy for Provable ARX

The Wallén Challenge

[...] design a simple and effjcient cipher that uses only addition modulo 2n and F2-affjne functions, and that is provably resistant against basic DC and LC. –Johan Wallén [Master Thesis, 2003]

Rationale

⊞ 𝛽 𝛾 𝛿 DP and LC drop exponentially with hw(𝛽 ⊕ 𝛾) Affjne part should maximize hw(𝛽 ⊕ 𝛾)!

Cryptolux Team SPARX and LAX 21 / 24

DP = difgerential probability; LC = linear correlation

slide-49
SLIDE 49

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

The LAX Construction

(yL, yR) = (LxR, L(xL ⊞ xR))

LAX-2n

2n-bit block, n ∈ {8, 16} L is n × n binary matrix that

1 is invertible, 2 has branch number d > 2,

[I L] is a [2n, n, d] lin. code:

LAX-16: [16, 8, 5] LAX-32: [32, 16, 8]

Linear transform, Addition, XOR = ⇒ LAX

Cryptolux Team SPARX and LAX 22 / 24

slide-50
SLIDE 50

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Difgerential Bound on 3 Rounds

Theorem

The maximum DP of any trail on 3 rounds of LAX-2n is 2−(d−2), where d is the branch number of L.

2n # Rounds 1 2 3 4 5 6 7 8 9 10 11 12 16 pbest +0 −2 −4 −7 −8 −11 −13 −16 −18 −20 −23 −25 pbound −3 −6 −9 −12 32 pbest +0 −2 −6 −9 −11 −16 −18 −20 −24 −28 −29 −34 pbound −6 −12 −18 −24

Open Problem

The bound does not hold for the linear case.

Cryptolux Team SPARX and LAX 23 / 24

slide-51
SLIDE 51

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Difgerential Bound on 3 Rounds

Theorem

The maximum DP of any trail on 3 rounds of LAX-2n is 2−(d−2), where d is the branch number of L.

2n # Rounds 1 2 3 4 5 6 7 8 9 10 11 12 16 pbest +0 −2 −4 −7 −8 −11 −13 −16 −18 −20 −23 −25 pbound −3 −6 −9 −12 32 pbest +0 −2 −6 −9 −11 −16 −18 −20 −24 −28 −29 −34 pbound −6 −12 −18 −24

Open Problem

The bound does not hold for the linear case.

Cryptolux Team SPARX and LAX 23 / 24

slide-52
SLIDE 52

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Plan

1 The Long-Trail Strategy 2 The SPARX Family of LW-BC

Methodology Results

3 The LAX Approach 4 Conclusion

Wrapping up!

Cryptolux Team SPARX and LAX 23 / 24

slide-53
SLIDE 53

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Conclusion

source: Wiki Commons

Long-Trail Strategy

Dual of the Wide-trail strategy Difgerential and linear bounds https://www.cryptolux.org/ index.php/SPARX

LAX

Branching number

  • difg. bound

Open problem: LAX for linear bound? Thank you!

Cryptolux Team SPARX and LAX 24 / 24

slide-54
SLIDE 54

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Conclusion

source: Wiki Commons

Long-Trail Strategy

Dual of the Wide-trail strategy Difgerential and linear bounds https://www.cryptolux.org/ index.php/SPARX

LAX

Branching number

  • difg. bound

Open problem: LAX for linear bound? Thank you!

Cryptolux Team SPARX and LAX 24 / 24

slide-55
SLIDE 55

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Conclusion

source: Wiki Commons

Long-Trail Strategy

Dual of the Wide-trail strategy Difgerential and linear bounds https://www.cryptolux.org/ index.php/SPARX

LAX

Branching number = ⇒ difg. bound Open problem: LAX for linear bound? Thank you!

Cryptolux Team SPARX and LAX 24 / 24

slide-56
SLIDE 56

The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion

Conclusion

source: Wiki Commons

Long-Trail Strategy

Dual of the Wide-trail strategy Difgerential and linear bounds https://www.cryptolux.org/ index.php/SPARX

LAX

Branching number = ⇒ difg. bound Open problem: LAX for linear bound? Thank you!

Cryptolux Team SPARX and LAX 24 / 24