IACR News item: 03 March 2016
Guoyan Zhang, Meicheng Liu
ePrint Report
At Crypto 2015, Blondeau \textit{et al.} showed a known-key analysis on the full \texttt{PRESENT} lightweight block cipher. Based on some of the best differential distinguishers, they introduced a meet in the middle (MitM) layer to pre-add the differential distinguisher, which extends the number of attacked rounds on \texttt{PRESENT} from 26 rounds to full rounds without reducing differential probability.
In this paper, we generalize their method and present a generic distinguisher on a kind of permutations called \texttt{PRESENT}-like permutations. This generic distinguisher is divided into two phases. The first phase is a truncated differential distinguisher with strong bias, which describes the unbalancedness of the output collision on some fixed bits, given the fixed input in some bits, and we take advantage of the strong relation between truncated differential probability and capacity of multidimensional linear approximation to derive the best differential distinguishers. The second phase is the meet-in-the-middle layer, which is pre-added to the truncated differential to propagate the differential properties as far as possible. Different with Blondeau \textit{et al.}'s work, we extend the MitM layers on a 64-bit internal state to states with any size, and we also give a concrete bound to estimate the attacked rounds of the MitM layer.
As an illustration, we apply our technique to all versions of \texttt{SPONGENT} permutations. In the truncated differential phase, as a result we reach one, two or three rounds more than the results shown by the designers. In the meet-in-the-middle phase, we get up to 11 rounds to pre-add to the differential distinguishers. Totally, we improve the previous distinguishers on all versions of \texttt{SPONGENT} permutations by up to 13 rounds.
In this paper, we generalize their method and present a generic distinguisher on a kind of permutations called \texttt{PRESENT}-like permutations. This generic distinguisher is divided into two phases. The first phase is a truncated differential distinguisher with strong bias, which describes the unbalancedness of the output collision on some fixed bits, given the fixed input in some bits, and we take advantage of the strong relation between truncated differential probability and capacity of multidimensional linear approximation to derive the best differential distinguishers. The second phase is the meet-in-the-middle layer, which is pre-added to the truncated differential to propagate the differential properties as far as possible. Different with Blondeau \textit{et al.}'s work, we extend the MitM layers on a 64-bit internal state to states with any size, and we also give a concrete bound to estimate the attacked rounds of the MitM layer.
As an illustration, we apply our technique to all versions of \texttt{SPONGENT} permutations. In the truncated differential phase, as a result we reach one, two or three rounds more than the results shown by the designers. In the meet-in-the-middle phase, we get up to 11 rounds to pre-add to the differential distinguishers. Totally, we improve the previous distinguishers on all versions of \texttt{SPONGENT} permutations by up to 13 rounds.
Additional news items may be found on the IACR news page.