Citation Context

..., denoting one computes lk ′ = ∑ lk i ′ = ∑ D (N) R −1 k ′ ◦Rk ( pi (δ, i) log ◦EK r+1 qi i wi = log ( pi qi ) { n! x1!x2!...xn! px1 1 ) . . . pxn n if ∑ xi = M 0 else wi · D (N) R −1 k ′ ◦Rk (δ, i). =-=(5)-=- ◦EK r+1 This is a weighted extension of the case where one considers only one counter. As before these weights naturally capture various types of differential attacks, i.e., in each component one con...

Citation Context

...y different, the linear and differential attacks have different impact on these ciphers. For PRESENT, linear cryptanalysis is more powerful (26 rounds [14]) than differential cryptanalysis (18 rounds =-=[8, 34]-=-). For PUFFIN, the best linear and differential types of attacks are about equally strong [10, 23]. The observed differences are largely due to the fact that PRESENT has the particularity of having st...

Citation Context

... submission document of PRESENT gives a thorough security analysis of the cipher against various types of attacks. The initial analysis has been extended with several attacks on round-reduced PRESENT =-=[22, 13, 16, 6, 7, 4, 23]-=-. In this work, we present another complementary security analysis of PRESENT-80 against related-key differential attacks. This analysis model gives the attacker the most freedom, and in many cases le...

Citation Context

...pect to clustering of one bit linear trails. Along with the strong symmetry of the PRESENT permutation layer, there are very serious clustering problems both for linear trails and differential trails =-=[10, 14, 31, 40, 46]-=-. We give more details in section 3. As a result, for PRESENT, the best distinguisher so far can reach 24 rounds [14], which can be used to mount a shortcut attack on 26-round PRESENT (out of 31). The...

Citation Context

...deduce ∆X3[24], and keep the pairs when ∆X3[24] = 0. There are about 2 7−2 = 25 remaining pairs on average. 4. Guess some subkey bits the 17th round listed in the 4th column of Table 3 to compute ∆X17=-=[2, 8, 0, 9, 15]-=- one by one, and eliminate the pairs which are not content with the conditions. There are about 25−5 = 1 pairs left. 5. For the 16th round, compute ∆X18[3] and ∆X19[5]. There are 4 types of subkey whi...

Citation Context

...le differential characteristics and Linear approximations. For cryptographic security, the differential and linear bounds are the most important factor. However, the methods of multiple differentials =-=[8]-=- and multiple linear approximations [7, 21, 29] raise the question of how many differentials and linear approximations there are at the respective boundaries. From Table 1 it can be observed that thes...

Citation Context

..., Biryukov and Shamir proposed in [5] to use differentials that happens with probability 0 as distinguishers; and recently, Blondeau and Gérard demonstrated the multiple differential cryptanalysis in =-=[6]-=-, where a set of input/output differentials are considered together. Saturation attack [23, 28, 8] exploits the fact that the output set is saturated, i.e., the outputs forms the whole space of F m 2 ...

Citation Context

...ntials with different output differences. The more general case of multiple differential attacks where both the input and output differences can be different was considered by Blondeau and Gérard in =-=[10]-=-. Later Blondeau, Gérard and Nyberg [11] considered multiple differential cryptanalysis with the same input difference but different output differences. They used the LLR and the χ2 test statistic al...

Citation Context

...schedule of PRESENT as it has no impact on our attack, yet we refer to [8] for a more complete description of the cipher. 2.2 Previous results on PRESENT In the last couple of years, various analyses =-=[12,31,1,13,3,27,32,4,5]-=- on reduced versions of PRESENT in the (secret)-single-key model have been proposed. Among these analyses, the most important one remains the multidimensional linear attack from Cho [12], which takes ...