This paper presents a new method for approximating the correlations of differential-linear distinguishers. From the perspective of Beyne’s geometric approach, the differential-linear correlation is a corresponding coordinate of the correlation vector associated with the ciphertext multiset, which can be obtained by using the correlation matrix of the 2-wise form of the cipher. The composite nature of the correlation matrix leads to a round-based approach to approximate the correlation vector. This simple approximation is remarkably precise, yielding the most accurate estimation for differential-linear correlations in Ascon thus far and the first DL distinguishers for 6-round Ascon-128a initialization. For Present, we present 17-round DL distinguishers, 4 rounds longer than the current record. To apply the round-based approach to ciphers with the large Chi ( \(\chi \) ) function as nonlinear functions, we derive theorems to handle the correlation propagation for \(\chi \) and its 2-wise form. Strong DL distinguishers for up to 6 rounds of Subterranean-2.0 and Koala-p are provided, 2 rounds longer than the previous differential and linear distinguishers. Furthermore, the round-based approximation idea is also extended to the higher-order differential-linear distinguishers. We give the first second-order DL distinguisher for 6-round Ascon-128 initialization and the first second-order DL distinguishers for up to 7 rounds of Subterranean-2.0 and Koala-p.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Round-Based Approximation of (Higher-Order) Differential-Linear Correlation

  • Kai Hu,
  • Zhongfeng Niu,
  • Meiqin Wang

摘要

This paper presents a new method for approximating the correlations of differential-linear distinguishers. From the perspective of Beyne’s geometric approach, the differential-linear correlation is a corresponding coordinate of the correlation vector associated with the ciphertext multiset, which can be obtained by using the correlation matrix of the 2-wise form of the cipher. The composite nature of the correlation matrix leads to a round-based approach to approximate the correlation vector. This simple approximation is remarkably precise, yielding the most accurate estimation for differential-linear correlations in Ascon thus far and the first DL distinguishers for 6-round Ascon-128a initialization. For Present, we present 17-round DL distinguishers, 4 rounds longer than the current record. To apply the round-based approach to ciphers with the large Chi ( \(\chi \) ) function as nonlinear functions, we derive theorems to handle the correlation propagation for \(\chi \) and its 2-wise form. Strong DL distinguishers for up to 6 rounds of Subterranean-2.0 and Koala-p are provided, 2 rounds longer than the previous differential and linear distinguishers. Furthermore, the round-based approximation idea is also extended to the higher-order differential-linear distinguishers. We give the first second-order DL distinguisher for 6-round Ascon-128 initialization and the first second-order DL distinguishers for up to 7 rounds of Subterranean-2.0 and Koala-p.