EPCBC - A Block Cipher Suitable for Electronic Product Code ...

(both rounds inclusive) by nk, for k ≤ i. Then n1 = 1, n2 ≥ 3, n3 ≥ 7, n4 ≥ 11, n5 ≥ 13, n6 ≥ 14 and
nk ≥ 2k +1 for k = 7,8,9.
Proof. The proof is similar to that of Lemma 1 and by using P1 and P2 instead. ⊓⊔
Lemma 3. For n ≥ 64, the r-round differential characteristic of PR-n has a minimum of 2r active
S-boxes for r = 5,6,7,8,9.
Proof. With no loss of generality, we consider the first round to the r-th round. Let Di be the number of
active S-boxes in round i. It is proven in [10] that the case for r = 5 holds. Consider 6-round differential
characteristic. Since there are at least 10 active S-boxes in the first five rounds, if there are at least
two active S-boxes in the sixth round, then we are done. Otherwise, suppose that D6 = 1. If D5 ≥ 2,
then applying Lemma 2 from round 6 to round 1, there is a minimum of 14 active S-boxes. Otherwise
D5 = 1. Then we must have a single bit difference to the output of the active S-box in round 5, else
it will contradict P1. Because of S2, D4 ≥ 2. Now we can apply Lemma 2 from round 5 to round 1,
yielding � 6
i=1 Di ≥ 13+1 = 14. For r = 7,8,9, we apply similar argument as before. ⊓⊔
As a direct consequence of Lemma 3, we have the following result.
Theorem 3. For n ≥ 64, the r-round differential characteristic of PR-n has a minimum of 2r active
S-boxes for r ≥ 5.
Linear cryptanalysis
Lemma 4. Consider linear approximations of PR-n where n ≥ 64. The active S-boxes over consecutive
rounds cannot form the following patterns:
1-2-1, 1-3-1, 1-3-2, 1-4-1, 1-4-2, 1-4-3, 1-i, i-1, for i ≥ 5.
Proof. For i ≥ 5, the patterns 1-i and i-1 clearly cannot happen since the S-boxes are four-bit. If the
pattern 1-2-1 were to happen, then the active S-boxes in the middle round are activated by the same
S-box and must therefore belong to two different groups. However, they cannot activate only one S-box
in the following round. Hence the pattern 1-2-1 is impossible. In general, we see that the active S-boxes
in the middle round must activate at least an equal number of S-boxes in the following round. ⊓⊔
Definition 1. Let a and b be the input and output mask to a S-box respectively. If wt(a) = wt(b) = 1,
then the S-box is said to have single-bit approximation.
In particular, with reference to S4, we see that the bias of any single-bit approximation is less than 2 −3 .
Further, we define ns to be the number of active S-boxes over r rounds with single-bit approximations.
Lemma 5. Consider r-round linear approximations of PR-n where n ≥ 64.
1. For r = 3 and the pattern 1-j-j, where 1 ≤ j ≤ 4, ns = j.
2. For r = 3 and the pattern 1-2-3, ns = 1.
3. For r = 3 and the pattern 1-3-4, ns = 2.
4. For r = 9 and {1,1,1,1,1,1,1,1,i} where i ≥ 2, ns ≥ 6.
5. For r = 9 and {1,1,1,1,1,1,1,i,j} where i ≥ 2 and j ≥ 2, ns ≥ 3.
6. For r = 9 and {1,1,1,1,1,1,i,j,k} where i ≥ 2, j ≥ 2 and k ≥ 2, ns ≥ 2.
Proof. (1) to (3) follows easily from P3 and P4, while (4) to (6) can be easily deduced from Lemma
4. ⊓⊔
Lemma 6. Consider nine-round linear approximations of PR-n where n ≥ 64. Suppose there are exactly
k rounds with one active S-box each and for each of the remaining rounds, there are exactly 2 active
S-boxes, where 3 ≤ k ≤ 8. Then ns ≥ k −2.