EPCBC - A Block Cipher Suitable for Electronic Product Code ...
EPCBC - A Block Cipher Suitable for Electronic Product Code ...
EPCBC - A Block Cipher Suitable for Electronic Product Code ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
(both rounds inclusive) by nk, <strong>for</strong> k ≤ i. Then n1 = 1, n2 ≥ 3, n3 ≥ 7, n4 ≥ 11, n5 ≥ 13, n6 ≥ 14 and<br />
nk ≥ 2k +1 <strong>for</strong> k = 7,8,9.<br />
Proof. The proof is similar to that of Lemma 1 and by using P1 and P2 instead. ⊓⊔<br />
Lemma 3. For n ≥ 64, the r-round differential characteristic of PR-n has a minimum of 2r active<br />
S-boxes <strong>for</strong> r = 5,6,7,8,9.<br />
Proof. With no loss of generality, we consider the first round to the r-th round. Let Di be the number of<br />
active S-boxes in round i. It is proven in [10] that the case <strong>for</strong> r = 5 holds. Consider 6-round differential<br />
characteristic. Since there are at least 10 active S-boxes in the first five rounds, if there are at least<br />
two active S-boxes in the sixth round, then we are done. Otherwise, suppose that D6 = 1. If D5 ≥ 2,<br />
then applying Lemma 2 from round 6 to round 1, there is a minimum of 14 active S-boxes. Otherwise<br />
D5 = 1. Then we must have a single bit difference to the output of the active S-box in round 5, else<br />
it will contradict P1. Because of S2, D4 ≥ 2. Now we can apply Lemma 2 from round 5 to round 1,<br />
yielding � 6<br />
i=1 Di ≥ 13+1 = 14. For r = 7,8,9, we apply similar argument as be<strong>for</strong>e. ⊓⊔<br />
As a direct consequence of Lemma 3, we have the following result.<br />
Theorem 3. For n ≥ 64, the r-round differential characteristic of PR-n has a minimum of 2r active<br />
S-boxes <strong>for</strong> r ≥ 5.<br />
Linear cryptanalysis<br />
Lemma 4. Consider linear approximations of PR-n where n ≥ 64. The active S-boxes over consecutive<br />
rounds cannot <strong>for</strong>m the following patterns:<br />
1-2-1, 1-3-1, 1-3-2, 1-4-1, 1-4-2, 1-4-3, 1-i, i-1, <strong>for</strong> i ≥ 5.<br />
Proof. For i ≥ 5, the patterns 1-i and i-1 clearly cannot happen since the S-boxes are four-bit. If the<br />
pattern 1-2-1 were to happen, then the active S-boxes in the middle round are activated by the same<br />
S-box and must there<strong>for</strong>e belong to two different groups. However, they cannot activate only one S-box<br />
in the following round. Hence the pattern 1-2-1 is impossible. In general, we see that the active S-boxes<br />
in the middle round must activate at least an equal number of S-boxes in the following round. ⊓⊔<br />
Definition 1. Let a and b be the input and output mask to a S-box respectively. If wt(a) = wt(b) = 1,<br />
then the S-box is said to have single-bit approximation.<br />
In particular, with reference to S4, we see that the bias of any single-bit approximation is less than 2 −3 .<br />
Further, we define ns to be the number of active S-boxes over r rounds with single-bit approximations.<br />
Lemma 5. Consider r-round linear approximations of PR-n where n ≥ 64.<br />
1. For r = 3 and the pattern 1-j-j, where 1 ≤ j ≤ 4, ns = j.<br />
2. For r = 3 and the pattern 1-2-3, ns = 1.<br />
3. For r = 3 and the pattern 1-3-4, ns = 2.<br />
4. For r = 9 and {1,1,1,1,1,1,1,1,i} where i ≥ 2, ns ≥ 6.<br />
5. For r = 9 and {1,1,1,1,1,1,1,i,j} where i ≥ 2 and j ≥ 2, ns ≥ 3.<br />
6. For r = 9 and {1,1,1,1,1,1,i,j,k} where i ≥ 2, j ≥ 2 and k ≥ 2, ns ≥ 2.<br />
Proof. (1) to (3) follows easily from P3 and P4, while (4) to (6) can be easily deduced from Lemma<br />
4. ⊓⊔<br />
Lemma 6. Consider nine-round linear approximations of PR-n where n ≥ 64. Suppose there are exactly<br />
k rounds with one active S-box each and <strong>for</strong> each of the remaining rounds, there are exactly 2 active<br />
S-boxes, where 3 ≤ k ≤ 8. Then ns ≥ k −2.