EPCBC - A Block Cipher Suitable for Electronic Product Code ...

The pLayer For n ≥ 64, the (generalized) pLayer observe the following properties:
P1. The input bits to an S-box come from 4 distinct S-boxes of the same group.
P2. The input bits to a group of four S-boxes come from 16 different S-boxes.
P3. The four output bits from a particular S-box enter four distinct S-boxes, each of which belongs to
a distinct group of S-boxes in the subsequent round.
P4. The output bits of S-boxes in distinct groups go to distinct S-boxes.
For PR-48, observe that while P1 and P4 are still true, P2 and P3 do not hold. Instead of P3, PR-48
(and in fact PR-n for all n, 16|n) obeys the following:
P3 ′ . The four output bits from a particular S-box enter four distinct S-boxes.
In the remaining of this paper, we only consider PR-n where 16|n.
4.2 Improved Differential and Linear cryptanalysis
Differential and linear cryptanalysis are among the most powerful techniques available to the cryptanalyst.
In order to evaluate the resistance of a block cipher to differential and linear cryptanalysis, we
provide a lower bound to the number of active S-boxes involved in a differential/linear characteristic. We
first prove new bounds for the differential and linear resistance of PRESENT-n which are of particular
interest with regards to n < 64.
Theorem 1. Any 4-round differential characteristic of PR-n has a minimum of 6 active S-boxes.
Proof. Suppose there are at most 5 active S-boxes for four consecutive rounds. The numbers of active
S-boxes in the four consecutive rounds takes up one of the following patterns: 1-1-1-1, 2-1-1-1, 1-2-1-1,
1-1-2-1, or 1-1-1-2. But the patterns 1-1-1 and and 1-2-1 are impossible by virtue of S2 and P3’. The
result now follows. ⊓⊔
Theorem 2. Let ǫ4 be the maximal bias of a linear approximation of 4 rounds of PR-n. Then ǫ4 ≤ 2 −7 .
Proof. The proof is similar to that of [10, Theorem 2]. However note that when n < 64, the patterns
(denoting the numbers of active S-boxes over four consecutive rounds) 1-2-1-1 and 1-1-2-1 are now
allowed, in addition to the existing patterns of [10, Theorem 2]. But due to P3 ′ , we must have at least
one active S-box with single-bit approximation over four rounds for all possible patterns. It follows that
ǫ4 ≤ 2 4 ×(2 −3 )×(2 −2 ) 4 ≤ 2 −7 , as desired. ⊓⊔
Remark 1. ThenewboundsinTheorems1and2areneededwhenanalyzingthesecurityofEPCBC(48,96)
against DC and LC because the block size n = 48 is less than 64.
In the remaining of this section, we state the improved and generalized results on the differential and
linear probability bounds of [10]. As many technicalities and rigorous arguments are involved, we have
included the formal proofs of the theorems in Appendix A.1.
Theorem 3. For n ≥ 64, the r-round differential characteristic of PR-n has a minimum of 2r active
S-boxes for r ≥ 5.
Remark 2. Note that if we have used the differential bound in [10, Theorem 1], we would only be able to
deduce 10 (differential) active S-boxes every 5 rounds. For example, if there are 14 rounds, [10, Theorem
1] would give 20 active S-boxes from 10 out of 14 rounds, the security margin from the remaining 4
rounds is not captured. In contrast, Theorem 3 would give us 28 active S-boxes from 14 rounds.