EPCBC - A Block Cipher Suitable for Electronic Product Code ...
EPCBC - A Block Cipher Suitable for Electronic Product Code ...
EPCBC - A Block Cipher Suitable for Electronic Product Code ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
The pLayer For n ≥ 64, the (generalized) pLayer observe the following properties:<br />
P1. The input bits to an S-box come from 4 distinct S-boxes of the same group.<br />
P2. The input bits to a group of four S-boxes come from 16 different S-boxes.<br />
P3. The four output bits from a particular S-box enter four distinct S-boxes, each of which belongs to<br />
a distinct group of S-boxes in the subsequent round.<br />
P4. The output bits of S-boxes in distinct groups go to distinct S-boxes.<br />
For PR-48, observe that while P1 and P4 are still true, P2 and P3 do not hold. Instead of P3, PR-48<br />
(and in fact PR-n <strong>for</strong> all n, 16|n) obeys the following:<br />
P3 ′ . The four output bits from a particular S-box enter four distinct S-boxes.<br />
In the remaining of this paper, we only consider PR-n where 16|n.<br />
4.2 Improved Differential and Linear cryptanalysis<br />
Differential and linear cryptanalysis are among the most powerful techniques available to the cryptanalyst.<br />
In order to evaluate the resistance of a block cipher to differential and linear cryptanalysis, we<br />
provide a lower bound to the number of active S-boxes involved in a differential/linear characteristic. We<br />
first prove new bounds <strong>for</strong> the differential and linear resistance of PRESENT-n which are of particular<br />
interest with regards to n < 64.<br />
Theorem 1. Any 4-round differential characteristic of PR-n has a minimum of 6 active S-boxes.<br />
Proof. Suppose there are at most 5 active S-boxes <strong>for</strong> four consecutive rounds. The numbers of active<br />
S-boxes in the four consecutive rounds takes up one of the following patterns: 1-1-1-1, 2-1-1-1, 1-2-1-1,<br />
1-1-2-1, or 1-1-1-2. But the patterns 1-1-1 and and 1-2-1 are impossible by virtue of S2 and P3’. The<br />
result now follows. ⊓⊔<br />
Theorem 2. Let ǫ4 be the maximal bias of a linear approximation of 4 rounds of PR-n. Then ǫ4 ≤ 2 −7 .<br />
Proof. The proof is similar to that of [10, Theorem 2]. However note that when n < 64, the patterns<br />
(denoting the numbers of active S-boxes over four consecutive rounds) 1-2-1-1 and 1-1-2-1 are now<br />
allowed, in addition to the existing patterns of [10, Theorem 2]. But due to P3 ′ , we must have at least<br />
one active S-box with single-bit approximation over four rounds <strong>for</strong> all possible patterns. It follows that<br />
ǫ4 ≤ 2 4 ×(2 −3 )×(2 −2 ) 4 ≤ 2 −7 , as desired. ⊓⊔<br />
Remark 1. ThenewboundsinTheorems1and2areneededwhenanalyzingthesecurityof<strong>EPCBC</strong>(48,96)<br />
against DC and LC because the block size n = 48 is less than 64.<br />
In the remaining of this section, we state the improved and generalized results on the differential and<br />
linear probability bounds of [10]. As many technicalities and rigorous arguments are involved, we have<br />
included the <strong>for</strong>mal proofs of the theorems in Appendix A.1.<br />
Theorem 3. For n ≥ 64, the r-round differential characteristic of PR-n has a minimum of 2r active<br />
S-boxes <strong>for</strong> r ≥ 5.<br />
Remark 2. Note that if we have used the differential bound in [10, Theorem 1], we would only be able to<br />
deduce 10 (differential) active S-boxes every 5 rounds. For example, if there are 14 rounds, [10, Theorem<br />
1] would give 20 active S-boxes from 10 out of 14 rounds, the security margin from the remaining 4<br />
rounds is not captured. In contrast, Theorem 3 would give us 28 active S-boxes from 14 rounds.