EPCBC - A Block Cipher Suitable for Electronic Product Code ...
EPCBC - A Block Cipher Suitable for Electronic Product Code ...
EPCBC - A Block Cipher Suitable for Electronic Product Code ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
S-box in the round. Otherwise, that round has no active S-box and zero output difference. Then the<br />
subsequent nonzero subkey difference when xored with this zero differential will cause an active S-box<br />
in the subsequent round. Hence, there are at least two active S-boxes every four rounds of the main<br />
cipher when the subkeys have non-zero differential. Hence over 28 rounds of the main cipher, there are<br />
at least 6 active S-boxes. This is because there are always at least three blocks of four consecutive rounds<br />
of the main cipher with non-zero key differentials. There<strong>for</strong>e p c|k ≤ (2 −2 ) 6 = 2 −12 and the related key<br />
differential probability satisfies p c|k×pk ≤ 2 −12 ×2 −48 = 2 −60 . Thus the attack complexity of related-key<br />
differential attack is at least 2 60 . Moreover, the adversary needs to obtain ciphertexts corresponding to<br />
2 48 related keys, which might be infeasible in practice.<br />
Analysis of <strong>EPCBC</strong>(96,96) We assume minus-4 round attacks, so a distinguisher of <strong>EPCBC</strong>(96,96)<br />
is on 28 rounds. For protection against differential cryptanalysis, we apply Theorem 3 on 28 rounds. The<br />
differential characteristic probability is at most:<br />
∆28 ≤ (2 −2 ) 28×2 = 2 −112 < 2 −96 = 2 −blocksize .<br />
For protection against linear cryptanalysis, there are three 9-round blocks in 27 out of 28 rounds. By<br />
Theorem 4, the linear bias is at most:<br />
ǫ27 ≤ (2 2 )×ǫ 3 9 ≤ (2 2 )×(2 −17 ) 3 = 2 −49 < 2 −48 = 2 −blocksize/2 .<br />
For protection against related-key differential attack, we need to bound both pk and p c|k as in the<br />
proof <strong>for</strong> <strong>EPCBC</strong>(48,96). By Theorem 3, pk ≤ 2 −96 . With some simple argument as be<strong>for</strong>e, we can prove<br />
that there are at least one active S-box every two rounds of the main cipher because the subkeys have<br />
non-zero differential. Thus p c|k ≤ (2 −2 ) 14 = 2 −28 and the related-key differential probability satisfies<br />
p c|k ×pk ≤ 2 −28 ×2 −96 = 2 −124 < 2 −96 . Thus related-key differential attack is infeasible.<br />
5.2 Other Attacks on <strong>EPCBC</strong><br />
Integral Attacks The integral attack [31] is a chosen plaintext attack originally applied to byte-based<br />
ciphers such as SQUARE and Rijndael. Lucks [37] ported it as the ‘saturation attack’ to Twofish, which<br />
is fundamentally a byte-based algorithm incorporating bit-oriented rotations. On this basis, the authors<br />
of PRESENT, which contains a bit-based permutation, discarded this attack almost out of hand. In<br />
2008, Z’aba et al. [48] developed the bit-based integral attack, which they applied to very reduced-round<br />
versions of Noekeon, Serpent and PRESENT.<br />
The attack categorizes each bit or byte across a structure of texts, as to whether or not it is balanced<br />
(the sum of its value in each text equals zero). At some point in the evolution of the text through the<br />
encryption, the balance property is lost. The attacker can guess parts of the subsequent round key, and<br />
partially decrypt this point. If the balance is not restored, the partial round key guess is incorrect.<br />
The details of the attack are driven by the structure of the linear permutation rather than of the<br />
S-boxes. The attack works best <strong>for</strong> ciphers in which the block size is less than the size of the secret key.<br />
It applies to seven of PRESENT’s 31 rounds, partly due to a weakness in its key schedule that allows<br />
61 bits of round keys 5 and 6 to be deduced by guessing the 64 bits of round key 7.<br />
The integral attacks on <strong>EPCBC</strong>(48, 96) and <strong>EPCBC</strong>(96, 96) use very similar differentials to those<br />
in the PRESENT attack, since the S-box is identical and permutation scaled to a different block size.<br />
In particular, the S-box has a probability-one differential 0x1 → w||0x1 <strong>for</strong> w ∈ {0x1,0x3,0x4,0x6}.<br />
In both cases, the attacker uses a structure of sixteen chosen plaintexts. For <strong>EPCBC</strong>(48, 96), each<br />
text in the structure is of the <strong>for</strong>m (c0,c1,c2||j), where c0 and c1 are 16-bit constants, c2 is a 12-bit<br />
constant, and j varies from 0 through to 15. This permits a 3.5 round differential similar to that of<br />
PRESENT except that the balance of bits relating to S-boxes 2, 5 and 8 are lost in the third rather than