2
$\begingroup$

This is a bit vauge and long winded. Any partial answers or comments/ways to make this more precise would be greatly appreciated.

Fix some general structure for a cipher, for example Sbox then Permutation then add round key iterated n times.

Consider all ciphers obtained by this method where we choose the S-box and permutation randomly from some set. For each such cipher form a tuple consisting of the probabilities of each (n-1)-round differential. Due to compounding randomness going on here, these tuples should have some limiting distribution.

If we can calculate this distribution, we can estimate How likley it is a random cipher of this structure can be broken via differentials.

My two questions:

  • Should such a limiting distribution exists?
  • What conditions on the cipher structure make this distribution uniform?
Improve this question
$\endgroup$
5
  • $\begingroup$ The random SBOX is tested for DES ( couldn't find the article yet). S-Box Modifications and Their Effect in DES-like Encryption Systems and here a related question S-box design criteria and random sboxes $\endgroup$
    – kelalaka
    Commented May 24, 2020 at 20:21
  • $\begingroup$ Great, thank you. I suppose a way forward for my question would be to look through all this research to find the bad properties of sboxes, then count all the random functions which satisfy these bad properties. $\endgroup$
    – user79425
    Commented May 24, 2020 at 20:40
  • 2
    $\begingroup$ There is a great SBox package in SageMath S-Boxes and Their Algebraic Representations that might be helpful in your cause. $\endgroup$
    – kelalaka
    Commented May 24, 2020 at 20:44
  • $\begingroup$ That’s pretty cool $\endgroup$
    – user79425
    Commented May 24, 2020 at 21:08
  • $\begingroup$ @zz7948 You told that you want to calculate the distribution with some fixed cipher structure and a random sbox. I guess by random sbox you mean before starting any encryption you generate one sbox randomly. Now, to calculate the (n-1) round differential you need one DDT. There will be a potential set of DDT for the corresponding sbox set. As the sbox is random so is the DDT. Now, I am just curious if the brute force(or if there is any better way to get DDT) complexity of the getting the proper DDT from the potential set is considered while analyzing the difficulty of this attack. $\endgroup$
    – Radium
    Commented Nov 25, 2020 at 3:41

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.