3
$\begingroup$

Integral cryptanalysis against 4-rounds AES is practical (Security of the AES with a Secret S-box). I did two experiments in order to find the impact and remove the integral distinguisher of 4 rounds:

  • I replaced key addition $\oplus$ with $\boxplus$ (mod 32 bit)
  • I replaced the sbox with S1 Sbox in Clefia cipher (same differential and linear probability).

but the integral distinguisher is still present.

Further reading lead me to find that BelT cipher (Finding Integral Distinguishers with Ease) has no integral distinguisher after three rounds.

Questions:

  • Where is the exploitable integral structure in AES-like?

  • What countermeasures are taken to remove integral distinguisher?

  • What is the advantage taken in BelT cipher?

|improve this question
$\endgroup$
  • $\begingroup$ What's wrong with more than 4 rounds, per common wisdom? $\endgroup$ – fgrieu Nov 20 '18 at 14:36
  • $\begingroup$ Nothing wrong but can we do better with less rounds $\endgroup$ – hardyrama Nov 20 '18 at 14:39
1
$\begingroup$

This question may be theoretically interesting.

However, it looks to me strongly likely that the nice diffusion properties of AES using operations of order $4$ ShiftRows) and matrix ($4\times 4$) multiplication on vectors of dimension $4$ (MixColumns) are the reason for the existence of these attacks and changing these properties may well require more rounds for security.

The requirement that these operations be one-to-one, in the absence of a feistel structure, means that the SPN structure may also need to be dumped in order to avoid 4 round integral cryptanalysis.

|improve this answer
$\endgroup$

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.