0
$\begingroup$

Consider 128-bit cipher. It has one weakness. In every round you can find such even number $E$ which is encrypted into block that has $0$ as one of $1-128$ bits (lets say it has $0$ as $k$-th bit). And then you can find a numbers $E+2^{i} \cdot n$ $\mod 2^{128}$ which are encrypted into blocks that have $r$ consecutive zeros on $k$, $k+1$, $k+2$,... position, if number $2+2^{i} \cdot n$ is divisible by $2^{r}$.

Lets say $E=14$. It means that number $E+2^{1} \cdot 3$ will got $3$ zeros as $k$, $k+1$, $k+2$ bit (becasue $2+2^1 \cdot 3$ is divisible by $2^{3}$). And for example number $14+2^{1} \cdot (2^{127}-1)$ $\mod 2^{128}$ will got all zeros.

And you can find also odd number $F$ which is encrypted into block that has $1$ as one of $1-128$ bits (lets say it has $1$ as $k$-th bit). And then you can find a numbers $F+2^{i} \cdot n$ $\mod 2^{128}$ which are encrypted into blocks that have $r$ consecutive ones on $k$, $k+1$, $k+2$,... position, if number $2+2^{i} \cdot n$ is divided by $2^{r}$.

Let's assume that all other bits of encrypted blocks are indistinguishable from random. It make sense to attack this cipher using only that vulnerabilities. $k$ is secret (but it is only 7-bit number) and also $E$ and $F$ are secret (they are different in every round).

What is best differential attack on this? Can these weaknesses be vulnerable to linear cryptanalysis? I planned about $20$ rounds, but I don't know will it be enough. It is quite clear how to find differential if keys $k$ are equal to $1$ in every round. Then every even number will got $0$ as a first bit and every odd number will got $1$ as a first bit (we can make differential attack in this case). But $k$ can be every number from $1$ to $128$.

I can give you and example of such cipher. Let's consider $a_{1}$, $a_{2}$, ..., $a_{20}$, $s_{1}$,$s_{2}$,...,$s_{20}$ and $k_{1}$,$k_{2}$,...,$k_{20}$ as keys. In every round we compute:

$P_{1}$ --> $INPUT$ xor $s_{i}$

$P_{2}$ --> $P_{1} \cdot$ $a_{i} \mod 2^{128}$

$P_{3}$ --> move $P_{2}$ block by $k_{i}$ bits

I'm pretty sure that we can attack it somehow using such vulnerabilities, but I can't decide how serious the problem is and how many rounds the cipher should have.

$\endgroup$
1
  • $\begingroup$ Here is python code of cipher: pastebin.pl/view/26abfc3b You can run it with yourfilename.py [1,2,3] [5,3,7] [1,1,1] 128 123, where 123 is plaintext. [1,2,3] are xoring keys. [5,3,7] are multipliers in subsequent rounds and [1,1,1] means that you are moving bits by one bit in every round. Example of first round: s = 123 XOR 1 = 122 s = 122*5 mod 2^128 = 610 Move it by 1 bit and you will get 1220. $\endgroup$ – Tom Dec 10 '20 at 1:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.