Specifying cycles of minimal length for commonly used linear layers in block ciphers

Abstract

Nonlinear invariant attack applied to lightweight block ciphers relies on the existence of a nonlinear invariant $g:F_2^n\to F_2$ for the round function. Whereas invariants of the entire S-box layer have been studied in terms of the corresponding cycle structure, a similar analysis for the linear layer has not been performed yet. In this article, we provide a theoretical analysis for specifying the minimal length of cycles for commonly used linear permutations in lightweight block ciphers. Namely, using a suitable matrix representation, we exactly specify the minimal cycle lengths for those linear layers that employ ShiftRows, Rotational-XOR and circular Boolean matrix operations which can be found in many well-known families of block ciphers. These results are practically useful for the purpose of finding nonlinear invariants of the entire encryption rounds since these can be specified using the intersection of cycles corresponding to the linear and S-box layer. We also apply our theoretical analysis practically and specify minimal cycle lengths of linear layers for certain families of block ciphers including some NIST candidates.