Differential–Linear Approximations of CHAM

Abstract

CHAM is a family of lightweight block ciphers designed for resource-constrained environments like IoT devices and embedded systems, which require low power consumption and high performance. Despite numerous cryptanalytic evaluations, the security of CHAM remains robust. Differential–linear cryptanalysis, a method that combines two of the strongest attack methods on block ciphers—differential cryptanalysis and linear cryptanalysis—has been successfully applied to many block ciphers. This study introduces the first concrete differential–linear approximations of CHAM, marking a significant advancement in the cryptanalysis of this cipher family. Utilizing a Boolean satisfiability problem framework, we present a 46-round differential–linear approximation of CHAM-64/128 with a correlation of 2−31.08 and a 58-round approximation for CHAM-128/128 and CHAM-128/256 with correlations of 2−58.86 and 2−59.08, respectively. These findings significantly exceed the designers’ expectations for differential–linear approximations using CHAM. Furthermore, the 46-round differential–linear approximation of CHAM-64/128 is the best distinguisher of CHAM-64/128 to date in a single-key attack model. Notably, our findings do not threaten the security of CHAM but provide deeper insights into its cryptanalytic resistance.