简单与矢量:利用结构对称性击败零和区分器

IF 1.4 2区 数学 Q3 COMPUTER SCIENCE, THEORY & METHODS
Sahiba Suryawanshi, Shibam Ghosh, Dhiman Saha, Prathamesh Ram
{"title":"简单与矢量:利用结构对称性击败零和区分器","authors":"Sahiba Suryawanshi, Shibam Ghosh, Dhiman Saha, Prathamesh Ram","doi":"10.1007/s10623-024-01502-x","DOIUrl":null,"url":null,"abstract":"<p>Higher order differential properties constitute a very insightful tool at the hands of a cryptanalyst allowing for probing a cryptographic primitive from an algebraic perspective. In FSE 2017, Saha et al. reported <span>SymSum</span> (referred to as <span>\\(\\textsf {SymSum}_\\textsf {Vec}\\)</span> in this paper), a new distinguisher based on higher order <i>vectorial</i> Boolean derivatives of <span>SHA-3</span>, constituting one of the best distinguishers on the latest cryptographic hash standard. <span>\\(\\textsf {SymSum}_\\textsf {Vec}\\)</span> exploits the difference in the algebraic degree of highest degree monomials in the algebraic normal form of <span>SHA-3</span> with regards to their dependence on round constants. Later in AFRICACRYPT 2020, Suryawanshi et al. extended <span>\\(\\textsf {SymSum}_\\textsf {Vec}\\)</span> using linearization techniques and in SSS 2023 also applied it to <span>NIST-LWC</span> finalist <span>Xoodyak</span>. However, a major limitation of <span>\\(\\textsf {SymSum}_\\textsf {Vec}\\)</span> is the maximum attainable derivative (<span>MAD</span>) of the polynomial representation, which is <i>less than half</i> of the widely studied <span>ZeroSum</span> distinguisher. This is attributed to <span>\\(\\textsf {SymSum}_\\textsf {Vec}\\)</span> being dependent on <i>k</i>-fold <i>vectorial</i> derivatives while <span>ZeroSum</span> relies on <i>k</i>-fold <i>simple</i> derivatives. In this work we overcome this limitation of <span>\\(\\textsf {SymSum}_\\textsf {Vec}\\)</span> by developing and validating the theory of computing <span>\\(\\textsf {SymSum}_\\textsf {Vec}\\)</span> with simple derivatives. This gives us a close to <span>\\(100\\%\\)</span> improvement in the <span>MAD</span> that can be computed. The new distinguisher reported in this work can also be combined with 1/2-round linearization to penetrate more rounds. Moreover, we identify an issue with the 2-round linearization claim made by Suryawanshi et al. which renders it invalid and also furnishes an algebraic fix at the cost of some additional constraints. Combining all the results we report <span>\\(\\textsf {SymSum}_\\textsf {Sim}\\)</span>, a new variant of the <span>\\(\\textsf {SymSum}_\\textsf {Vec}\\)</span> distinguisher based on <i>k</i>-fold <i>simple</i> derivatives that outperforms <span>ZeroSum</span> by a factor of <span>\\(2^{257}, 2^{129}\\)</span> for <span>\\( 10- \\)</span>round <span>SHA3-384</span> and 9-round <span>SHA3-512</span> respectively while enjoying the same <span>MAD</span> as <span>ZeroSum</span>. For every other <span>SHA-3</span> variant, <span>\\(\\textsf {SymSum}_\\textsf {Sim}\\)</span> maintains an advantage of factor 2 over the <span>ZeroSum</span>. Combined with 1/2-round linearization, <span>\\(\\textsf {SymSum}_\\textsf {Sim}\\)</span> improves upon all existing <span>ZeroSum</span> and <span>\\(\\textsf {SymSum}_\\textsf {Vec}\\)</span> distinguishers on both <span>SHA-3</span> and <span>Xoodyak</span>. As regards <span>Keccak</span> <span>\\(-p\\)</span>, the internal permutation of <span>SHA-3</span>, we report the best 15-round distinguisher with a complexity of <span>\\(2^{256}\\)</span> and the first better than birthday-bound 16-round distinguisher with a complexity of <span>\\(2^{512}\\)</span> (improving upon the 15/16-round results by Guo et al. in ASIACRYPT 2016). We also devise the best <i>full-round</i> distinguisher on the <span>Xoodoo</span> internal permutation of <span>Xoodyak</span> with a <i>practically</i> verifiable complexity of <span>\\(2^{32}\\)</span> and furnish the first third-party distinguishers on the Belarushian-standard hash function <span>Bash</span>. All distinguishers presented in this work have been verified through implementations whenever practically viable. Overall, with the <span>MAD</span> barrier broken, <span>\\(\\textsf {SymSum}_\\textsf {Sim}\\)</span> emerges as a better distinguisher than <span>ZeroSum</span> on all fronts and adds to the state-of-the-art of cryptanalytic tools investigating non-randomness of crypto primitives.</p>","PeriodicalId":11130,"journal":{"name":"Designs, Codes and Cryptography","volume":"17 1","pages":""},"PeriodicalIF":1.4000,"publicationDate":"2024-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"0","resultStr":"{\"title\":\"Simple vs. vectorial: exploiting structural symmetry to beat the ZeroSum distinguisher\",\"authors\":\"Sahiba Suryawanshi, Shibam Ghosh, Dhiman Saha, Prathamesh Ram\",\"doi\":\"10.1007/s10623-024-01502-x\",\"DOIUrl\":null,\"url\":null,\"abstract\":\"<p>Higher order differential properties constitute a very insightful tool at the hands of a cryptanalyst allowing for probing a cryptographic primitive from an algebraic perspective. In FSE 2017, Saha et al. reported <span>SymSum</span> (referred to as <span>\\\\(\\\\textsf {SymSum}_\\\\textsf {Vec}\\\\)</span> in this paper), a new distinguisher based on higher order <i>vectorial</i> Boolean derivatives of <span>SHA-3</span>, constituting one of the best distinguishers on the latest cryptographic hash standard. <span>\\\\(\\\\textsf {SymSum}_\\\\textsf {Vec}\\\\)</span> exploits the difference in the algebraic degree of highest degree monomials in the algebraic normal form of <span>SHA-3</span> with regards to their dependence on round constants. Later in AFRICACRYPT 2020, Suryawanshi et al. extended <span>\\\\(\\\\textsf {SymSum}_\\\\textsf {Vec}\\\\)</span> using linearization techniques and in SSS 2023 also applied it to <span>NIST-LWC</span> finalist <span>Xoodyak</span>. However, a major limitation of <span>\\\\(\\\\textsf {SymSum}_\\\\textsf {Vec}\\\\)</span> is the maximum attainable derivative (<span>MAD</span>) of the polynomial representation, which is <i>less than half</i> of the widely studied <span>ZeroSum</span> distinguisher. This is attributed to <span>\\\\(\\\\textsf {SymSum}_\\\\textsf {Vec}\\\\)</span> being dependent on <i>k</i>-fold <i>vectorial</i> derivatives while <span>ZeroSum</span> relies on <i>k</i>-fold <i>simple</i> derivatives. In this work we overcome this limitation of <span>\\\\(\\\\textsf {SymSum}_\\\\textsf {Vec}\\\\)</span> by developing and validating the theory of computing <span>\\\\(\\\\textsf {SymSum}_\\\\textsf {Vec}\\\\)</span> with simple derivatives. This gives us a close to <span>\\\\(100\\\\%\\\\)</span> improvement in the <span>MAD</span> that can be computed. The new distinguisher reported in this work can also be combined with 1/2-round linearization to penetrate more rounds. Moreover, we identify an issue with the 2-round linearization claim made by Suryawanshi et al. which renders it invalid and also furnishes an algebraic fix at the cost of some additional constraints. Combining all the results we report <span>\\\\(\\\\textsf {SymSum}_\\\\textsf {Sim}\\\\)</span>, a new variant of the <span>\\\\(\\\\textsf {SymSum}_\\\\textsf {Vec}\\\\)</span> distinguisher based on <i>k</i>-fold <i>simple</i> derivatives that outperforms <span>ZeroSum</span> by a factor of <span>\\\\(2^{257}, 2^{129}\\\\)</span> for <span>\\\\( 10- \\\\)</span>round <span>SHA3-384</span> and 9-round <span>SHA3-512</span> respectively while enjoying the same <span>MAD</span> as <span>ZeroSum</span>. For every other <span>SHA-3</span> variant, <span>\\\\(\\\\textsf {SymSum}_\\\\textsf {Sim}\\\\)</span> maintains an advantage of factor 2 over the <span>ZeroSum</span>. Combined with 1/2-round linearization, <span>\\\\(\\\\textsf {SymSum}_\\\\textsf {Sim}\\\\)</span> improves upon all existing <span>ZeroSum</span> and <span>\\\\(\\\\textsf {SymSum}_\\\\textsf {Vec}\\\\)</span> distinguishers on both <span>SHA-3</span> and <span>Xoodyak</span>. As regards <span>Keccak</span> <span>\\\\(-p\\\\)</span>, the internal permutation of <span>SHA-3</span>, we report the best 15-round distinguisher with a complexity of <span>\\\\(2^{256}\\\\)</span> and the first better than birthday-bound 16-round distinguisher with a complexity of <span>\\\\(2^{512}\\\\)</span> (improving upon the 15/16-round results by Guo et al. in ASIACRYPT 2016). We also devise the best <i>full-round</i> distinguisher on the <span>Xoodoo</span> internal permutation of <span>Xoodyak</span> with a <i>practically</i> verifiable complexity of <span>\\\\(2^{32}\\\\)</span> and furnish the first third-party distinguishers on the Belarushian-standard hash function <span>Bash</span>. All distinguishers presented in this work have been verified through implementations whenever practically viable. Overall, with the <span>MAD</span> barrier broken, <span>\\\\(\\\\textsf {SymSum}_\\\\textsf {Sim}\\\\)</span> emerges as a better distinguisher than <span>ZeroSum</span> on all fronts and adds to the state-of-the-art of cryptanalytic tools investigating non-randomness of crypto primitives.</p>\",\"PeriodicalId\":11130,\"journal\":{\"name\":\"Designs, Codes and Cryptography\",\"volume\":\"17 1\",\"pages\":\"\"},\"PeriodicalIF\":1.4000,\"publicationDate\":\"2024-11-01\",\"publicationTypes\":\"Journal Article\",\"fieldsOfStudy\":null,\"isOpenAccess\":false,\"openAccessPdf\":\"\",\"citationCount\":\"0\",\"resultStr\":null,\"platform\":\"Semanticscholar\",\"paperid\":null,\"PeriodicalName\":\"Designs, Codes and Cryptography\",\"FirstCategoryId\":\"100\",\"ListUrlMain\":\"https://doi.org/10.1007/s10623-024-01502-x\",\"RegionNum\":2,\"RegionCategory\":\"数学\",\"ArticlePicture\":[],\"TitleCN\":null,\"AbstractTextCN\":null,\"PMCID\":null,\"EPubDate\":\"\",\"PubModel\":\"\",\"JCR\":\"Q3\",\"JCRName\":\"COMPUTER SCIENCE, THEORY & METHODS\",\"Score\":null,\"Total\":0}","platform":"Semanticscholar","paperid":null,"PeriodicalName":"Designs, Codes and Cryptography","FirstCategoryId":"100","ListUrlMain":"https://doi.org/10.1007/s10623-024-01502-x","RegionNum":2,"RegionCategory":"数学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"Q3","JCRName":"COMPUTER SCIENCE, THEORY & METHODS","Score":null,"Total":0}
引用次数: 0

摘要

高阶微分属性是密码分析师手中极具洞察力的工具,可以从代数的角度对密码基元进行探测。在 FSE 2017 中,Saha 等人报告了 SymSum(本文中称为 \(\textsf {SymSum}_\textsf {Vec}\),这是一种基于 SHA-3 的高阶向量布尔导数的新型区分器,是最新加密哈希标准的最佳区分器之一。\(\textsf {SymSum}_\textsf {Vec}\)利用了SHA-3代数正则表达式中最高阶单项式代数程度的差异,以及它们对回合常数的依赖性。后来在 AFRICACRYPT 2020 中,Suryawanshi 等人使用线性化技术扩展了 \(\textsf {SymSum}_\textsf {Vec}\),并在 SSS 2023 中将其应用于 NIST-LWC 决赛选手 Xoodyak。然而,\(\textsf {SymSum}_\textsf {Vec}\)的一个主要局限是多项式表示的最大可实现导数(MAD),它不到广泛研究的零和区分器的一半。这是因为 \(textsf {SymSum}_\textsf {Vec}\) 依赖于 k 倍矢量导数,而 ZeroSum 依赖于 k 倍简单导数。在这项工作中,我们通过发展和验证用简单导数计算 \(\textsf {SymSum}_\textsf {Vec}\) 的理论,克服了 \(\textsf {SymSum}_\textsf {Vec}\) 的这一局限性。这使得我们可以计算的MAD有了接近(100%)的提高。这项工作中报告的新区分器还可以与 1/2 轮线性化相结合,以穿透更多轮。此外,我们还发现了苏里亚万斯等人提出的 2 轮线性化主张中的一个问题,这个问题使线性化主张失效,并以一些额外约束为代价提供了一个代数修复方法。综合所有结果,我们报告了基于k倍简单导数的\(\textsf {SymSum}_\textsf {Sim}\) 区分器的一个新变体--\(\textsf {SymSum}_\textsf {Vec}\),它比ZeroSum的性能高出了\(2^{257}、2^{129}\) ,同时享有与 ZeroSum 相同的 MAD。对于其他每一种 SHA-3 变体,(textsf {SymSum}_\textsf {Sim}\)都比 ZeroSum 保持 2 倍的优势。结合1/2轮线性化,(\textsf {SymSum}_\textsf {Sim}\)在SHA-3和Xoodyak上改进了所有现有的ZeroSum和(\textsf {SymSum}_\textsf {Vec}\)区分器。至于 SHA-3 的内部排列 Keccak \(-p\),我们报告了复杂度为 \(2^{256}\)的最佳 15 轮区分器,以及复杂度为 \(2^{512}\)的首个优于生日约束的 16 轮区分器(改进了 Guo 等人在 ASIACRYPT 2016 中的 15/16 轮结果)。我们还在 Xoodoo 内部排列的 Xoodyak 上设计了最佳的全轮区分器,其实际可验证的复杂度为 \(2^{32}\),并在贝拉鲁什标准哈希函数 Bash 上提供了首个第三方区分器。只要实际可行,这项工作中提出的所有区分器都已通过实现进行了验证。总之,随着MAD障碍的打破,\(\textsf {SymSum}_\textsf {Sim}\) 在所有方面都成为比ZeroSum更好的区分器,并为研究密码原语非随机性的密码分析工具增添了最先进的技术。
本文章由计算机程序翻译,如有差异,请以英文原文为准。

Simple vs. vectorial: exploiting structural symmetry to beat the ZeroSum distinguisher

Simple vs. vectorial: exploiting structural symmetry to beat the ZeroSum distinguisher

Higher order differential properties constitute a very insightful tool at the hands of a cryptanalyst allowing for probing a cryptographic primitive from an algebraic perspective. In FSE 2017, Saha et al. reported SymSum (referred to as \(\textsf {SymSum}_\textsf {Vec}\) in this paper), a new distinguisher based on higher order vectorial Boolean derivatives of SHA-3, constituting one of the best distinguishers on the latest cryptographic hash standard. \(\textsf {SymSum}_\textsf {Vec}\) exploits the difference in the algebraic degree of highest degree monomials in the algebraic normal form of SHA-3 with regards to their dependence on round constants. Later in AFRICACRYPT 2020, Suryawanshi et al. extended \(\textsf {SymSum}_\textsf {Vec}\) using linearization techniques and in SSS 2023 also applied it to NIST-LWC finalist Xoodyak. However, a major limitation of \(\textsf {SymSum}_\textsf {Vec}\) is the maximum attainable derivative (MAD) of the polynomial representation, which is less than half of the widely studied ZeroSum distinguisher. This is attributed to \(\textsf {SymSum}_\textsf {Vec}\) being dependent on k-fold vectorial derivatives while ZeroSum relies on k-fold simple derivatives. In this work we overcome this limitation of \(\textsf {SymSum}_\textsf {Vec}\) by developing and validating the theory of computing \(\textsf {SymSum}_\textsf {Vec}\) with simple derivatives. This gives us a close to \(100\%\) improvement in the MAD that can be computed. The new distinguisher reported in this work can also be combined with 1/2-round linearization to penetrate more rounds. Moreover, we identify an issue with the 2-round linearization claim made by Suryawanshi et al. which renders it invalid and also furnishes an algebraic fix at the cost of some additional constraints. Combining all the results we report \(\textsf {SymSum}_\textsf {Sim}\), a new variant of the \(\textsf {SymSum}_\textsf {Vec}\) distinguisher based on k-fold simple derivatives that outperforms ZeroSum by a factor of \(2^{257}, 2^{129}\) for \( 10- \)round SHA3-384 and 9-round SHA3-512 respectively while enjoying the same MAD as ZeroSum. For every other SHA-3 variant, \(\textsf {SymSum}_\textsf {Sim}\) maintains an advantage of factor 2 over the ZeroSum. Combined with 1/2-round linearization, \(\textsf {SymSum}_\textsf {Sim}\) improves upon all existing ZeroSum and \(\textsf {SymSum}_\textsf {Vec}\) distinguishers on both SHA-3 and Xoodyak. As regards Keccak \(-p\), the internal permutation of SHA-3, we report the best 15-round distinguisher with a complexity of \(2^{256}\) and the first better than birthday-bound 16-round distinguisher with a complexity of \(2^{512}\) (improving upon the 15/16-round results by Guo et al. in ASIACRYPT 2016). We also devise the best full-round distinguisher on the Xoodoo internal permutation of Xoodyak with a practically verifiable complexity of \(2^{32}\) and furnish the first third-party distinguishers on the Belarushian-standard hash function Bash. All distinguishers presented in this work have been verified through implementations whenever practically viable. Overall, with the MAD barrier broken, \(\textsf {SymSum}_\textsf {Sim}\) emerges as a better distinguisher than ZeroSum on all fronts and adds to the state-of-the-art of cryptanalytic tools investigating non-randomness of crypto primitives.

求助全文
通过发布文献求助,成功后即可免费获取论文全文。 去求助
来源期刊
Designs, Codes and Cryptography
Designs, Codes and Cryptography 工程技术-计算机:理论方法
CiteScore
2.80
自引率
12.50%
发文量
157
审稿时长
16.5 months
期刊介绍: Designs, Codes and Cryptography is an archival peer-reviewed technical journal publishing original research papers in the designated areas. There is a great deal of activity in design theory, coding theory and cryptography, including a substantial amount of research which brings together more than one of the subjects. While many journals exist for each of the individual areas, few encourage the interaction of the disciplines. The journal was founded to meet the needs of mathematicians, engineers and computer scientists working in these areas, whose interests extend beyond the bounds of any one of the individual disciplines. The journal provides a forum for high quality research in its three areas, with papers touching more than one of the areas especially welcome. The journal also considers high quality submissions in the closely related areas of finite fields and finite geometries, which provide important tools for both the construction and the actual application of designs, codes and cryptographic systems. In particular, it includes (mostly theoretical) papers on computational aspects of finite fields. It also considers topics in sequence design, which frequently admit equivalent formulations in the journal’s main areas. Designs, Codes and Cryptography is mathematically oriented, emphasizing the algebraic and geometric aspects of the areas it covers. The journal considers high quality papers of both a theoretical and a practical nature, provided they contain a substantial amount of mathematics.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
确定
请完成安全验证×
copy
已复制链接
快去分享给好友吧!
我知道了
右上角分享
点击右上角分享
0
联系我们:info@booksci.cn Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。 Copyright © 2023 布克学术 All rights reserved.
京ICP备2023020795号-1
ghs 京公网安备 11010802042870号
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术官方微信