Parallel SAT framework to find clustering of differential characteristics and its applications

The most crucial but time-consuming task for differential cryptanalysis is to find a differential with a high probability. To tackle this task, we propose a new SAT-based automatic search framework developed to efficiently determine the differential with the highest probability under a specified condition. Conventional SAT-based methods have primarily aimed to accelerate the search for an optimal single differential characteristic or to evaluate the clustering effect for a specific input–output difference. However, methods tailored to the former purpose are often not optimized to evaluate the clustering effect. Meanwhile, methods developed for the latter purpose lack comprehensive search capabilities and, therefore, have difficulty identifying a differential with the highest probability. Our framework leverages a multi-threading technique to solve incremental SAT problems in parallel, offering the following advantages over previous methods: (1) speedy identification of the differential with the highest probability under the specified conditions; (2) efficient construction of the truncated differential with the highest probability from multiple obtained differentials; and (3) applicability to a wide class of symmetric-key primitives. To demonstrate the effectiveness of our framework, we apply it to various low-latency primitives, including block ciphers (PRINCE and PRINCEv2) and tweakable block ciphers (QARMA and QARMAv2). We have successfully determined the tight differential bounds for all variants of the target ciphers within a practical time, identifying the longest distinguisher for all the variants, excluding QARMAv2 under the related-tweak setting. Besides, we have uncovered significant differences in the behavior of differential between PRINCE and QARMA, particularly concerning the clustering effect. Our findings shed light on the new structural properties of these important primitives. In the context of key recovery attacks, our framework allows the derivation of key-recovery-friendly truncated differentials for all variants of QARMA. Consequently, we report key recovery attacks based on (truncated) differential cryptanalysis on QARMA under the related-tweak setting for the first time. demonstrating that these key recovery attacks are competitive with existing attacks.