reducing63aaa.com

63aaa.com  时间:2021-04-08  阅读:()
SCIENCECHINAInformationSciencesMarch2020,Vol.
63139111:1–139111:3https://doi.
org/10.
1007/s11432-018-9495-xcScienceChinaPressandSpringer-VerlagGmbHGermany,partofSpringerNature2020info.
scichina.
comlink.
springer.
com.
LETTER.
ImproveddistinguishersearchtechniquesbasedonparitysetsXiaofengXIE&TianTIAN*NationalDigitalSwitchingSystemEngineering&TechnologicalResearchCenter,P.
O.
Box407,Zhengzhou450001,ChinaReceived12February2018/Accepted15June2018/Publishedonline10February2020CitationXieXF,TianT.
Improveddistinguishersearchtechniquesbasedonparitysets.
SciChinaInfSci,2020,63(3):139111,https://doi.
org/10.
1007/s11432-018-9495-xDeareditor,DivisionpropertywasatechniqueproposedbyTodoatEUROCRYPT2015tosearchintegraldis-tinguishersagainstblockciphers[1].
Todo[2]ap-pliedthistechniquetoperformstructuralevalu-ationagainstboththeFeistelandtheSPNcon-structionsandattackedthefullMISTY1.
Sub-sequently,manyimprovedtechniquesbasedonthedivisionpropertywereproposed[3,4].
AtFSE2016,TodoandMorii[3]introducedthebit-baseddivisionpropertyandproveditseective-nesstonddistinguishersagainstnon-S-box-basedciphers.
Althoughmoreaccurateintegraldistinguisherswerefoundbyusingthebit-baseddivisionprop-erty,itcouldnotbeappliedtocipherswhoseblocklengthismorethan32becauseofitshightimeandmemorycomplexities.
BasedonTodo'swork,Xiangetal.
[5]convertedthedistinguishersearchalgorithmbasedonthebit-baseddivisionpropertyintoanMILPproblematASIACRYPT2016.
Withthismethod,theyobtainedaseriesofimprovedresultsincludinga9-roundPRESENTdistinguisherwithonebalancedbit.
Thisdistin-guisherisoneofthebest-knowndistinguishersre-latedtoroundnumbers.
AtCRYPTO2016,BouraandCauteaut[6]introducedtheparitysettostudythedivi-sionproperty.
TheyutilizedtheparitysettoexploitfurtherpropertiesofthePRESENTS-boxandthePRESENTlinearlayer,leadingtoseveralimproveddistinguishersagainstreduced-roundPRESENT.
BecausemorepropertiesoftheS-boxandthelinearlayerareutilized,paritysetscanndmoreaccurateintegralcharacteris-tics.
However,althoughtheauthorsdidnotpointout,aparitysetrequireshighertimeandmemorycomplexitiesthanthedivisionpropertydoes.
Ourworkaimsatreducingtimeandmemorycomplex-itieswhenusingparitysetstosearchintegraldis-tinguishers.
Asaresult,weintroducetheideaofmeet-in-the-middleintothedistinguishersearch.
Toillustrateourtechniques,weperformedexten-siveexperimentsonPRESENTandfounda9-rounddistinguisherwith22balancedbits.
Notation1(Bitproductfunction).
Letu,x∈Fn2.
Denotexu=ni=1x[i]u[i],andforu,x∈Fn12*Fn22Fnm2,wherex=(x1,x2,xm),u=(u1,u2,um),denebitproductfunctionasxu=mi=1xuii.
Notation2(Comparisonbetweenvectors).
Fora,b∈Zm,denoteabifaibiforall0bifabbuta=b.
Foru∈Fn2,letusdenotePrec(u)={v∈Fn2:vu},Succ(u)={v∈Fn2:uv}.
*Correspondingauthor(email:tiantiand@126.
com)XieXF,etal.
SciChinaInfSciMarch2020Vol.
63139111:2Theorem1.
Ifu,v∈Fnt2satisfyuv,thenW(u)W(v).
Notation3(Comparisonbetweensets).
LetAandBbetwosetswhoseelementsareinFn2.
De-noteABifthereexista∈Aandb∈Bwithab,andABifnoneofsuchcoupleexists.
Proposition1.
LetAandBbetwosetswhoseelementsareinFn2withAB.
Iftherearea1,a2∈A,b1,b2∈Bsuchthata2a1andb1b2,thenA\{a1}B\{b1}.
Notation4(Roundfunction).
LetFbeaper-mutationofFn2denedbyF:x=(x1,x2,xn)→y=(y1,y2,yn).
TheneveryyicanbeseenasaBooleanfunctiononx1,x2,xn,denotedbyyi=Fi(x).
Forapositiveintegerr,wedenoteFrasacompositionofrpermutationF.
Denition1(Divisionproperty[1]).
LetXbeamultisetwhoseelementsbelongtoFn2.
Then,XhasthedivisionpropertyDnkwhenitfulllsthefollowingconditions:Foru∈Fn2,theparityofxuoverallelementsinXisalwaysevenwhenwt(u)Forfurtherstudyofthedivisionprop-erty,pleasereferto[1,4]indetail.
Denition2(Parityset[6]).
LetXbeasetwhoseelementstakevaluesofFn2.
TheparitysetofXisdenotedbyU(X)anddenedasfollows:U(X)=u∈Fn2:x∈Xxu=1.
Remark1.
IftheparitysetU(X)ofXisknown,thenthedivisionpropertyofXisgivenbyDnk,wherek=minu∈U(X)wt(u).
ForthepropagationrulesoftheparitysetonSPN,pleasereferto[1].
ForaninputsetXandaroundfunctionE,de-notetheparitysetafterr1-roundencryptionasU(Er1(X)),andthealgebraicnormalform(ANF)ofthei-thoutputbitafterr2-roundencryptionasEr2i(x).
IfallthetermsappearinginEr2i(x)arenotdivisiblebyanytermin{xu:u∈U(Er(X))},thenthei-thoutputbitof(r1+r2)-roundencryp-tionisbalanced.
Basedonthisobservation,weimprovedthein-tegraldistinguishersearchbyutilizingthemeet-in-the-middletechniquewhichdividesthen-roundpropagationofparitysetsinton1-roundpropaga-tionofparitysetsand(nn1)-roundpropagationoftheANF.
Next,weproposeanewconcept,whichwecalltermset,todescribetheANFandshowtheprop-agationrulesofthetermsetonSPN.
Denition3(Termset).
Letf(x)beann-variableBooleanfunction.
Thetermsetoff(x)denotedbyT(f)isthesubsetofFn2denedbyT(f)={u∈Fn2:xuappearsintheANFoff(x)}.
Proposition2.
LetSbeanS-boxoverFm2.
De-noteTs(u)={v∈Fm2:xvappearsintheANFofSu(x)}.
Thenforanm-variableBooleanfunctionfwiththetermsetT(f),wehaveT(f(S(x)))u∈T(f)Ts(u).
Proposition3.
LetSbeapermutationofFmt2whichconsistsoftparallelindepen-dentS-boxesoverFm2,namely,S(x1,xt)=(S(x1)S(xt)).
Foranmt-variableBooleanfunctionfwiththetermsetT(f),wehaveT(f(S))(u1,···,ut)∈T(f)Ts1(u1)Tst(ut).
Proposition4.
Letfbeann-variableBooleanfunctionwiththetermsetT(f).
Foranyk∈Fn2,thetermsetoff(kx)=(x1k1,xnkn)satisesT(f(kx))u∈T(f)Prec(u).
Then,thetermsetafteroneroundencryptioncanbededucedbyPropositions2and4,i.
e.
,T(f(S(xk)))u∈T(f)v∈Ts(u)Prec(v),fork∈Fn2.
Theproofsofthesepropositionscouldbefoundthroughhttps://eprint.
iacr.
org/2018/447.
Wecanalsosearchdistinguishersbytermsetsonly.
Ifthereexistsau∈Fn2satisfyingSucc(u)T(Eri)=,thenar-rounddistinguisherwhoseinputsetisPrec(u)isfound.
However,thetimeandmemorycomplexitieswillbeveryhigh.
Thus,wetookadvantageofthemeet-in-the-middletechniquesothatthetermsetandtheparitysetcouldbecombinedtoreducetimeandmemorycomplexities.
Inordertondadistinguisher,weneedtocom-pareT(Er2i)withU(Er1(X))andverifywhetherT(Er2i)U(Er1(X)).
Ourdistinguishersearchalgorithmconsistsofvesteps,whichcanbede-scribedasfollows.
XieXF,etal.
SciChinaInfSciMarch2020Vol.
63139111:3Step1.
Choosethepropagationroundnum-bersr1andr2fortheparitysetandthetermsetrespectively,wherer1+r2=r.
Step2.
ChooseaninputsetX.
Step3.
CalculatetheparitysetU(Er1(X)).
Step4.
CalculatethetermsetsT(Er2i)for1in.
Step5.
CompareU(Er1(X))withT(Er2i)for1in.
IfU(Er1(X))T(Er2i),thenthei-thoutputbitinr-roundencryptionisbalanced.
Ifnoneofsuchintersectionsisempty,thenchooseanotherXandgotoStep2.
Wealsoproposesomenoveltechniquestomakeouralgorithmmoreecient.
Sizereduceoperation.
ForthetermsetT(Eri(x)),thesizereduceoperationRtremovesalltheelementsv∈T(Eri(x))suchthatthereisanelementv′∈T(Eri(x))withv′v.
Asforaparityset,theoperationRuremovesalltheelementsu∈U(Er1(X))suchthatthereisanelementu′∈U(Er1(X))withuu′.
ItcanbededucedfromProposition1thatthecom-parisonresultofT(Eri(x))andU(Er1(X))isthesameasthecomparisonresultofRt(T(Eri(x)))andRu(U(Er1(X))).
Observation1.
ThePRESENTsuperS-boxescanworkindependentlyinthe2-roundencryption.
Reducinglook-uptable.
BasedonObserva-tion1,wecaneasilyconstructa2-roundpropaga-tiontableforthesuperS-boxbycalculatingRuU(S(P(S(X))))forallpossibleinputs,whereSisapermutationofF4n2consistingoffourPRESENTS-boxesS(x1,x2,x3,x4)=(S(x1),S(x2),S(x3),S(x4)).
Multiplecomparison.
Thistechniqueat-temptstoremovethetermsthathavenomultipleinU;ifnotermisdivisiblebyavectorinU,thenitisclearthattheoutputbitisbalanced.
Wetriedtojudgesuchdivisibilityintermsofdegreeorderandalphabetorder.
Forthedetailsofthistech-nique,refertohttps://eprint.
iacr.
org/2018/447.
Toillustrateourtechniques,weapplyouralgo-rithmtothePRESENTdistinguishersearch.
Observation2.
ThecubictermsintheANFsofthesecondandfourthcoordinatesofthePRESENTS-box(sayS2andS4)arethesame[7].
Asaresult,thexorofthesetwocoordinatesS2S4=1x1x2x3x2x4x3x4hasonlydegree2.
Moreover,everyterminS2S4hasamultipleinS2andS4respectively.
Hence,S2S4maybebalancedevenifS2andS4areunbalanced.
Wetriedtond10-roundPRESENTdistin-guishersrst,buttheresultoftherightmostout-putbitisunbalancedforalltheinputsetswithdimension63.
ItseemsthattheANFofthisout-putbitisthesimplestamong64outputbits,andtherefore,ourresultsshowthatthePRESENTprobablyhasno10-roundintegraldistinguishersbyonlyusingthedivisionproperty.
Then,wefo-cusonthe9-roundPRESENT,andndadistin-guisherwith22balancedoutputbits.
Input:(aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaac),Output:b3b3bb2b2bb1b1bbbbbbbbbbbbbbbbb),where"c"meansaconstantbit,"a"meansanac-tivebit,""meansanunknownbit,and"b"meansabalancedbit.
Inaddition,thepresenceofbitswiththesamenotationbimeanstheiradditionisbalanced.
Conclusion.
Inthisstudy,weproposedacon-ceptcalledthetermsettopropagateinformationoftheANF.
Withtermsets,weimprovedthedis-tinguishersearchmethodbasedontheparitysetintermsofbothmemoryandtimecomplexities.
Fromtherelationbetweentheparitysetandthebit-baseddivisionproperty,itwasfoundthatthetermsetcouldalsobeappliedtoimprovethedis-tinguishersearchmethodbasedonthebit-baseddivisionproperty.
AcknowledgementsThisworkwassupportedbyNa-tionalNaturalScienceFoundationofChina(GrantNo.
61672533).
References1TodoY.
Structuralevaluationbygeneralizedintegralproperty.
LectNotesComputSci,2015,9056:287–3142TodoY.
IntegralcryptanalysisonfullMISTY1.
JCryptol,2017,30:920–9593TodoY,MoriiM.
Bit-baseddivisionpropertyandap-plicationtosimonfamily.
LectNotesComputSci,2016,9783:357–3774SunL,WangW,WangMQ.
Automaticsearchofbit-baseddivisionpropertyforARXciphersandword-baseddivisionproperty.
LectNotesComputSci,2017,10624:128–1575XiangZJ,ZhangWT,BaoZZ,etal.
ApplyingMILPmethodtosearchingintegraldistinguishersbasedondivisionpropertyfor6lightweightblockciphers.
LectNotesComputSci,2016,10031:648–6786BouraC,CanteautA.
Anotherviewofthedivisionproperty.
LectNotesComputSci,2016,9814:654–6827BogdanovA,KnudsenLR,LeanderG,etal.
PRESENT:anultra-lightweightblockcipher.
LectNotesComputSci,2007,4727:450–466

Sharktech云服务器35折年付33美元起,2G内存/40G硬盘/4TB流量/多机房可选

Sharktech又称SK或者鲨鱼机房,是一家主打高防产品的国外商家,成立于2003年,提供的产品包括独立服务器租用、VPS云服务器等,自营机房在美国洛杉矶、丹佛、芝加哥和荷兰阿姆斯特丹等。之前我们经常分享商家提供的独立服务器产品,近期主机商针对云虚拟服务器(CVS)提供优惠码,优惠后XS套餐年付最低仅33.39美元起,支持使用支付宝、PayPal、信用卡等付款方式。下面以XS套餐为例,分享产品配...

香港云服务器 1核 256M 19.9元/月 Mineserver Ltd

Mineserver(ASN142586|UK CompanyNumber 1351696),已经成立一年半。主营香港日本机房的VPS、物理服务器业务。Telegram群组: @mineserver1 | Discord群组: https://discord.gg/MTB8ww9GEA7折循环优惠:JP30(JPCN2宣布产品可以使用)8折循环优惠:CMI20(仅1024M以上套餐可以使用)9折循...

RAKsmart新年钜惠:E3服务器秒杀$30/月起,新上韩国服务器,香港/日本/美国站群服务器,VPS月付$1.99起,GPU服务器,高防服务器_vps香港

RAKsmart发布了新年钜惠活动,即日起到2月28日,商家每天推出限量服务器秒杀,美国服务器每月30美元起,新上了韩国服务器、GPU服务器、香港/日本/美国常规+站群服务器、1-10Gbps不限流量大带宽服务器等大量库存;VPS主机全场提供7折优惠码,同时针对部分特惠套餐无码直购每月仅1.99美元,支持使用PayPal或者支付宝等方式付款,有中英文网页及客服支持。爆款秒杀10台/天可选精品网/大...

63aaa.com为你推荐
金评媒朱江请问朱江恺撒堡KX系列的钢琴怎么样?梦之队官网梦之队是哪个国家的?陈嘉垣马德钟狼吻案事件是怎么回事陈嘉垣大家觉得陈嘉桓漂亮还是钟嘉欣漂亮?www.kk4kk.com猪猪影院www.mlzz.com 最新电影收费吗?郭泊雄郭佰雄最后一次出现是什么时候?www.idanmu.com新开奇迹SF|再创发布网|奇迹SF|奇迹mu|网通奇迹|电信奇迹|www.ijinshan.com金山毒霸的网站是多少www.147qqqcom求女人能满足我的…woshiheida这个左下角水印woshiheida的gif出处在哪呢?急!!!!!
便宜虚拟主机 美国加州vps 工信部域名备案系统 中国万网虚拟主机 中国域名网 免费申请网页 kvmla 老鹰主机 java主机 云主机51web 卡巴斯基永久免费版 合肥鹏博士 赞助 流量计费 1元域名 上海电信测速网站 免费asp空间 个人免费邮箱 阿里云邮箱登陆地址 美国迈阿密 更多