At EUROCRYPT 2015, Dinur et al. proposed cube-attack-like cryptanalysis on reduced-round Keccak. The process of recovering the key is divided into the preprocessing and the online phase. The preprocessing phase is setting a look-up table by computing the cube sum of involved key bits. The online phase is computing the cube sum of auxiliary variables and recording the matching values in the table as candidates. Auxiliary variables help balance the complexity of the two phases by reducing the number of involved key bits. Following this idea, a series of works has been presented, mainly focusing on a better selection of cube variables, auxiliary variables and involved key bits. We provide new methods to select auxiliary variables and involved key bits. The first step is to get a precise algebraic expression of each bit after one round permutation. Then, combined with the corresponding constraints on these variables, we can construct a Mixed-integer Linear Programming (MILP) model. Secondly, unlike the previous idea that auxiliary variables are chosen to satisfy the CP-kernel property just for the consideration of controlling diffusion, we cancel this restriction and adopt a more skilled selection of auxiliary variables. Based on these two steps, we improve the cube-attack-like cryptanalysis in terms of the complexity.

In this study, the authors settle the feasibility of mixed integer linear programming (MILP)‐aided bit‐based division property for ciphers with non‐bit‐permutation linear layers. First, they transform the complicated linear layers to their primitive representations. Then, the original Copy and exclusive OR models are generalised, and these models are exploited to depict the primitive representations. Accord‐ ingly, the MILP‐aided bit‐based division property can be applied to much more primitives with complicated linear layers. As an illus‐ tration, they rst evaluate the bit‐based division properties of some word‐oriented block ciphers. For Midori64, they obtain a 7‐round integral distinguisher, which achieves one more round than the previous results. At the same time, the data requirements of some existing distinguishers are also reduced. They decrease the data complexities of 4‐round and 5‐round distinguishers for LED and Joltik‐BC by half. Then, the bit‐based division properties of some bit‐oriented ciphers such as Serpent and Noekeon are considered. The data complexities of their distinguishers for short rounds are reduced. Besides, they evaluate the bit‐based division properties of the internal permutations in some hash functions. An 18‐round zero‐sum distinguisher for SPONGENT‐88 is proposed, which achieves four more rounds than the previous ones. Some integral distinguishers for PHOTON permutations are improved.

SM4 is a Chinese commercial block cipher standard used for wireless communication in China. In this paper, we use the partial linear approximation table of S-box to search for three rounds of iterative linear approximations of SM4, based on which the linear approximation for 20-round SM4 has been constructed. However, the best previous identified linear approximation only covers 19 rounds. At the same time, a linear approximation for 19-round SM4 is obtained, which is better than the known results. Furthermore, we show the key recovery attack on 24-round SM4 which is the best attack according to the number of rounds.