Abstract In truncated differential cryptanalysis of symmetric primitives, a generalized framework is to search a distinguisher concerning part of output differences, like truncated differential distribution (TDD) on certain bits (e.g. a nibble) first, and then append several rounds before and after it to recover the secret key. The logarithmic likelihood ratio statistic with respect to the TDD is usually used to distinguish guessed key bits. In this paper, we study how to improve the effect of truncated differential cryptanalysis by considering key schedules of the attacked ciphers. It turns out that for a cipher with a simple key schedule, certain guessed subkey bits may reveal information of the master key, which will help build a stronger TDD distinguisher and reduce the key recovery complexity or attack more rounds. As a result, we explore heuristic techniques to search key-recovery-friendly TDDs and construct automatic search models based on MILP. The refined methods are applied to two recent designs of symmetric primitives, WARP and Orthros, together with peculiarities of their structures as well. For WARP, after making two observations on relations between certain differences with key bits, we propose an algorithm that can find TDDs with low complexities and having potentialities to cover more rounds. Consequently, we launch key recovery attacks on 24 to 27 rounds of WARP. When it comes to Orthros, we present a two-step search algorithm to balance the number of guessed key bits and TDDs, obtaining a key recovery attack on a 7-round variant of it in the weak-key setting. Finally, we perform several verification experiments on round-reduced versions of WARP and Orthros, and the experimental results are consistent with the theoretical distributions and the analysis of generalized key recovery attack framework.

In this paper, inspired by the work of Beyne and Rijmen at CRYPTO 2022, we explore the accurate probability ofd-differential in the fixed-key model. The theoretical foundations of our method are based on a special matrix - quasi-d-differential transition matrix, which is a natural extension of the quasidifferential transition matrix. The role of quasi-d-differential transition matrices in polytopic cryptananlysis is analogous to that of correlation matrices in linear cryptanalysis. Therefore, the fixed-key probability of ad-differential can be exactly expressed as the sum of the correlations of its quasi-d-differential trails. Then we revisit the boomerang attack from a perspective of 3-differential. Different from previous works, the probability of a boomerang distinguisher can be exactly expressed as the sum of the correlations of its quasi-3-differential trails without any assumptions in our work. In order to illustrate our theory, we apply it to the lightweight block cipher GIFT. It is interesting to find the probability of every optimal 3-differential characteristic of an existing 2-round boomerang is zero, which can be seen as an evidence that the security of block ciphers adopting half-round key XOR might be overestimated previously to some extent in differential-like attacks.

Abstract Differential-linear cryptanalysis, as the combination of differential and linear cryptanalysis, is an efficient way to attack many kinds of ciphers. Recently, various refinements to this cryptanalytic technique have been proposed, especially with good effects on ARX ciphers. In the current framework of a differential-linear attack, a cipher $E$ is often divided into three parts: a differential part $E_1$, a linear part $E_2$ and a connective part $E_m$. It is a challenging problem to deal with the connective part when building a differential-linear distinguisher, and for ARX ciphers, estimating the correlation of $ E_m $ experimentally under given input difference $\Delta _m$ and output linear mask $\Gamma _m$ is the main approach so far. In this paper, we discuss the effects of $ \Delta _{m} $ and $ \Gamma _{m} $ on the correlation of $ E_m $ for the first time. As a result, we propose a new strategy to find $\Delta _m$ and $\Gamma _m$ to build differential-linear distinguishers with high correlations for ARX ciphers based on algebraic equations derived from their round functions. For the key recovery parts of differential-linear attacks, we also find a new partitioning technique which will reduce the time complexity. Based on our new methods, we improve the differential-linear attack on 7-round Chaskey.

Abstract In this paper, we greatly increase the number of impossible differentials for SIMON and SIMECK by eliminating the 1-bit constraint in input/output difference, which is the precondition to ameliorate the complexity of attacks. We propose an algorithm which can greatly reduce the searching complexity to find such trails efficiently since the search space exponentially expands to find impossible differentials with multiple active bits. There is another situation leading to the contradiction in impossible differentials except for miss-in-the-middle. We show how the contradiction happens and conclude the precondition of it defined as miss-from-the-middle. It makes our results more comprehensive by applying these two approach simultaneously. This paper gives for the first time impossible differential characteristics with multiple active bits for SIMON and SIMECK, leading to a great increase in the number. The results can be verified not only by covering the state-of-art, but also by the MILP model.

This paper contributes to increase our knowledge on generalized bent functions (including generalized bent Boolean functions and generalized $p$ -ary bent functions with odd prime $p$ ) by bringing new results on their characterization and construction in arbitrary characteristic. More specifically, we first investigate relations between generalized bent functions and bent functions by the decomposition of generalized bent functions. This enables us to completely characterize generalized bent functions and $\mathbb Z_{p^{k}}$ -bent functions by some affine space associated with the generalized bent functions. We also present the relationship between generalized bent Boolean functions with an odd number of variables and generalized bent Boolean functions with an even number of variables. Based on the well-known Maiorana-McFarland class of Boolean functions, we present some infinite classes of generalized bent Boolean functions. In addition, we introduce a class of generalized hyperbent functions that can be seen as generalized Dillon's $PS$ functions. Finally, we solve an open problem related to the description of the dual function of a weakly regular generalized bent Boolean function with an odd number of variables via the Walsh-Hadamard transform of their component functions, and we generalize these results to the case of odd prime.

We introduce and study dual functions of generalized Boolean bent functions over ℤ4, i.e., functions from F2-vector spaces to ℤ4whose Fourier transforms have constant magnitudes. For a special class of generalized Boolean bent functions with even number of variables constructed from a class of quadratic binary bent functions in polynomial forms proposed by the first author, we explicitly determine their dual functions by explicitly determining duals of these binary bent functions.

In this paper, we investigate on constructing cryptographically significant Boolean functions with n variables based on decompositions of the multiplicative group of the finite field F2nof the form F2n* = U × V, where U and V are cyclic subgroups of F2n* satisfying (|U|, |V|) = 1. For positive integers s, m and n = 2sm, we obtain classes of unbalanced functions with optimal algebraic immunity in the cases |U| = 2m+ 1, |V| = (2n-1)/(2m+1) and |U| = 2m-1, |V| = (2n-1)/(2m-1), respectively, where in the latter case the optimal algebraic immunity is based on correctness of the Tu-Deng conjecture. Functions belonging to both classes can be modified to be balanced ones with (potentially) optimal algebraic immunity and optimal algebraic degree, and computer experiments show that they also have high nonlinearity and good immunity against fast algebraic attacks. As by-products, variants of the Tu-Deng conjecture and combinatorial results on binary strings in analogy to it are also obtained.

We propose new classes of quadratic bent functions in polynomial forms, coefficients of which are from extension fields of F2. Bentness of these functions is based on certain linearized permutation polynomials over finite fields of even characteristic, whose permutation properties are confirmed by virtue of arithmetics in skew-polynomial rings. This is the first time skew-polynomials over finite fields are used in studying quadratic bent functions.

We propose a general approach to construct cryptographic significant Boolean functions of (r + 1)m variables based on the additive decomposition F2rm× F2mof the finite field F2(r+1)m, where r ≥ 1 is odd and m ≥ 3. A class of unbalanced functions is constructed first via this approach, which coincides with a variant of the unbalanced class of generalized Tu-Deng functions in the case r = 1. Functions belonging to this class have high algebraic degree, but their algebraic immunity does not exceed m, which is impossible to be optimal when r > 1. By modifying these unbalanced functions, we obtain a class of balanced functions which have optimal algebraic degree and high nonlinearity (shown by a lower bound we prove). These functions have optimal algebraic immunity provided a combinatorial conjecture on binary strings which generalizes the Tu-Deng conjecture is true. Computer investigations show that, at least for small values of number of variables, functions from this class also behave well against fast algebraic attacks.