English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools annual

Global: Zendy Free Plan

Global: Zendy Tools monthly

Global: Zendy Plus monthly

FOX is a family of block ciphers designed by Junod and Vaudenay in 2004, which is the result of a joint project with the company MediaCrypt AG in Switzerland. Several attacks on reduced FOX have been proposed. In this paper we present an improbable differential cryptanalysis on the reduced-round FOX. By using this method, we present the attacks on 6, 7, and 8-round FOX64 with the time complexity of 276.92, 2141.27, and 2205.85 respectively. Introduction FOX [1], also known as IDEA-NXT, is a family of block ciphers designed by Junod and Vaudenay in 2004. The high level of FOX adopts a modified structure of Lai-Massey Scheme [2], which can be proven to have good pseudorandom properties in the Luby-Rackoff paradigm and decorrelation in hesitance properties. FOX has two version, both have the variable number of rounds which depends on the key size. The first FOX64/k/r has a 64-bit block-size with a variable key length which is a multiple of 8 and up to 256 bits. The second FOX128/k/r uses a 128-bit block-size with the same possible key lengths. The original design suggests these two ciphers should be iterated for 16 rounds. The round function of FOX uses SPS (Substitution-Permutation-Substitution) structure with sub-key addition of those three layers. The key schedule of FOX is very complex, which uses the round function as a compress function to generate sub-keys from the master key. The designers of FOX have analyzed the security of FOX against differential attacks, linear attacks, integral attacks, statistical attacks, slide attacks, interpolation attacks and algebraic attacks [3]. In 2006, Wu et al. made some improvement of integral attack [4]. For FOX64, the time complexity of their improved integral attack on 4, 5, 6, 7 rounds is 2, 2, 2 and 2, respectively. Then, Wu et al. proposed the impossible differential attack on reduced FOX [5]. They presented impossible differential attack could break 5, 6, 7 rounds FOX64 with 2 chosen plaintexts and 2, 2, 2 one-round encryptions respectively. As we known, impossible differential cryptanalysis [6] uses the impossible differential shows that a particular difference can’t occur for the correct key. Therefore, if these differences are satisfied under a trial key, then it cannot be the correct one. Thus, the correct key can be obtained by eliminating all or most of the wrong keys. Recently, Tezcan [7] proved that it is possible to obtain differentials such that the predicted differences occur less frequently for the correct key. This new cryptanalytic technique is called the improbable differential attack and the impossible differential attack is just a special case of it. The power of this method was shown in [7] by constructing the 15-round improbable differential cryptanalysis of CLEFIA. This was the best known attack on CLEFIA. Moreover, in [8], they presented an improbable differential attacks on PRESNET. In this paper, we find 5-round improbable differentials of FOX and use them to attack 6, 7, and 8-round FOX64. 4th International Conference on Mechatronics, Materials, Chemistry and Computer Engineering (ICMMCCE 2015) © 2015. The authors Published by Atlantis Press 2450 Description of FOX64 In FOX64/k/r, the number of round r must satisfy 12  r  255. The key length is k bits, which is a multiple of 8 and no more than 256 bits. Here we give brief descriptions of FOX64, for more details refer to [1]. Round Function f32. The round function f32 consists of three main parts: sigma4 denotes a substitution part; mu4 denotes a diffusion part; and a round key addition part. Let 32 64 32 32 :{0,1} {0,1} {0,1} f   , for a 32-bit input x{0,1} 32 and a 64-bit round key 0 1 || k k k  , 32 0 1 0 ( , ) 4( 4( ( )) ) f x k sigma mu sigma x k k k     . The substitution transformation sigma4: {0,1}{0,1} consists of 4 parallel applications of a non-linear bijective s-box. The linear bijection mu4: [GF(256)] [GF(256)] considers an input (x0, x1, x2, x3) as a vector (x0, x1, x2, x3) over [GF(256)] and multiple it with a MDS matrix to output vector with the same size. The branch number of the MDS matrix is 5. The MDS matrix is defined as follows: 1 1 1 1 1 1 1 1                     Where =1,  is a root of the irreducible polynomial 8 7 6 5 4 3 ( ) 1 m x x x x x x x        . Encryption and Decryption of FOX64. FOX64 is 15-times iteration of round transformation Imor64, followed by the applications of last round transformation called Imid64. The round transformation Imor64 is defined as 32 32 ( || ) ( ( , )) || ( ( , )) L R L L R R L R y y or x f x x k y f x x k      , where || L R x x and || L R y y represent the input and output of Imor64, respectively, k is the round key, ( , ) ( , ) or a b b a b   is a linear orthomorphism. The Imid64 function is a slightly modified version of Imor64, namely the orthomorphism or is replaced by the identity transformation. Moreover, for the Imid64 transformation, bit-wise exclusive OR the two parts of an input is obviously equal to bit-wise exclusive OR the two parts of output. The encrypted result by FOX64 for a 64-bit plaintext P is defined as 1 2 64( 64( ( 64( , ), , ), ) r C Imid Imor Imor P k k k    , where 1 2 , , , r k k k  are round sub-keys. Improbable Differential Attack The improbable differential cryptanalysis was proposed by Tezcan [7]. The attack aims to find a differential with an  input difference and an  output difference so that these differences are observed with probability , c k p for the correct key and with probability , w k p for a wrong key, where , , c k w k p p  . One way of obtaining such differences is to find nontrivial differentials that have  input difference and an output difference other than , or vice versa. Since , c k p is less than , w k p , improbable differential aims to use N plaintext pairs and count the hits that every guessed sub-key gets and expect that the counter for the correct sub-key to be less than a thresholdT . Number of hits a wrong sub-key gets can be seen as a random variable of a binomial distribution with parameters N, , c k p (and a random variable of a binomial distribution with parameters N, , w k p for the correct sub-key). The non-detection error probability nd p denotes the probability of the counter for the correct sub-key to be higher thanT . And the false alarm error

Improbable Differential Attacks on Reduced FOX64