Revisiting the Extension of Matsui’s Algorithm 1 to Linear Hulls: Application to TinyJAMBU

• Published in: IACR Transactions on Symmetric Cryptology Vol. 2022; no. 2; pp. 161 - 200
• Main Authors: Li, Muzhou, Mouha, Nicky, Sun, Ling, Wang, Meiqin
• Format: Journal Article
• Language: English
• Published: Ruhr-Universität Bochum 10.06.2022
• Subjects: Linear Hull; Matsui’s Algorithm 1; TinyJAMBU
• ISSN: 2519-173X; 2519-173X
• DOI: 10.46586/tosc.v2022.i2.161-200

At EUROCRYPT ’93, Matsui introduced linear cryptanalysis. Both Matsui’s Algorithm 1 and 2 use a linear approximation involving certain state bits. Algorithm 2 requires partial encryptions or decryptions to obtain these state bits after guessing extra key bits. For ciphers where only part of the state can be obtained, like some stream ciphers and authenticated encryption schemes, Algorithm 2 will not work efficiently since it is hard to implement partial encryptions or decryptions. In this case, Algorithm 1 is a good choice since it only involves these state bits, and one bit of key information can be recovered using a single linear approximation trail. However, when there are several strong trails containing the same state bits, known as the linear hull effect, recovering key bits with Algorithm 1 is infeasible. To overcome this, Röck and Nyberg extended Matsui’s Algorithm 1 to linear hulls. However, Röck and Nyberg found that their theoretical estimates are quite pessimistic for low success probabilities and too optimistic for high success probabilities. To deal with this, we construct new statistical models where the theoretical success probabilities are in a good accordance with experimental ones, so that we provide the first accurate analysis of the extension of Matsui’s Algorithm 1 to linear hulls. To illustrate the usefulness of our new models, we apply them to one of the ten finalists of the NIST Lightweight Cryptography (LWC) Standardization project: TinyJAMBU. We provide the first cryptanalysis under the nonce-respecting setting on the full TinyJAMBU v1 and the round-reduced TinyJAMBU v2, where partial key bits are recovered. Our results do not violate the security claims made by the designers.