Integral cryptanalysis on two block ciphers Pyjamask and uBlock

• Published in: IET information security Vol. 14; no. 5; pp. 572 - 579
• Main Authors: Tian, Wenqiang, Hu, Bin
• Format: Journal Article
• Language: English
• Published: The Institution of Engineering and Technology 01.09.2020
• Subjects: block cipher; computational complexity; cryptography; integer programming; integral cryptanalysis; integral distinguishers; key‐recovery attacks; linear programming; MILP‐aided division property; partial sums technique; Pyjamask‐128; Pyjamask‐96; Research Article; search problems; S‐box; uBlock‐128; uBlock‐256; block cipher; integer programming; partial sums technique; MILP-aided division property; cryptography; linear programming; integral cryptanalysis; uBlock-256; uBlock-128; Pyjamask-128; S-box; Pyjamask-96; key-recovery attacks; integral distinguishers; search problems; computational complexity
• ISSN: 1751-8709; 1751-8717
• DOI: 10.1049/iet-ifs.2019.0624

The integral cryptanalysis is a powerful cryptanalytic technique for the security evaluation of block cipher. However, when using the MILP-aided division property to search the integral distinguishers, many candidates of initial division properties need to be tested, so that the computations are unbearable in practice. This study takes advantage of the division property propagation of S-box to improve the optimal integral distinguisher searching algorithm, and further reduce its time complexity. Whereafter, the improved algorithm is used to give 8- and 9-round integral distinguishers of uBlock-128 and uBlock-256, and 10- and 9-round integral distinguishers of Pyjamask-96 and Pyjamask-128. On this basis, utilising the partial sums technique, the authors perform 9- and 11-round key-recovery attacks on uBlock-128 and Pyjamask-96, respectively. The data complexities are $2^{124}$2124 and $2^{93}$293, and the time complexities are less than $2^{124.9}$2124.9 times of 9-round uBlock-128 encryption and $2^{93.8}$293.8 times of 11-round Pyjamask-96 encryption. The results given in this study are the best integral attacks available of the two ciphers presently.