New Search Method for Sbox-Related Impossible Differentials

Abstract

The impossible differential attack is one of the most fundamental tools of cryptanalysis and has been successfully applied to a large variety of block ciphers. In a typical impossible differential attack, the foundation and first step is to construct an impossible differential. Nowadays, two kinds of most commonly used approaches in impossible differential construction are the matrix-based and tool-aided automatic search methods. In this paper, we proposed a new search method combining an early-abort strategy with the guess-and-determine technique to find longer impossible differentials. Compared with the previous matrix-based search methods, ours has taken the details of Sbox into consideration, while compared with the tool-aided methods, ours is independent of a third-party solver and is applicable to ciphers with large (≥8 bits) Sboxes, which could be tough work for tool-aided methods to cover. Therefore, more accurate results could be obtained. To prove the effectiveness of our method, it is applied to CSA and FOX64. For CSA, 23/24/25-round impossible differentials were found for CSA-BC. This improved the longest impossible differential distinguisher so far by 1/2/3 rounds. And 25-round key recovery attacks are performed against CSA-BC and CSA, which are the longest impossible differential attack by now. For FOX64, we proved that an impossible differential for its round function always implies an impossible differential for 4-round FOX64, and new types of impossible differentials were able to be found. Our method has its own advantage in dealing with large Sboxes, and it may be a possible direction to search for Sbox-related impossible differentials.