![](https://csdnimg.cn/release/download_crawler_static/15543132/bg5.jpg)
Differential cryptanalysis of PRESENT-like cipher 387
cipher in a linear-style. To cipher Maya, their attack can recover the secret S-boxes in versions
up to 16-rounds with 2
38
data complexity and 2
38
time complexity successfully. The correct
S-boxes were usually found in less than one week on a standard PC. In order to be able to
extrapolate the attack complexity for a large number of rounds, they described a theoretical
model. The model suggests that they can break up to 28-round before data complexity reaches
the boundary of 2
64
available plaintexts.
The Borghoff’s slender-set differential attack mainly divides into two parts: data collection
phase and S-box recovery phase. However, the attack presented in [ 10,11] can be improved in
two ways. First, the data collection phase can get more information about the secret S-boxes
with a more efficient method. Second, the attack in [10,11] just only checked whether the
candidate slender-sets are correct or not by using some filtering methods. In other words, in
case of an inconsistency during the checking, their attack will terminate. Actually, in S-box
recovery phase, we can swap the elements in the incorrect sets properly to construct the
correct slender-sets. Furthermore, how can we recover the secret key of the cipher with public
S-boxes with lower data and time complexity? This paper studies an improved slender-set
differential cryptanalysis of PRESENT-like cipher.
Our Results Our contributions are twofold. First, we investigate two different attacks on
PRESENT-like cipher with secret S-boxes and public S-boxes. For PRESENT-like cipher
with secret S-boxes, we introduce two new cryptanalytic techniques, and use them to recover
the secret S-boxes more efficiently. Our first new idea is that we present a new method of
data collection based on the method of optimal distinguisher for collecting information effi-
ciently. This method could make efficient use of all the differential information that comes
from the active S-boxes synthetically, which can reduce data and time complexity. Another
new technique is that we propose a method of constructing the entire valid slender-sets
by pruning search algorithm instead of checking correctness of slender-sets in the S-box
recovery phase. In particular, we implemented a successful attack on the cipher Maya. In
our experiments, the correct S-boxes can be recovered with 2
26
data complexity and 2
22.4
time complexity at a success rate of 100 % based on 200 independent samples. Second, for
PRESENT-like cipher with public S-boxes, we develop a new method to recover the secret
key with lower data and time complexity. Our starting point is to study the differences of
information leakage for correct key and wrong key. A new distinguisher for making a dis-
tinction between the correct key and wrong key is proposed. In particular, we apply our
attack to PRESENT and PRINT
CIPHER
. To the 12-round PRESENT, the experiments show
that we can recover the entire 80-bit secret key with 2
34.9
data and 2
38.9
time complex-
ity. To the 22-round PRINT
CIPHER
, experiments show that we can recover the entire 80-bit
secret key with 2
37.5
data complexity and 2
41.5
time complexity. The experiments suggest
that 18-round PRESENT-80 could be break with approximately 2
59
data complexity and 2
63
time complexity, and at most 27 rounds PRINT
CIPHER
-48 can be broken with 2
48
plaintexts.
Our attack is the best known differential result against PRESENT and PRINT
CIPHER
in prac-
tice. These methods can be used to most cipher where the linear layer is bit-wise permutation.
Related work There are lots of design and analysis on ciphers with secret S-boxes. In 1994,
Gilbert and Chauvaud presented a differential attack on the cipher Khufu which used secret
S-boxes [15]. In 1996, Vaudenay provided cryptanalysis of reduced-round variants of Blow-
fish where the S-boxes were randomly generated from the private key [26]. In 2001, Biryukov
and Shamir studied the security of iterated ciphers where the substitutions and permutations
are all secret and key-dependent [3,4]. In 2009, Borghoff researched on the cipher C2, which
has a secret S-box [9]. In 2011, Szaban and Seredynski proposed a methodology to design
dynamic cellular automata (CA)-based S-boxes [25]. Stoianov presented one approach for
123