Reconstructing an S-box from its difference distribution table

Orr Dunkelman, Senyang Huang

Research output: Contribution to journalArticlepeer-review

Abstract

In this paper we study the problem of recovering a secret S-box from its difference distribution table (DDT). While being an interesting theoretical problem on its own, the ability to recover the S-box from the DDT of a secret S-box can be used in cryptanalytic attacks where the attacker can obtain the DDT (e.g., in Bar-On et al.’s attack on GOST), in supporting theoretical analysis of the properties of difference distribution tables (e.g., in Boura et al.’s work), or in some analysis of S-boxes with unknown design criteria (e.g., in Biryukov and Perrin’s analysis). We show that using the well established relation between the DDT and the linear approximation table (LAT), one can devise an algorithm different from the straightforward guess-and-determine (GD) algorithm proposed by Boura et al. Moreover, we show how to exploit this relation, and embed the knowledge obtained from it in the GD algorithm. We tested our new algorithm on random S-boxes of different sizes, and for random 14-bit bijective S-boxes, our results outperform the GD attack by several orders of magnitude.

Original languageEnglish
Pages (from-to)193-217
Number of pages25
JournalIACR Transactions on Symmetric Cryptology
Volume2019
Issue number2
DOIs
StatePublished - 11 Jun 2019

Bibliographical note

Funding Information:
The research in this paper supported in part by the Israel Ministry of Science and Technology, the Center for Cyber, Law, and Policy in conjunction with the Israel National Cyber Bureau in the Prime Minister’s Office and by the Israeli Science Foundation through grant No. 880/18. Senyang Huang was supported in part by the Israeli Science Foundation through grant No. 573/16.

Publisher Copyright:
© 2019, Ruhr-Universitat Bochum. All rights reserved.

Keywords

  • DDT
  • LAT
  • S-box
  • The sign determination problem

ASJC Scopus subject areas

  • Software
  • Computer Science Applications
  • Computational Mathematics
  • Applied Mathematics

Fingerprint

Dive into the research topics of 'Reconstructing an S-box from its difference distribution table'. Together they form a unique fingerprint.

Cite this