Extended c-differential distinguishers of full 9 and reduced-round Kuznyechik cipher
Fuente:
arXiv
Enregistré dans:
| Auteurs principaux: | , , |
|---|---|
| Format: | Preprint |
| Publié: |
2025
|
| Sujets: | |
| Accès en ligne: | |
| Tags: |
Ajouter un tag
Pas de tags, Soyez le premier à ajouter un tag!
|
| _version_ | 1866912916802895872 |
|---|---|
| author | Stanica, Pantelimon Dutta, Ranit Mandal, Bimal |
| author_facet | Stanica, Pantelimon Dutta, Ranit Mandal, Bimal |
| contents | This paper introduces {\em truncated inner $c$-differential cryptanalysis}, a technique that enables the practical application of $c$-differential uniformity to block ciphers. While Ellingsen et al. (IEEE Trans. Inf. Theory, 2020) established the notion of $c$-differential uniformity by analyzing the equation $F(x\oplus a) \oplus cF(x) = b$, a key challenge remained: the outer multiplication by $c$ disrupts the structural properties essential for block cipher analysis, particularly key addition. We address this challenge by developing an \emph{inner} $c$-differential approach where multiplication by $c$ affects the input: $(F(cx\oplus a), F(x))$, thereby returning to the original idea of Borisov et al. (FSE, 2002). We prove that the inner $c$-differential uniformity of a function $F$ equals the outer $c$-differential uniformity of $F^{-1}$, establishing a duality between the two notions. This modification preserves cipher structure while enabling practical cryptanalytic applications.
We apply our methodology to Kuznyechik (GOST R 34.12-2015) without initial key whitening. For reduced rounds, we construct explicit $c$-differential trails achieving probability $2^{-84.0}$ for two rounds and $2^{-169.7}$ for three rounds, representing improvements of 5.2 and 4.6 bits respectively over the best classical differential trails. For the full 9-round cipher, we develop a statistical truncated $c$-differential distinguisher. Through computational analysis involving millions of differential pairs, we identify configurations with bias ratios reaching $1.7\times$ and corrected p-values as low as $1.85 \times 10^{-3}$. The distinguisher requires data complexity $2^{33}$ chosen plaintext pairs, time complexity $2^{34}$, and memory complexity $2^{16}$. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2507_02181 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Extended c-differential distinguishers of full 9 and reduced-round Kuznyechik cipher Stanica, Pantelimon Dutta, Ranit Mandal, Bimal Cryptography and Security Information Theory 94A60, 11T71, 12E20, 68P25, 62P99 This paper introduces {\em truncated inner $c$-differential cryptanalysis}, a technique that enables the practical application of $c$-differential uniformity to block ciphers. While Ellingsen et al. (IEEE Trans. Inf. Theory, 2020) established the notion of $c$-differential uniformity by analyzing the equation $F(x\oplus a) \oplus cF(x) = b$, a key challenge remained: the outer multiplication by $c$ disrupts the structural properties essential for block cipher analysis, particularly key addition. We address this challenge by developing an \emph{inner} $c$-differential approach where multiplication by $c$ affects the input: $(F(cx\oplus a), F(x))$, thereby returning to the original idea of Borisov et al. (FSE, 2002). We prove that the inner $c$-differential uniformity of a function $F$ equals the outer $c$-differential uniformity of $F^{-1}$, establishing a duality between the two notions. This modification preserves cipher structure while enabling practical cryptanalytic applications. We apply our methodology to Kuznyechik (GOST R 34.12-2015) without initial key whitening. For reduced rounds, we construct explicit $c$-differential trails achieving probability $2^{-84.0}$ for two rounds and $2^{-169.7}$ for three rounds, representing improvements of 5.2 and 4.6 bits respectively over the best classical differential trails. For the full 9-round cipher, we develop a statistical truncated $c$-differential distinguisher. Through computational analysis involving millions of differential pairs, we identify configurations with bias ratios reaching $1.7\times$ and corrected p-values as low as $1.85 \times 10^{-3}$. The distinguisher requires data complexity $2^{33}$ chosen plaintext pairs, time complexity $2^{34}$, and memory complexity $2^{16}$. |
| title | Extended c-differential distinguishers of full 9 and reduced-round Kuznyechik cipher |
| topic | Cryptography and Security Information Theory 94A60, 11T71, 12E20, 68P25, 62P99 |
| url | https://arxiv.org/abs/2507.02181 |