Results of Linear Cryptanalysis Using Linear Sieve Methods

Yukiyasu TSUNOO; Hiroki NAKASHIMA; Hiroyasu KUBO; Teruo SAITO; Takeshi KAWABATA

doi:10.1587/transfun.E92.A.1347

Results of Linear Cryptanalysis Using Linear Sieve Methods

Yukiyasu TSUNOO, Hiroki NAKASHIMA, Hiroyasu KUBO, Teruo SAITO, Takeshi KAWABATA

Full Text Views

0

Cite this

Summary :

Linear cryptanalysis using sieve methods is a technique proposed by Takeda et al. in 1998 as an attack capable of breaking ciphers with smaller amounts of data than linear cryptanalysis (LC) by using data that satisfies linear sieve conditions. This paper shows that when considering the amount of data required for cryptanalysis in Takeda et al.'s proposed sieved linear cryptanalysis (S-LC), it is necessary to take into account the independence of keys relating to the linear mask (Linear key) and keys relating to the linear sieve mask (Sieve key) in rounds that are affected by these keys. If p is the probability that the linear approximate expression holds and p^* is the probability after applying the linear sieve, then it has been shown that when the Linear keys are independent of the Sieve keys, then it is necessary to select the linear mask and linear sieve mask so that a larger value of p^*-p is obtained. It is also shown that the amount of data needed for S-LC cannot be reduced below the amount of data needed for LC when the Linear key and Sieve key are not independent. In fixed sieve linear cryptanalysis, it is shown that the amount of data needed for cryptanalysis cannot be reduced regardless of the independence of the Linear key and Sieve key.

Publication: IEICE TRANSACTIONS on Fundamentals Vol.E92-A No.5 pp.1347-1355

Publication Date: 2009/05/01

Publicized

Online ISSN: 1745-1337

DOI: 10.1587/transfun.E92.A.1347

Type of Manuscript: PAPER

Category: Cryptography and Information Security

Cite this

Copy

Yukiyasu TSUNOO, Hiroki NAKASHIMA, Hiroyasu KUBO, Teruo SAITO, Takeshi KAWABATA, "Results of Linear Cryptanalysis Using Linear Sieve Methods" in IEICE TRANSACTIONS on Fundamentals, vol. E92-A, no. 5, pp. 1347-1355, May 2009, doi: 10.1587/transfun.E92.A.1347.
Abstract: Linear cryptanalysis using sieve methods is a technique proposed by Takeda et al. in 1998 as an attack capable of breaking ciphers with smaller amounts of data than linear cryptanalysis (LC) by using data that satisfies linear sieve conditions. This paper shows that when considering the amount of data required for cryptanalysis in Takeda et al.'s proposed sieved linear cryptanalysis (S-LC), it is necessary to take into account the independence of keys relating to the linear mask (Linear key) and keys relating to the linear sieve mask (Sieve key) in rounds that are affected by these keys. If p is the probability that the linear approximate expression holds and p^* is the probability after applying the linear sieve, then it has been shown that when the Linear keys are independent of the Sieve keys, then it is necessary to select the linear mask and linear sieve mask so that a larger value of p^*-p is obtained. It is also shown that the amount of data needed for S-LC cannot be reduced below the amount of data needed for LC when the Linear key and Sieve key are not independent. In fixed sieve linear cryptanalysis, it is shown that the amount of data needed for cryptanalysis cannot be reduced regardless of the independence of the Linear key and Sieve key.
URL: https://global.ieice.org/en_transactions/fundamentals/10.1587/transfun.E92.A.1347/_p

Copy

@ARTICLE{e92-a_5_1347,
author={Yukiyasu TSUNOO, Hiroki NAKASHIMA, Hiroyasu KUBO, Teruo SAITO, Takeshi KAWABATA, },
journal={IEICE TRANSACTIONS on Fundamentals},
title={Results of Linear Cryptanalysis Using Linear Sieve Methods},
year={2009},
volume={E92-A},
number={5},
pages={1347-1355},
abstract={Linear cryptanalysis using sieve methods is a technique proposed by Takeda et al. in 1998 as an attack capable of breaking ciphers with smaller amounts of data than linear cryptanalysis (LC) by using data that satisfies linear sieve conditions. This paper shows that when considering the amount of data required for cryptanalysis in Takeda et al.'s proposed sieved linear cryptanalysis (S-LC), it is necessary to take into account the independence of keys relating to the linear mask (Linear key) and keys relating to the linear sieve mask (Sieve key) in rounds that are affected by these keys. If p is the probability that the linear approximate expression holds and p^* is the probability after applying the linear sieve, then it has been shown that when the Linear keys are independent of the Sieve keys, then it is necessary to select the linear mask and linear sieve mask so that a larger value of p^*-p is obtained. It is also shown that the amount of data needed for S-LC cannot be reduced below the amount of data needed for LC when the Linear key and Sieve key are not independent. In fixed sieve linear cryptanalysis, it is shown that the amount of data needed for cryptanalysis cannot be reduced regardless of the independence of the Linear key and Sieve key.},
keywords={},
doi={10.1587/transfun.E92.A.1347},
ISSN={1745-1337},
month={May},}

Copy

TY - JOUR
TI - Results of Linear Cryptanalysis Using Linear Sieve Methods
T2 - IEICE TRANSACTIONS on Fundamentals
SP - 1347
EP - 1355
AU - Yukiyasu TSUNOO
AU - Hiroki NAKASHIMA
AU - Hiroyasu KUBO
AU - Teruo SAITO
AU - Takeshi KAWABATA
PY - 2009
DO - 10.1587/transfun.E92.A.1347
JO - IEICE TRANSACTIONS on Fundamentals
SN - 1745-1337
VL - E92-A
IS - 5
JA - IEICE TRANSACTIONS on Fundamentals
Y1 - May 2009
AB - Linear cryptanalysis using sieve methods is a technique proposed by Takeda et al. in 1998 as an attack capable of breaking ciphers with smaller amounts of data than linear cryptanalysis (LC) by using data that satisfies linear sieve conditions. This paper shows that when considering the amount of data required for cryptanalysis in Takeda et al.'s proposed sieved linear cryptanalysis (S-LC), it is necessary to take into account the independence of keys relating to the linear mask (Linear key) and keys relating to the linear sieve mask (Sieve key) in rounds that are affected by these keys. If p is the probability that the linear approximate expression holds and p^* is the probability after applying the linear sieve, then it has been shown that when the Linear keys are independent of the Sieve keys, then it is necessary to select the linear mask and linear sieve mask so that a larger value of p^*-p is obtained. It is also shown that the amount of data needed for S-LC cannot be reduced below the amount of data needed for LC when the Linear key and Sieve key are not independent. In fixed sieve linear cryptanalysis, it is shown that the amount of data needed for cryptanalysis cannot be reduced regardless of the independence of the Linear key and Sieve key.
ER -