Automatic Search for Related-Key Differential Trails in SIMON-like Block Ciphers Based on MILP

Abstract

In this paper, we revisit the relationship between the probability of differential trails and the input difference of each round for SIMON-like block ciphers. The key observation is that not only the Hamming weight but also the positions of active bits of the input difference have effect on the probability. Based on this, our contributions are mainly twofold. Firstly, we rebuild the MILP model for SIMON-like block ciphers without quadratic constraints. Accordingly, we give the accurate objective function and reduce its degree to one by adding auxiliary variants to make the model easy to solve. Secondly, we search for optimal differential trails for SIMON and SIMECK based on this model. To the best of our knowledge, this is the first time that related-key differential trails have been obtained. Besides, we not only recover the single-key results in [11], but also obtain impossible differentials through this method.

Appendices

A Proof of Lemma 1

Proof

Let x and $(x \oplus \varDelta x)$ be two inputs of the function f. We have

$$\begin{aligned} \begin{aligned} \varDelta d&= f(x)\oplus f(x\oplus \varDelta x) \\&= (S^{a}(x)\odot S^{b}(x))\oplus (S^{a}(x\oplus \varDelta x)\odot S^{b}(x\oplus \varDelta x))\\&= S^{a}(x)\odot S^{b}(\varDelta x)\oplus S^{a}(\varDelta x)\odot S^{b}(x)\oplus S^{a}(\varDelta x)\odot S^{b}(\varDelta x) \end{aligned}\end{aligned}$$

(4)

Then for any bit $\varDelta d_{i}$ in $\varDelta d$ ($i=0,\cdots ,n-1$), we have

$$\begin{aligned} \varDelta d_{i} = x_{i+a}\odot \varDelta x_{i+b}\oplus \varDelta x_{i+a}\odot x_{i+b} \oplus \varDelta x_{i+a}\odot \varDelta x _{i+b} \end{aligned}$$

(5)

Obviously, only two bits in $\varDelta x$, namely $\varDelta x_{i+a}$ and $\varDelta x_{i+b}$ can affect the value of $\varDelta d_{i}$.

Fix an arbitrary i, assume that $\varDelta d_{k}$ is affected by $\varDelta x_{i}$. First, we have

$$\begin{aligned} \varDelta d_{k} = x_{k+a}\odot \varDelta x_{k+b}\oplus \varDelta x_{k+a}\odot x_{k+b} \oplus \varDelta x_{k+a}\odot \varDelta x _{k+b}, \end{aligned}$$

(6)

from Eq. (5). If $\varDelta d_{k}$ is affected by $\varDelta x_{i}$, then we have

$$\begin{aligned} i \equiv k+a \mod n \end{aligned}$$

(7)

or

$$\begin{aligned} i \equiv k+b \mod n \end{aligned}$$

(8)

Put it in another form, we have

$$\begin{aligned} k \equiv i-a \mod n \end{aligned}$$

(9)

or

$$\begin{aligned} k \equiv i-b \mod n \end{aligned}$$

(10)

So proved that an arbitrary bit $\varDelta x_{i}$ can affect only two bits $\varDelta d_{i-a}$ and $\varDelta d_{i-b}$.

From Eq. (5), we have that

• (1) if $\varDelta x_{i+a}=0, \varDelta x_{i+b}=0$, then $\varDelta d_{i}=0$;

• (2) if $\varDelta x_{i+a}=1, \varDelta x_{i+b}=1$, then $\varDelta d_{i}$ = $(x_{i+a}\oplus x_{i+b})\odot 1 \oplus 1$;

• (3) if $\varDelta x_{i+a} = 1$, $\varDelta x_{i+b} = 0$, then $\varDelta d_{i} = \varDelta x_{i+a} \odot x_{i+b} = x_{i+b}$;

• (4) if $\varDelta x_{i+a} = 0$, $\varDelta x_{i+b} = 1$, then $\varDelta d_{i} = x_{i+a} \odot \varDelta x_{i+b} = x_{i+a}$.

Let $x_i$ denote an arbitrary bit in x. $\varDelta d_k$ is affected by $x_i$, iff. $k \equiv i-a \mod n$ and $\varDelta x_{k+b}=\varDelta x_{i-a+b} = 1$, or $k \equiv i-b \mod n$ and $\varDelta x_{k+a}=\varDelta x_{i-b+a} = 1$.     $\square$

B Proof of Theorem 1

Proof

Let $R_{d}$ be the collection of bits in $\varDelta d$ which are affected by bits in R. From Lemma 1,

$$R_{d}=\{\varDelta d_{i_{0}-a}, \varDelta d_{i_{0}-b}, \varDelta d_{i_{1}-a}, \varDelta d_{i_{1}-b}, \ldots , \varDelta d_{i_{m-1}-a}, \varDelta d_{i_{m-1}-b} \}$$

There may be duplicate elements in the collection $R_d$.

• 1. Since $a \ne b$, then $i_\ell -a \not \equiv i_\ell -b \mod n$, for $\ell = 0,\cdots ,m-1$;

• 2. For $0 \le j \ne k \le m-1$, $i_j -a \not \equiv i_k - a \mod n$, since $i_j \ne i_k$;

• 3. For $0 \le j \ne k \le m-1$, if $i_j -a \equiv i_k - b \mod n$, then $i_j - i_k \equiv a - b \mod n$;

• 4. For $0 \le j \ne k \le m-1$, if $i_j -b \equiv i_k - a \mod n$, then $i_j - i_k \equiv b - a \mod n$;

If there exist $p_1$ pairs of $\{i_j,i_k\}$ such that $|i_j-i_k |\equiv |a-b |\mod n$, we have

$$\begin{aligned} i_j-i_k \equiv a-b \mod n \end{aligned}$$

(11)

or

$$\begin{aligned} i_j-i_k \equiv b-a \mod n \end{aligned}$$

(12)

we claim that Eqs. (11) and (12) cannot hold true simultaneously, otherwise it contradicts with $gcd(n,a-b)=1$. Let $R_d'$ denote the set obtained by removing duplicate elements from the collection $R_d$. Then if there exist $p_1$ pairs of $\{i_j,i_k\}$ such that $|i_j-i_k |\equiv |a-b |\mod n$, $|R_d |- |R_d' |= p_1$.

Now we turn to discuss the relationships amongst bits in $\varDelta d$. First, for $\varDelta d_k \notin R_d'$, we have $\varDelta x_{k+a}=0$ and $\varDelta x_{k+b} = 0$ from Lemma 1; specifically, $\varDelta d_{k}=0$ holds with probability 1, regardless of the values of $x_{k+a}$ and $x_{k+b}$. Thus, we need only to discuss the relationships amongst bits in $R_d'$. For $\varDelta d_k \in R_d'$, it has been proved by Lemma 1 that at least one of $\varDelta x_{k+a}$ and $\varDelta x_{k+b}$ is active. Specifically,

• 1. $\varDelta x_{k+a}=1$, $\varDelta x_{k+b}=0$. In this case, $\varDelta d_{k}=x_{k+b}$. If there exists some other bit $\varDelta d_{k}' \in R_d'$ such that $\varDelta d_{k}'$ is dependent of $\varDelta d_{k}$, then $k' \equiv k+b-a \mod n$, since $\varDelta d_{k+b-a}$ is the only bit which may be affected by $x_{k+b}$ except for $\varDelta d_k$ from Lemma 1.

  $$\begin{aligned} \begin{aligned} \varDelta d_{k+b-a}=&\varDelta x_{k+b}\odot x_{k+2b-a}\oplus x_{k+b}\odot \varDelta x_{k+2b-a}\\&\oplus \varDelta x_{k+b}\odot \varDelta x_{k+2b-a} \end{aligned}\end{aligned}$$

  (13)

  If $\varDelta x_{k+2b-a}\in R$, then $\varDelta d_{k+b-a}=x_{k+b}=\varDelta d_{k}$; otherwise, $\varDelta d_{k+b-a}=0$ holds with probability 1 (independent of $\varDelta d_{k}$).

• 2. $\varDelta x_{k+a}=0$, $\varDelta x_{k+b}=1$. In this case, $\varDelta d_{k}=x_{k+a}$. If there exists some other bit $\varDelta d_{k}' \in R_d'$ such that $\varDelta d_{k}'$ is dependent of $\varDelta d_{k}$, then $k' \equiv k+a-b \mod n$, since $\varDelta d_{k+a-b}$ is the only bit which may be affected by $x_{k+a}$ except for $\varDelta d_k$ from Lemma 1.

  $$\begin{aligned} \begin{aligned} \varDelta d_{k+a-b}=&\varDelta x_{k+a}\odot x_{k+2a-b}\oplus x_{k+a}\odot \varDelta x_{k+2a-b}\\&\oplus \varDelta x_{k+a}\odot \varDelta x_{k+2a-b} \end{aligned}\end{aligned}$$

  (14)

  If $\varDelta x_{k+2a-b}\in R$, then $\varDelta d_{k+a-b}=x_{k+a}=\varDelta d_{k}$; otherwise, $\varDelta d_{k+a-b}=0$ holds with probability 1 (independent of $\varDelta d_{k}$).

• 3. $\varDelta x_{k+a}=1$, $\varDelta x_{k+b}=1$. In this case, $\varDelta d_{k}=(x_{k+a}\oplus x_{k+b})\odot 1\oplus 1$. From Lemma 1, the only other bit which may be affected by $x_{k+a}$ is $\varDelta d_{k+a-b}$. Specifically, the following equation holds if $\varDelta x_{k+2a-b} \in R$.

  $$\begin{aligned} \varDelta d_{k+a-b}=(x_{k+2a-b}\oplus x_{k+a})\odot 1\oplus 1 \end{aligned}$$

  (15)

  From Lemma 1, the only other bit which may be affected by $x_{k+b}$ is $\varDelta d_{k+b-a}$. Specifically, the following equation holds if $\varDelta x_{k+2b-a} \in R$.

  $$\begin{aligned} \varDelta d_{k+b-a}=(x_{k+b}\oplus x_{k+2b-a})\odot 1\oplus 1 \end{aligned}$$

  (16)

  It is obvious that $\varDelta d_k$ can be dependent of other bit(s) in $R_d'$, only in the case that $\varDelta x_{k+2a-b},\varDelta x_{k+2b-a} \in R$. However, since $\varDelta d_{k+b-a}$ and $\varDelta d_{k+a-b}$ introduce the new bits (variants) of $x_{k+2a-b}$ and $x_{k+2b-a}$ respectively, we should involve more elements in $R_d'$ to reduce the effects of $x_{k+2a-b}$ and $x_{k+2b-a}$. Again from Lemma 1, the only other bit affected by $x_{k+2a-b}$ ($x_{k+2b-a}$) is $\varDelta d_{k+2a-2b} = (x_{k+3a-2b}\oplus x_{k+2a-b})\odot 1\oplus 1$ ($\varDelta d_{k+2b-2a} =(x_{k+2b-a}\oplus x_{k+3b-2a})\odot 1\oplus 1$) on condition that $\varDelta x_{k+3a-2b} \in R$ ($\varDelta x_{k+3b-2a} \in R$).

  Thus, in order to eliminate the effects of $x_{k+2a-b}$ and $x_{k+2b-a}$, the only choice (from Lemma 1) is involving the new bits of $\varDelta d_{k+2a-2b}$ and $\varDelta d_{k+2b-2a}$, which can indeed eliminate $x_{k+2a-b}$ and $x_{k+2b-a}$ however introduce two new variants of $x_{k+3a-2b}$ and $x_{k+3b-2a}$. Under the condition $gcd(n,a-b)=1$, this eliminating-while-introducing process will succeed iff. $|R |= n$, and the probability of each possible value of $\varDelta d$ is $2^{-(n-1)}$ which coincides with the result in [11]. On the other hand, $\varDelta d_{k}=(x_{k+a}\oplus x_{k+b})\odot 1\oplus 1$ is independent of other bits in $R_d'$ when $|R |< n$.

    $\square$

For a better understanding, we give an example with (n, a, b)=(8, 0, 3) as shown in Fig. 3. Assume that $\varDelta x_{0}=1$, $\varDelta x_{3}=1$. Only in the case where all input difference bits are active, can $\varDelta d_0$ be dependent of other bits in $\varDelta d$, namely $\varDelta d_0 = \varDelta d_1 \oplus \cdots \oplus \varDelta d_7$.

• 1. $\varDelta d_0 = (x_0 \oplus x_3) \odot 1 \oplus 1$

• 2. $\varDelta d_5 = (x_0 \oplus x_5) \odot 1 \oplus 1$, when $\varDelta x_5=1$; $\varDelta d_3 = (x_6 \oplus x_3) \odot 1 \oplus 1$, when $\varDelta x_6=1$

• 3. $\varDelta d_2 = (x_2 \oplus x_5) \odot 1 \oplus 1$, when $\varDelta x_2=1$; $\varDelta d_6 = (x_6 \oplus x_1) \odot 1 \oplus 1$, when $\varDelta x_1=1$

• 4. $\varDelta d_7 = (x_2 \oplus x_7) \odot 1 \oplus 1$, when $\varDelta x_7=1$; $\varDelta d_1 = (x_1 \oplus x_4) \odot 1 \oplus 1$, when $\varDelta x_4=1$

• 5. $\varDelta d_4 = (x_4 \oplus x_7) \odot 1 \oplus 1$

Fig. 3.

The affected relationship between input and output difference bits of ROTATION-AND.

Essentially, given $gcd(n,a-b)=1$, there is only one cycle ($\left( \begin{array}{cccccccc} 3 &{} 6 &{} 1 &{} 4 &{} 7 &{} 2 &{} 5 &{} 0 \\ 6 &{} 1 &{} 4 &{} 7 &{} 2 &{} 5 &{} 0 &{} 3\\ \end{array} \right)$ in this example). More generally, when $gcd(n, a-b) = t$, there will be t cycles, and this in some way explains the rationalities of such requirement $gcd(n,a-b)=1$.