Reference : Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog
Scientific journals : Article
Engineering, computing & technology : Computer science
Security, Reliability and Trust
http://hdl.handle.net/10993/29887
Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog
English
Perrin, Léo Paul mailto [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
Udovenko, Aleksei mailto [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
Jan-2017
IACR Transactions on Symmetric Cryptology
Ruhr-University
2016
2
99-124
Yes
International
2519-173X
Bochum
Germany
[en] Reverse-Engineering ; S-Box ; Streebog ; Kuznyechik ; STRIBOBr1 ; White-Box ; Linear Approximation Table ; Exponentiation ; BelT
[en] The block cipher Kuznyechik and the hash function Streebog were recently standardized by the Russian Federation. These primitives use a common 8-bit S-Box, denoted 𝜋, which is given only as a look-up table. The rationale behind its design is, for all practical purposes, kept secret by its authors. In a paper presented at Eurocrypt 2016, Biryukov et al. reverse-engineered this S-Box and recovered an unusual Feistel-like structure relying on finite field multiplications. In this paper, we provide a new decomposition of this S-Box and describe how we obtained it. The first step was the analysis of the 8-bit S-Box of the current standard block cipher of Belarus, BelT. This S-Box is a variant of a so-called exponential substitution, a concept we generalize into pseudo-exponential substitution. We derive distinguishers for such permutations based on properties of their linear approximation tables and notice that 𝜋 shares some of them. We then show that 𝜋 indeed has a decomposition based on a pseudo-exponential substitution. More precisely, we obtain a simpler structure based on an 8-bit finite field exponentiation, one 4-bit S-Box, a linear layer and a few modular arithmetic operations. We also make several observations which may help cryptanalysts attempting to reverse-engineer other S-Boxes. For example, the visual pattern used in the previous work as a starting point to decompose 𝜋 is mathematically formalized and the use of differential patterns involving operations other than exclusive-or is explored.
Fonds National de la Recherche - FnR
Researchers ; Professionals
http://hdl.handle.net/10993/29887
10.13154/tosc.v2016.i2.99-124
http://tosc.iacr.org/index.php/ToSC/article/view/567

File(s) associated to this reference

Fulltext file(s):

FileCommentaryVersionSizeAccess
Open access
exponential.pdfPublisher postprint751.29 kBView/Open

Bookmark and Share SFX Query

All documents in ORBilu are protected by a user license.