Cryptanalysis, Reverse-Engineering and Design of Symmetric - PowerPoint PPT Presentation

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Motivation A malicious designer can easily hide a structure in an S-Box. 16 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Motivation A malicious designer can easily hide a structure in an S-Box. To keep an advantage in implementation (WB crypto)... 16 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Motivation A malicious designer can easily hide a structure in an S-Box. To keep an advantage in implementation (WB crypto)... ... or an advantage in cryptanalysis (backdoor). 16 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion The Two Tables Let S : F n 2 → F n 2 be an S-Box. 17 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion The Two Tables Let S : F n 2 → F n 2 be an S-Box. Definition (DDT) The Difference Distribution Table of S is a matrix of size 2 n × 2 n such that DDT [ a , b ] = # { x ∈ F n 2 | S ( x ⊕ a ) ⊕ S ( x ) = b } . 17 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion The Two Tables Let S : F n 2 → F n 2 be an S-Box. Definition (DDT) The Difference Distribution Table of S is a matrix of size 2 n × 2 n such that DDT [ a , b ] = # { x ∈ F n 2 | S ( x ⊕ a ) ⊕ S ( x ) = b } . Definition (LAT) The Linear Approximations Table of S is a matrix of size 2 n × 2 n such that LAT [ a , b ] = # { x ∈ F n 2 | x · a = S ( x ) · b } − 2 n − 1 . 17 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Example S = [ 4 , 2 , 1 , 6 , 0 , 5 , 7 , 3 ] The DDT of S . The LAT of S .     8 0 0 0 0 0 0 0 4 0 0 0 0 0 0 0         0 0 0 0 2 2 2 2 0 0 2 2 0 0 2 − 2         0 0 0 0 2 2 2 2 0 2 2 0 0 2 − 2 0         0 0 4 4 0 0 0 0 0 2 0 2 0 − 2 0 2         0 0 0 0 2 2 2 2 0 2 0 − 2 0 − 2 0 − 2         0 4 4 0 0 0 0 0 0 − 2 2 0 0 − 2 − 2 0         0 4 0 4 0 0 0 0 0 0 − 2 2 0 0 − 2 − 2         0 0 0 0 2 2 2 2 0 0 0 0 − 4 0 0 0 18 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Coefficient Distribution in the DDT If an n -bit S-Box is bijective, then its DDT coefficients behave like independent and identically distributed random variables following a Poisson distribution: Pr [DDT[ a , b ] = 2 z ] = e − 1 / 2 2 z z . 19 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Coefficient Distribution in the DDT If an n -bit S-Box is bijective, then its DDT coefficients behave like independent and identically distributed random variables following a Poisson distribution: Pr [DDT[ a , b ] = 2 z ] = e − 1 / 2 2 z z . Always even, ≥ 0 Typically between 0 and 16. Lower is beter. 19 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Coefficient Distribution in the LAT If an n -bit S-Box is bijective, then its LAT coefficients behave like independent and identically distributed random variables following this distribution: � 2 n − 1 � 2 n − 2 + z Pr [LAT[ a , b ] = 2 z ] = . � 2 n � 2 n − 1 20 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Coefficient Distribution in the LAT If an n -bit S-Box is bijective, then its LAT coefficients behave like independent and identically distributed random variables following this distribution: � 2 n − 1 � 2 n − 2 + z Pr [LAT[ a , b ] = 2 z ] = . � 2 n � 2 n − 1 Always even, signed. Typically between -40 and 40. Lower absolute value is beter. 20 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Looking Only at the Maximum ℓ log 2 ( Pr [max ( L ) ≤ ℓ ] ) δ log 2 ( Pr [max ( D ) ≤ δ ] ) 38 -0.084 14 -0.006 36 -0.302 34 -1.008 12 -0.094 32 -3.160 10 -1.329 30 -9.288 8 -16.148 28 -25.623 26 -66.415 6 -164.466 24 -161.900 4 -1359.530 22 -371.609 DDT LAT Probability that the maximum coefficient in the DDT/LAT of an 8-bit permutation is at most equal to a certain threshold. 21 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Looking Only at the Maximum ℓ log 2 ( Pr [max ( L ) ≤ ℓ ] ) δ log 2 ( Pr [max ( D ) ≤ δ ] ) 38 -0.084 14 -0.006 36 -0.302 34 -1.008 12 -0.094 32 -3.160 10 -1.329 30 -9.288 8 -16.148 28 -25.623 26 -66.415 6 -164.466 24 -161.900 4 -1359.530 22 -371.609 DDT LAT Probability that the maximum coefficient in the DDT/LAT of an 8-bit permutation is at most equal to a certain threshold. 21 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Taking Number of Maximum Values into Account −20 −30 Probability (log 2 ) −40 Pr[max = 28] −50 Pr[max = 26] Pr[max = 28, #28 ≤ N 28 ] −60 −70 0 5 10 15 20 25 30 35 40 N 28 22 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Application of this Analysis? We applied this method on the S-Box of Skipjack. 23 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion What is Skipjack? (1/2) Type Block cipher Bloc 64 bits Key 80 bits Authors NSA Publication 1998 24 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion What is Skipjack? (2/2) Skipjack was supposed to be secret... ... but eventually published in 1998 [NIST, 1998] , 25 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion What is Skipjack? (2/2) Skipjack was supposed to be secret... ... but eventually published in 1998 [NIST, 1998] , It uses an 8 × 8 S-Box ( F ) specified only by its LUT, 25 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion What is Skipjack? (2/2) Skipjack was supposed to be secret... ... but eventually published in 1998 [NIST, 1998] , It uses an 8 × 8 S-Box ( F ) specified only by its LUT, Skipjack was to be used by the Clipper Chip . 25 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Reverse-Engineering F For Skipjack’s F , max ( LAT ) = 28 and #28 = 3 . 26 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Reverse-Engineering F For Skipjack’s F , max ( LAT ) = 28 and #28 = 3 . −20 −30 Probability (log 2 ) −40 Pr[max = 28] −50 Pr[max = 26] Pr[max = 28, #28 ≤ N 28 ] −60 −70 0 5 10 15 20 25 30 35 40 N 28 26 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Reverse-Engineering F For Skipjack’s F , max ( LAT ) = 28 and #28 = 3 . −20 −30 Probability (log 2 ) −40 Pr[max = 28] −50 Pr[max = 26] Pr[max = 28, #28 ≤ N 28 ] −60 −70 0 5 10 15 20 25 30 35 40 N 28 26 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Reverse-Engineering F For Skipjack’s F , max ( LAT ) = 28 and #28 = 3 . −20 −30 Probability (log 2 ) −40 Pr[max = 28] −50 Pr[max = 26] Pr[max = 28, #28 ≤ N 28 ] −60 −70 0 5 10 15 20 25 30 35 40 N 28 Pr [max ( LAT ) = 28 and #28 ≤ 3] ≈ 2 − 55 26 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion What Can We Deduce? F has not been picked uniformly at random. F has not been picked among a feasibly large set of random S-Boxes. Its linear properties were optimized (though poorly). 27 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion What Can We Deduce? F has not been picked uniformly at random. F has not been picked among a feasibly large set of random S-Boxes. Its linear properties were optimized (though poorly). The S-Box of Skipjack was built using a dedicated algorithm. 27 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Conclusion on Skipjack F 28 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Conclusion on Skipjack F 28 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Distinguisher vs. Decomposition We have figured out that F is not random... 29 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Distinguisher vs. Decomposition We have figured out that F is not random... But what can we do to find actual structures? Structural Atacks Atacks against structures regardless of their details. Examples: Integral atacks against SPNs, Yoyo game against Feistel Networks, Looking at the Pollock representations of the DDT/LAT, 29 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Distinguisher vs. Decomposition We have figured out that F is not random... But what can we do to find actual structures? Structural Atacks Atacks against structures regardless of their details. Examples: Integral atacks against SPNs, Yoyo game against Feistel Networks, Looking at the Pollock representations of the DDT/LAT, TU-Decomposition. 29 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion TU-Decomposition in a Nutshell 1 Identify linear paterns in zeroes of LAT; 30 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion TU-Decomposition in a Nutshell µ 1 Identify linear paterns in zeroes of LAT; 2 Deduce linear layers µ , η such that π is T decomposed as in right picture; U η 30 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion TU-Decomposition in a Nutshell µ 1 Identify linear paterns in zeroes of LAT; 2 Deduce linear layers µ , η such that π is T decomposed as in right picture; U 3 Decompose U , T ; η 30 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion TU-Decomposition in a Nutshell µ 1 Identify linear paterns in zeroes of LAT; 2 Deduce linear layers µ , η such that π is T decomposed as in right picture; U 3 Decompose U , T ; 4 Put it all together. η 30 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Kuznyechik/Stribog Stribog Type Hash function Publication [GOST, 2012] Kuznyechik Type Block cipher Publication [GOST, 2015] 31 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Kuznyechik/Stribog Stribog Type Hash function Publication [GOST, 2012] Kuznyechik Type Block cipher Publication [GOST, 2015] Common ground Both are standard symmetric primitives in Russia. Both were designed by the FSB (TC26). Both use the same 8 × 8 S-Box, π . 31 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion The LAT of π 32 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion The LAT of η ◦ π ◦ µ 33 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Final Decomposition Number 1 α ⊙ ⊙ Multiplication in F 2 4 I ν 0 ν 1 α Linear permutation I Inversion in F 2 4 ν 0 , ν 1 , σ 4 × 4 permutations ϕ ⊙ ϕ 4 × 4 function σ ω Linear permutation ω 34 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Conclusion for Kuznyechik/Stribog? The Russian S-Box was built like a strange Feistel... 35 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Conclusion for Kuznyechik/Stribog? The Russian S-Box was built like a strange Feistel... ... or was it? 35 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Conclusion for Kuznyechik/Stribog? The Russian S-Box was built like a strange Feistel... ... or was it? Belarussian inspiration The last standard of Belarus [Bel. St. Univ., 2011] uses an 8-bit S-box, somewhat similar to π ... 35 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Conclusion for Kuznyechik/Stribog? The Russian S-Box was built like a strange Feistel... ... or was it? Belarussian inspiration The last standard of Belarus [Bel. St. Univ., 2011] uses an 8-bit S-box, somewhat similar to π ... ... based on a finite field exponential! 35 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Final Decomposition Number 2 (!) log w , 16 0 1 2 3 4 5 6 7 8 9 a b c d e f T 0 0 1 2 3 4 5 6 7 8 9 a b c d e f T 1 0 1 2 3 4 5 6 7 8 9 a b c d e f ⊗ − 1 T 2 0 1 2 3 4 5 6 7 8 9 a b c d f e T 3 0 1 2 3 4 5 6 7 8 9 a b c f d e T T 4 0 1 2 3 4 5 6 7 8 9 a b f c d e T 5 0 1 2 3 4 5 6 7 8 9 a f b c d e T 6 0 1 2 3 4 5 6 7 8 9 f a b c d e ⊞ T 7 0 1 2 3 4 5 6 7 8 f 9 a b c d e T 8 0 1 2 3 4 5 6 7 f 8 9 a b c d e T 9 0 1 2 3 4 5 6 f 7 8 9 a b c d e q ′ T a 0 1 2 3 4 5 f 6 7 8 9 a b c d e T b 0 1 2 3 4 f 5 6 7 8 9 a b c d e T c 0 1 2 3 f 4 5 6 7 8 9 a b c d e T d 0 1 2 f 3 4 5 6 7 8 9 a b c d e ω ′ T e 0 1 f 2 3 4 5 6 7 8 9 a b c d e T f 0 f 1 2 3 4 5 6 7 8 9 a b c d e 36 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Conclusion on Kuznyechik/Stribog π 37 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Conclusion on Kuznyechik/Stribog π 37 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Conclusion on Kuznyechik/Stribog π 37 / 54

Introduction Mathematical Background On S-Box Reverse-Engineering Detailed Analysis of the Two Tables On Lightweight Cryptography TU-Decomposition Conclusion Conclusion on Kuznyechik/Stribog π ? 37 / 54

Introduction Internet of Things On S-Box Reverse-Engineering State of the Art On Lightweight Cryptography Our Block Cipher: SPARX Conclusion Outline Introduction 1 On S-Box Reverse-Engineering 2 On Lightweight Cryptography 3 Conclusion 4 37 / 54

Introduction Internet of Things On S-Box Reverse-Engineering State of the Art On Lightweight Cryptography Our Block Cipher: SPARX Conclusion Plan of this Section Introduction 1 On S-Box Reverse-Engineering 2 On Lightweight Cryptography 3 Internet of Things State of the Art Our Block Cipher: SPARX 4 Conclusion 37 / 54

Introduction Internet of Things On S-Box Reverse-Engineering State of the Art On Lightweight Cryptography Our Block Cipher: SPARX Conclusion What Things? Everything is being connected to the internet. 38 / 54

Introduction Internet of Things On S-Box Reverse-Engineering State of the Art On Lightweight Cryptography Our Block Cipher: SPARX Conclusion What Things? Everything 38 / 54

Introduction Internet of Things On S-Box Reverse-Engineering State of the Art On Lightweight Cryptography Our Block Cipher: SPARX Conclusion What Things? Everything 38 / 54

Introduction Internet of Things On S-Box Reverse-Engineering State of the Art On Lightweight Cryptography Our Block Cipher: SPARX Conclusion What Things? Everything 38 / 54

Introduction Internet of Things On S-Box Reverse-Engineering State of the Art On Lightweight Cryptography Our Block Cipher: SPARX Conclusion Security “In IoT, the S is for Security.” Internet-enabled devices have security flaws. Security is an aferthought (at best). Security has a cost in terms of engineering... ... and computationnal resources! 39 / 54

Introduction Internet of Things On S-Box Reverse-Engineering State of the Art On Lightweight Cryptography Our Block Cipher: SPARX Conclusion Lightweight Cryptography Lightweight cryptography uses litle resources. 40 / 54

Introduction Internet of Things On S-Box Reverse-Engineering State of the Art On Lightweight Cryptography Our Block Cipher: SPARX Conclusion Lightweight Cryptography from the Industry Stream ciphers, unless †(BC) or ‡(MAC) A5/1 CryptoMem. Cryptomeria † A5/2 Hitag2 Csa -BC † Cmea † Megamos Csa -SC Oryx Keeloq † PC-1 A5-GMR-1 Dst 40 † SecurID ‡ A5-GMR-2 iClass E0 Dsc Crypto-1 SecureMem. RC4 Css 41 / 54

Introduction Internet of Things On S-Box Reverse-Engineering State of the Art On Lightweight Cryptography Our Block Cipher: SPARX Conclusion Lightweight Cryptography from the Industry Stream ciphers, unless † (BC) or ‡ (MAC) A5/1 CryptoMem. Cryptomeria † A5/2 Hitag2 Csa -BC † Cmea † Megamos Csa -SC Oryx Keeloq † PC-1 A5-GMR-1 Dst 40 † SecurID ‡ A5-GMR-2 iClass E0 Dsc Crypto-1 SecureMem. RC4 Css They’re all dead (atacks in less than 2 64 ). 41 / 54

Introduction Internet of Things On S-Box Reverse-Engineering State of the Art On Lightweight Cryptography Our Block Cipher: SPARX Conclusion Lightweight Block Ciphers from Academia 3-Way DESLX PRINCE RECTANGLE RC5 PRESENT ITUbee Fantomas Misty1 MIBS TWINE Robin XTEA KATAN Zorro Midori AES GOST rev. Chaskey SIMECK Khazad PRINTCipher PRIDE RoadRunneR Noekeon EPCBC Joltik FLY Iceberg KLEIN LEA Mantis mCrypton LBlock iScream SKINNY HIGHT LED LBlock-s SPARX SEA Piccolo Scream Mysterion CLEFIA PICARO Lilliput Qarma 48 distinct block ciphers! 42 / 54

Introduction Internet of Things On S-Box Reverse-Engineering State of the Art On Lightweight Cryptography Our Block Cipher: SPARX Conclusion Common Trade-Offs in LWC Small internal state size. 43 / 54

Introduction Internet of Things On S-Box Reverse-Engineering State of the Art On Lightweight Cryptography Our Block Cipher: SPARX Conclusion Common Trade-Offs in LWC Small internal state size. Small key. 43 / 54

Introduction Internet of Things On S-Box Reverse-Engineering State of the Art On Lightweight Cryptography Our Block Cipher: SPARX Conclusion Common Trade-Offs in LWC Small internal state size. Small key. Simple key schedule. 43 / 54

Introduction Internet of Things On S-Box Reverse-Engineering State of the Art On Lightweight Cryptography Our Block Cipher: SPARX Conclusion Common Trade-Offs in LWC Small internal state size. Small key. Simple key schedule. No table look-ups (instead, ARX or bit-sliced S-Box). 43 / 54

Introduction Internet of Things On S-Box Reverse-Engineering State of the Art On Lightweight Cryptography Our Block Cipher: SPARX Conclusion How did we design SPARX? 44 / 54

Introduction Internet of Things On S-Box Reverse-Engineering State of the Art On Lightweight Cryptography Our Block Cipher: SPARX Conclusion Block Cipher Design (1/2) Requirement S-Box-based ARX-based Confusion S ⊞ Diffusion L ⊞ , ≪ , ⊕ 45 / 54

Introduction Internet of Things On S-Box Reverse-Engineering State of the Art On Lightweight Cryptography Our Block Cipher: SPARX Conclusion Block Cipher Design (2/2) � ∆ S � # active S-Boxes P diff ≤ 2 b Design of an S-Box based SPN (wide trail strategy) 46 / 54

Introduction Internet of Things On S-Box Reverse-Engineering State of the Art On Lightweight Cryptography Our Block Cipher: SPARX Conclusion Block Cipher Design (2/2) � ∆ S � # active S-Boxes P diff ≤ 2 b Design of an ARX-cipher Design of an S-Box based SPN (wide trail (allegory) strategy) source: Wiki Commons 46 / 54

Introduction Internet of Things On S-Box Reverse-Engineering State of the Art On Lightweight Cryptography Our Block Cipher: SPARX Conclusion Block Cipher Design (2/2) � ∆ S � # active S-Boxes P diff ≤ 2 b Design of an ARX-cipher Design of an S-Box based SPN (wide trail (allegory) strategy) source: Wiki Commons Can we use ARX and have provable bounds? 46 / 54