L. O'Connor, "On the Distribution of Characteristics in Bijective Mappings," Advances in Cryptology, Proceedings of Eurocrypt '93, LNCS 765, T. Helleseth, Ed., SpringerVerlag, 1993, pp. 360--370.  Home/Search   Document Details and Download   Summary   Related Articles   Check

....On the other hand, since every non zero linear combination of the component functions of F is a bent function, the equality in (14) must hold i.e. the equality in Part (i) of the theorem holds. This completes the proof of Part (ii) ut We note that for a permutation on V n , results obtained in [18] imply that the expected value of T nz approaches (1 Gamma e , when n is large, where e = 2:718 : By using Theorem 3, the expected value of N F for a permutation satisfies (1 Gamma e 12 Before moving on to the next topic on regular S boxes, we would like to stress that ....

....it is easy to verify that the expression under the square root is always positive. Furthermore there is a j 0 , 1 jhj j 0 ; i 0 ij ( Now the theorem follows immediately from (1) ut For a permutation F on V n , F must be regular) again from results obtained in [18], we know that the expected value of t nz approaches (1 Gamma e Gamma 1) while n is large enough, where e = 2:718 : This, together with Theorem 4, shows that the expected value of N F for regular S boxes is bounded from above by 2 . Namely, 6.3 Remarks on the Two ....

O'Connor, L. J. On the distribution of characteristics in bijective mappings. In Advances in Cryptology - EUROCRYPT'93 (1994), vol. 765, Lecture Notes in Computer Science, SpringerVerlag, Berlin, Heidelberg, New York, pp. 360--370.

.... of choices available for column i is at least (7) and hence the number of choices of A is at least A : 8) The lemma follows by dividing the expression above by the total number of nonsingular M2M matrices over GF (q) O Connor [11], and Youssef and Tavares [15] 14] studied the XOR distribution table and the Linear Approximation Table (LAT) properties of randomly selected bijective s boxes. From the analysis in [11] 15] and [14] the expected value of the maximum XOR table entry of an 8 8 randomly selected bijective ....

....by dividing the expression above by the total number of nonsingular M2M matrices over GF (q) O Connor [11] and Youssef and Tavares [15] 14] studied the XOR distribution table and the Linear Approximation Table (LAT) properties of randomly selected bijective s boxes. From the analysis in [11], 15] and [14] the expected value of the maximum XOR table entry of an 8 8 randomly selected bijective mapping is less than or equal to 12 and the expected nonlinearity is greater than 92. Using an approach similar to the analysis in [4] it is possible to establish upper bounds on the ....

L.J. O'Connor. On the distribution of characteristics in bijective mappings. Advances in Cryptology: Proc. of EUROCRYPT '93, Springer-Verlag, Berlin, pp. 360--370, 1994.

....differential cryptanalysis, since the best previously known general algorithm to find non trivial impossible differentials was by exhaustive search. Moreover, the high density of impossible differentials makes differential cryptanalysis more efficient; most of the wrong pairs can be filtered out [BS91a,O C95]. Furthermore, we compute the explicit probabilities P [DP ( i] for any i; 0 i 1. This helps us to compute the distribution of the random variable X : 7 DP ( and to create formulas for the expected value and variance of the random variable X . Based on this knowledge, one can ....

.... n 1 P n 1 i=0 b k; n 1; 3 5 = 1 2 5 16 n 1 . Therefore, Var[X ] 1 2 5 16 n 1 2 2n = 1 2 5 16 n 1 4 16 n 1 . Note that the density of possible differentials P[X 6= 0] is exponentially small in n. This can be contrasted with a result of O Connor [O C95] that a randomly selected n bit Algorithm 3 Algorithm that finds all s, s.t. DP ( 7 ) DP max ( INPUT: OUTPUT: All ( optimal output differences 1. 0 0 0 ; 2. p C( 3. For i 1 to n 1 do If i 1 = i 1 = i 1 then i i i i 1 else ....

Luke O'Connor. On the Distribution of Characteristics in Bijective Mappings. Journal of Cryptology, 8(2):67--86, 1995.

....cryptanalysis, since the best previously known general algorithm to find non trivial impossible differentials was by exhaustive search. Moreover, the high density of impossible differentials makes differential cryptanalysis more efficient, by enabling most of the wrong pairs to be filtered out [BS91a,O C95]. Furthermore, we compute the explicit probabilities P [DP ( i] for any i; 0 i 1. This helps us to compute the distribution of the random variable X : 7 DP ( and to create formulas for the expected value and variance of the random variable X . Based on this knowledge, one can ....

....16 n 1 P n 1 i=0 b k; n 1; 3 5 = 1 2 5 16 n 1 . Therefore, Var[X ] 1 2 5 16 n 1 2 2n = 1 2 5 16 n 1 4 16 n 1 . Note that the density of possible differentials P[X 6= 0] is exponentially small in n. This can be contrasted with a result of O Connor [O C95] that a randomly selected m bit permutation has a fraction of 1 e 1=2 0:4 impossible differentials, independently of the choice of n. Moreover, a randomly selected n bit composite permutation [O C93] controlled by an n bit string, has a negligible fraction 2 3n =e 2 n 1 of impossible ....

Luke O'Connor. On the Distribution of Characteristics in Bijective Mappings. Journal of Cryptology, 8(2):67--86, 1995.

....is based on the iteration of the F function. The number of rounds required for resistance to a given attack is dependent on the properties of the function. While there has been considerable research in determining what sorts of F functions yield secure Feistel networks [Nyb91] Nyb93] OCo94a] [OCo94b], OCo94c] Knu94a] Knu94b] Nyb94] DGV94] NK95] little has been written about the underlying Feistel structure. The aim of our research is to generalize Feistel networks and show the implications of di#erent structures for block cipher design. 2 A Taxonomy of Feistel Networks One of ....

....the extreme, if b = 1 we would have to assume that any time we have a single bit di#erence somewhere in the input, it always leads to the same output di#erence with some usably high probability. However, as t gets smaller, it appears that high probability di#erentials become easier to find again [OCo94b]. Note that this may lead to situations in which a multi round characteristic is extremely di#cult to find, but relatively easy to exploit. A second type of di#erential works with any even construction: a di#erence of a in every sub block of s produces a di#erence of 0 in every sub block of t ....

L. O'Connor, "On the Distribution of Characteristics in Bijective Mappings, " Advances in Cryptology --- EUROCRYPT '93 Proceedings, SpringerVerlag, 1994, pp. 360-370.

....a ner grained di usion, instead of a 4 by 4 MDS matrix over GF(2 8 ) the former would have been no slower on a Pentium but at least twice as slow on a low memory smart card. 6. 2 Conservative Design There has been considerable research in designing ciphers to be resistant to known attacks [Nyb91, Nyb93, OCo94a, OCo94b, OCo94c, Knu94a, Knu94b, Nyb94, DGV94b, Nyb95, NK95, Mat96, Nyb96], such as di erential [BS93] linear [Mat94] and related key cryptanalysis [Bih94, KSW96, KSW97] This research has culminated in strong cipher designs CAST 128 [Ada97a] and MISTY [Mat97] are probably the most noteworthy as well as some excellent cryptanalytic theory. However, it is dangerous to ....

L. O'Connor, \On the Distribution of Characteristics in Bijective Mappings," Advances in Cryptology | EUROCRYPT '93 Proceedings, Springer-Verlag, 1994, pp. 360-370.

....a finer grained di#usion, instead of a 4 by 4 MDS matrix over GF(2 8 ) the former would have been no slower on a Pentium but at least twice as slow on a low memory smart card. 6. 2 Conservative Design There has been considerable research in designing ciphers to be resistant to known attacks [Nyb91, Nyb93, OCo94a, OCo94b, OCo94c, Knu94a, Knu94b, Nyb94, DGV94b, Nyb95, NK95, Mat96, Nyb96], such as di#erential [BS93] linear [Mat94] and related key cryptanalysis [Bih94, KSW96, KSW97] This research has culminated in strong cipher designs CAST 128 [Ada97a] and MISTY [Mat97] are probably the most noteworthy as well as some excellent cryptanalytic theory. However, it is ....

L. O'Connor, "On the Distribution of Characteristics in Bijective Mappings," Advances in Cryptology --- EUROCRYPT '93 Proceedings, Springer-Verlag, 1994, pp. 360--370.

....On the other hand, since every non zero linear combination of the component functions of F is a bent function, the equality in (14) must hold i.e. the equality in Part (i) of the theorem holds. This completes the proof of Part (ii) ut We note that for a permutation on V n , results obtained in [18] imply that the expected value of T nz approaches (1 Gamma e Gamma 1 2 ) 2 n Gamma 1) 2 , when n is large, where e = 2:718 : By using Theorem 3, the expected value of N F for a permutation satisfies N F = 2 n Gamma1 Gamma 2 3 4 n Gamma1 4 q (1 Gamma e Gamma 1 2 ....

.... such that jhj j 0 ; i 0 ij = 2 3n 2m Gamma 2 4n t Gamma1 nz Delta 2 n (2 2n Gamma 2 n m ) 2 (2 n Gamma 1) 2 m Gamma 1) 2 ) 1 4 : Now the theorem follows immediately from (1) ut For a permutation F on V n , F must be regular) again from results obtained in [18], we know that the expected value of t nz approaches (1 Gamma e Gamma 1 2 ) 2 n Gamma 1) while n is large enough, where e = 2:718 : This, together with Theorem 4, shows that the expected value of N F for regular S boxes is bounded from above by 2 n Gamma1 Gamma 2 n Gamma1 p 2 ....

O'Connor, L. J. On the distribution of characteristics in bijective mappings. In Advances in Cryptology - EUROCRYPT'93 (1994), vol. 765, Lecture Notes in Computer Science, SpringerVerlag, Berlin, Heidelberg, New York, pp. 360--370.

....a finer grained diffusion, instead of a 4 by 4 MDS matrix over GF(2 8 ) the former would have been no slower on a Pentium but at least twice as slow on a low memory smart card. 6. 2 Conservative Design There has been considerable research in designing ciphers to be resistant to known attacks [Nyb91, Nyb93, OCo94a, OCo94b, OCo94c, Knu94a, Knu94b, Nyb94, DGV94b, Nyb95, NK95, Mat96, Nyb96], such as differential [BS93] linear [Mat94] and related key cryptanalysis [Bih94, KSW96, KSW97] This research has culminated in strong cipher designs CAST 128 [Ada97a] and MISTY [Mat97] are probably the most noteworthy as well as some excellent cryptanalytic theory. However, it is ....

L. O'Connor, "On the Distribution of Characteristics in Bijective Mappings," Advances in Cryptology --- EUROCRYPT '93 Proceedings, Springer-Verlag, 1994, pp. 360--370.

....probability 1, there are no such problems here. Equation (13) actually is a so called truncated differential, as described in [11] The importance of using a truncated differential instead of a conventional one especially becomes clear by looking at the qualities of differentials as examined in [10]. There it is proven that for large n the expected probability of the most likely nonzero differential for an n to n bit S box (like fi for a fixed Z value) is at most n 2 n Gamma1 . Even for the worst case (13) does much better than this. This truncated differential is one of the most ....

L. O'Connor, On the Distribution of Characteristics in Bijective Mappings, in Advances in Cryptology, Proc. Eurocrypt '93, LNCS 765, T. Helleseth, Ed., Springer-Verlag, 1993, pp. 360--370

.... advantage for a particular round [3, 42, 111] Biham and Shamir point out however, that variants of DES with such S boxes turn out to be easier to attack because this new regularity allows differences to be contained within single boxes, rather than propagating on into other S boxes [17] O Conner [118, 119] has established bounds on the strength against differential and linear attack of a randomly chosen S box which implements a permutation and his work implies that such S boxes are more likely to be secure if they are larger. Meanwhile, Nyberg [115] has taken a different approach and analyzed the ....

L. O'Conner. On the distribution of characteristics in bijective mappings. In T. Helleseth, editor, Advances in Cryptology --- Eurocrypt 62 Block Ciphers '93, volume 765 of Lecture Notes in Computer Science, pages 360--370, Berlin, 1994. Springer-Verlag.

....X p 1 p 2 Delta Delta Delta p 2 c =k p i 0 2 c Y i=1 Pr( i ( DeltaX; DeltaY ) 2p i ) 3) where i ( DeltaX; DeltaY ) is the XOR table entry for DeltaX; DeltaY in i and DeltaX are the m data bits of DeltaX . Again these random variables are i.i.d. In this case, O Connor [10, 9] has shown that i ( DeltaX; DeltaY ) is described by the following probability distribution Pr( i ( DeltaX; DeltaY ) 2k) 2 m Gamma1 k 2 Delta k Delta 2 k Delta Phi(2 m Gamma1 Gamma k) 2 m (4) where Phi(d) d X i=0 ( Gamma1) i Delta d i 2 Delta ....

L. J. O'Connor. On the distribution of characteristics in bijective mappings. Advances in Cryptology, EUROCRYPT 93, Lecture Notes in Computer Science, vol. 765, T. Helleseth ed., Springer-Verlag, pages 360--370, 1994.

....for these functions the probabilities of non trivial one round characteristics are low. And because of their high nonlinearity they are also wellsuited for the construction of ciphers resistant against linear attacks as we will illustrate in the next section. Finally it follows from the results in [19] that round functions build from big random S boxes are resistant to differential attacks. A similar result for linear attacks is not known to us. 3.3 Examples In this section we give two examples of iterated block ciphers practically resistant to both linear and differential attacks. The ....

L. J. O'Connor. On the distribution of characteristics in bijective mappings. Proceedings of EuroCrypt'93, Springer Verlag, LNCS 765, 1994.

....of a differential is larger than 2 Gamma63 , or it is equal to zero. Also the correlations between input and output bits are multiples of 2 Gamma63 . More specific, in a 64bit block cipher the expected value for the probability of a differential is upper bounded by 128 Delta 2 Gamma64 [O94]. The probabilities and correlations in the table were calculated by assuming independent and variable round keys; they are probabilities over the input and round key space. These values give only an indication of the safety margin against linear and differential attacks. When the probability of a ....

L. O'Connor, "On the distribution of characteristics in bijective mappings," Advances in Cryptology, Proc. Eurocrypt'93, LNCS 765, T. Helleseth, Ed., Springer-Verlag, 1994, pp. 360--370.

....structure that may be exploited in attacks in unanticipated ways, designers often resort to random substitutions: a substitution is selected from a set of substitutions that are generated by the use of a random source and evaluated with respect to (presumably) relevant nonlinearity criteria. In [14] the average differential properties of permutations are investigated and a bound for the expected value of ffi is given. For an m bit permutation lim m 1 E[ffi2 m ] 2m 1 : We verified this experimentally for 1.5 million samples with m = 8 and measured at the same time ffi and . The results ....

L. O'Connor, "On the distribution of characteristics in bijective mappings," Journal of Cryptology, Vol. 8, No. 2, 1995, pp. 67--86..

....probabilities should lie well below 2 . However, block ciphers often have a iterative structure which allows for differential approximations with higher probabilities than expected for a random permutation. For example, the 13 round differential The upper bound on M Phi; was determined by [11]. n 8 16 32 64 128 256 512 1024 B n 4.6 7.2 11.7 20.8 34.3 60.4 108.1 195.6 2 Delta dB n e 10 16 24 42 70 122 218 392 Table 2: The values of B n = ln N , N = 2 Gamma 1) for several n. approximation used by Biham and Shamir for DC of the Data Encryption Standard (DES) 12, 3] has an ....

.... permutations that preserve exactly t edges from D ff in D fi P t = j Gammat ( Gamma1) S t i ; S k = Y E ff jYj=k fi fi fi fi fi uv2Y A uv fi fi fi fi ; 2) and it follows that p t (2 ; a; b) P t = 2 ) In the case of XOR differences ( Omega = Phi) it is known [11] that P 2t Delta t Delta Gamma t) 1=2 : 3) In this case determining an exact expression for P t is assisted by the fact that ord ff = ord fi = 2, and the sets A uv are independent in the sense that uv is the only edge incident on u and v. For a general group ....

[Article contains additional citation context not shown here]

L. J. O'Connor. On the distribution of characteristics in bijective mappings. Advances in Cryptology, EUROCRYPT'93, Lecture Notes in Computer Science, vol. 765, T. Helleseth ed., Springer-Verlag, pages 360--370, 1994.

....2 We will assume that that the entries of P are distributed approximately randomly with respect to being zero or nonzero, as all computational results suggest. We then claim that if the number of edges in G dominates N log N then G is strongly connected with high probability. Theorem 2. 3 (Oconnor[17]) Let be the largest entry in the XOR table for a bijective F : Z n 2 Z n 2 . Then if F is selected uniformly, lim n 1 E[ 2n 1. 2 Corollary 2.1 If F is selected uniformly, then Pr(P is ergodic) 1. Proof. Since E[ P i i Delta Pr( i) it follows from Theorem 2.3 ....

L. J. O'Connor. On the distribution of characteristics in bijective mappings. Advances in Cryptology, EUROCRYPT 93, Lecture Notes in Computer Science, vol. 765, T. Helleseth ed., Springer-Verlag, pages 360--370, 1994.

....of the attack will exceed the cost of exhaustive key search. Our approach has been to bound the largest value in the linear approximation table of a bijective mapping, and to then show that this is sufficient to defeat linear cryptanalysis. A similar approach has been used by used O Connor [12] to show that sufficiently large S boxes will also defeat differential cryptanalysis, as the largest value in the table can be bounded asymptotically. Thus random selection of S boxes seems able to avoid both these major cryptanalytic attacks. ....

L. J. O'Connor. On the distribution of characteristics in bijective mappings. Advances in Cryptology, EUROCRYPT 93, Lecture Notes in Computer Science, vol. 765, T. Helleseth ed., Springer-Verlag, pages 360--370, 1994.

....from several round approximations cannot be combined directly (that is, Matsui s Piling Up lemma does not apply) 6. 2 Differential Cryptanalysis In differential cryptanalysis we are looking for mappings whose XOR tables exhibit a relatively flat distribution (all values are small) It is known [4] that the largest entry in the XOR table of an n bit permutation is tending to be at most 2n as n increases. Applying this result directly to 4 bit mappings indicates that the probability of the most likely input output difference pair DeltaX; DeltaY in a 4 bit permutation is approximately 8 16 ....

L.J. O'Connor. On the distribution of characteristics in bijective mappings. In Extended Abstracts - Eurocrypt'93, May 1993.

No context found.

L. O'Connor, "On the Distribution of Characteristics in Bijective Mappings," Advances in Cryptology, Proceedings of Eurocrypt '93, LNCS 765, T. Helleseth, Ed., SpringerVerlag, 1993, pp. 360--370.

No context found.

L. O'Connor, "On the Distribution of Characteristics in Bijective Mappings," Advances in Cryptology, Proceedings of Eurocrypt '93, LNCS 765, T. Helleseth, Ed., SpringerVerlag, 1993, pp. 360--370.

No context found.

L. O'Connor, On the Distribution of Characteristics in Bijective Mappings, Proceedings of Eurocrypt'93, 360--370, 1994.

No context found.

L. O'Connor, \On the Distribution of Characteristics in Bijective Mappings, " Advances in Cryptology | EUROCRYPT '93 Proceedings, SpringerVerlag, 1994, pp. 360-370.

No context found.

Luke O'Connor, On the Distribution of Characteristics in Bijective Mappings, EUROCRYPT'93, pp. 360--370, 1993.

No context found.

L. O'Connor, #On the distribution of characteristics in bijective mappings," Journal of Cryptology, Vol. 8, No. 2, 1995, pp. 67#86..

First 50 documents

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC