In the present work we study a linearization framework for assessing the security of hash functions and analyze the proposal of hash function BLAKE. The thesis demonstrates a limitation of a method presented in the linearization framework for which the method could not be applied to the full extent. Further in the thesis, it is explained how to find a message difference for second preimage attack with the help of linear codes. To that end, a matrix representing the linearized compression function of BLAKE is constructed. My thesis as a PDF file and source codes of computations that I created in Mathematica software are on an enclosed CD.

Differential cryptanalysis and linear cryptanalysis are the first significant methods used to attack on block ciphers. These concepts compose the keystones for most of the attacks in recent years. Also, while designing a cipher, these attacks should be taken into consideration and the cipher should be created as secure against them. Although differential cryptanalysis and linear cryptanalysis are still important, they started to be inecient due to the improvements in the technology. So, these attacks are extended. For instance, higher order differential cryptanalysis, truncated differential cryptanalysis, generalized linear cryptanalysis, partitioning linear cryptanalysis, linear cryptanalysis using multiple linear approximations are introduced as the extended versions of these attacks. There exists significant applications of these extended attacks. Algebraic attack is a method of cryptanalysis that consists of obtaining a representation of the cipher as a system of equations and then, solving this system. Up to today, just a few attacks that are practically possible to mount are presented. However, due to the fact that algebraic cryptanalysis requires only a handful of known plaintexts to perform, it is a promising and significant attack. This thesis is a survey covering all the methods of attacks described above. Illustrations and summaries of some important papers including these cryptanalysis techniques are given.

La première partie de la thèse porte sur l'utilisation de la méthode des variances dans le cadre des attaques différentielles sur des schémas de Feistel généralisés. Cette méthode permet d'améliorer des attaques sur deux points : la complexité en données ou le nombre de tours couvert par l'attaque.Afin d'atteindre ce but, un outil a été développé permettant de calculer la valeur exacte de l'espérance et de la variance et nous nous servons alors de cette précision pour améliorer les attaques.La seconde partie porte sur une famille de schémas de chiffrement : les EGFN.Nous avons utilisé la méthode des variances et notre outil afin de construire des attaques différentielles. Des simulations ont été effectuées afin de confirmer les résultats.Dans la dernière partie, nous nous intéressons à LILLIPUT, un système de chiffrement concret issu des EGFN. Nous avons effectué une analyse différentielle et monté des attaques avec une structure spécifique.Ces attaques sont trouvées par un programme cherchant des attaques automatiquement. Nous avons notamment mis en avant la possibilité d'études sur les attaques différentielles improbables. / The first part of the thesis is the cryptanalysis of generalized Feistel networks with the use of the variance method.This method allows to improve existing attacks by two ways: data complexity or the number of rounds. In order to do that, we have developed a tool which computes the right values of expectations and variances.It provides a better analysis of the attacks.In the second part, we have studied the EGFN a new family of generalized Feistel networks. We have used the variance method and our tool in order to build some differential attacks. Simulations were made to confirm the theoritical study.In the last part, we have studied LILLIPUT, a concret cipher based on the EGFN.We have provided a differential analysis and build differential attacks which have unusual conditions. These attacks were found empirically by a tool that automatically look for differential attacks. In particular, we have highlighted some improbable differential attacks.

Design and analysis of lightweight block ciphers have become more popular due to the fact that the future use of block ciphers in ubiquitous devices is generally assumed to be extensive. In this respect, several lightweight block ciphers are designed, of which HIGHT is proposed by Hong et al. at CHES 2006 as a constrained hardware oriented block cipher. HIGHT is shown to be highly convenient for extremely constrained devices such as RFID tags and sensor networks and it became a standard encryption algorithm in South Korea. Impossible differential cryptanalysis is a technique discovered by Biham et al. and is applied to many block ciphers including Skipjack, IDEA, Khufu, Khafre, HIGHT, AES, Serpent, CRYPTON, Twofish, TEA, XTEA and ARIA. The security of HIGHT against impossible differential attacks is investigated both by Hong et al. and Lu: An 18-round impossible differential attack is given in the proposal of HIGHT and Lu improved this result by giving a 25-round impossible differential attack. Moreover, Lu found a 28-round related-key impossible differential attack which is the best known attack on HIGHT. In related-key attacks, the attacker is assumed to know the relation between the keys but not the keys themselves. In this study, we further analyzed the resistance of HIGHT against impossible differential attacks by mounting a new 26-round impossible differential attack and a new 31-round related-key impossible differential attack. Although our results are theoretical in nature, they show new results in HIGHT and reduce its security margin further.

Cryptanalytic methods are very important tools in terms of evaluating the security of block ciphers in a more accurate and reliable way. Differential and linear attacks have been the most effective cryptanalysis methods since the early 1990s. However, as the technology developed and more secure ciphers are designed, these fundamental methods started to be not so efficient. In order to analyze the ciphers, new methods should be introduced. One approach is inventing new techniques that are different from the existing ones. Another approach is extending or combining known cryptanalytic methods to analyze the cipher in a different way. This thesis is a survey of the attacks that are generated by combination of existing techniques and their applications on specific block ciphers. Mentioned attacks are namely differential-linear, differential-bilinear, higher order differential-linear, differential-nonlinear, square-nonlinear, impossible differential and boomerang type attacks.

Title: Solving AX-equations Author: Jan Butora Department: Department of algebra Supervisor: doc. RNDr. Jiří Tůma, DrSc., Department of algebra Abstract: In this work, we present concept of AX-equations and focus on two such equations. Using similiar techniques, we build a theory for both equations, which allows us to express number of their solutions based only on their parameters. Using this theory, we demonstrate on an example that differential steps, used in differential cryptanalysis of modular addition, are not independent. Moreover, based on this theory we introduce and implement fast algorithms for searching solutions. Keywords: differential cryptanalysis, AX-equations, modular addition, carry, sol- vability condition

In this thesis, we analyze the cryptographic sponge function family Keccak - the winner of the SHA-3 Cryptographic Hash Standard competition. Firstly, we explore how higher order differentials can be used to forge a tag in a parallelizable MAC function. We introduce new terms and theory studying what affine spaces remain affine after one round of Keccak's underlying permutation Keccak-f. This allows us to improve the forgery. Secondly, collisions in Keccak could be generated from pairs of values, that follow particular differential trails in Keccak-f. We tested finding pairs for a given differential trail in reduced-round Keccak-f using algebraic techniques with the mathematics software SAGE. We found a pair in a 4-round trail in Keccak-f[50] in under 5 minutes and a 3-round trail in Keccak-f[100] in 80 seconds on a regular PC. Powered by TCPDF (www.tcpdf.org)

Les travaux exposés dans cette thèse se situent à l’interface des mathématiques discrètes, des corps finis et de la cryptographie symétrique.Les 'boîtes-S’ sont des fonctions non-linéaires de petites tailles qui constituent souvent la partie de confusion, indispensable, des chiffrements par blocs ou des fonctions de hachages.Dans la première partie de cette thèse, nous nous intéressons à la construction de boîtes-S bijectives résistantes aux attaques différentielle. Nous étudions l’inverse pour la composition des monômes de permutations optimaux vis-à-vis du critère différentiel. Nous explorons ensuite des classes spécifiques de polynômes creux. Enfin, nous construisons des boîtes-S à partir de leurs dérivées discrètes.Dans la deuxième partie, nous portons notre attention sur la cryptanalyse différentielle impossible. Cette cryptanalyse à clairs choisis très performante pour attaquer des chiffrements par blocs itératifs, exploite la connaissance d’une différentielle de probabilité zéro pour écarter les clés candidates. Elle est très technique, et de nombreuses erreurs ont été repérées dans des travaux passés, invalidant certaines attaques. Le but de ces travaux est de formaliser et d’automatiser l’évaluation des complexités d’une telle attaque afin d’unifier et d’optimiser les résultats obtenus. Nous proposons aussi de nouvelles techniques réduisant les complexités cette cryptanalyse. Nous démontrons enfin l’efficacité de notre approche en fournissant les meilleures cryptanalyses différentielles impossibles contre les chiffrements CLEFIA, Camellia, LBlock et Simon. / The work I have carried out in this thesis lie between discrete mathematics, finite fields theory and symmetric cryptography. In block ciphers, as well as in hash functions, SBoxes are small non-linear and necessary functions working as confusion layer.In the first part of this document, we are interesting in the design of bijective SBoxes that have the best resistance to differential attacks. We study the compositional inverse of the so-called Almost Perfect Nonlinear power functions. Then, we extensively study a class of sparse permutation polynomials with low differential uniformity. Finally, we build functions, over finite fields, from their discrete derivatives.In the second part, we realize an automatic study of a certain class of differential attacks: impossible differential cryptanalysis. This known plaintexts attack has been shown to be very efficient against iterative block ciphers. It exploits the knowledge of a differential with probability zero to occur. However this cryptanalysis is very technical and many flaws have been discovered, thus invalidating many attacks realized in the past. Our goal is to formalize, to improve and to automatize the complexity evaluation in order to optimize the results one can obtain. We also propose new techniques that aims at reducing necessary data and time complexities. We finally prove the efficiency of our method by providing some of the best impossible differential cryptanalysis against Feistel oriented block ciphers CLEFIA, Camellia, LBlock and Simon.

S-boxes are key components of many symmetric cryptographic primitives. Among them, some block ciphers and hash functions are vulnerable to attacks based on differential cryptanalysis, a technique introduced by Biham and Shamir in the early 90’s. Resistance against attacks from this family depends on the so-called differential properties of the S-boxes used. When we consider S-boxes as functions over finite fields of characteristic 2, monomials turn out to be good candidates. In this Master’s Thesis, we study the differential properties of a particular family of monomials, namely those with exponent 2ͭᵗ-1 In particular, conjectures from Blondeau’s PhD Thesis are proved. More specifically, we derive the differential spectrum of monomials with exponent 2ͭᵗ-1 for several values of t using a method similar to the proof Blondeau et al. made of the spectrum of x -<img src="http://www.diva-portal.org/cgi-bin/mimetex.cgi?%5Crightarrow" /> x⁷. The first two chapters of this Thesis provide the mathematical and cryptographic background necessary while the third and fourth chapters contain the proofs of the spectra we extracted and some observations which, among other things, connect this problem with the study of particular Dickson polynomials.

Cyclic-additive-difference sets are combinatorial objects defined by Claude Carlet in 2018. It is, in some sense similar to cyclic difference sets, a well-known concept. In this thesis, first we summarize the current knowledge about cyclic-additive-difference sets and their connection to differential cryptanalysis. Then we present our own results. First, we prove the existence of three infinite families of cyclic-additive-difference sets arising from powers of Singer sets which is an open problem asked by Carlet in 2019. Then we generalize the definition of cyclic-additive-difference sets to the fields of odd characteristic and study similar sets in odd characteristic case. 1