基于矩阵方法的减轮μ^(2)算法不可能差分分析  

Impossible differential cryptanalysis of reduced-round μ^(2) algorithm based on matrix method

作　　者：杜小妮 余恬[1] 贾美纯 梁丽芳 DU Xiaoni;YU Tian;JIA Meichun;LIANG Lifang(College of Mathematics and Statistic,Northwest Normal University,Lanzhou 730070,China;Key Laboratory of Cryptography and Data Analytics,Northwest Normal University,Lanzhou 730070,China)

机构地区：[1]西北师范大学数学与统计学院,甘肃兰州730070 [2]西北师范大学密码技术与数据分析重点实验室,甘肃兰州730070

出　　处：《通信学报》2024年第11期106-113,共8页Journal on Communications

基　　金：国家自然科学基金资助项目(No.62172337);甘肃省自然科学基金重点资助项目(No.23JRRA685);甘肃省基础研究创新群体基金资助项目(No.23JRRA684)。

摘　　要：为了评估μ^(2)算法在不可能差分分析方面的安全性,首先基于矩阵方法,结合中间相错技术构造了μ^(2)算法的9轮不可能差分区分器。其次在该区分器的基础上分别向前和向后扩展2轮,利用密钥桥技术,对μ^(2)算法进行了13轮密钥恢复攻击。研究结果表明,该攻击可恢复45 bit主密钥,数据复杂度为242.5个选择明文,时间复杂度为265.3次13轮算法加密。相比之前的研究结果,该研究实现了最长的攻击轮数,且数据复杂度显著降低。To evaluate the security ofμ^(2) algorithm in impossible differential cryptanalysis,a 9-round impossible differen‐tial distinguisher ofμ^(2) algorithm was constructed based on matrix method and meet-in-the middle technique firstly.Then,with the utilization of key-bridge technique,a 13-round key recovery attack was presented toμ^(2) algorithm by expanding the 9-round distinguisher forward and backward 2 rounds,respectively.The results show that the master key can be re‐covered 45 bit in the attack,the data complexity of plaintexts is 242.5,and the time complexity of 13 rounds of algorithm encryptions is 265.3.Compared with the previous research,the study achieves the longest attack rounds,and the data com‐plexity is effectively reduced.

关 键 词：轻量级分组密码 μ^(2)算法 不可能差分分析 矩阵方法 

分 类 号：TP309.7[自动化与计算机技术—计算机系统结构]