Differential-Invariant Subspace Cryptanalysis—A Real-Time Attack Against IoT-Friendly Word-Based Block Ciphers

This article considers a new cryptanalysis called differential-invariant subspace cryptanalysis, which can be used to evaluate the security of IoT-friendly word-based block ciphers. This cryptanalysis estimates the behavior of differential propagation for particularly chosen input differences, and applies to the ciphers contain only the word-based components, e.g., word-based S-boxes, word-based linear mappings, etc. First, this article proves that, for any word-based block cipher, if the S-box causes the differential-invariant subspace property, it then indicates a full-round distinguisher with probability 1, even if the target cipher is believed to be resistant enough against traditional differential or linear cryptanalysis. Second, a class of linear-equivalent S-boxes meeting the differential-invariant subspace property are constructed as
$L\circ S\circ L^{-1}$
, where
$L$
is any invertible linear mapping and
$S$
is a group of S-boxes in parallel. Finally, as application, we provide a full-round differential-invariant subspace distinguisher for the variant
Midori128
(the only difference is that the variant version utilizes only one single-type S-box instead of four types). This distinguishing is experimentally verified and could be executed within negligible time.