On Perfect Linear Approximations and Differentials over Two-Round SPNs


Conference / Medium


Patrick Neumann Lukas Stennes Gregor Leander Patrick Felke Christof Beierle

Research Hub

Research Hub A: Kryptographie der Zukunft

Research Challenges

RC 1: Cryptography against Mass Surveillance


Recent constructions of (tweakable) block ciphers with an embedded cryptographic backdoor relied on the existence of probability-one differentials or perfect (non-)linear approximations over a reduced-round version of the primitive. In this work, we study how the existence of probability-one differentials or perfect linear approximations over two rounds of a substitution-permutation network can be avoided by design. More precisely, we develop criteria on the s-box and the linear layer that guarantee the absence of probability-one differentials for all keys. We further present an algorithm that allows to efficiently exclude the existence of keys for which there exists a perfect linear approximation.


Symmetric Cryptography