【摘要】 GIFT算法是CHES 2017上推出的新的轻量级密码算法,是Banik等人为庆祝PRESENT算法10周年设计的.GIFT算法的结构跟PRESENT相似,是经典的SPN结构,有GIFT-64和GIFT-128两个版本,其分组长度分别为64和128比特,轮数分别是28轮和40轮.GIFT算法跟PRESENT算法相比较,结构方面更加的小巧,效率方面也更加高效,按照轮函数实现方式在效率方面不亚于SIMON算法和SKINNY算法.在安全性方面,GIFT-64算法甚至还改进了PRESENT算法针对线性近似存在的缺陷.从算法设计的结构方面看,GIFT-64算法线性层只有置换,不单独产生扩散效果,S盒是唯一的非线性部件,密钥加层只有一半的比特有密钥的介入和7比特的常数介入.基于GIFT-64算法的特点,对差分路径的输入状态设定输入活性比特数小于8同时活性S盒数目不多于2个的条件,并在差分寻找的过程中,对整条路线的概率和活性S盒的数目都加以控制,我们找到了10轮概率为2-57的差分路径.基于此差分路线我们给出了GIFT-64算法16轮和17轮的差分分析,并且在分析过程中给出了数据复杂度、时间复杂度和存储复杂度的估计,最后对差分分析的成功率进行了估计.更多还原

【Abstract】 GIFT is a new lightweight block cipher proposed by Banik et al. at CHES 2017 for celebrating the 10 th anniversary of PRESENT. Similar to PRESENT, GIFT is in SPN structure with two distinct versions, namely GIFT-64 and GIFT-128, whose block sizes are 64 and 128 and round numbers are 28 and 40 respectively. GIFT-64 is much smaller and more efficient than PRESENT,and even outperforms SIMON and SKINNY for round-based implementation. Moreover, in terms of security, GIFT-64 improves the well-known weakness of PRESENT regarding to linear hulls. From the design perspective, the linear layer of GIFT-64 consists of only permutation which performs no diffusion, and the only nonlinear component is the S-box layer. In key addition layer, half block size of key bits and 7 bits of constants are involved. Based on these observations on GIFT-64, we restrict the number of active bits and active S-boxes of the input difference to no more than 8 and 2 respectively.Then by controlling the number of active S-boxes and the probability, we found a 10-round differential path with probability 2-57. Based on the differential path we give 16-and 17-round differential analysis of GIFT-64. We also estimate the data, time and memory complexity as well as the success probability.更多还原