Integral cryptanalysis on reduce-round SAILFISH-I

Abstract SAILFISH-I, first proposed by Agarwal et al. in 2022, is a lightweight block cipher with a typical Feistel structure, which is evaluated for the first time in this paper for its resistance to integral cryptanalysis. Firstly, the S-box and the overall structure are modeled based on the MILP method. We can find 11-round integral distinguishers for SAILFISH-I, which further reduces the number of active bits to find 10-round integral distinguishers with 57 active bits. Secondly, one round is added in front of the distinguisher and three rounds are added at the back, while the partial sum technique is used for the first time to recover the key of SAILFISH-I for 14-round. In the whole process of integral attack, the required data complexity is adding one round in front of the distinguisher and three rounds at the same time, using the partial sum technique. For the key recovery of SAILFISH-I for the first time, the required data complexity is $$2^{59}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msup> <mml:mn>2</mml:mn> <mml:mn>59</mml:mn> </mml:msup> </mml:math> chosen plaintexts, the time complexity is $$2^{59.42}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msup> <mml:mn>2</mml:mn> <mml:mrow> <mml:mn>59.42</mml:mn> </mml:mrow> </mml:msup> </mml:math> times 14-round of encryption, and the memory complexity is $$2^{57}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msup> <mml:mn>2</mml:mn> <mml:mn>57</mml:mn> </mml:msup> </mml:math> . Finally, based on the 14-round key recovery attack, the guessing order of key bits is optimized, and the 18-round key recovery attack on SAILFISH-I is completed for the first time. Throughout the integral attack process, we recover 97 bits of key with $$2^{61.64}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msup> <mml:mn>2</mml:mn> <mml:mrow> <mml:mn>61.64</mml:mn> </mml:mrow> </mml:msup> </mml:math> chosen plaintexts and $$2^{147.06}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msup> <mml:mn>2</mml:mn> <mml:mrow> <mml:mn>147.06</mml:mn> </mml:mrow> </mml:msup> </mml:math> time complexity of the 18-round encryption. Moreover, if we can use the balanced bits fully, then the number of recoverable key bits will rise to 129.