SAT-Based Differential Analysis of Initialization Phase of AEGIS/Tiaoxin-346/Rocca/Rocca-S

We examine the security of AES-based authenticated encryption schemes including the AEGIS family, Tiaoxin-346, Rocca and Rocca-S. In existing work, Takeuchi et al. evaluated the security against differential attacks for the initialization phase of AEGIS and Rocca and estimated the lower bounds for the number of active S-boxes by byte-wise search. Similarly, Shiraya et al. evaluated the security against differential attacks for the initialization phase of Tiaoxin-346. However, the byte-wise evaluation might underestimate the lower bounds for the number of active S-boxes as it might include invalid characteristics. In this paper, we conduct a bit-wise evaluation of the AEGIS family, Tiaoxin-346, Rocca, and Rocca-S to obtain exact lower bounds for the number of active S-boxes by the boolean satisfiability problem (SAT) tools. Besides, we derive the optimal differential characteristics in the initialization phase. As a result, we update the lower bounds for the number of active S-boxes in some rounds for each targets and derived the probability of optimal differential characteristics for the first time, which allowed us to find longest differential distinguisher of initialization phase on AEGIS family, Tiaoxin-346, Rocca and Rocca-S. As far as we known, our results are the first bit-wise distinguishing attacks on initialization phases of AEGIS, Tiaoxin-346, Rocca, and Rocca-S.