Chengcheng Chang
School of Cyber Science and Technology, Shandong University, Qingdao, Shandong, China; Quancheng Laboratory, Jinan, China; Key Laboratory of Cryptologic Technology and Information Security, Ministry of Education, Shandong University, Jinan, China; State Key Laboratory of Cryptography and Digital Economy Security, Shandong University, Qingdao, China

Hosein Hadipour
Ruhr University Bochum, Bochum, Germany

Kai Hu
School of Cyber Science and Technology, Shandong University, Qingdao, Shandong, China; Quancheng Laboratory, Jinan, China; Key Laboratory of Cryptologic Technology and Information Security, Ministry of Education, Shandong University, Jinan, China; State Key Laboratory of Cryptography and Digital Economy Security, Shandong University, Qingdao, China; Suzhou Research Institute, Shandong University, Suzhou, China

Muzhou Li
School of Cyber Science and Technology, Shandong University, Qingdao, Shandong, China; Quancheng Laboratory, Jinan, China; Key Laboratory of Cryptologic Technology and Information Security, Ministry of Education, Shandong University, Jinan, China; State Key Laboratory of Cryptography and Digital Economy Security, Shandong University, Qingdao, China

Meiqin Wang
School of Cyber Science and Technology, Shandong University, Qingdao, Shandong, China; Key Laboratory of Cryptologic Technology and Information Security, Ministry of Education, Shandong University, Jinan, China; State Key Laboratory of Cryptography and Digital Economy Security, Shandong University, Qingdao, China

Keywords: Boomerang, Fixed-Key, Mix-Basis, Geometric Approach

Abstract

Differential cryptanalysis relies on assumptions such as the Markov cipher property and the hypothesis of stochastic equivalence. The probability of a differential characteristic estimated by classical methods is the key-averaged probability under those assumptions, but the real probability can vary significantly between keys. Tools for differential cryptanalysis in the fixed-key model are therefore desirable. Recently, Beyne and Rijmen applied the geometric approach to differential cryptanalysis and proposed the quasi-differential framework. As a variant of differential cryptanalysis, boomerang attacks rely on similar assumptions, so it is important to study their probability in the fixed-key model as well. A direct extension of quasi-differentials to boomerang attacks leads to a quasi-3-differential framework, but that straightforward approach is difficult in practice because there are too many quasi-3-differential trails. We tackle this problem by applying the mix-basis style geometric approach to boomerang attacks and construct the quasi-boomerang framework. By choosing a suitable pair of bases, the boomerang probability can be computed by summing correlations of quasi-boomerang characteristics, while the influence of keys can be analyzed in a similar way to the quasi-differential framework. We apply the framework to SKINNY-64 and GIFT-64, confirm previously reported distinguishers with high probability, show that a previously considered invalid 19-round distinguisher of GIFT-64 is valid, and also extend the quasi-differential framework to the related-key scenario as an independent contribution.