@article{Song_Qin_Hu_2019, title={Boomerang Connectivity Table Revisited. Application to SKINNY and AES}, volume={2019}, url={https://tosc.iacr.org/index.php/ToSC/article/view/7399}, DOI={10.13154/tosc.v2019.i1.118-141}, abstractNote={<p>The boomerang attack is a variant of differential cryptanalysis which regards a block cipher E as the composition of two sub-ciphers, i.e., <em>E</em> = <em>E</em><sub>1</sub> <span style="color: #501c7b; font-family: Arial, Helvetica;"><span style="color: #501c7b; font-family: Arial, Helvetiva;"><span style="font-family: Times New Roman;">o</span></span></span> <em>E</em><sub>0</sub>, and which constructs distinguishers for <em>E</em> with probability <em>p</em><sup>2</sup><em>q</em><sup>2</sup> by combining differential trails for <em>E</em><sub>0</sub> and <em>E</em>1 with probability <em>p</em> and <em>q</em> respectively. However, the validity of this attack relies on the dependency between the two differential trails. Murphy has shown cases where probabilities calculated by <em>p</em><sup>2</sup><em>q</em><sup>2</sup> turn out to be zero, while techniques such as boomerang switches proposed by Biryukov and Khovratovich give rise to probabilities greater than <em>p</em><sup>2</sup><em>q</em><sup>2</sup>. To formalize such dependency to obtain a more accurate estimation of the probability of the distinguisher, Dunkelman <em>et al.</em> proposed the sandwich framework that regards <em>E</em> as <em>Ẽ</em><sub>1</sub> <span style="color: #501c7b; font-family: Arial, Helvetica;"><span style="color: #501c7b; font-family: Arial, Helvetiva;"><span style="font-family: Times New Roman;">o</span></span></span> <em>E<sub>m</sub></em> <span style="color: #501c7b; font-family: Arial, Helvetica;"><span style="color: #501c7b; font-family: Arial, Helvetiva;"><span style="font-family: Times New Roman;">o</span></span></span> <em>Ẽ</em><sub>0</sub>, where the dependency between the two differential trails is handled by a careful analysis of the probability of the middle part <em>E<sub>m</sub></em>. Recently, Cid <em>et al.</em> proposed the Boomerang Connectivity Table (BCT) which unifies the previous switch techniques and incompatibility together and evaluates the probability of <em>E<sub>m</sub></em> theoretically when <em>E<sub>m</sub></em> is composed of a single S-box layer. In this paper, we revisit the BCT and propose a generalized framework which is able to identify the actual boundaries of <em>E<sub>m</sub></em> which contains dependency of the two differential trails and systematically evaluate the probability of <em>E<sub>m</sub></em> with any number of rounds. To demonstrate the power of this new framework, we apply it to two block ciphers SKINNY and AES. In the application to SKINNY, the probabilities of four boomerang distinguishers are re-evaluated. It turns out that <em>E<sub>m</sub></em> involves5 or 6 rounds and the probabilities of the full distinguishers are much higher than previously evaluated. In the application to AES, the new framework is used to exclude incompatibility and find high probability distinguishers of AES-128 under the related-subkey setting. As a result, a 6-round distinguisher with probability 2<sup>−109.42</sup> is constructed. Lastly, we discuss the relation between the dependency of two differential trails in boomerang distinguishers and the properties of components of the cipher.</p>}, number={1}, journal={IACR Transactions on Symmetric Cryptology}, author={Song, Ling and Qin, Xianrui and Hu, Lei}, year={2019}, month={Mar.}, pages={118–141} }