Improving the Security Bounds against Differential Attacks for Pholkos Family

Abstract

At CT-RSA 2022, Bossert et al. proposed Pholkos family, an efficient large-state tweakable block cipher. In order to evaluate the security of differential attacks on Pholkos, they obtained the lower bounds for the number of active S-boxes for Pholkos using MILP (Mixed Integer Linear Programming) tools. Based on it, they claimed that Pholkos family is secure against differential attacks. However, they only gave rough security bounds in both of related-tweak and related-tweakey settings. To be more precise, they estimated the lower bounds of the number of active S-boxes for relatively-large number of steps by just summing those in the small number of steps.

In this paper, we utilize efficient search methods based on MILP to obtain tighter lower bounds for the number of active S-boxes in a larger number of steps. For the first time, we derive the exact minimum number of active S-boxes of each variant up to the steps where the security against differential attacks can be ensured in related-tweak and related-tweakey settings. Our results indicate that Pholkos-256-128/256-256/512/1024 is secure after 4/5/3/4 steps in the related-tweak setting, and after 5/6/3/4 steps in the related-tweakey setting, respectively. Our results enable reducing the required number of steps to be secure against differential attacks of Pholkos-256-256 in related-tweak setting, and Pholkos-256-128/256 and Pholkos-1024 in the related-tweakey setting by one step, respectively.