Abstract:
The guaranteed number of activations (GNA) is an important characteristic that determines the efficiency of differential cryptanalysis of a given $\mathsf{XS}$-circuit. In the paper, we propose an approach to optimize the known GNA calculation algorithm based on the branch and bound method and the analysis of special matrices that define the $\mathsf{XS}$-circuit. Now, it is possible to compute GNA for more than 30 rounds, which would take significantly longer if the original algorithm were used. The optimized algorithm was used for exhaustive enumeration of low-dimensional $\mathsf{XS}$-schemes. We prove that the canonical forms of the $\mathsf{XS}$-circuit and its dual coincide, which provides a strict connection between the guaranteed number of linear and differential activations. Based on computational experiments, several hypotheses have been proposed. One of the hypotheses is that there are no $\mathsf{XS}$-circuits of dimension greater than two that achieve an optimal GNA in every round.
Keywords:guaranteed number of activations, $\mathsf{XS}$-circuit, differential cryptanalysis, linear cryptanalysis, branch and bound method.