Extended c-differential distinguishers of full 9 and reduced-round Kuznyechik cipher

TL;DR

This paper develops a new inner $c$-differential cryptanalysis technique, enabling practical analysis of Kuznyechik cipher's security by constructing trails and distinguishers with improved probabilities and low p-values.

Contribution

It introduces the inner $c$-differential approach, establishing a duality with outer $c$-differential uniformity, and applies it to Kuznyechik to improve differential trails and develop a statistical distinguisher.

Findings

Constructed 2-round $c$-differential trails with probability $2^{-84.0}$

Constructed 3-round $c$-differential trails with probability $2^{-169.7}$

Developed a statistical distinguisher requiring $2^{33}$ data and $2^{34}$ time complexity

Abstract

This paper introduces {\em truncated inner $c$-differential cryptanalysis}, a technique that enables the practical application of $c$-differential uniformity to block ciphers. While Ellingsen et al. (IEEE Trans. Inf. Theory, 2020) established the notion of $c$-differential uniformity by analyzing the equation $F(x\oplus a) \oplus cF(x) = b$, a key challenge remained: the outer multiplication by $c$ disrupts the structural properties essential for block cipher analysis, particularly key addition. We address this challenge by developing an \emph{inner} $c$-differential approach where multiplication by $c$ affects the input: $(F(cx\oplus a), F(x))$, thereby returning to the original idea of Borisov et al. (FSE, 2002). We prove that the inner $c$-differential uniformity of a function $F$ equals the outer $c$-differential uniformity of $F^{-1}$, establishing a duality between the two notions. This modification preserves cipher structure while enabling practical cryptanalytic applications. We apply our methodology to Kuznyechik (GOST R 34.12-2015) without initial key whitening. For reduced rounds, we construct explicit $c$-differential trails achieving probability $2^{-84.0}$ for two rounds and $2^{-169.7}$ for three rounds, representing improvements of 5.2 and 4.6 bits respectively over the best classical differential trails. For the full 9-round cipher, we develop a statistical truncated $c$-differential distinguisher. Through computational analysis involving millions of differential pairs, we identify configurations with bias ratios reaching $1.7\times$ and corrected p-values as low as $1.85 \times 10^{-3}$. The distinguisher requires data complexity $2^{33}$ chosen plaintext pairs, time complexity $2^{34}$, and memory complexity $2^{16}$.