![](bg7.png)
obtain that a differential of type [8070070080700700]
can occur at 10 rounds from the beginning with prob-
ability 2
−29.4
. Similarly it can occur 10 rounds from
the end but with probability 2
−29.4
. Overall we ex-
pect only about 2
−29.4−29.4+27.1
= 2
−31.7
pairs (P
i
,P
j
)
on average will have the propagation characteristic as
shown. Therefore the two sets are entirely disjoint
with high probability. This gives us an ADV of ap-
proximately 25.8 standard deviations.
5.2 Gost28147-CryptoProParamSetA
In this section we present the results obtained when
our methodology is applied to the GOST which uses
the set of S-boxes as described in Table 3.
Table 3: The set of S-boxes named Gost28147-
CryptoProParamSetA.
Order Gost28147-CryptoProParamSetA
1 10,4,5,6,8,1,3,7,13,12,14,0,9,2,11,15
2 5,15,4,0,2,13,11,9,1,7,6,3,12,14,10,8
3 7,15,12,14,9,4,1,0,3,11,5,2,6,10,8,13
4 4,10,7,12,0,15,2,8,14,1,6,5,13,11,9,3
5 7,6,4,11,9,12,2,10,1,8,0,14,15,13,3,5
6 7,6,2,4,13,9,15,0,10,1,5,11,8,14,12,3
7 13,14,4,1,7,0,5,10,3,12,8,15,6,2,9,11
8 1,3,10,9,5,11,4,15,8,6,7,14,13,0,2,12
Result 5.2.1.
0770070077777770
↓(10R)
[7007070070070700]
↓ (10R)
7777777007700700
is a 20 rounds distinguisher for this variant of GOST,
where [7007070070070700] is a closed set.
Justification: For a typical permutation on 64-bits
(does not have to be a random permutation, it can
be GOST with more rounds) we expect that there are
2
55.1
pairs (P
i
,P
j
) with such differences. The distribu-
tion of this number can be approximated by a Gaus-
sian with a standard deviation 2
27.55
.
For 18 rounds of GOST and for a given random
GOST key, there exists two disjoint sets of 2
55.1
+
2
33.0
such pairs (P
i
,P
j
).
None of the 2
33.0
pairs (P
i
,P
j
) is a member of the
2
55.1
occurring naturally. For any of these cases which
occur naturally, we have a non-zero input differen-
tial 0770070077777770. By a computer simulation
we obtained the probability for a differential of type
[7007070070070700] to occur at 10 rounds from the
beginning and Similarly to occur 10 rounds from the
end. Overall we expect only about 2
1.47
pairs (P
i
,P
j
)
on average will have the propagation characteristic as
shown. Therefore the two sets are entirely disjoint
with high probability. This gives us an ADV of ap-
proximately 42.24 standard deviations.
6 CONCLUSIONS
GOST is an important government and industrial
block cipher with a 256-bit key which is widely
used implemented in standard crypto libraries such as
OpenSSL and Crypto++ (GOST, 2005). Until 2010
there was not attacks on GOST when used in encryp-
tion such as advanced differential attacks.
The most difficult step involved in all these ad-
vanced differential attacks on full GOST is the design
of a distinguisher for some 20 Rounds using differ-
entials of special form constructed based on the con-
nections between the S-boxes (Courtois and Misztal,
2011).
In this paper we have for the first time proposed a
methodology which allows for efficient discovery of
”good” attacks of this type.
In order to achieve this we have introduced a fun-
damental notion of ”general open sets”, which are
special sets consisting of 32-bit strings which are dic-
tated by the structure of GOST. The methodology
we provide regarding the construction of reduced-
round distinguishers can be seen as a series of ad-
vanced combinatorial optimization problems which is
obtained by studying the low-levelstructure of GOST:
the S-boxes and the connections between them, then
we study how differentials from various open sets can
only lead to other very specific open sets with high
probability, and then we construct distinguishers for
more rounds.
Our methodology is validated by the construction
of very good distinguishers for 20 rounds for two vari-
ants of GOST; ”GostR3411-94-TestParamSet”, and
”Gost28147-CryptoProParamSetA”.
This paper introduces important enhancements
and new forms of advanced differential attacks which
can be applied to any block cipher in order to improve
known attacks such as Knudsen truncated differential
attacks and Seki-Kaneko-Misztal-Courtois attacks on
GOST and many other.
REFERENCES
A. Poschmann, S. L. and Wang, H. (2010). 256 bit stan-
dardized crypto for 650 ge gost revisited. In In CHES
2010, LNCS 6225, pp. 219-233.
EnhancedTruncatedDifferentialCryptanalysisofGOST
417