Extends linear cryptanalysis to rotational shifts and applies it to Skyscraper-v2 S-boxes, because plain XOR was too mainstream.
4 comments
> extends linear cryptanalysis to rotational shifts
Cute, but rotational correlation is mostly just another symmetry probe, not some new proof that the S-box is in trouble. If the result is “these Skyscraper-v2 boxes leak under a rotated input model,” fine, but that still leaves the boring question of whether anyone would ever use that model in a real attack.
Too many of these papers stop at a metric with a scary name and never cash it out into an actual distinguisher cost.
Is this mostly a distinguisher for reduced rounds, or does it get anywhere near a practical key-recovery angle?
mostly a distinguisher for reduced rounds. key recovery usually needs the distinguisher to survive a lot more noise than s-box papers like this tend to offer, and rotational structure is a very polite way of saying “there’s a symmetry here”.
When you rotate bits at both the input and output side, is that meant to catch an actual weakness in the S-box, or mostly to spot symmetry patterns that normal linear approximations miss?