SCAN-C: a lightweight cryptographic algorithm to secure CAN communications in modern vehicles

Abstract

A controller area network (CAN, ISO-11898:2003) is the central nervous system of contemporary, high-tech vehicles, which links electronic control units (ECUs) to offer a distinctive driving experience through data communication. We propose a lightweight cryptographic algorithm SCAN-C with a unique architecture to secure data communication over the CAN bus in contemporary vehicles. It is a 64-bit block cipher supporting a 160-bit primary key with 12 iterative rounds. The proposed algorithm has a unique hybrid architecture with two structural combinations. The key generation schedule has multiplexers, linear feedback shift registers, and a nonlinear function. The encryption schedule has a Feistel and uniform substitution-permutation network. The decryption schedule is the same as the encryption, with keys applied in reverse order. The innovative architecture of SCAN-C exhibits low consumption of resources (1197 gate equivalents to implement in hardware), better security with low iterative rounds, and optimal energy efficiency. The experimental results suggest that the SCAN-C is suitable for implementation in hardware and software.

Introduction

The automotive sector with modern contemporary vehicles offers a unique and safe driving experience due to integrated and interconnected road safety networks powered by the Internet of Things (IoT) for real-time data processing. The electronic control units interact with each other via a CAN bus and exchange information with the external network in real time to deliver optimum performance.

The ECUs networked with the CAN bus regulate the operations such as steering, transmission, and electrical accessories of contemporary automobiles, leading to a security risk of high degree (Tindel 2020). The on-board diagnostic interface II (OBD-II) is a known security-prone vector of the CAN bus that increases the vulnerability of the entire system (Shi et al. 2022). If the attacker accesses the CAN bus, the security of the complete vehicle would be compromised, as demonstrated by hijacking the Jeep Cherokee remotely (Lu et al. 2019). It was possible in the absence of appropriate encryption and authentication measures, which resulted in various types of assaults and endangers the privacy and safety of the passengers in the car. Thus, the CAN bus system is more vulnerable to cyberattacks like eavesdropping, message-tampering, message fabrication, and reply attacks (Levy et al. 2021).

Related work

Lightweight cryptography is the only suitable technology to secure resource-constrained devices such as IoT in connected environments.

Lu et al. (2019) proposed a lightweight encryption and authentication protocol (LEAP) based on the Rivest Cipher 4 (RC4) algorithm. The technique identifies one of the secured ECUs to generate and distribute the session keys periodically to the rest of the ECUs, which may result in underperformance.

Hyun Park et al. (2021) proposed a hybrid algorithm with symmetric and asymmetric-key cryptographic methods to secure the information over the CAN bus. The proposed method exploits advanced encryption standards (AES) to encrypt and decrypt the message. The Diffie-Helman key-exchange method was employed to exchange keys. An elliptic curve digital signature algorithm (ECDSA) was employed to authenticate a source and messages. A shared key and a sequence number are the parameters used to generate a one-time encryption key for each packet of the CAN bus using a password-based key-derivation function 2 (PKDF2). Thus, the proposed method is too complex and degrades the system's performance.

Castiglione et al. (2020) examined the possibility of securing the CAN bus messages using the encryption algorithms PRESENT, SIMON, and SPECK. Algorithms provide security at the cost of complexity. Bogdanov et al. (2007) devised an encryption algorithm PRESENT: An Ultra-Lightweight Block Cipher for data security on the line of AES for resource-constrained devices. It is a block cipher with multiple rounds and a key length of 80 and 128 bits. It is complex and not suitable for resource-constrained devices.

Siddiqui et al. (2017) proposed mutual authentication and a message encryption scheme based on a physical unclonable function (PUF) to secure messages over the CAN bus. The scheme employs the elliptic Curve Diffie-Helman (ECDH) algorithm to exchange keys. The complexity is that the cipher requires large data memory to store session keys and public keys, including the public-private key pair generation.

Jakul et al. (2015) proposed a tiny encryption algorithm (TEA) to secure CAN bus communication. The complexity of key generation and distribution are the major issues of TEA.

Yeom and Seo (2020) investigated the suitability of the shuffling algorithm for securing messages over the CAN bus. Fisher-Yates initially designed the shuffling algorithm to generate a random permutation of finite sequences. The investigation revealed that message security depends on the block size if the shuffling algorithm is employed.

Farag (2017) presented a CANTrack computer-aided design tool-powered investigation of message security over the CAN bus using an intuitive algorithm. The results were positive. Pese et al. (2021) developed a sufficiently secure controller area network by leveraging protocol-specific properties, such as differential signal levels, to provide security instead of using cryptographic primitives. Since signal levels of the protocol depend upon the network clock, synchronization, and operating conditions, the proposed cipher is not advisable. The related work (and introduction) comprises old and recent articles up to 2023.

Motivation

The many interconnected, resource-constrained systems in modern cars necessitate effective yet reliable encryption techniques to guarantee secure communication. These environments are unsuitable for traditional encryption algorithms because of their high computational and memory requirements. As pointed out, there are still significant gaps in the trade-off between the level of security and resource consumption, security, and performance despite the development of lightweight block ciphers to overcome these limitations.

Contributions

We propose a SCAN-C (signifies secured controller area network for communications) new lightweight block cipher optimized for resource-constrained devices (ECUs) in connected and autonomous vehicles.

We summarize the technical and contextual contributions of this unique research as follows:

1. A unique hybrid architecture encompassing uniquely designed round key generation and encryption schedule built with multilayer F function embedded in the Feistel network improves the diffusion effect.

2. The cipher ensures the confidentiality and integrity of the data over the CAN bus with a sufficient security margin within 12 rounds, thereby improving processing speed. The maximum differential and linear probability of 2^–272 and 2^–274 ensures this aspect.

3. The cipher implemented using an ASIC cell library of 0.13um technology consumes only 1197 GEs. It is suitable for resource-constrained ECUs.

4. It (SCAN-C) requires only 2459.3 execution cycles, which include key generation, encryption, and decryption when implemented in a generic hardware platform Arduino Uno (ATmega 320 microcontroller) compared to 17,428 cycles of PRESENT, 3248 cycles of RBFK-64, 4084 cycles of SPECK, and 14,076 cycles of AES. It is thus suitable for resource-constrained ECUs and IoT devices.

5. Since the SCAN-C has a 64-bit block, and CAN has a payload size equal to a 64-bit block, it is well suited to operate efficiently in ECUs. The encrypted payload resists passive eavesdropping, and replay attacks.

In summary, we focused on achieving a secure, scalable, energy-efficient, hardware and software-friendly lightweight block cipher to secure data communications over the CAN bus in autonomous, connected vehicles powered by IoT devices. The contributions list is limited to five only.

Organization

The rest of the article is arranged into sections as follows. The section "Background" presents the details of the area of concern. The section "Proposed Algorithm" describes the design of the cipher. The analysis of cipher resistivity to known classical attacks is in the "Security Analysis" section. The performance assessment is in the “Performance Analysis" section. The summary of the work is in the "Research Summary" section. The last section is "Conclusion and Future Scope".

Background

This section covers an overview of the CAN bus protocol, threat model, and security goals of this research.

Overview-the CAN bus

A controller area network (CAN) bus is an electronic communication bus defined by the ISO 11898-1/2 standards (1983 to 1986/ Revised in 2003) for the intercommunication between the various electronic control units employed in connected and autonomous vehicles. The most important advantage of this protocol standard was its ability to accommodate several ECUs to connect economically and efficiently.

The CAN bus protocol is a message-based communication with prioritization decided by a listen-and-respond technique to avoid critical data loss. This protocol supports two data frame formats for communication viz; the basic frame format shown in Fig. 1a and the extended frame format Fig. 1b on the next page.

[See PDF for image]

Fig. 1

a The structure of the CAN standard frame. b The structure of the CAN extended frame

Data, remote, error, and overload are the frames of four types supported by the CAN protocol. The data frame is the main frame in the CAN bus communication. The maximum data over the CAN bus that could be transmitted is 64 bits in both standard formats at configurable speeds of 250 kbps, 500 kbps, and 1 Mbps.

Threat model of CAN bus

Figure 2 shows the threat model of the CAN bus with legitimate and malicious nodes. The threat model has two legitimate ECUs (ECU-1 and ECU-2) and ECU-3 as a malicious node. The adversary can attack the CAN bus either through the onboard diagnostic II (OBD-II) connector or by compromising on one of the ECUs remotely within the network.

[See PDF for image]

Fig. 2

CAN bus threat model

Adversaries can gain access to the CAN bus, either by physically connecting a malicious ECU or by compromising an existing ECU remotely.

The anticipated specific threats to the CAN bus communications are as follows.

1. Messages sent over the CAN bus can be intercepted, changed, or deleted.

2. Adversaries can hijack the session key.

3. Adversaries can seize the BUS by flooding it with messages from malicious ECUs.

Security goals

The security goals of the proposed research are to ensure.

1. Confidentiality: The cipher must ensure that the messages between the two legitimate entities remain inaccessible and secret.

2. Message Integrity: The cipher must ensure the messages are unmodified or deleted by adversaries.

3. Availability: The protocol must have low computational and communication costs to ensure the timely availability of messages between entities and remain in service.

4. Forward security: The protocol must ensure that the current and previous sessions have no relation.

Proposed algorithm

SCAN-C is a symmetric 64-bit block cipher with a 160-bit primary key iterating over 12 rounds. It encompasses a unique round key generation and encryption schedules. Table 1 shows the notations used in the article.

Table 1. Notations

Sl no.	Notation	Function
1	⊕	XOR
2	⊙	XNOR
3	∥, ∦	Concatenation
4	ρ	Round number

Round key generation

Architecture

Figure 3 illustrates the architecture of the three-layered round key generator.

[See PDF for image]

Fig. 3

Architecture of round key generation

Layer 1 has three linear feedback shift registers (LFSRs) with 89-bit, 37-bit, and 34-bit lengths connected serially. The combination has a 160-bit length. Each LFSR has a fixed primitive polynomial with taps. All 160 bits are parallel-tapped to form output bits.

Layer 2 has five 32:1 multiplexers, and each multiplexer requires five selection bits to produce an output bit. The parallel-tapped 160 bits of the first layer are divided into five groups of 32 bits each to feed to all multiplexers of layer 2.

Layer 3 has a single five-bit input nonlinear function and produces a single-bit output. The nonlinear function f(x) is defined by Eq. (1).

1

$$\begin{array}{c}\text{f}\left(\text{x}\right)=\overline{\text{X}1\text{X}2\text{X}3\text{X}4}+\overline{\text{X}1\text{X}2\text{X}5}\left(\text{X}3\oplus \text{X}4\right)\\ +\overline{\text{X}1}\text{X}2\overline{\text{X}3}\text{X}4+\overline{\text{X}1}\text{X}2\text{X}3\left(\overline{\text{X}4\oplus \text{X}5}\right)\\ +\text{X}1\overline{\text{X}2\text{X}3\text{X}5}+\text{X}1\text{X}3\left(\text{X}4\oplus \text{X}5\right)\\ +\text{X}1\text{X}2\overline{\text{X}3}\text{X}4\text{X}5+\text{X}1\text{X}2\text{X}3\overline{\text{X}4\text{X}5}\\ \end{array}$$

Configuration of round key generator

As illustrated in Fig. 3, the round key generator requires 160-bit initial bits for layer 1 and 25 (5 × 5) selection bits for layer 2 to generate a bit stream. These 185 = 160 + 25 bits form a session key generated from a session key generator described in Appendix I. The session key is denoted by (sk₁₈₄-sk₀). As and when required, the key generator is loaded with appropriate session key bits as per Table 2. To be specific, the session key bits sk₂₄-sk₀, select output bit of five multiplexers, sk₁₁₃-sk₂₅, sk₁₅₀-sk₁₁₄, and sk₁₈₄-sk₁₅₁, serve as initial vector bits for 89-bit, 37-bit, and 34-bit LFSRs. The user key is 160-bit initial bits denoted by sk₁₈₄-sk₂₅.

Table 2. Session key bits allocation

Sl No	Mux no.	Key bits	Output bit
1	1	sk4-sk0	X1
2	2	sk9-sk5	X2
3	3	sk14-sk10	X3
4	4	sk19-sk15	X4
5	5	sk24-sk20	X5
6	89-bit LFSR	sk113-sk25	Acts as initial vector bits for LFSRs
7	37-bit LFSR	sk150-sk114
8	34-bit LFSR	sk184-sk151

Round key generation process

As seen in Fig. 3, the round key generator requires at least five clock pulses to generate a single bit of key. The proposed encryption schedule requires 12 × 16 = 192 key bits. Therefore, to generate these 192 key bits, the round key generator is supplied with 5 × 192 clock pulses whenever required. Thus, the generated 192 bits (k₀-k₁₉₁) are split into twelve groups of 16-bit each to form 12 round keys (K1 to K12), shown in Eq. (2).

2

$$\text{K}1={\text{k}}_0-{\text{k}}_{15},\text{K}2={\text{k}}_{16}-{\text{k}}_{31},\text{K}3={\text{k}}_{32}-{\text{k}}_{47},\text{K}4={\text{k}}_{48}-{\text{k}}_{63},\text{K}5={\text{k}}_{64}-{\text{k}}_{79},\text{K}6={\text{k}}_{80}-{\text{k}}_{95},\text{K}7={\text{k}}_{96}-{\text{k}}_{111},\text{K}8={\text{k}}_{112}-{\text{k}}_{127},\text{K}9={\text{k}}_{128}-{\text{k}}_{143},\text{K}10={\text{k}}_{144}-{\text{k}}_{159},\text{K}11={\text{k}}_{160}-{\text{k}}_{175},\text{and K}12={\text{k}}_{176}-{\text{k}}_{191},$$

The proposed round key generator produces a truly random and distinct round key due to linear feedback shift registers with primitive polynomials, multiplexers, and nonlinear functions (Justified in section key cryptanalysis). Since the proposed cipher has a distinct round key generator and encryption/decryption schedules, it ensures more than a 50% avalanche effect (Table 3). It is the best feature and contribution of our research to lightweight cryptography.

Table 3. Truth table of a nonlinear function

Truth Table of Non-linear function
	X5	X4	X3	X2	X1	Output
1	0	0	0	0	0	1
2	0	0	0	0	1	1
3	0	0	0	1	0	0
4	0	0	0	1	1	0
5	0	0	1	0	0	0
6	0	0	1	0	1	0
7	0	0	1	1	0	1
8	0	0	1	1	1	1
9	0	1	0	0	0	0
10	0	1	0	0	1	1
11	0	1	0	1	0	1
12	0	1	0	1	1	0
13	0	1	1	0	0	0
14	0	1	1	0	1	1
15	0	1	1	1	0	0
16	0	1	1	1	1	1
17	1	0	0	0	0	1
18	1	0	0	0	1	0
19	1	0	0	1	0	0
20	1	0	0	1	1	0
21	1	0	1	0	0	1
22	1	0	1	0	1	1
23	1	0	1	1	0	0
24	1	0	1	1	1	1
25	1	1	0	0	0	1
26	1	1	0	0	1	0
27	1	1	0	1	0	1
28	1	1	0	1	1	1
29	1	1	1	0	0	0
30	1	1	1	0	1	0
31	1	1	1	1	0	1
32	1	1	1	1	1	0

Encryption schedule

SCAN-C employs the Feistel and uniform substitution-permutation networks in its encryption/decryption process.

F-function

F function is the critical building block of the encryption/decryption schedule of SCAN-C. It has twelve substitution boxes arranged in a 3 × 4 matrix sandwiched between two fixed permutation layers. It is shown in Fig. 4 and influenced by the tweaked Kazad block cipher proposed by Bogdanov and Rijmen (2014). The F-function encompasses two types of substitution boxes denoted by P and Q (Tables 4 and 5).

[See PDF for image]

Fig. 4

F-function

Table 4. S-box P

i	0	1	2	3	4	5	6	7
S(i)	3	F	E	0	5	4	B	C
i	8	9	A	B	C	D	E	F
S(i)	D	A	9	6	7	8	2	1

Table 5. S-box Q

i	0	1	2	3	4	5	6	7
S(i)	0	8	6	D	5	F	7	C
i	8	9	A	B	C	D	E	F
S(i)	4	E	2	3	9	1	B	A

The SP network of the F function exhibits confusion and diffusion characteristics to satisfy Shannon's criteria. The P and Q tables are distinct and introduce confusion and diffusion in the encryption and decryption processes. Multiplexer and nonlinear functions introduce confusion and diffusion in round key generation. The P and Q tables ensure a 50% avalanche effect on the output compared to the corresponding input. For instance, in the Q table, the bits of output change by 50% when the input bits (0000)2 are replaced by (1001)2.

Architecture

Figure 5 illustrates the architecture of the encryption schedule. The architecture encompasses four columns 1 to 4. The 1st and 4th columns have an XNOR operator to add with round keys. The schedule has an F function between columns 1st and 2nd and between columns 4th and 3rd. The output of the respective F functions is added with swapped column inputs as illustrated in Fig. 5. For example, $R_{1-2}={\mathit{Ef}}_{l1}\oplus P_{1-3}$ and $R_{1-3}={\mathit{Ef}}_{r1}\oplus P_{1-2}$. At the end of the round, $R_{1-1}$ and $R_{1-3}$ are swapped with $R_{1-2}$ and $R_{1-4}$. Thus, a round function encompasses two add-round keys, two F functions, two XOR, and swapping operations.

[See PDF for image]

Fig. 5

Architecture of encryption process

Encryption process

As illustrated in Fig. 5, the encryption architecture accepts 64-bit input in four groups of 16 bits each. The designated groups are P_i–1, P_i–2, P_i–3, and P_i–4. The round key is Ki, where i = 1 to 12 since the cipher has 12 iterations.

Mathematically, the encryption process is expressed as

3

$$R_i=\left\{\begin{array}{c}{P}_{i,j}\otimes K_i;j=1,4\\ P_{i,j+1}\oplus {\mathit{Ef}}_{\mathit{li}};j=2\\ P_{i,j-1}\oplus {\mathit{Ef}}_{\mathit{ri}};j=3\end{array}\right)$$where i = 1 to 12, and indicates the number of rounds, j indicates the column on which the respective operations are applicable. The used round keys are K1 to K12.

The algorithm below describes the encryption process.

Detailed encryption process

As a first step, divide the plaintext of 64 bits into four groups of 16 bits, each designated as $P_{1-1}$, $P_{1-2}$, $P_{1-3}$, and $P_{1-4}$. The process of execution is as follows (first round).

1. Swap $P_{1-2}$, and $P_{1-3}$

2. $R_{1-1}=P_{1-1}\otimes K_1$

3. Input $R_{1-1}$ to F function, which yields ${\mathit{Ef}}_{l1}=F\left(R_{1-1}\right)$.

4. $R_{1-2}={\mathit{Ef}}_{l1}\oplus P_{1-3}$

5. $R_{1-4}=P_{1-4}\otimes K_1$

6. Input $R_{1-4}$ to F function, which yields ${\mathit{Ef}}_{r1}=F\left(R_{1-4}\right)$

7. $R_{1-3}={\mathit{Ef}}_{r1}\oplus P_{1-2}$

For succeeding rounds,

• $P_{2-1}=R_{1-2}$

• $P_{2-2}=R_{1-1}$

• $P_{2-4}=R_{1-3}$

• $P_{2-3}=R_{1-4}$

Repeat the above process for eleven rounds by swapping the necessary data segments, and no swapping is allowed at the last round.

Since the cipher is symmetric, the swapping operation process is not executed in the 12th round to enable the decryption process by reversing the use of round keys.

At the end of every round, the concatenated data is represented by,

4

$$R_i=\left(R_{i-1},\Vert ,R_{i-2},\Vert ,,R_{i-3},\Vert ,R_{i-4}\right)$$

Equation (5) shows the concatenated cipher text obtained after the 12th round.

5

$$C_t=R_{12\_1}\nparallel R_{12\_2}\nparallel R_{12\_3}\nparallel R_{12\_4}$$

Cipher employs two distinct substitution tables (P and Q) to increase the confusion and diffusion properties with a fixed permutation. Logical operators such as XNOR and XOR help the cipher to achieve a high degree of security. The XNOR operator helps to maximize the active S-boxes by activating the data bits that reduce the iterative rounds. It is another contribution of our research to lightweight cryptography.

Summary

This section describes the design intricacies of SCAN-C in two parts. The first part is on round key generation, and the second is on encryption/decryption structure. Its round-key generation consists of two sub-sections: configuration of round-key generator and process of key generation. On a similar note, the encryption schedule consists of three sections: the F-function, the encryption process structure, and the execution of the encryption process. From the point of better understanding, an algorithm (Pseudocode) followed by a step-by-step execution process is included in this section.

Security analysis

The security analysis in this section includes both encryption and round-key generation schedules.

Differential and linear cryptanalysis

The security analysis in this section includes both encryption and round-key generation schedules. F-function structure plays a role in deciding the level of security offered by the ciphers against the attacks. The active S-box count is the metric to determine the security level of a particular block cipher against differential and linear cryptanalysis if designed with an SP network Biham et al. (1991), and Heys (2017). Thus, the total count of active S-boxes in a certain number of iterative rounds indicates the level of security against differential and linear attacks.

To ensure sufficient security by SCAN-C, function F has a structure with twelve substitution boxes arranged in three rows with a permutation layer sandwiched between the rows. The F function has three rows of four S-boxes and two layers of permutation effectively. Further, the first and the fourth branches of the SCAN-C have an XNOR operator, which inverts the input data bits. These bits go as input to the function F in the left and right half of the Feistel structure (Ref: Fig. 5). The XNOR operator decides the maximum or minimum number of active substitution boxes in the first layer of the respective function F. Further, the activation of substitution boxes in the subsequent layers of the respective function F relies on the propagation of the bits due to permutation layer. The F-functions outputs (Efl and Efr) will be active if the outputs ${\text{R}}_{\text{i}-1}$ and ${\mathrm{\Delta }\text{R}}_{1-4}$ are active.

It is typical practice to employ maximum distance separable code Bogdanov et al. (2007), mixed integer linear programming Mouha et al. (2007), and exhaustive search approaches to identify the active S-boxes.

In this article, algorithm 2, by Matsui (1994), is employed and verified with a mixed integer programming technique. Appendix III briefs the other concerned properties in determining the lower bound for the minimum number of active S-boxes. The exhaustive search technique suggests the same results.

Differential cryptanalysis

Differential cryptanalysis is a chosen plaintext attack in which an adversary looks at the output to determine the key using a selected input. This analysis exploits the information coming into the last round of the cipher to derive bits from the final layer of subkeys. The S-box layer is the only nonlinear layer in SCAN-C. It implies that the substitution operation is the only nonlinear operation in SCAN-C. Substitution is treated as a linear operation, leading to a linear process for differential and linear cryptanalysis of SCAN-C.

Theorem 1

Any consecutive three-round differential characteristic of SCAN-C has a minimum of 34 active S-boxes.

Proof

The count of active S-boxes over a fixed number of iterative rounds is the metric that indicates the ability of the block cipher to resist differential, linear, or both attacks. The count of active S-boxes is a function of branch numbers, which is 5 for this SCAN-C (ref: Fig. 6).

[See PDF for image]

Fig. 6

Transition of active S-boxes through F function

The proof of Theorem 1 is as follows.

Let ${\mathrm{\Delta }}_{\text{i}}={\mathrm{\Delta }\text{P}}_{\text{i}-1}\Vert {\mathrm{\Delta }\text{P}}_{\text{i}-2}\Vert {\mathrm{\Delta }\text{P}}_{\text{i}-3}\Vert {\mathrm{\Delta }\text{P}}_{\text{i}-4}$ be the i^th round input difference characteristic with concatenated four segments. Any non-zero nibble is an active S-box. To prove Theorem 1, the differential patterns of SCAN-C are analyzed over three iterative rounds with multiple input instantiations.

1st instantiation Let $\mathrm{\Delta }\text{P}=\left[0,\text{xFFFF},\Vert ,0,\text{x},0001,\Vert ,0,\text{x},0000,\Vert ,0,\text{xFFFF}\right]$. Therefore, ${\mathrm{\Delta }\text{P}}_{\text{i}-1}=0\text{xFFFF}$, ${\mathrm{\Delta }\text{P}}_{\text{i}-2}=0\text{x}0001$, ${\mathrm{\Delta }\text{P}}_{\text{i}-3}=0\text{x}0000$, ${\mathrm{\Delta }\text{P}}_{\text{i}-4}=0\text{xFFFF}$

The first and fourth branches of the encryption schedule have a function XNOR, which inverts the differential input bits (refer to Fig. 5). Effectively, the differential input chosen above has only one active nibble in the second segment (${\mathrm{\Delta }\text{P}}_{\text{i}-2}=0\text{x}0001$) with an active bit (During the First round) such that ${\mathrm{\Delta }\text{R}}_{1-1}=0\text{x}0000$ and ${\mathrm{\Delta }\text{R}}_{1-4}=0\text{x}000.$ This results in both F functions being inactive. Thus, there are no active S-boxes in the ∆1. By the end of the second round, at least 18 active S-boxes in the ∆2, with nine active S-boxes contributed by each F function. By the end of the third round, at least 16 active S-boxes in the ∆3, with eight active S-boxes contributed by each F function. It means that during three successive iterative encryption rounds, SCAN-C has 0 + 18 + 16 = 34 active S-boxes. Appendix III presents a detailed differential pattern analysis with equations of approximation.

2nd instantiation Let $\mathrm{\Delta }\text{P}=\left[0,\text{xFFFF},\Vert ,0,\text{x},0011,\Vert ,0,\text{x},0000,\Vert ,0,\text{xFFFF}\right]$. Therefore, ${\mathrm{\Delta }\text{P}}_{\text{i}-1}=0\text{xFFFF}$, ${\mathrm{\Delta }\text{P}}_{\text{i}-2}=0\text{x}0011$, ${\mathrm{\Delta }\text{P}}_{\text{i}-3}=0\text{x}0000$, ${\mathrm{\Delta }\text{P}}_{\text{i}-4}=0\text{xFFFF}$

The differential input chosen above has two active nibbles in the second segment (${\mathrm{\Delta }\text{P}}_{\text{i}-2}=0\text{x}0011$) with an active bit in each active nibble (During the First round) such that ${\mathrm{\Delta }\text{R}}_{1-1}=0\text{x}0000$ and ${\mathrm{\Delta }\text{R}}_{1-4}=0\text{x}0000$. This results in both F functions being inactive. Thus, there are no active S-boxes in the ∆1. By the end of the second round, at least 18 active S-boxes in the ∆2, with nine active S-boxes contributed by each F function. By the end of the third round, at least 16 active S-boxes in the ∆3, with eight active S-boxes contributed by each F function. It means that during three successive iterative encryption rounds, SCAN-C has 0 + 18 + 16 = 34 active S-boxes.

3rd instantiation Let $\mathrm{\Delta }\text{P}=\left[0,\text{xFFFF},\Vert ,0,\text{x},0001,\Vert ,0,\text{x},0001,\Vert ,0,\text{xFFFF}\right]$. Therefore, ${\mathrm{\Delta }\text{P}}_{\text{i}-1}=0\text{xFFFF}$, ${\mathrm{\Delta }\text{P}}_{\text{i}-2}=0\text{x}0001$, ${\mathrm{\Delta }\text{P}}_{\text{i}-3}=0\text{x}0001$, ${\mathrm{\Delta }\text{P}}_{\text{i}-4}=0\text{xFFFF}$

The differential input has two active nibbles one in each segment of the second (${\mathrm{\Delta }\text{P}}_{\text{i}-2}=0\text{x}0001$) and third segments (${\mathrm{\Delta }\text{P}}_{\text{i}-3}=0\text{x}0001$) with an active bit in each active nibble (During the First round) such that ${\mathrm{\Delta }\text{R}}_{1-1}=0\text{x}0000$ and ${\mathrm{\Delta }\text{R}}_{1-4}=0\text{x}0000$. This results in both F functions being inactive. Thus, there are no active S-boxes in the ∆1. By the end of the second round, at least 18 active S-boxes in the ∆2, with nine active S-boxes contributed by each F function. By the end of the third round, at least 16 active S-boxes in the ∆3, with eight active S-boxes contributed by each F function. It means that during three successive iterative encryption rounds, SCAN-C has 0 + 18 + 16 = 34 active S-boxes.

4th instantiation Let $\mathrm{\Delta }\text{P}=\left[0,\text{xFFFE},\Vert ,0,\text{x},0000,\Vert ,0,\text{x},0000,\Vert ,0,\text{xFFFF}\right]$. Therefore, ${\mathrm{\Delta }\text{P}}_{\text{i}-1}=0\text{xFFFE}$, ${\mathrm{\Delta }\text{P}}_{\text{i}-2}=0\text{x}0000$, ${\mathrm{\Delta }\text{P}}_{\text{i}-3}=0\text{x}0000$, ${\mathrm{\Delta }\text{P}}_{\text{i}-4}=0\text{xFFFF}$

The first segment of the differential input has one active nibble with an active bit (${\mathrm{\Delta }\text{P}}_{\text{i}-1}=0\text{xFFFE}$) such that 〖${\mathrm{\Delta }\text{R}}_{1-1}=0\text{x}0001$ during the first round. This results in the first F being active and the other inactive. Thus, the first F function contributes three active S-boxes to ∆1. By the end of the second round, at least 16 active S-boxes in the ∆2, with eight active S-boxes contributed by each F function. By the end of the third round, at least 16 active S-boxes in the ∆3, with eight active S-boxes contributed by each F function. It means that during three successive iterative encryption rounds, SCAN-C has 3 + 16 + 16 ≥ 34 active S-boxes.

Our experimental results show that the number of active S-boxes will be at least 34 with different input instantiations over any three-round differential characteristic. Hence the Theorem.

Lemma 1

Let the maximum differential probability of the three-round cipher SCAN-C be $P_{3D}$ with 34 active S-boxes, then $P_{3D}={\left(2^{-2}\right)}^{34}=2^{-68}.$

Lemma 2

Let the maximum differential probability of the twelve-round cipher SCAN-C be $P_D$ with 34 active S-boxes, then $P_D={\left(2^{-2}\right)}^{12x34/3}\cong 2^{-272}.$

Linear cryptanalysis

Linear cryptanalysis is a known plaintext attack that exploits a high probability of occurrences of linear expressions containing plaintext, ciphertext, and subkey bits.

Theorem 2

Any consecutive three-round linear approximation of SCAN-C has a minimum of 34 active S-boxes.

Proof

Since the differential branch number is the same as the linear branch number Rijmen et al. (1996), the count of active S-boxes is also the same.

Hence the Theorem.

Lemma 3

Let the maximal bias of a linear approximation of the three-round cipher SCAN-C be $P_{3\in }$ with 34 active S-boxes, then $P_{3\in }=2^{-35}.$

Lemma 4

Let the maximal bias of a linear approximation of the twelve-round cipher SCAN-C be $P_{\in }$ with 34 active S-boxes, then $P_{\in }\cong 2^{-274}.$

Summary Since SCAN-C exhibits a maximum differential probability of $\cong 2^{-272}$ and a maximum linear bias of $P_{\in }\cong 2^{-274}$, it has sufficient immunity against differential and linear attacks.

Special case

To test SCAN-C's resistance, linear and differential cryptanalysis was performed by substituting the XOR operator for the XNOR operator in branches one and four. After three consecutive iterative cycles, there are nine active S-boxes. A twelve-round SCAN-C has a maximum differential probability of $P_D={\left(2^{-2}\right)}^{12\times 3}\cong 2^{-72}$ and a linear approximation of ${\in }_{\text{L}}=2^{35}\times 2^{-72}=2^{-37}$. Thus, the number of ciphertext or plaintext pairs required is $2^{72}$ and $2^{74}$. Such data requirements exceed the available text. Hence, modified SCAN-C is safe.

Conclusion Given the described cryptanalysis above, SCAN-C exhibits the highest resistance with fewer iterative rounds to differential and linear attacks. For example, the maximum differential probability and linear approximation of SCAN-C over six iterative rounds are $P_D={\left(2^{-2}\right)}^{6\times 34/3}\cong 2^{-136}$ and ${\in }_{\text{L}}=2^{67}\times 2^{-2\times 68}=2^{-69}$. Thus, the number of ciphertext or plaintext pairs required is $2^{136}$ and $2^{138}$. Such data requirements exceed the available text. Hence, a six-iterative round SCAN-C is also safe against differential and linear attacks.

Impossible differential cryptanalysis

It is extended differential cryptanalysis to discover inaccurate key guesses using differential, which never occurs and narrows the key-space Hong Xu et al. (2023) and Eli Biham et al. (1999). The miss-in-the-middle is the best technique to conduct an impossible differential attack on block ciphers Eli Biham et al. (1999). In this attack, the subkey bit recovery is achieved by sieving out the keys, suggesting the impossible differential from the list of all possible keys.

Two states with a transfer probability1 are selected to establish a two-round impossible differential distinguisher. One of the states is in the direction of encryption, the other in the direction of decryption.

The impossible differential distinguisher with defined states is ${\mathit{FFFF}}_{(16)},{0001}_{(16)}{0000}_{(16)}{\mathit{FFFF}}_{(16)}\mapsto {\mathit{FFFF}}_{(16)},{0000}_{(16)},{0001}_{(16)},{\mathit{FFFF}}_{(16)}$.

Let ${\mathrm{\Delta }}_{\alpha }=\left\{F,F,F,F,,,\text{0001,0000},,,F,F,F,F\right\}$ be the input difference in the direction of encryption, which yields an output difference of ${\mathrm{\Delta }}_{\beta }=\left\{0000,,,\alpha ,10,\alpha ,2,\mathbf{\alpha },3,,,\alpha ,40,\alpha ,5,\mathbf{\alpha },6,,,0000\right\}$ at the end of the first iterative round.

Let ${\mathrm{\Delta }}_{⋋}=\left\{F,F,F,F,,,\text{0000,0001},,,F,F,F,F\right\}$ be the input difference in the direction of decryption, which yields an output difference of ${\mathrm{\Delta }}_{⋎}=\left\{0000,,,\mathrm{\beta },10,\mathrm{\beta },2,\mathbf{\beta },3,,,\mathrm{\beta },40,\mathrm{\beta },5,\mathbf{\beta },6,,,0000\right\}$ at the end of the first iterative round.

Since ${\mathrm{\Delta }}_{\beta }\ne {\mathrm{\Delta }}_{⋋}$, ${\mathrm{\Delta }}_{\alpha }\top {\mathrm{\Delta }}_{⋋}(\text{FFFF}00010000\text{FFFF})2\text{R}\top (\text{FFFF}00000001\text{FFFF})$ is an impossible differential for a two-iterative round.

Table 6 shows the impossible trails.

Table 6. Impossible differential trails

Round #	Impossible differential (Hex)				Direction
	${\mathrm{\Delta }\text{P}}_{\text{i}-1}$	${\mathrm{\Delta }\text{P}}_{\text{i}-2}$	${\mathrm{\Delta }\text{P}}_{\text{i}-3}$	${\mathrm{\Delta }\text{P}}_{\text{i}-4}$
0	FFFF	0001	0000	FFFF	Forward differential
1	0000	α10α2α3	α40α5α6	0000
1	0000	β10β2β3	β40β5β6	0000	Reverse differential
0	FFFF	0000	0001	FFFF

α₃ ≠ β₃ and α₆ ≠ β₆

Figure 7 shows the differential propagation during the key-recovery process for impossible differential cryptanalysis. The process is as follows.

[See PDF for image]

Fig. 7

N + 1 round impossible differential cryptanalysis

i. Let the plaintext difference be

• $\mathrm{\Delta }P=\mathrm{\Delta }{P}_{i-1}^0\Vert \mathrm{\Delta }{P}_{i-2}^0\Vert \mathrm{\Delta }{P}_{i-3}^0\Vert \mathrm{\Delta }{P}_{i-4}^0$, and

• $\mathrm{\Delta }{P}_{i-1}^0=0\times FFFF$,

• $\mathrm{\Delta }{P}_{i-2}^0=0\times 0001$,

• $\mathrm{\Delta }{P}_{i-3}^0=0\times 0000$,

• $\mathrm{\Delta }{P}_{i-4}^0=0\times FFFF$.

Let the plaintext structure be,

• $P_{i-1}^0={\alpha }_0,{\alpha }_1,\cdots {\alpha }_{15},$

• $P_{i-2}^0={\alpha }_{16},{\alpha }_{17},\cdots {\alpha }_{31}$

• $P_{i-3}^0={\alpha }_{32},{\alpha }_{33},\cdots {\alpha }_{47}$,

• $P_{i-4}^0={\alpha }_{48},{\alpha }_{49},\cdots {\alpha }_{63}$,

where ${\alpha }_i(0\le i\le 63)$ is a constant. There are 2ⁿ⁺¹plaintext pairs of 2ⁿ structures. After N + 1 rounds of encryption, obtain the corresponding ciphertext pairs.

ii. The ciphertext pairs that satisfy the following form are selected,$$\mathrm{\Delta }{P}^{N+1}=\mathrm{\Delta }{P}_{i-1}^{N+1}\Vert \mathrm{\Delta }{P}_{i-2}^{N+1}\Vert \mathrm{\Delta }{P}_{i-3}^{N+1}\Vert \mathrm{\Delta }{P}_{i-4}^{N+1}$$$$\mathrm{\Delta }{P}_{i-1}^{N+1}=0000\cdots 0000$$$$\mathrm{\Delta }{P}_{i-2}^{N+1}=\ast \ast \ast \ast 0000\ast 000\ast \ast 00$$$$\mathrm{\Delta }{P}_{i-3}^{N+1}=\ast \ast \ast \ast 0000\ast 000\ast \ast 0\ast$$$$\mathrm{\Delta }{P}_{i-4}^{N+1}=0000\cdots 0000,$$where * ∈ F₂. The ciphertext pairs that satisfy the above form with a probability of $2^{15}\times 2^{-64}=2^{-49}$, are $2^{15}$. Thus, the remaining ciphertext pairs after screening are $2^{n+1}\times 2^{-49}=2^{n-48}$.

iii. Guess the 32-bit key (2 times 16-bit) in the N + 1 round. Then decrypt each ciphertext pair from step ii one round forward and judge the ciphertext if it holds $\mathrm{\Delta }{P}_N={\mathit{FFFF}}_{(16)},{0000}_{(16)},{0001}_{(16)},{\mathit{FFFF}}_{(16)}$. If it holds, then the guessed key is wrong and is discarded. Repeat the procedure until the correct key remains.

Complexity analysis The error value of the key after step iii is $\left(2^{32},-,1\right)\times {\left(1,-,2^{-1}\right)}^{2^{n-48}}$ approximately. The condition for excluding all wrong keys is $\left(2^{32},-,1\right)\times {\left(1,-,2^{-1}\right)}^{2^{n-48}}<1$ with n = 53. The data complexity is 2n + ∆in + 1, according to Boura et al. (2014). The ∆in represents the number of active bits in plaintext difference.

The data complexity is $2^{53+33+1}=2^{87}$. A time complexity of $2^{n-48}\times 2^{32}\times 2=2^{38}$ one-round encryption is required to complete step iii, followed by an exhaustive search to retrieve 128 bits of the primary key. Thus, the time complexity of $2^{38}/N+1+2^{128}\cong 2^{128}$ (N + 1) round encryption is required to recover the full round key.

A total memory complexity of $\left(2^5+2^{32}+2^{128}\right)/64\approx 2^{122}$ 64-bit block is required to retrieve the full round key. SCAN-C has 12 rounds and N = 11. Therefore, a full round impossible differential attack on SCAN-C requires $2^{87}$ data complexity, time complexity of $2^{128}$ 12-round encryption, and memory complexity of $2^{122}$ 64-bit block. Thus, SCAN-C is safe against impossible differential attacks.

Zero correlation cryptanalysis-6 rounds

Zero-correlation cryptanalysis is one of the recent cryptanalytic methods introduced by Bogdanov and Rijmen (2014) based on linear approximations with zero correlation. Consider a function f with input ${x\in \mathbb{F}}_2^n$, whose linear approximation with an input mask u and an output mask v is

6

$$x\mapsto u·x\oplus v·f\left(x\right)$$

The probability of linear approximation (6) is

7

$$p\left(u,,,v\right)=\text{Pr}(x\mapsto u·x\oplus v·f\left(x\right)=0)$$

The correlation is

8

$$c_f\left(u,,,v\right)=2p(u,v)-1$$

Zero-correlation linear cryptanalysis involves using linear approximations that exhibit zero correlation for all keys. If there are 2 ^m zero-correlation approximations, according to Lu et al. (2019), the number of distinct plaintexts needed is approximately 2^n+2−m/2. The key-recovery process employs Matsui's Algorithm 2 (1994).

A miss-in-the-middle technique is employed to construct the zero-correlation linear distinguisher. The zero-correlation linear distinguisher with defined states is 000α000000000000 → 000000000000000β. Where α and β are non-zeros. Table 7 displays the zero-correlation trails for the six rounds of SCAN-C. The contradiction occurs in 3rd round.

Table 7. Zero-correlation linear approximation

Round #	Zero-correlation Linear approximation-6 rounds
	P1	P2	P3	P4
0	000α	0000	0000	0000
1	****	$\overline{0}\overline{0}\overline{0}\overline{0}$	$\overline{0}\overline{0}\overline{0}\overline{\alpha }$	****
2	****	$\ast \alpha \alpha \alpha$	$\overline{0}\overline{0}\overline{0}\overline{0}$	****
3	****	$\overline{0}\overline{0}\overline{0}\overline{0}$	$\overline{0}\overline{0}\overline{0}\overline{\alpha }$	****
3	****	$\overline{0}\overline{0}\overline{0}\overline{\beta }$	$\overline{0}\overline{0}\overline{0}\overline{0}$	****
4	****	$\overline{0}\overline{0}\overline{0}\overline{0}$	$\ast \beta \beta \beta$	****
5	****	$\overline{0}\overline{0}\overline{0}\overline{\beta }$	$\overline{0}\overline{0}\overline{0}\overline{0}$	****
6	0000	0000	0000	000β

Notations used in Table 7 are as per [41]

A 6-round zero correlation linear approximation distinguisher (Table 7) from rounds 4 to 9 is employed in the analysis. The subkey bits for the first three rounds and the last two rounds are determined based on a sufficient collection of plaintexts and ciphertext pairs. Merely, the values of ${\text{P}}_{4-1}\left(\text{3,1}\right)$ and ${\text{P}}_{10-4}\left(\text{3,1}\right)$, unaffected by every bit of the outer rounds are sufficient to measure the correlation. Table 8 shows the plaintext and ciphertext bits that affect the ${\text{P}}_{4-1}\left(\text{1,3}\right)\text{and}{\text{P}}_{10-4}\left(\text{1,3}\right),$ round-wise.

Table 8. Plaintext-Ciphertext bits

Forward
1	P1-1	P1-2	P1-3	P1-4	#bits
	15,11,7,3	14,10,6,2	13,9,5,1	12,8,4,0	16
2	P2-1	P2-2	P2-3	P2-4	26
	14,12,10,10,8,6,4,2,0	15,13,9,3,1	15,11,9,6,4,2,0	11,9,8,6,2
3	P3-1	P3-2	P3-3	P3-4	2
	Nil	2,0	Nil	Nil
Backward
10	P10-1	P10-2	P10-3	P10-4	2
	Nil	2,0	Nil	Nil
11	P11-1	P11-2	P11-3	P11-4	26
	14,12,10,8,5,1,0	15,13,9,6,3,0	15,10,8,5,3,1,0	2,8,7,5,2,0
12	P12-1	P13-2	P14-3	P14-4	16
	14,10,6,2	12,8,4,0	15,11,7,3	13,9,5,1

The time complexity is around 2⁶⁴ × 2³² = 2⁹⁶ and is much more than an exhaustive search, where 2⁶⁴ is the plaintext-ciphertext pair, and 2³² is the outer rounds subkeys. In this article, the technique utilized for the zero-correlation attack is the divide-and-conquer technique Matsui (1994). Table 8 shows the active bits involved in each round of the cipher while cryptanalysis is underway.

A counter with appropriate width is employed to maintain the count of the plaintext-ciphertext pairs indexed by the active bits. For every subkey candidate, the active bits are encrypted (Decrypted) in round r over one round in each step. Then, the count of the pairs that yield the same value in active bits over the r + 1 (r-1) round is determined. The zero-correlation attack scenario is in Fig. 8.

[See PDF for image]

Fig. 8

Zero-correlation attack scenario

Attack procedure

• I. Collect 2⁶⁴ plaintext-ciphertext pairs and guess 10 sub-key bits K₁₀(14,8,6) (Twice) and K₁₁(3,1) (Twice) to calculate ${\text{P}}_{10-4}\left(\text{1,3}\right)$.

• ii. Set an 8-bit counter $N_1\left[x_1,\Vert ,x_{10}\right]$ for each of the 2¹⁸ possible values of ($x_1\Vert x_{10}$) with $x_1=P_{1-1}\Vert P_{1-2}\Vert P_{1-3}\Vert P_{1-4}$ and $x_{10}=P_{10-2}$ and set them to zero. Determine the number of plaintext-ciphertext pairs with the above-given values and update the counters. There are 2⁶⁴ plaintext-ciphertext pairs in this step with 2¹⁸ different states. An 8-bit counter is sufficient to count the expected pairs for each of the states of 2⁴⁶.

• iii. Guess the 12-bits $K_1\left(\text{15,12,8},,,\text{4,3},,,0\right)\times 2$, then set a counter $N_2\left[x_2,\Vert ,x_{10}\right]$ for each of the 2²⁸ possible values of ($x_2\Vert x_{10}$) with $x_2=P_{2-1}\Vert P_{2-2}\Vert P_{2-3}\Vert P_{2-4}$ and $x_{10}=P_{10-2}$ and set them to zero. Next, update the value $N_2\left[x_2,\Vert ,x_{10}\right]=N_2\left[x_2,\Vert ,x_{10}\right]+N_1\left[x_1,\Vert ,x_{10}\right]$ for all four values of $x_{10}$ by encrypting $x_1$ one round to update $x_2$ for all 2¹⁶ values of $x_1$.

• iv. Guess the 4-bits $K_2\left(\text{3,1}\right)\times 2$, then set a counter $N_3\left[x_3,\Vert ,x_{10}\right]$ for each of the 2⁴ possible values of ($x_3\Vert x_{10}$) with $x_3=P_{3-1}\Vert P_{3-2}\Vert P_{3-3}\Vert P_{3-4}$ and $x_{10}=P_{10-2}$ and set them to zero. Next, update the value $N_3\left[x_3,\Vert ,x_{10}\right]=N_3\left[x_3,\Vert ,x_{10}\right]+N_2\left[x_2,\Vert ,x_{10}\right]$ for all four values of $x_{10}$ by encrypting $x_2$ one round to update $x_3$ for all 2²⁶ values of $x_2$.

• v. Guess the 6-bits $K_3\left(\text{11,9},,,5\right)\times 2$, then set a counter $N_4\left[x_4,\Vert ,x_{10}\right]$ for each of the 2⁴ possible values of ($x_4\Vert x_{10}$) with $x_{10}=P_{10-2}$ and set them to zero. Next, update the value $N_4\left[x_4,\Vert ,x_{10}\right]=N_4\left[x_4,\Vert ,x_{10}\right]+N_3\left[x_3,\Vert ,x_{10}\right]$ for all four values of $x_{10}$ by encrypting $x_3$ one round to update $x_4$ for all 2² values of $x_3$.

• vi. Next, check if$$\sum _{x_4=x_{10}}{N}_4\left[x_4,\Vert ,x_{10}\right]=N/2$$

  If not, discard the guessed corresponding key.

• vii. Repeat the search for all keys corresponding to the guessed subkey bits.

Attack complexity The time complexity of step 1 is $2^{64}\times 2^{10}=2^{74}$.The time complexity of each step from iii to v is as follows.

1. $2^{10}\times 2^{12}\times 2^{18}=2^{40}$

2. $2^{10+12}\times 2^4\times 2^{28}=2^{54}$

3. $2^{10+12+4}\times 2^6\times 2^4=2^{36}$

Key schedule-cryptanalysis

The strength of the cipher relies on encryption and round-key-generation schedules in any iterative block cipher. The encryption schedule transforms the plaintext into ciphertext using the round keys. The fundamental property of the key is to ensure the ciphertext is completely random compared to its corresponding plaintext. Hence, the strength of the encryption algorithm relies on the key. It is, therefore, necessary to ensure that the key-generation schedule is strong enough and safe to produce a random-bit key stream.

Definition 1

A polynomial of order n with coefficients of 0 or 1 is irreducible if it cannot be divisible by another polynomial of degree m, where m < n Wentan Yi et al. (2017)

Definition 2

If and only if an irreducible polynomial of order n divides x^p + 1 for a p that is higher than or equal to 2ⁿ-1, then the polynomial is said to be "primitive" Wentan Yi et al. (2017).

Definition 3

The period p of the sequence produced by an n-stage LFSR is a factor of 2ⁿ—1 if the characteristic polynomial of the LFSR is irreducible.

Definition 4

An n-stage LFSR can generate maximum-length pseudorandom sequences if it has an even number of total feedback connections.

Definition 5

For any key stream generator of length N that produces a finite sequence whose linear complexity is very close to N/2 with a complexity profile growing continuously (roughly).

Definition 6

For odd n ≥ 3, it is possible to construct balanced f ∈ Ω_n, with algebraic degree (n − 1) and nonlinearity 2ⁿ⁻¹ − 2^(n−1)/2.

Properties

In this section, the authors present the multiple aspects of the cryptanalysis of key-generation schedules.

The first layer consists of three LFSRs of degrees 34 (N3), 37 (N2), and 89 (N1) with primitive polynomials and has a length of 160-bit.

Period By definitions 1–4, the overall period of the first layer of the key-generation schedule is given by

9

$$Period=\left(2^{34},-,1\right)\left(2^{37},-,1\right)\left(2^{89},-,1\right)$$

10

$$\text{Period}=2^{160}-1$$

Linear complexity By definition 5, the linear complexity ($L_C$) of the first layer is given by

11

$$L_C=N/2$$

12

$$L_C=160/2=80$$

Algebraic degree The algebraic degree ($A_d$) of nonlinear function f(x) represented by (1) with 'n' input variables is given by

13

$$A_d=n-1$$

14

$$A_d=5-1=4$$

Nonlinearity The nonlinearity ${(N}_f)$ of the function f(x) is given by

15

$$N_f=2^{n-1}-2^{\left(n,-,1\right)/2}$$

16

$$N_f=2^{5-1}-2^{\left(5,-,1\right)/2}=12$$

Theorem 3

The key-generation schedule of SCAN-C resists Berlekamp-Massey attacks with a linear complexity of 80.

Proof

The Berlekamp–Massey algorithm tries to model the given LFSR layer as the shortest linear feedback shift register while attacking. The length of the modeled shortest LFSR must match half of the specified schedule length for this to be successful.

Since the length of the LFSR is 160 bits and by Eq. 12, the linear complexity is 80. That is equal to the size of the required shortest LFSR to attack. The effort required to attack the key-generation schedule is much higher than the available data 2⁶⁴, which is 2⁸⁰. Therefore, the key-generation schedule is safe. Hence, the theorem.

Theorem 4

The key-generation schedule of SCAN-C resists algebraic and correlation-key attacks.

Proof

The third layer of the key-generation schedule is functionally comparable to substitution boxes, which has a nonlinear function f (x) Eq. 1. Using the Walsh spectrum and affine function, the nonlinearity displayed by Eq. 1 is determined. As can be shown from Eqs. 14 and 16, the degree of nonlinearity for any function with five variables is 4, and the nonlinearity is 12. For five variables, the highest value of a function f(x) has an algebraic degree of 4. As a result, the function f(x)'s random output bits can all effectively fend off the algebraic attack. Table 3 makes it abundantly evident that each of the five variables of the function f(x) has an equal chance of 1/2. Therefore, the key-generation schedule can resist correlation attacks as well. Hence, the theorem.

Theorem 5

The key-generation schedule of SCAN-C resists related key and key-collision attacks.

Proof

The key-generation schedule has three layers prominently consisting of LFSRs, Multiplexers, and nonlinear functions. The 160-bit key stream generated by LFSR is random. These bits are divided into groups of 32 bits each and fed to five multiplexers, and the out bit from each one goes as an input to a nonlinear function. The output bit stream of the nonlinear function completely masks the relation between the user-supplied key and the round keys generated. As a result, and by Eqs. 10,12, 14, and 16, the key-generation schedule resists related-key attacks. The key-collision attack creates a message with a complexity of 2 ^k/2, where k is the length of the key. The complexity of the created message is equal to 2^160/2 = 2⁸⁰, which is much more than the available data of 2⁶⁴. Therefore, the key-generation schedule is safe. Hence, the theorem. In summary, the key-generation schedule is resistant to various known threats.

Statistical tests

In this section, the authors present the analysis of round keys generated by the key-generation schedule for randomness through statistical tests. A test suite developed by the National Institute of Standards and Technology (NIST) tests the randomness exhibited by the bitstream and validates their compliance with SP800-22 Revision 1a AndrewRukhin et al. (2010). Randomness is a probabilistic property; that is, the properties of a random sequence can be characterized and described in terms of probability (P-value). Using a round key generator set of 100 round-key streams of size 107 is generated. They are all tested for randomness using a NIST test suite with selected tests. The summary of the test results is in Table 9.

Table 9. Statistical test results

Significance value α	0.01
Name of the test	P-Value	Proportion
Frequency	0.763210	96
Serial	0.470618	98
Universal	0.549802	100
Runs	0.067954	99
Cumulative sums	0.439110	98
Linear Complexity	0.681204	99

In summary, the key-generation schedule produces a random round key bitstream.

Avalanche effect

The avalanche effect is a desirable property of cryptographic algorithms. It serves as the metric to ensure the randomness exhibited by the ciphertext corresponding to a single-bit change in either plaintext or a key. The expected numerical value is > 50%. Consequently, round keys were generated and tested. The results are in Fig. 9.

[See PDF for image]

Fig. 9

Block size versus avalanche effect

Performance analysis

This section details the cipher's performance concerning hardware, firmware implementation, linear, differential characteristics, execution cycles, and power consumption.

Hardware implementation-ASIC

A 0.13 μm ASIC technology is employed to evaluate the performance of the proposed SCAN-C in hardware. The cipher consists of a key, encryption, and decryption schedules. The cell library, the 0.13 μm technology, delineates the domain of standard logic gates with gate equivalents (GEs). Among them are NOT (0.75), D flip-flop (4.25), XOR (2.0), XNOR (2.0), AND (1.25), NAND (1.00), and others. The hardware implementation strategy is in Fig. 10.

[See PDF for image]

Fig. 10

Hardware Implementation Strategy

The number of gate equivalent requirements for the key schedule and encryption schedule of the SCAN-C is as follows.

Key schedule GE requirements

• 160-bit LFSR 160 × 4.25 = 680 GE.

• Feedback (12 + 6 + 7) × 2 = 50 GE.

• MUX 5 × 6.25 = 31.25 GE.

• MUX 5 × 7.25 = 36.25 GE.

• Encryption schedule GE requirements.

• 64-bit register         64 × 4.75 = 272 GE.

• F-Function         16 × 4 = 64 GE.

• XOR         16 × 4 = 64 GE.

• Total         1197.5 GE.

Firmware implementation

The proposed SCAN-C was implemented on a generic hardware platform, an AVR-based Arduino Uno, to evaluate its firmware performance. The microcontroller used in the Arduino-Uno is an ATmega 328, an 8-bit device with an operating frequency of 16 MHz and a clock period/machine cycle of 0.06 microseconds. Table 10 shows the complexity of SCAN-C implementation in firmware.

Table 10. Complexity of SCAN-C in firmware

Metrics	Attribute	Value	Remark	Total
Time complexity	Seed key generation	5.34µs	89Cycles	243.434 µs
	Session key generation	12.96 µs	216. Cycles
	Round key generation	41.04 µs	684 Cycles
	Encryption	53.259 µs	887.65 Cycles
	Decryption	53.259 µs	887.65 Cycles
Space complexity	Flash memory	1121 Bytes	XOR, XNOR, SP and LFSR utilised	1185 Bytes
	SRAM	64 Bytes	Temporary
	EEPROM	Nil	Nil
Power	Power	24.15mW		24.15mW
GE (HW)	GE	1198

The total execution cycles of this cipher are high (3151) with raw code. The optimized code resulted in a total execution cycle of 2459.3. The optimized code resulted in a total execution time of 165.858 μs, which includes seed key 5.34 μs, session key 12.96 μs, round key 41.04 μs, encryption process, and decryption process 53.259 μs each. It means that the best performance of the cipher can be expected in firmware only if the code is optimized. Furthermore, it suggests that expertise in software coding is the key to expecting better performance (of the cipher) if implemented in microcontrollers and software.

Comparison of linear/differential attack

Table 11 shows the linear and differential attack comparison of SCAN-C with other block ciphers. The proposed SCAN-C has a better attack complexity with a minimal number of iterative rounds.

Table 11. Linear/differential attack comparison

Algorithm	Rounds No	Active S-boxes No	Known Plaintexts No	Chosen Plaintexts No
SCAN-C proposed	12	136/136	2274	2272
PRESENT (2007)	25	50	2102	2100
SLIM (2020)	32	≅ 42	266	266
SLA (2023)	16	48	298	296
ANU (2016)	18	54/48	2110	296

The comparative analysis in Table 11 clearly states that SCAN-C is superior to PRESENT (Bagdanav et al. 2007), SLIM (Basam et al. 2020), SLA (Nahla et al. 2023), and ANU (Gaurava et al. 2016) in terms of resistance to classical attacks (Linear/differential), iterative rounds, and number of active S-boxes.

Comparison of hardware resources

Space complexity is one of the metrics to evaluate the performance of the cipher in hardware implementation. The type of cell technology adapted for the cipher implementation is the parameter that validates the space complexity.

The cell technology of 0.13 μm technology is employed to compare the hardware resource requirements for the selected ciphers' implementation. The SCAN-C outsmarts the fellow ciphers in hardware implementation with reduced hardware resources. Table 12 shows the comparative analysis.

Table 12. Comparison of hardware resources

Technology: 0.13 µm
Algorithm	Block size (Bits)	Key size (Bits)	Network structure	Area (GE)
SCAN-C Proposed	64	64	FSPN	1197
AES-128 (2001)	128	128	SPN	3101
RECTANGLE (2014)	64	80	SPN	1211
PRESENT (2007)	64	80	SPN	2195

Comparison of firmware resources

Time complexity is one of the metrics to evaluate the performance of the cipher in firmware or software implementation. The performance of the cipher depends upon the technology adapted to create the microcontroller or a microprocessor in addition to the optimization of the code. The firmware code is developed for a microcontroller with AVR architecture while comparing the performance of the ciphers. The microcontroller used in the Arduino-Uno is an ATmega 328, an 8-bit device with an operating frequency of 16 MHz and a clock period/machine cycle of 0.06 microseconds. Table 13 compares the complexity of different block ciphers with the SCAN-C.

Table 13. Firmware Complexity Comparison of SCAN-C and other block ciphers (AVR Architecture)

Algorithm	Size of block	Key	Code space	RAM space	Key generation µs	Encryption µs	Decryption µs	Total time µs
AES (2001)	128	128	23,090	720	198.06	325.38	323.89	847.33
RC4 (1994)	64	128	20,044	360	168.71	253.56	255.61	677.88
SPECK (2013)	64	96	2552	124	79.84	87.93	88.68	256.45
PRESENT (2007)	64	80	2698	274	76.13	154.56	152.72	383.41
SCAN-C proposed	64	160	1121	64	41.04	53.259	53.259	147.668

Comparison of execution cycles and power consumption

The execution cycles and power consumption are other parameters used to analyze the performance of ciphers. The Figs. 11 and 12 show the comparative analysis of execution cycles and power consumption of selected block ciphers. The overall execution cycles 2459.3 of the SCAN-C are fewer compared to 17,428 of PRESENT (Bagdanav et al. 2007), 3289 of RBFK (S Rana et al. 2023), 4084 of SPECK (Ray Beaulieu et al. 2013), and 14,076 of AES (Daemen 2001a, b).

[See PDF for image]

Fig. 11

Comparative analysis of execution cycles

[See PDF for image]

Fig. 12

Comparative analysis of power consumption

The optimized code resulted in fewer execution cycles of 684 cycles for the round key and 887.65 cycles for each encryption and decryption process. Figures 11 and 12 are updated with new values. An expanded comprehensive comparative analysis is in Appendix IV.

Research summary

Until now, there are no cryptographic algorithms specific to CAN-bus security. This article presents a lightweight block cipher specific to CAN-bus security. SCAN-C (signifies secured controller area network for communications) is a new lightweight block cipher optimized for resource-constrained devices (ECUs) in connected and autonomous vehicles. The cipher encompasses distinct technologies to design encryption and round-key generation schedules. The proposed SCAN-C exhibits better security features while maintaining communication characteristics intact. Encryption schedule resists linear, differential, impossible differential, and zero correlation attacks, as demonstrated in the section on security analysis. The round-key generation schedule resists Berlekamp-Massey, Algebraic, correlation, related, and key-collision attacks, as shown in the section on security analysis. Thus, the cipher is resistant to a couple of cryptographic attacks. SCAN-C is the best contribution to lightweight cryptography.

The hardware efficiency of SCAN-C is demonstrated by the gate equivalents of 1197 using 0.13μm technology. Furthermore, a single iterative round can be completed in just four clock cycles using the recommended hardware implementation method shown in Fig. 10. Similarly, the code size of 1643 KB (1121 KB with optimized code) indicates its efficiency in firmware. In addition, the total execution time with optimized code is 147.668 μs (2459.3 cycles) compared to 231.124 μs (3151 execution cycles) without optimization. SCAN-C is efficient in hardware and software. Also, it is energy-efficient due to fewer clock cycles to operate in hardware and fewer firmware execution cycles.

The various properties of the round key generation schedule, such as period, linear complexity, algebraic degree, and nonlinearity, prove that it is cryptographically secure. The statistical results, avalanche effect, and sensitivity of the key exhibited by the round key generation schedule justify that it produces a highly random key bitstream. Given the above, the proposed cipher with only twelve rounds is cryptographically secure. In toto, SCAN-C is a unique cryptographic solution with a distinct architecture that addresses the security concerns of data communication over the CAN-bus between the resource-constrained ECUs in autonomous and connected vehicles.

Conclusion and future scope

This article describes and proposes a uniquely devised lightweight block cipher SCAN-C, which addresses the security concerns of data communication over the CAN-bus in autonomous and connected vehicles. The SCAN-C has distinct architectures for round-key generation and encryption/decryption processes. SCAN-C is energy, hardware, and firmware efficient. It also exhibits high resistance to classical attacks. The performance of the SCAN-C has been validated experimentally by implementing it in real applications. The application is a CAN-Bus-based air conditioning system developed for real-time applications. The experimental validation of attacks on CAN-bus communication is also underway, with one of the ECUs configured as a malicious node. The experimental results are not part of this article due to the non-conclusion of the experiments.

SCAN-C implementation in programmable devices will be the focus of future research for creating application-specific integrated circuits (ASICs). Another future scope of this research is to study the vulnerabilities and limitations of SCAN-C areas where it may not perform well.

Acknowledgements

We sincerely thank our colleagues for their assistance and recommendations. We are grateful to the anonymous reviewers for their informative and helpful criticism, which helped to make the manuscript better.

Authors’ contributions

NH: Conceptualization, Methodology, Software, Visualization, Writing—original draft. BP: Investigation, Data curation, Writing—review & editing, KN: Revision and Creating tables, verification and corrections of the draft. All authors have scrutinized the draft and revised it to the present form. All the authors read and approved the final manuscript.

Funding

None.

Availability of data and materials

None.

Declarations

Competing interests

The authors declare no competing interests.

Publisher's Note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

References

Aboshosha B, Ramadan RA, Dwivedi AD, El-Sayed A, Dessouky MM (2020) SLIM: a lightweight block cipher for internet of health things. Special section on lightweight sceurity and provenance for internet of health things. IEEE Access 2020. https://doi.org/10.1109/Access.2020.3036589.

Ahmad, A; Elabdallai, AM. An efficient method to determine linear feedback connections in shift registers that generate maximal length pseudo-random up and down binary sequences. Comput Electron Eng; 1997; 23, 1 pp. 33-39. [DOI: https://dx.doi.org/10.1016/S0045-7906(96)00020-1]

Alshammari AS (2020) A stream cipher generator based on a combination of two non-linear systems for secure signal transmissions. Przegląd Elektrotechniczny, ISSN 0033-2097, R. 96 NR 10/2020. https://doi.org/10.15199/48.2020.10.09

Bakhtiari, M; Maarof, MA. An efficient stream cipher algorithm for data encryption. IJCSI Int J Comput Sci Issues; 2011; 8, 31 pp. 1694-1814.1248.39015

Bansod, G; Patil, A; Sutar, S; Pishorpty, N. ANU: an ultra-lightweight cipher design for security in IoT. Security Commun Netw; 2016; 9, pp. 5238-5251. [DOI: https://dx.doi.org/10.1002/sec.1692] 1408.94314

Barker E, Barker WC Guideline for using cryptographic standards in the federal government: directives, mandates and policies. NIST Special Publication 800-175A

Barreto P, Rijmen V (2000) The Khazad legacy-level block cipher. Primitive submitted to NSSIE, vol 97

Biham E, Biryukov A, Shamir A (1999) Miss in the middle attacks on IDEA and Khufu. In: L Knudsen (ed) FSE'99, LNCS 1636, 1999. Springer, Berlin, pp 124–138

Biham, E; Shamir, A. Differential cryptanalysis of DES-like cryptosystems. J Cryptol; 1991; 4, 1 pp. 3-72.1202786 [DOI: https://dx.doi.org/10.1007/BF00630563] 0729.68017

Bogdanov A, Knudsen LR, Leander G, Paar C, Poschmann A, Robshaw MJ, Seurin Y, Vikkelsoe C (2007) Present: an ultra-lightweight block cipher". Lecture notes in computer science, vol 4727 (Cryptographic Hardware and Embedded Systems–CHES 2007), pp 450–466. https://doi.org/10.1007/978-3-540-74735-2_31

Bogdanov, A; Rijmen, V. Linear hulls with correlation zero and linear cryptanalysis of block ciphers. Des Codes Cryptogr; 2014; 70, pp. 369-383.3160736 [DOI: https://dx.doi.org/10.1007/s10623-012-9697-z] 1323.94103

Boura C, Naya-Plasencia M, Suder V (2014) Scrutinizing and improving impossible differential attacks: applications to CLEFIA, Camellia, LBlock and Simon (full version). Ph.D. thesis, IACR cryptology ePrint archive

Bozdal, M; Samie, M; Aslam, S; Jennions, I. Evaluation of CAN bus security challenges. Sensors; 2020; 20, 2364. [DOI: https://dx.doi.org/10.3390/s20082364] 07714510

Castiglione, A; Palmieri, F; Colace, F; Lombardi, M; Santaniello, D; D’Aniello, G. Securing the internet of vehicles through lightweight block ciphers. Pattern Recogn Lett; 2020; 135, pp. 264-270. [DOI: https://dx.doi.org/10.1016/j.patrec.2020.04.038]

Daemen JR (2001a) The design of Rijndael. Springer, 2001

Daemen JR (2001b) The wide trail design strategy. Cryptography and coding, LNCS 2260. Springer, Berlin, pp 222–238

Farag WA (2017) CANTrack: enhancing automotive CAN bus security using intuitive encryption algorithms. 978-1-5090-5454-1/17/$31.00 ©2017. IEEE

Gao, R; Li, S; Gao, Y; Guo, R. A lightweight cryptographic algorithm for the transmission of images from road environments in self-driving. Cybersecurity; 2021; 4, 3. [DOI: https://dx.doi.org/10.1186/s42400-020-00066-2] 1486.94013

Gmiden M, Gmiden MH, Trabelsi H (2019) Cryptographic and intrusion detection system for automotive CAN bus: survey and contributions. In: 2019 16th international multi-conference on systems, signals & devices (SSD'19), 978-1-7281-1820-8/19/$31.00 ©2019. IEEE

Gorlov, L; Iavich, M; Bocu, R. Linear layer architecture based on cyclic shift and XOR. Symmetry; 2023; 15, 1496. [DOI: https://dx.doi.org/10.3390/sym15081496] 1240.97008

Heys HM (2017) A tutorial on linear and differential cryptanalysis. Crypto

Ibrahim, N; Agbinya, J. Design of a lightweight cryptographic scheme for resource-constrained internet of things devices. Appl Sci; 2023; 13, 4398. [DOI: https://dx.doi.org/10.3390/app13074398] 1512.92099

Jorstad ND, Smith LT Jr. Cryptographic algorithm metrics. IDA, Institute for Defense Analyses Science and Technology Division

Jukl, M; Čupera, J. Using of tiny encryption algorithm in CAN-Bus communication. Res Agr Eng; 2016; 62, 2 pp. 50-55. [DOI: https://dx.doi.org/10.17221/12/2015-RAE] 1279.60103

Kanda M (2001) Practical security evaluation against differential and linear cryptanalysis for feistel ciphers with SPN round function, SAC 2000, LNCS 2012. Springer, pp 324–338

Kumar M, Pal SK, Panigrahi A (2014) FeW: A lightweight block ciphers. Cryptology ePrint Archive, Report 2014/326

Levy E, Shabtai A, Groza B, Murvay P, Elovici Y (2021) CAN-LOC: spoofing detection and physical intrusion localization on an in-vehicle CAN bus based on deep features of voltage signals. arXiv:2106.07895v1 [cs.CR] 15 Jun 2021.

Lu Z, Wang Q, Chen X, Qu G, Lyu Y, Liu Z (2019) LEAP: a lightweight encryption and authentication protocol for in-vehicle communications. arXiv:1909.10380v1 [cs.CR] 23 Sep 2019.

Matsui M (1994) Linear cryptoanalysis method for DES cipher. In: Helleseth T (ed) EUROCRYPT 1993. LNCS, vol 765, pp 386–397. Springer

Matsui M (1994) Linear cryptanalysis method for DES cipher. Advances in cryptology: proceedings of EUROCRYPT’93. Springer, Berlin, pp 386–397

Mouha N, Wang Q, Gu D, Preneel B (2011) Differential and linear cryptanalysis using mixed-integer linear programming. Information security and cryptology. Inscrypt 2011. Lecture notes in computer science, vol 7537. Springer, Berlin. https://doi.org/10.1007/978-3-642-34704-7_5

Mun, H; Han, K; Hoon Lee, D. Ensuring safety and security in CAN-based automotive embedded systems: a combination of design optimization and secure communication. IEEE Trans Veh Technol; 2020; [DOI: https://dx.doi.org/10.1109/TVT.2020.2989808] 1049.68808

Nyberg K (1994) Differentially uniform mappings for cryptography. In: Helleseth T (eds) Advances in Cryptology—EUROCRYPT’93. EUROCRYPT 1993. Lecture notes in computer science, vol 765. Springer, Berlin. https://doi.org/10.1007/3-540-48285-7_6

Park CH, Kim Y, Jo J-Y (2021) A secure communication method for CANBus. 2021 IEEE 11th annual computing and communication workshop and conference (CCWC)|978-1-6654-1490-6/21/$31.00 ©2021 IEEE. https://doi.org/10.1109/CCWC51732.2021.9376166

Pesé MD, Schauer JW, Li J, Shin KG (2021) S2-CAN: sufficiently secure controller area network. In: Annual computer security applications conference (ACSAC ’21), 6–10 Dec 2021, Virtual Event, USA. ACM, New York. https://doi.org/10.1145/3485832.3485883

Raiynal, J. Data and cyber security in autonomous vehicle networks. Transp Telecommun; 2018; 19, 4 pp. 325-334. [DOI: https://dx.doi.org/10.2478/ttj-2018-0027] 1471.35163

Rijmen V, Daemen J, Preneel B, Bosselaers A, Win ED (1996) The cipher SHARK. In: Proceeding of fast software encryption—FSE 1996. Springer, pp 99–111

Rukhin A, Soto J, Nechvatal J, Smid M, Barker E, Leigh S, Levenson M, Vangel M, Banks D, Heckert A, Dray J (2010) A statistical test suite for random and pseudorandom number generators for cryptographic applications. NIST Special Publication 800-22 Revision 1a Revised: April 2010 Lawrence E Bassham III.

Rukhin A, Soto J, Nechvatal J, Smid M, Barker E, Leigh S, Levenson M, Vangel M, Banks D, Heckert A, Dray J (2010) A statistical test suite for random and pseudorandom number generators for cryptographic applications. Special Publication 800-22 Revision 1a, April 2010.

Shi, D; Kou, L; Huo, C; Wu, T. A CAN bus security testbed framework for automotive cyber-physical systems. Wirel Commun Mob Comput; 2022; 2022, 7176194. [DOI: https://dx.doi.org/10.1155/2022/7176194]

Siddiqui AS, Lee C-C, Che W, Plusquellic J, Saqib F, Secure intra-vehicular communication over CANFD. 978-1-5386-1421-1/17/$31.00©2017 IEEE.

Siddiqui AS, Gui Y, Plusquellic J, Saqib F (2017) Secure communication over CANBUS. 978-1-5090-6389-5/17/$31.00©2017. IEEE.

Soleimany, H; Nyberg, K. Zero-correlation linear cryptanalysis of reduced-round LBlock. Des Codes Cryptogr; 2014; 73, pp. 683-698.3237952 [DOI: https://dx.doi.org/10.1007/s10623-014-9976-y] 1310.94169

Tindel K (2020) CAN bus security-attacks on CAN bus and their mitigations. White Paper- No.1901, Ver. 07, 14 Feb 2020. CANIS Automotive Labs

Wang R, Guan Y, Li X, Zhang R (2020) Formal verification of CAN bus in cyber-physic system. In: 2020 IEEE 20th international conference on software quality, reliability and security companion (QRS-C) 978-1-7281-8915-4/20/$31.00 ©2020 IEEE. https://doi.org/10.1109/QRS-C51114.2020.0005

Xiang Z, Zhang W, Bao Z, Lin D (2016) Applying MILP method to searching integral distinguishers based on division property for6 lightweight block ciphers. ASIACRYPT 2016. ASIACRYPT 2016. Lecture notes in computer science, vol 10031. Springer, Berlin https://doi.org/10.1007/978-3-662-53887-6_24

Xu H, Hao C, Cui Y, Qi W, Impossible differential cryptanalysis ofightweight block cipher WARP. https://doi.org/10.21203/rs.3.rs-3215560/v1.

Yang Q, Hu L, Shi D, Todo Y, Sun S (2018) On the complexity of impossible differential cryptanalysis. In: Hindawi security and communication networks, vol 2018, 7393401. https://doi.org/10.1155/2018/7393401

Yeom J, Seo S (2020) A methodology of CAN communication encryption using a shuffling algorithm. In: 2020 International conference on connected and autonomous driving (MetroCAD), 978-1-7281-6059-7/20/$31.00 ©2020 IEEE. https://doi.org/10.1109/MetroCAD48866.2020.00012

Yi, W; Chen, S; Li, Y. Zero-correlation linear cryptanalysis of SAFER block cipher family using the undisturbed bits. Comput J; 2017; 60, 4 pp. 613-624.3947178 [DOI: https://dx.doi.org/10.1093/comjnl/bxw086] 1229.34013