Linear cryptanalysis of the PP-1 and PP-2 block ciphers

Abstract

PP-1 and PP-2 are scalable SPN-based block ciphers introduced in 2008 and 2013, respectively. PP-2 was intended as an improvement to PP-1, which was broken in 2011 using differential cryptanalysis. The designers of PP-2 claim that it is comparable to the Advanced Encryption Standard (AES) in its resistance to linear and differential cryptanalysis. However, we demonstrate that both PP-1 and PP-2 with 64-bit and 128-bit block sizes are vulnerable to linear cryptanalysis. Specifically, we find high probability linear hulls that allow us to break each cipher faster than exhaustive search of the keyspace. This is the first use of linear cryptanalysis against PP-1, and the first successful attack of any kind against PP-2. We confirm our theoretical results by experimentally breaking a reduced-round version of PP-2.