Cryptanalysis Of Block Cipher Raindrop

Chinese Association for Cryptologic Research(CACR)held the national com-petition for block ciphers and public-key ciphers in 2018.Raindrop is a family of lightweight block ciphers which entered the finals.Raindrop ciphers have three versions in total,which are Raindrop-128/128/60,Raindrop-128/256/80 and Raindrop-256/256/100.The designers declare that Raindrop ciphers can resist against most attacks which include differential attack,linear attack,impos-sible differential attack and so on.Raindrop ciphers use Feistel construction.Besides,Raindrop ciphers use the nonlinear part of Keccak to generate S-Boxes in different sizes.Raindrop ciphers use Mix Row and Cyclic Shift in Column in linear operations.A binary matrix whose depth is one is used in Mix Row.About the key schedule,Raindrop ciphers only use several xor operations to generate round subkeys.This is also a feature for lightweight block ciphers that there are only several operations in their components.In the view of security,Raindrop block cipher has a high degree of redundan-cy.For the differential cryptanalysis,the designers declare that the Raindrop-128/128/60 and Raindrop-128/256/80's effective differential distinguishers won't be more than 32 rounds while Raindrop-256/256/100's effective differential dist.in-guishers won't be more than 64 rounds.For the linear cryptanalysis,Raindrop-128/128/60 and Raindrop-128/256/80's effective linear distinguishers won't be more than 32 rounds while Raindrop-256/256/100's effective linear distinguish-ers won't be more than 64 rounds.In this paper,we make a further evaluation of Raindrop ciphers.For Raindrop-128/128/60 and Raindrop-128/256/80,in the view of differential cryptanalysis,we give the smallest number of active S-Boxes from round 1 to round 16,the maximum probability of differential character from round 1 to round 12 and the maximum probability of iteration differential character from round 1 to round 8.In the view of linear cryptanalysis,we give the smallest number of active S-Boxes from round 1 to round 16 and the maximum linear probability of lin-ear character from round 1 to round 13.In the view of key schedule,we give the analysis of leaked information for round key and the property of diffusion.For Raindrop-256/256/100,in the view of differential cryptanalysis,we give the smallest number of active S-Boxes from round lto round 16,the maximum prob-ability of differential character from round 1 to round 11.In the view of linear cryptanalysis,we give the smallest number of active S-Boxes from round 1 to round 16 and the maximum correlation of linear character from round 1 to round 4.In the view of key schedule,we give the analysis of leaked information for round key and the property of diffusion.At last,we give a 30-round differential attack to Raindrop-128/128/60.