Extended Differential Cryptanalysis of Kuznyechik

Abstract

We study the input-side relation $F(cx\oplus a)\oplus F(x)=b$ as an extended differential for block-cipher analysis. Because multiplication occurs before the first S-box, fixing that S-box output leaves an ordinary XOR difference for subsequent binary linear layers and common key additions. For permutations, the extended and outer $c$-differential tables are related by inversion. For the Kuznyechik S-box, the exceptional inverse classes $02/e1$, $04/91$, and $03/\mathtt{be}$ have exact extended differential uniformities $64$, $33$, and $21$. We connect them to the pseudo-exponential structure of Perrin and Udovenko through a cross-field transfer theorem. In the common polynomial basis, the disagreement rank between multiplication maps in the hidden and Kuznyechik fields equals the degree of the multiplier polynomial, yielding structural lower bounds $60$, $30$, and $16$. We also analyze the complete extended differential table: its normalization is doubly stochastic, its energy is an exact multiplicative correlation of ordinary DDT rows, and transferred hidden fibers give explicit Pearson and Shannon-information bounds. Whitening selects the effective row $a\oplus (1\oplus c)K$. For two-round standard Kuznyechik we derive the exact fixed-key channel $Q_{c,\ell }=W_c{P}_{\ell }{W}_1$ and a two-stage maximum-likelihood attack. With $c=04$ it recovers the full $256$-bit master key with failure probability at most $0.01$, using $226,512$ chosen-plaintext pairs and at most $240,669$ encryption queries. Restricted product-model searches give gains of $5.2$, $4.6$, and about $1.6$ bits over the corresponding classical families at two, three, and four rounds. A separate nine-round no-pre-whitening Monte Carlo study is reported only as exploratory evidence because its final configurations followed preliminary screening.