Connecting Cryptanalytic Distinguishers through Divisibility

What it is

Hosein Hadipour's ePrint 2026/2471 (preprint, revised 2026-10-14) treats divisibility as the common currency between linear, integral, differential-linear and restricted-differential distinguishers. An integral distinguisher can show that the count of ones in an output component is divisible by a high power of 2, which is stronger than the usual "even" zero-sum property. Conversions between the distinguisher types come with explicit divisibility guarantees and data complexity.

How it works

• The paper derives exact random-permutation probabilities and rigorous bounds, so the distinguishing strength accounts for dependencies between output conditions.
• Symbolic route: MILP/SAT models use complete-round Walsh coefficients, or combine Walsh with ultrametric representations for stronger bounds. The weighted models prove finite divisibility even when compatible trails exist, which trail-existence tests alone cannot do.
• Differential-linear sums: combining differential and linear propagation with local DLCT zeros can give false zero-correlation claims. The paper's exact mix-basis models establish zero correlation and finite divisibility without this flaw.
• Black-box route: exact histograms plus the fast Walsh-Hadamard transform search all output masks for chosen input conditions and report zeros and finite divisibility.

Results beyond the summary

• Improvements over Beyne–Verbauwhede come without trail enumeration and at unchanged data complexity.
• Besides the 9-round SIMON32 case, 10-round SIMON48 improves from 2^6 to 2^22.
• SKINNY-64 gets exact counts.
• The black-box searches found output-bit combinations that single-bit searches miss.
• The paper introduces "probabilistic divisibility".

What to do

• If you build distinguishers from differential-linear trails, re-check any zero-correlation claim derived from local DLCT zeros. The paper says these can be false.
• For integral or divisibility analysis of an ARX, Feistel or SPN cipher, test the black-box FWHT search on reduced instances. It needs no cipher-specific modelling.

Caveats

• Only the abstract was available. Tool availability, code release, runtimes and full tables are not stated, so check the paper itself.
• Results are distinguishers on reduced-round primitives. The abstract does not claim full-cipher breaks.