Related-tweakey impossible differential attack on reduced-round Deoxys-BC-256

Abstract

Deoxys-BC is the internal tweakable block cipher of Deoxys, a third-round authenticated encryption candidate at the CAESAR competition. In this study, by adequately studying the tweakey schedule, we seek a six-round related-tweakey impossible distinguisher of Deoxys-BC-256, which is transformed from a 3.5-round single-key impossible distinguisher of AES, by application of the mixed integer linear programming (MILP) method. We present a detailed description of this interesting transformation method and the MILP-modeling process.Based on this distinguisher, we mount a key-recovery attack on 10 (out of 14) rounds of Deoxys-BC-256.Compared to previous results that are valid only when the key size $>204$ and the tweak size $<52$, our method can attack 10-round Deoxys-BC-256 as long as the key size $\\geq174$ and the tweak size $\\leq82$. For the popular setting in which the key size is 192 bits, we can attack one round more than previous studies.Note that this paper only gives a more accurate security evaluation and does not threaten the security of full-round Deoxys-BC-256.