SMT Solver-Based Cryptanalysis of Block Ciphers

Abstract

Satisfiability modulo theories (SMT) is a powerful framework for solving constraint satisfaction problem expressed in first-order logic and mainly used for software and hardware verification. In this article, we demonstrate the power of SMT solvers in cryptanalysis. We propose an algorithm for cryptanalysis of block ciphers using SMT solvers. In the cryptanalytic attack, we represent a block cipher in terms of Boolean equations and convert them into a suitable format (i.e. SMT-LIB). Finally, we use SMT solvers to find the key. An important feature of our attack is that it requires a few plaintext-ciphertext pairs to recover the secret key. We use the propose algorithm to demonstrate the cryptanalysis of International Data Encryption Algorithm (IDEA). We use various serial and parallel SMT solvers to apply known plaintext attack on IDEA and compare their performances. SMT solver can recover full key for three round of IDEA and 32 unknown key bits for full IDEA cipher, assuming 96 key bits are known. Furthermore, we compare our results with existing attacks on IDEA.