Algebraic Attacks Research Articles

A New Key Exchange Protocol Based on Infinite Non-Abelian Groups

In order to resist quantum attacks, a key exchange protocol based on infinite non-abelian groups is proposed in this paper. For the purpose, by the composition of twice the operation of a semidirect product, we construct a shared secret key which contains two hard problems of equivalent decomposition problem (EDP) and discrete logarithm problem (DLP). Then, two methods，algebra attack and brute force attack, were employed to verify the antiattack for the proposed protocol. By a sound mathematical inference, it demonstrates that the proposed protocol possesses security positively. Finally, we analyzed the computational complexity and bit complexity when the protocol being implemented on braid groups, and furthermore, the complexity data confirm the feasibility of establishing the key exchange protocol there. Thus, in any case, security or complexity, the actual use of the proposed protocol means achievable in practice.

A Wide Class of Boolean Functions Generalizing the Hidden Weight Bit Function

Designing Boolean functions whose output can be computed with light means at high speed, and satisfying all the criteria necessary to resist all major attacks on the stream ciphers using them as nonlinear components, has been an open problem since the beginning of this century, when algebraic attacks were invented. Functions allowing a good resistance are known since 2008, but their output is a little too complex to compute. Functions with fast and easy to compute output are known which have good algebraic immunity, such as majority functions and the so-called hidden weight bit (HWB) functions, but they all have the same cryptographic weakness: their too small nonlinearity. In the present paper, we introduce a generalization of the HWB functions into a construction of n-variable balanced functions f from (n - 1)-variable Boolean functions g having some property held by a large number of functions. Function f is defined by its support, equal to the image set of a vectorial function depending on g. This makes the function complex enough for allowing good cryptographic parameters, while its output is light to compute. The HWB function is what we obtain with f when the initial function g equals constant 1. Other well chosen functions g provide functions f having good cryptographic parameters. We analyze the constructed functions f, we provide a fast way to compute their output, we determine their algebraic normal forms and we show that, most often, their algebraic degree is optimal. We study their Walsh transform and their nonlinearity and algebraic immunity. We observe with computer investigations that this generalization of the HWB function allows to keep its quality of being fast to compute and having good enough algebraic immunity, while significantly improving its nonlinearity. The functions already obtained in the investigations provide a quite good (and never reached before) trade-off between speed and security. Further (probably difficult) work should allow obtaining, among such generalized HWB functions whose number is huge, still better filter functions to be used in stream ciphers.

A comprehensive tolerant algebraic side-channel attack over modern ciphers using constraint programming

A comprehensive tolerant algebraic side-channel attack over modern ciphers using constraint programming

Key-Dependent Feedback Configuration Matrix of Primitive σ–LFSR and Resistance to Some Known Plaintext Attacks

In this paper, we propose and evaluate a method for generating key-dependent feedback configurations (KDFC) for <inline-formula> <tex-math notation="LaTeX">$\sigma $ </tex-math></inline-formula>-LFSRs. <inline-formula> <tex-math notation="LaTeX">$\sigma $ </tex-math></inline-formula>-LFSRs with such configurations can be applied to any stream cipher that uses a word-based LFSR. Here, a configuration generation algorithm uses the secret key(K) and the Initialization Vector (IV) to generate a new feedback configuration after the initialization round. It replaces the older known feedback configuration. The keystream is generated from this new feedback configuration and the FSM part. We have mathematically analysed the feedback configurations generated by this method. As a test case, we have applied this method on SNOW 2.0 and have studied its impact on resistance to algebraic attacks. Besides, as a consequence of resisting algebraic attacks, SNOW 2.0 can also withstand some other attacks like Distinguishing Attack, Fast Correlation Attack, Guess and Determining Attack and Cache Timing Attack. Further, we have also tested the generated keystream for randomness and have briefly described its implementation and the challenges involved in the same.

Algebraic attacks on block ciphers using quantum annealing

This paper presents the transformation method of the system of algebraic equations describing the symmetric cipher into the QUBO problem. After transformation of given equations <inline-formula><tex-math notation="LaTeX">$f_0, f_1, \ldots, f_{n-1}$</tex-math><alternatives><mml:math><mml:mrow><mml:msub><mml:mi>f</mml:mi><mml:mn>0</mml:mn></mml:msub><mml:mo>,</mml:mo><mml:msub><mml:mi>f</mml:mi><mml:mn>1</mml:mn></mml:msub><mml:mo>,</mml:mo><mml:mo>...</mml:mo><mml:mo>,</mml:mo><mml:msub><mml:mi>f</mml:mi><mml:mrow><mml:mi>n</mml:mi><mml:mo>-</mml:mo><mml:mn>1</mml:mn></mml:mrow></mml:msub></mml:mrow></mml:math><inline-graphic xlink:href="wronski-ieq1-3143152.gif"/></alternatives></inline-formula> to equations over integers <inline-formula><tex-math notation="LaTeX">$f^{\prime }_0, f^{\prime }_1, \ldots, f^{\prime }_{n-1}$</tex-math><alternatives><mml:math><mml:mrow><mml:msubsup><mml:mi>f</mml:mi><mml:mn>0</mml:mn><mml:mo>&#x0027;</mml:mo></mml:msubsup><mml:mo>,</mml:mo><mml:msubsup><mml:mi>f</mml:mi><mml:mn>1</mml:mn><mml:mo>&#x0027;</mml:mo></mml:msubsup><mml:mo>,</mml:mo><mml:mo>...</mml:mo><mml:mo>,</mml:mo><mml:msubsup><mml:mi>f</mml:mi><mml:mrow><mml:mi>n</mml:mi><mml:mo>-</mml:mo><mml:mn>1</mml:mn></mml:mrow><mml:mo>&#x0027;</mml:mo></mml:msubsup></mml:mrow></mml:math><inline-graphic xlink:href="wronski-ieq2-3143152.gif"/></alternatives></inline-formula>, one can linearize each, obtaining <inline-formula><tex-math notation="LaTeX">$f^{\prime }_{lin_i}=lin(f^{\prime }_i)$</tex-math><alternatives><mml:math><mml:mrow><mml:msubsup><mml:mi>f</mml:mi><mml:mrow><mml:mi>l</mml:mi><mml:mi>i</mml:mi><mml:msub><mml:mi>n</mml:mi><mml:mi>i</mml:mi></mml:msub></mml:mrow><mml:mo>&#x0027;</mml:mo></mml:msubsup><mml:mo>=</mml:mo><mml:mi>l</mml:mi><mml:mi>i</mml:mi><mml:mi>n</mml:mi><mml:mrow><mml:mo>(</mml:mo><mml:msubsup><mml:mi>f</mml:mi><mml:mi>i</mml:mi><mml:mo>&#x0027;</mml:mo></mml:msubsup><mml:mo>)</mml:mo></mml:mrow></mml:mrow></mml:math><inline-graphic xlink:href="wronski-ieq3-3143152.gif"/></alternatives></inline-formula>, for <inline-formula><tex-math notation="LaTeX">$i=\overline{0, n-1}$</tex-math><alternatives><mml:math><mml:mrow><mml:mi>i</mml:mi><mml:mo>=</mml:mo><mml:mover><mml:mrow><mml:mn>0</mml:mn><mml:mo>,</mml:mo><mml:mi>n</mml:mi><mml:mo>-</mml:mo><mml:mn>1</mml:mn></mml:mrow><mml:mo>&#x00AF;</mml:mo></mml:mover></mml:mrow></mml:math><inline-graphic xlink:href="wronski-ieq4-3143152.gif"/></alternatives></inline-formula>, where <inline-formula><tex-math notation="LaTeX">$lin$</tex-math><alternatives><mml:math><mml:mrow><mml:mi>l</mml:mi><mml:mi>i</mml:mi><mml:mi>n</mml:mi></mml:mrow></mml:math><inline-graphic xlink:href="wronski-ieq5-3143152.gif"/></alternatives></inline-formula> denotes linearization operation. Finally, one can obtain problem in the QUBO form as <inline-formula><tex-math notation="LaTeX">$(f^{\prime }_{lin_0} )^2+\cdots +(f^{\prime }_{lin_{n-1}} )^2+Pen-C$</tex-math><alternatives><mml:math><mml:mrow><mml:msup><mml:mrow><mml:mo>(</mml:mo><mml:msubsup><mml:mi>f</mml:mi><mml:mrow><mml:mi>l</mml:mi><mml:mi>i</mml:mi><mml:msub><mml:mi>n</mml:mi><mml:mn>0</mml:mn></mml:msub></mml:mrow><mml:mo>&#x0027;</mml:mo></mml:msubsup><mml:mo>)</mml:mo></mml:mrow><mml:mn>2</mml:mn></mml:msup><mml:mo>+</mml:mo><mml:mo>&#x22EF;</mml:mo><mml:mo>+</mml:mo><mml:msup><mml:mrow><mml:mo>(</mml:mo><mml:msubsup><mml:mi>f</mml:mi><mml:mrow><mml:mi>l</mml:mi><mml:mi>i</mml:mi><mml:msub><mml:mi>n</mml:mi><mml:mrow><mml:mi>n</mml:mi><mml:mo>-</mml:mo><mml:mn>1</mml:mn></mml:mrow></mml:msub></mml:mrow><mml:mo>&#x0027;</mml:mo></mml:msubsup><mml:mo>)</mml:mo></mml:mrow><mml:mn>2</mml:mn></mml:msup><mml:mo>+</mml:mo><mml:mi>P</mml:mi><mml:mi>e</mml:mi><mml:mi>n</mml:mi><mml:mo>-</mml:mo><mml:mi>C</mml:mi></mml:mrow></mml:math><inline-graphic xlink:href="wronski-ieq6-3143152.gif"/></alternatives></inline-formula>, where <inline-formula><tex-math notation="LaTeX">$Pen$</tex-math><alternatives><mml:math><mml:mrow><mml:mi>P</mml:mi><mml:mi>e</mml:mi><mml:mi>n</mml:mi></mml:mrow></mml:math><inline-graphic xlink:href="wronski-ieq7-3143152.gif"/></alternatives></inline-formula> denotes penalties obtained during linearization of equations, <inline-formula><tex-math notation="LaTeX">$n$</tex-math><alternatives><mml:math><mml:mi>n</mml:mi></mml:math><inline-graphic xlink:href="wronski-ieq8-3143152.gif"/></alternatives></inline-formula> is the number of equations and <inline-formula><tex-math notation="LaTeX">$C$</tex-math><alternatives><mml:math><mml:mi>C</mml:mi></mml:math><inline-graphic xlink:href="wronski-ieq9-3143152.gif"/></alternatives></inline-formula> is constant appearing in the polynomial <inline-formula><tex-math notation="LaTeX">$(f^{\prime }_{lin_0} )^2+\cdots +(f^{\prime }_{lin_{n-1}} )^2+Pen$</tex-math><alternatives><mml:math><mml:mrow><mml:msup><mml:mrow><mml:mo>(</mml:mo><mml:msubsup><mml:mi>f</mml:mi><mml:mrow><mml:mi>l</mml:mi><mml:mi>i</mml:mi><mml:msub><mml:mi>n</mml:mi><mml:mn>0</mml:mn></mml:msub></mml:mrow><mml:mo>&#x0027;</mml:mo></mml:msubsup><mml:mo>)</mml:mo></mml:mrow><mml:mn>2</mml:mn></mml:msup><mml:mo>+</mml:mo><mml:mo>&#x22EF;</mml:mo><mml:mo>+</mml:mo><mml:msup><mml:mrow><mml:mo>(</mml:mo><mml:msubsup><mml:mi>f</mml:mi><mml:mrow><mml:mi>l</mml:mi><mml:mi>i</mml:mi><mml:msub><mml:mi>n</mml:mi><mml:mrow><mml:mi>n</mml:mi><mml:mo>-</mml:mo><mml:mn>1</mml:mn></mml:mrow></mml:msub></mml:mrow><mml:mo>&#x0027;</mml:mo></mml:msubsup><mml:mo>)</mml:mo></mml:mrow><mml:mn>2</mml:mn></mml:msup><mml:mo>+</mml:mo><mml:mi>P</mml:mi><mml:mi>e</mml:mi><mml:mi>n</mml:mi></mml:mrow></mml:math><inline-graphic xlink:href="wronski-ieq10-3143152.gif"/></alternatives></inline-formula>. This paper presents the transformation method of SPN block ciphers to the QUBO problem. What is more, we present the results of the transformation of the complete AES-128 cipher to the QUBO problem, where the number of variables of the equivalent QUBO problem equals approximately 30,026. It is worth noting that AES-128 is much easier to solve using quantum annealing than the factorization problem and the discrete logarithm problem of a similar level of security. For example, factorizing a 3072 bit long RSA integer using quantum annealing requires a QUBO problem of about 2,360,000 variables.

Efficient Image Encryption Based on New Substitution Box Using DNA Coding and Bent Function

This paper contributes to creating an unbreakable S-Box based on strong bent function expanded by DNA sequences and investigates and analyzes the strength of the proposed S-Box against major standard criteria and benchmarks such as interpolation attack, algebraic attack, avalanche effect, nonlinearity, and period. The outcome of the tests shows that the proposed S-box has good security, as well as it is passed all the randomness tests. On average, the results had after the tests applied have been come with SAC =0.50122, NL = 112, BIC =103.40625 and an iterative period with its maximum value = 256. The complexity of the proposed S-Box is increased with the getting algebraic expression of 255 terms which implies that the algebraic attack resistance = 2¹⁶⁰. Based on the proposed S-Box, a candidate image enciphering scheme is also suggested to prove the strength of the S-Box. The analysis of the experiments that applied on two modes of images, gray images and RGB ones, supports the scheme&#x2019;s robustness against different differential and statical using standard criteria such as correlation coefficient analysis, information entropy, histogram analysis, unified average change intensity, number of pixels change rate and many others. This enforces the capability of using it in modern-day cryptosystems that utilized in multimedia data exchange.

Design Principles of Secure Certificateless Signature and Aggregate Signature Schemes for IoT Environments

Certificateless cryptography resolves the certificate management problem of public-key cryptography and the key-escrow problem of identity-based cryptography. An aggregate signature scheme which allows to aggregate <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</i> distinct signatures on <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</i> distinct messages of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</i> distinct signers into a single signature reduces communication overhead and computational cost. Due to the suitability of certificateless signature (CLS) and certificateless aggregate signature (CLAS) schemes for IoT environments, similar CLS and CLAS schemes have been proposed for a long time and, despite their security proofs, they have been attacked and modified to prevent the attacks. Even now, similar design methods and similar attacks on the schemes are being repeated. In order to prevent the similar attacks on the schemes, it is necessary to analyze their causes and vulnerabilities. In this paper, we first show that recently proposed five CLS and CLAS schemes are insecure against universal forgery attacks, type I attacks, type II attacks or malicious-but-passive-KGC attacks. We discuss their security flaws, causes and countermeasures. We then present design principles to prevent various algebraic attacks including our attacks. The design principles will help in the construction of secure CLS and CLAS schemes against the previous attacks and potential attacks.

ESSM: Formal Analysis Framework for Protocol to Support Algebraic Operations and More Attack Capabilities

The strand space model has been proposed as a formal method for verifying the security goals of cryptographic protocols. However, only encryption and decryption operations and hash functions are currently supported for the semantics of cryptographic primitives. Therefore, we establish the extended strand space model (ESSM) framework to describe algebraic operations and advanced threat models. Based on the ESSM, we add algebraic semantics, including the Abelian group and the XOR operation, and a threat model based on algebraic attacks, key-compromise impersonation attacks, and guess attacks. We implement our model using the automatic analysis tool, Scyther. We demonstrate the effectiveness of our framework by analysing several protocols, in particular a three-factor agreement protocol, with which we can identify new attacks while providing trace proofs.

Stream/block ciphers, difference equations and algebraic attacks

In this paper we model a class of stream and block ciphers as systems of (ordinary) explicit difference equations over a finite field. We call this class “difference ciphers” and we show that ciphers of application interest, as for example systems of LFSRs with a combiner, Trivium and KeeLoq, belong to the class. By using Difference Algebra, that is, the formal theory of difference equations, we can properly define and study important properties of these ciphers, such as their invertibility and periodicity. We describe then general cryptanalytic methods for difference ciphers that follow from these properties and are useful to assess the security. We illustrate such algebraic attacks in practice by means of the ciphers Bivium and KeeLoq.

A White-Box Implementation of IDEA

IDEA is a classic symmetric encryption algorithm proposed in 1991 and widely used in many applications. However, there is little research into white-box IDEA. In traditional white-box implementations of existing block ciphers, S-boxes are always converted into encoded lookup tables. However, the algebraic operations of IDEA without S-boxes, make the implementation not straight forward and challenging. We propose a white-box implementation of IDEA by applying a splitting symmetric encryption method, and verify its security against algebraic analysis and BGE-like attacks. Our white-box implementation requires an average of about 2800 ms to encrypt a 64-bit plaintext, about 60 times more than the original algorithm would take, which is acceptable for practical applications. Its storage requirements are only about 10 MB. To our knowledge, this is the first public white-box IDEA solution, and its design by splitting can be applied to similar algebraic encryption structures.

Encryption Based on Cellular Automata for Wireless Devices in IoT Environment

A large number of physical objects are interconnected and accessed through the internet along with the existing technology like cloud computing, mobile computing, wireless sensor networks and big data forms a big paradigm called the Internet of Things (IoT). Data from remote and neglected areas are collected via wireless sensors and stored in the cloud. Growth in the number of the sensing device and the server to which these are connected leads to many security issues and malicious attacks. With mirai botnet and jeep hack about 150 million user’s information from MyFitnessPal nutrition app was stolen. This paper mainly focuses on security challenges for transmitting the data in the wireless sensor network in the IoT environment. To avoid the malicious attack, eavesdropping, algebraic attacks and other attacks a new security algorithm is proposed based on Cellular Automata (CA) which has a key length of 80 bits and the text size is 64 bits. Reversible rules of CA are used in this algorithm to achieve reversibility, parallelism, stability, randomness, and uniformity. The process of encryption and decryption is performed for 15 rounds to avoid dependency between the ciphertext and the plain text. Finally, we compare the execution time, throughput and the avalanche effect of the proposed algorithm with the existing algorithm like Advanced Encryption Standard (AES), Height, Present algorithm. The proposed algorithm is verified to be a better choice for lost cost and resource-restricted devices.

Cryptanalysis of the extension field cancellation cryptosystem

In this article, we present algebraic attacks against the Extension Field Cancellation ( $$\texttt {EFC}$$ ) scheme, a multivariate public-key encryption scheme which was published at PQCRYPTO’2016. First, we present a successful Grobner basis message-recovery attack on the first and second proposed parameters of the scheme. For the first challenge parameter, a Grobner-based hybrid attack has a $$2^{65}$$ bit complexity which beats the claimed 80 bit security level. We further show that the algebraic system arising from an $$\texttt {EFC}$$ public-key is much easier to solve than a random system of the same size. Briefly, this is due to the apparition of many lower degree equations during the Grobner basis computation. We present a polynomial-time method to recover such lower-degree relations and also show their usefulness in improving the Grobner basis attack complexity on $$\texttt {EFC}$$ . Thus, we show that there is an algebraic structural weakness in the system of equations coming from $$\texttt {EFC}$$ and hence makes the scheme not suitable for encryption.

Obfuscating Circuits Via Composite-Order Graded Encoding

We present a candidate obfuscator based on composite-order graded encoding schemes (GES), which are a generalization of multilinear maps. Our obfuscator operates on circuits directly without converting them into formulas or branching programs as was done in previous solutions. As a result, the time and size complexity of the obfuscated program, measured by the number of GES elements, is directly proportional to the circuit complexity of the program being obfuscated. This improves upon previous constructions whose complexity was related to the formula or branching program size. Known instantiations of Graded Encoding Schemes allow us to obfuscate circuit classes of polynomial degree, which include for example families of circuits of logarithmic depth. We prove that our obfuscator is secure against a class of generic algebraic attacks, formulated by a generic graded encoding model. We further consider a more robust model which provides more power to the adversary and extend our results to this setting as well. As a secondary contribution, we define a new simple notion of algebraic security (which was implicit in previous works) and show that it captures standard security relative to an ideal GES oracle.

A White-Box Masking Scheme Resisting Computational and Algebraic Attacks

White-box cryptography attempts to protect cryptographic secrets in pure software implementations. Due to their high utility, white-box cryptosystems (WBC) are deployed by the industry even though the security of these constructions is not well defined. A major breakthrough in generic cryptanalysis of WBC was Differential Computation Analysis (DCA), which requires minimal knowledge of the underlying white-box protection and also thwarts many obfuscation methods. To avert DCA, classic masking countermeasures originally intended to protect against highly related side-channel attacks have been proposed for use in WBC. However, due to the controlled environment of WBCs, new algebraic attacks against classic masking schemes have quickly been found. These algebraic DCA attacks break all classic masking countermeasures efficiently, as they are independent of the masking order.In this work, we propose a novel generic masking scheme that can resist both DCA and algebraic DCA attacks. The proposed scheme extends the seminal work by Ishai et al. which is probing secure and thus resists DCA, to also resist algebraic attacks. To prove the security of our scheme, we demonstrate the connection between two main security notions in white-box cryptography: probing security and prediction security. Resistance of our masking scheme to DCA is proven for an arbitrary order of protection, using the well-known strong non-interference notion by Barthe et al. Our masking scheme also resists algebraic attacks, which we show concretely for first and second-order algebraic protection. Moreover, we present an extensive performance analysis and quantify the overhead of our scheme, for a proof-of-concept protection of an AES implementation.

Quantum Algorithm for Boolean Equation Solving and Quantum Algebraic Attack on Cryptosystems

This paper presents a quantum algorithm to decide whether a Boolean equation system F has a solution and to compute one if F does have solutions with any given success probability. The runtime complexity of the algorithm is polynomial in the size of F and the condition number of certain Macaulay matrix associated with F. As a consequence, the authors give a polynomial-time quantum algorithm for solving Boolean equation systems if their condition numbers are polynomial in the size of F. The authors apply the proposed quantum algorithm to the cryptanalysis of several important cryptosystems: The stream cipher Trivum, the block cipher AES, the hash function SHA-3/Keccak, the multivariate public key cryptosystems, and show that they are secure under quantum algebraic attack only if the corresponding condition numbers are large. This leads to a new criterion for designing such cryptosystems which are safe against the attack of quantum computers: The corresponding condition number.

Linear codes from vectorial Boolean functions in the context of algebraic attacks

In this paper, we study the relationship between vectorial (Boolean) functions and cyclic codes in the context of algebraic attacks. We first derive a direct link between the annihilators of a vectorial function (in univariate form) and certain [Formula: see text]-ary cyclic codes (which we show that they are LCD codes). We also present some properties of those cyclic codes as well as their weight enumerator. In addition, we generalize the so-called algebraic complement and study its properties.

Improved algebraic attacks on lightweight block ciphers

This paper proposes improved algebraic attacks that are effective for lightweight block ciphers. Concretely, we propose a new framework that leverages on algebraic preprocessing as well as modern SAT solvers to perform algebraic cryptanalysis on block ciphers. By combining with chosen plaintext attacks, we show that our framework can be applied to lightweight block ciphers that exhibit a nice differential trail. In particular, we demonstrate our techniques by performing algebraic cryptanalysis on both the Present cipher and the Simon cipher. For the Present cipher, we successfully solved up to 9 rounds with at most 32 key bits fixed and 8 chosen plaintexts. On the other hand, for the Simon cipher, we tested our method on Simon-32/64 and Simon-64/128. For these two versions, our attack can solve up to 13 rounds with only 8 chosen plaintexts by fixing 4 and 6 key bits for Simon-32/64 and Simon-64/128, respectively. Further, by considering a class of weak keys, we can extend our attacks to 16 rounds. As far as we are aware, these are the best algebraic attacks on these ciphers in the literature.

Different Types of Attacks on Block Ciphers

Cryptanalysis is a very important challenge that faces cryptographers. It has several types that should be well studied by cryptographers to be able to design cryptosystem more secure and able to resist any type of attacks. This paper introduces six types of attacks: Linear, Differential, Linear-Differential, Truncated differential Impossible differential attack and Algebraic attacks. In this paper, algebraic attack is used to formulate the substitution box(S-box) of a block cipher to system of nonlinear equations and solve this system by using a classical method called Grobner Bases. By Solving these equations, we made algebraic attack on S-box.

SMT‐based cube attack on round‐reduced Simeck32/64

In this study, the authors take advantage of feeding the SMT solver by extra information provided through middle state cube characteristics to introduce a new method which they call SMT-based cube attack, and apply it to improve the success of the solver in attacking reduced-round versions of Simeck32/64 lightweight block cipher. The key idea is to search for and utilise all found middle state characteristics of a cube at one round of attack. They first propose a new algorithm to find cubes with most number of middle state characteristics. Then, they apply these obtained cubes and their characteristics as extra information in the SMT definition of the cryptanalysis problem, to evaluate its effectiveness. Their cryptanalysis results in a full key recovery attack by 64 plaintext/ciphertext pairs on 12 rounds of the cipher in just 122.17 s. This is the first algebraic attack so far presented against the reduced-round versions of Simeck32/64, and also with practical complexities. They also conduct the cube attack on the Simeck32/64 to compare with the SMT-based cube attack. The results indicate that the proposed attack is more powerful than the cube attack.

Algebraic immunity of vectorial boolean functions and boolean groebner bases

The basic concepts and results related to the Boolean Groebner bases and their application for computing the algebraic immunity of vectorial Boolean functions are considered. This parameter plays an important role for the security evaluation of block ciphers against algebraic attacks. Unlike the available works, the description is carried out at the elementary level using terms of Boolean functions theory. In addition, obtained proofs are shorter than the previous ones. This allows us to achieve significant progress in building the fundamentals of the theory (for the Boolean case) using only elementary methods.The paper can be useful for students and postgraduate students studying cryptology. It may also save time for professionals who want to get familiar with the mathematical techniques used in algebraic attacks on block ciphers.