Cryptanalytic Results Research Articles

Understanding the security failures of four user authentication schemes for wireless sensor networks in IoT environment

User authentication protocols are applied to provide a secure conversation between participating entities in wireless sensor networks (WSNs). To identify how to ensure security in these schemes, it is imperative to look into the security vulnerabilities of these authentication mechanisms. As a part of this study, we examine the security of four 2-factor authentication schemes for WSNs (namely, Zhang and Wen, Jangirala et al., Maurya and Sastry and Singh et al.). Security verification result shows that they are all confronted by serious security weaknesses (like sensor node capture attack, exposer of session key by gateway node attack, smart card lost attack, malicious gateway node attack, and session-specific ephemeral information loss attack) and lack of important security functionalities (like multi-factor security, perfect forward secrecy, user anonymity and untraceability, and session key security). This research concentrates on the ‘root cause of the problem. This will help in the research and development of reliable and efficient user authentication mechanisms for WSNs. Our research results point out some new challenges in building reliable multi-factor mechanisms of user authentication for WSNs. We additionally identify some significant insights from the cryptanalysis results of these mechanisms.

New Practical Attacks on GEA-1 Based on a New-Found Weakness

GEA-1, a proprietary stream cipher, was initially designed and used to protect against eavesdropping general packet radio service (GPRS) between the phone and the base station. Now, a variety of current mobile phones still support this standard cipher. In this paper, a structural weakness of the GEA-1 stream cipher that has not been found in previous works is discovered and analyzed. That is the probability that two different inputs of GEA-1 generate the identical keystream can be up to 2−7.30, which is quite high compared with an ideal stream cipher that generates random sequences. Based on this newfound weakness, a new practical distinguishing attack on GEA-1 is proposed, which shows that the keystreams generated by GEA-1 are far from random and can be easily distinguished with a practical time cost. After then, a new practical key recovery attack on GEA-1 is presented. It has a time complexity of 221.02 GEA-1 encryptions and requires only seven related keys, which is much less than the existing related key attack on GEA-1. The experimental results show that GEA-1 can be broken within about 41.75 s on a common PC in the related key setting. These cryptanalytic results show that GEA-1 cannot provide enough security and should be immediately prohibited to be supported in the massive GPRS devices.

Automatic boomerang attacks search on Rijndael

Abstract Boomerang attacks were introduced in 1999 by Wagner (The boomerang attack. In: Knudsen LR, editor. FSE’99. vol. 1636 of LNCS. Heidelberg: Springer; 1999. p. 156–70) as a powerful tool in differential cryptanalysis of block ciphers, especially dedicated to ciphers with good short differentials. They have been generalized to the related-key case by Biham et al. (Related-key boomerang and rectangle attacks. In: Cramer R, editor. Advances in Cryptology - EUROCRYPT 2005, 24th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Aarhus, Denmark, May 22–26, 2005, Proceedings. vol. 3494 of Lecture Notes in Computer Science. Springer; 2005. p. 507–25. doi: 10.1007/11426639_30). In this article, we show how to adapt the model proposed in 2020 by Delaune et al. (Catching the fastest boomerangs application to SKINNY. IACR Trans Symm Cryptol. 2020;2020(4):104–29) for related-key boomerang attacks on the block cipher SKINNY to the Rijndael case. Rijndael is composed of 25 instances that could be seen as generalizations of the Advanced Encryption Standard. We detail our models and present the results we obtain concerning related-key boomerang attacks on Rijndael. Notably, we present a nine-round attack against Rijndael-128-160, which has 11 rounds and beats all previous cryptanalytic results against Rijdael-128-160.

A practical key recovery attack on the lightweight WG-5 stream cipher

WG-5 is a lightweight stream cipher proposed for usage in the resource-constrained devices, e.g., passive RFID tags, industrial controllers, contactless smart cards and sensors. In this paper, a weakness called slide property of WG-5 which has not been discovered in previous works is for the first time explored and analyzed. The result shows that the probability that two related key-IV pairs of WG-5 generate the shifted keystreams can be up to 2−20, which is significantly high compared with an ideal stream cipher that generates the random keystreams. The correctness and accuracy of this theoretical probability is confirmed experimentally. Based on the slide property of WG-5, some key recovery attacks on WG-5 in the related key setting are proposed. The cryptanalytic result shows that the 80-bit secret key of WG-5 can be recovered with a time complexity of 225.615, requiring 6 related keys and 80 keystream bits for each of 224.585 chosen IVs. The experimental result validates our attack and shows that WG-5 can be broken within about 92.054 seconds on a common PC in the related key setting. These results imply that the design of WG-5 is far from optimal and needs to be strengthened to provide enough security for the lightweight constrained applications.

Cryptanalysis of Reduced Round ChaCha – New Attack & Deeper Analysis

In this paper we present several analyses on ChaCha, a software stream cipher. First, we consider a divide-and-conquer approach on the secret key bits by partitioning them. The partitions are based on multiple input-output differentials to obtain a significantly improved attack on 6-round ChaCha256 with a complexity of 299.48. It is 240 times faster than the currently best known attack. This is the first time an attack on a round reduced ChaCha with a complexity smaller than 2k/2, where the secret key is of k bits, has been successful.Further, all the attack complexities related to ChaCha are theoretically estimated in general and there are several questions in this regard as pointed out by Dey, Garai, Sarkar and Sharma in Eurocrypt 2022. In this regard, we propose a toy version of ChaCha, with a 32-bit secret key, on which the attacks can be implemented completely to verify whether the theoretical estimates are justified. This idea is implemented for our proposed attack on 6 rounds. Finally, we show that it is possible to estimate the success probabilities of these kinds of PNB-based differential attacks more accurately. Our methodology explains how different cryptanalytic results can be evaluated with better accuracy rather than claiming that the success probability is significantly better than 50%.

Linear Cryptanalysis of Reduced-Round Simeck Using Super Rounds

The Simeck family of lightweight block ciphers was proposed by Yang et al. in 2015, which combines the design features of the NSA-designed block ciphers Simon and Speck. Previously, we proposed the use of linear cryptanalysis using super-rounds to increase the efficiency of implementing Matsui’s second algorithm and achieved good results on all variants of Simon. The improved linear attacks result from the observation that, after four rounds of encryption, one bit of the left half of the state of the cipher depends on only 17 key bits (19 key bits for the larger variants of the cipher). We were able to follow a similar approach, in all variants of Simeck, with an improvement in Simeck 32 and Simeck 48 by relaxing the previous constraint of a single active bit, using multiple active bits instead. In this paper we present improved linear attacks against all variants of Simeck: attacks on 19-rounds of Simeck 32/64, 28-rounds of Simeck 48/96, and 34-rounds of Simeck 64/128, often with the direct recovery of the full master key without repeating the attack over multiple rounds. We also verified the results of linear cryptanalysis on 8, 10, and 12 rounds for Simeck 32/64.

Chosen plaintext attack on JPEG image encryption with adaptive key and run consistency

A JPEG image encryption with the adaptive key and run consistency of MCUs is proposed. The chosen-plaintext attack (CPA) is given here on this encryption scheme. First, the adaptive key can be reproduced from the encrypted image, so that the plaintext images with the same adaptive key can be constructed. Second, the existence of run consistency of MCUs (RCM) between the original image and the encrypted image facilitates rapid estimation. In addition, the single swap for the runs of MCUs with RCM is designed for more accurate estimation. Detailed cryptanalytic results suggest that this encryption scheme can only be used to realize perceptual encryption but not to provide content protection for digital images. Furthermore, applications of the CPA to break other encryption schemes with RCM are presented.

Rotational Differential-Linear Cryptanalysis Revisited

The differential-linear attack, combining the power of the two most effective techniques for symmetric-key cryptanalysis, was proposed by Langford and Hellman at CRYPTO 1994. From the exact formula for evaluating the bias of a differential-linear distinguisher (JoC 2017), to the differential-linear connectivity table technique for dealing with the dependencies in the switch between the differential and linear parts (EUROCRYPT 2019), and to the improvements in the context of cryptanalysis of ARX primitives (CRYPTO 2020, EUROCRYPT 2021), we have seen significant development of the differential-linear attack during the last four years. In this work, we further extend this framework by replacing the differential part of the attack by rotational-XOR differentials. Along the way, we establish the theoretical link between the rotational-XOR differential and linear approximations and derive the closed formula for the bias of rotational differential-linear distinguishers, completely generalizing the results on ordinary differential-linear distinguishers due to Blondeau, Leander, and Nyberg (JoC 2017) to the case of rotational differential-linear cryptanalysis. We then revisit the rotational cryptanalysis from the perspective of differential-linear cryptanalysis and generalize Morawiecki et al.’s technique for analyzing Keccak, which leads to a practical method for estimating the bias of a (rotational) differential-linear distinguisher in the special case where the output linear mask is a unit vector. Finally, we apply the rotational differential-linear technique to the cryptographic permutations involved in FRIET, Xoodoo, Alzette, and SipHash. This gives significant improvements over existing cryptanalytic results, or offers explanations for previous experimental distinguishers without a theoretical foundation. To confirm the validity of our analysis, all distinguishers with practical complexities are verified experimentally. Moreover, we discuss the possibility of applying the rotational differential-linear technique to S-box-based designs or keyed primitives, and propose some open problems for future research.

Lattice‐based cryptosystems in standardisation processes: A survey

AbstractThe current widely used public‐key cryptosystems are vulnerable to quantum attacks. To prepare for cybersecurity in the quantum era, some projects have been launched to call for post‐quantum alternatives. Due to solid security and desirable performance, lattice‐based cryptosystems are viewed as promising candidates in the upcoming standardisation of post‐quantum cryptography. This study surveys the lattice‐based cryptosystems in the post‐quantum standardisation processes including the NIST Post‐Quantum Cryptography Standardisation and the Chinese Cryptographic Algorithm Design Competition, from both design and security aspects. We present generic design paradigms of lattice‐based schemes and describe several representative proposals and recent progress. We also recap some main cryptanalytic results and methods for estimating the concrete security of lattice‐based schemes.

AES Based White Box Cryptography in Digital Signature Verification

According to the standard paradigm, white box cryptographic primitives are used to block black box attacks and protect sensitive information. This is performed to safeguard the protected information and keys against black box assaults. An adversary in such a setting is aware of the method and can analyze many system inputs and outputs, but is blind to the specifics of how a critical instantiation primitive is implemented. This is the focus of white-box solutions, which are designed to withstand attacks that come from the execution environment. This is significant because an attacker may obtain unrestricted access to the program's execution in this environment. The purpose of this article is to assess the efficiency of white-box implementations in terms of security. Our contribution is twofold: first, we explore the practical implementations of white-box approaches, and second, we analyze the theoretical foundations upon which these implementations are built. First, a research proposal is crafted that details white-box applications of DES and AES encryption algorithms. To begin, this preparation is necessary. The research effort planned for this project also includes cryptanalysis of these techniques. Once the general cryptanalysis results have been examined, the white-box design approaches will be covered. We have decided to launch an investigation into creating a theoretical model for white box, since no prior formal definitions have been offered, and suggested implementations have not been accompanied by any assurance of security. This is due to the fact that no formal definition of "white box" has ever been provided. In this way lies the explanation for why this is the situation. We define WBC to encompass the security requirements of WBC specified over a white box cryptography technology and a security concept by studying formal models of obfuscation and shown security. This definition is the product of extensive investigation. This state-of-the-art theoretical model provides a setting in which to investigate the security of white-box implementations, leading to a wide range of positive and negative conclusions. As a result, this paper includes the results of a Digital Signature Algorithm (DSA) study which may be put to use in the real world with signature verification. Possible future applications of White Box Cryptography (WBC) research findings are discussed in light of these purposes and areas of investigation.

Hybrid dual attack on LWE with arbitrary secrets

In this paper, we study the hybrid dual attack over learning with errors (LWE) problems for any secret distribution. Prior to our work, hybrid attacks are only considered for sparse and/or small secrets. A new and interesting result from our analysis shows that for most cryptographic use cases a hybrid dual attack outperforms a standalone dual attack, regardless of the secret distribution. We formulate our results into a framework of predicting the performance of the hybrid dual attacks. We also present a few tricks that further improve our attack. To illustrate the effectiveness of our result, we re-evaluate the security of all LWE related proposals in round 3 of NIST’s post-quantum cryptography process, and improve the state-of-the-art cryptanalysis results by 2-15 bits, under the BKZ-core-SVP model.

2D eπ-map for image encryption

A chaotic map generally employed to generate chaotic sequence is key element for an image encryption algorithm (IEA). In this study, an IEA using novel 2D chaotic map, which is based on Euler and Pi numbers so-called eπ-map, is presented. eπ-map exploits infinity diversity attribute of these numbers. Moreover, a diffusion operation referred to as “bit reversion” in which the bits of the pixels are symmetrically reverted is proposed for manipulating the pixel value. eπ-map is exhaustively examined through bifurcation and trajectory diagrams, Lyapunov exponent (LE), sample entropy (SE), permutation entropy (PE) and 0-1 test. The encryption performance of the IEA is then investigated across various cryptanalysis such as key-space, key sensitivity, histogram, information entropy, correlation coefficient, differential attack, cropping attack, noise attack and encryption execution time. Furthermore, the results are compared with the most recent literature. It is demonstrated that eπ-map has superior hyperchaotic performance in views of ergodicity, complexity and randomness. The IEA based on eπ-map and bit reversion is a secure and reliable algorithm thanks to its outperforming cryptanalysis results.

Cryptanalysis of the system based on word problems using logarithmic signatures

Rapid development and advances of quantum computers are contributing to the development of public key cryptosystems based on mathematically complex or difficult problems, as the threat of using quantum algorithms to hack modern traditional cryptosystems is becoming much more real every day. It should be noted that the classical mathematically complex problems of factorization of integers and discrete logarithms are no longer considered complex for quantum calculations. Dozens of cryptosystems were considered and proposed on various complex problems of group theory in the 2000s. One of such complex problems is the problem of the word. One of the first implementations of the cryptosystem based on the word problem was proposed by Magliveras using logarithmic signatures for finite permutation groups and further proposed by Lempken et al. for asymmetric cryptography with random covers. The innovation of this idea is to extend the difficult problem of the word to a large number of groups. The article summarizes the known results of cryptanalysis of the basic structures of the cryptosystem and defines recommendations for ways to improve the cryptographic properties of structures and the use of non-commutative groups as basic structures.

Guess-and-Determine Attacks on AEGIS

Abstract AEGIS is one of the authenticated encryption with associated data designs selected for the final portfolio of the CAESAR competition. It combines the AES round function and simple Boolean operations to update its large state and extract a keystream to achieve an excellent software performance. The AEGIS family consists of AEGIS-128, AEGIS-256 and AEGIS-128L, which use 5, 6 and 8 parallel AES round functions to process 128, 128 and 256 bits message block per step with slightly different output functions separately. Surprisingly, very few cryptanalytic results on AEGIS have been published so far. This paper presents the first guess-and-determine attacks on AEGIS family. Firstly, we propose a new observation on the structure of AEGIS that the relations of fixed variables remain in the outputs at consecutive steps under some conditions on the AND operations, and the vectorial bitwise AND operation is biased, which is able to derive the additional variables added directly. Secondly, we add several techniques, such as divide and conquer on byte-based columns, reduction by meet in the middle and simplification through constraints on variables, for each AEGIS member. Finally, we conduct guess-and-determine attacks on AEGIS-128, AEGIS-256 and AEGIS-128L and result in a complexity of $2^{309}$, $2^{437}$ and $2^{384}$ to $2^{416}$, respectively. Although neither attack threatens the practical security of AEGIS, it has great significance to evaluate the resistance of such structure compared with their large internal state exploited of 640, 768 and 1024 bits. It is also the first internal state recovery attack on AEGIS without nonce reusing, while only distinguishing attacks on AEGIS exist up to now.

Atom: A Stream Cipher with Double Key Filter

It has been common knowledge that for a stream cipher to be secure against generic TMD tradeoff attacks, the size of its internal state in bits needs to be at least twice the size of the length of its secret key. In FSE 2015, Armknecht and Mikhalev however proposed the stream cipher Sprout with a Grain-like architecture, whose internal state was equal in size with its secret key and yet resistant against TMD attacks. Although Sprout had other weaknesses, it germinated a sequence of stream cipher designs like Lizard and Plantlet with short internal states. Both these designs have had cryptanalytic results reported against them. In this paper, we propose the stream cipher Atom that has an internal state of 159 bits and offers a security of 128 bits. Atom uses two key filters simultaneously to thwart certain cryptanalytic attacks that have been recently reported against keystream generators. In addition, we found that our design is one of the smallest stream ciphers that offers this security level, and we prove in this paper that Atom resists all the attacks that have been proposed against stream ciphers so far in literature. On the face of it, Atom also builds on the basic structure of the Grain family of stream ciphers. However, we try to prove that by including the additional key filter in the architecture of Atom we can make it immune to all cryptanalytic advances proposed against stream ciphers in recent cryptographic literature.

New results in biclique cryptanalysis of full round GIFT

Security of a recently proposed bitwise block cipher GIFT is evaluated in this paper. In order to mount full round attacks on the cipher, biclique cryptanalysis method is applied. Both variants of the block cipher are attacked using Independent biclique approach. For recovering the secret keys of GIFT-64, the proposed attack requires 2127.45 full GIFT-64 encryption and 28 chosen plain texts. For recovering the secret keys of GIFT-128, the proposed attack requires 2127.82 full GIFT-128 encryption and 218 chosen plain texts. The attack complexity is compared with that of other attacks proposed previously. The security level of GIFT is also compared with that of the parent block cipher PRESENT, based on the analysis.

Chaotic Map Optimization for Image Encryption Using Triple Objective Differential Evolution Algorithm

Chaotic maps used to shuffle and manipulate the image pixels are important for image encryption (IE). In this study, a novel 2D optimized chaotic map (OPMAP) using a triple-objective differential evolution (TODE) algorithm is presented for IE. A model for OPMAP with eight decision variables is empirically designed, and then its variables are determined utilizing TODE through minimizing a triple-objective function that involving Lyapunov exponent (LE), entropy and 0–1 test. OPMAP is assessed with respect to credible measurements like bifurcation, 3D phase space, LE, 0–1 test, permutation entropy (PE) and sample entropy (SE). The capability of OPMAP is then verified through an IE scheme including permutation and diffusion through various cryptanalyses: key space 2298, mean entropy 7.9995, mean correlation 13.61E-5, number of pixels changing rate (NPCR) 99.6093, unified average changing intensity (UACI) 33.4630 and encryption processing time (EPT) 0.2919 (s). A detailed review of IE schemes reported elsewhere is presented and IE performance of OPMAP is also validated by comparison with those IE schemes with and without optimization used. The 2D-OPMAP-based IE is faster and has low computational complexity. Moreover, the proposed it shows better cryptanalysis results for the most of the comparisons.

Optimization of Advanced Encryption Standard on Graphics Processing Units

Graphics processing units (GPUs) are specially designed for parallel applications and perform parallel operations much faster than central processing units (CPUs). In this work, we focus on the performance of the Advanced Encryption Standard (AES) on GPUs. We present optimizations which remove bank conflicts in shared memory accesses and provide 878.6 Gbps throughput for AES-128 encryption on an RTX 2070 Super, which is equivalent to 4.1 Gbps per Watt. Our optimizations provide more than 2.56x speed-up against the best GPU results in the literature. Our optimized AES implementations on GPUs even outperform any CPU using the hardware level AES New Instructions (AES-NI) and legacy FPGA-based cluster architectures like COPACOBANA and RIVYERA. Even on a low-end GPU like MX 250, we obtained 60.0 Gbps throughput for AES-256 which is generally faster than the read/write speeds of solid disks. Thus, transition from AES-128 to AES-256 when using GPUs would provide military grade security with no visible performance loss. With these breakthrough performances, GPUs can be used as a cryptographic co-processor for file or full disk encryption to remove performance loss coming from CPU encryption. With a single GPU as a co-processor, busy SSL servers can be free from the burden of encryption and use their whole CPU power for other operations. Moreover, these optimizations can help GPUs to practically verify theoretically obtained cryptanalysis results or their reduced versions in reasonable time.

Some results on lightweight stream ciphers Fountain v1 & Lizard

In this paper, we propose cryptanalytic results on two lightweight stream ciphers: Fountain v1 and Lizard. The main results of this paper are the followings:$ - $ We propose a zero-sum distinguisher on reduced round Fountain v1. In this context, we study the non-randomness of the cipher with a careful selection of cube variables. Our obtained cube provides a zero-sum on Fountain v1 till $ 188 $ initialization rounds and significant non-randomness till $ 189 $ rounds. This results in a distinguishing attack on Fountain v1 with $ 189 $ initialization rounds. $ - $ Further, we find that the same cipher has a weakness against conditional Time-Memory-Data-Tradeoff (TMDTO). We show that TMDTO attack using sampling resistance has online complexity $ 2^{110} $ and offline complexity $ 2^{146} $. $ - $ Finally, we revisit the Time-Memory-Data-Tradeoff attack on Lizard by Maitra et al. (IEEE Transactions on Computers, 2018) and provide our observations on their work. We show that instead of choosing any random string, some particular strings would provide better results in their proposed attack technique.

On the Security Analysis of a Hopfield Chaotic Neural Network-Based Image Encryption Algorithm

In this paper, the security analysis of a color image encryption algorithm based on Hopfield chaotic neural network is given. The original chaotic image encryption algorithm includes permutation encryption and diffusion encryption. The result of cryptanalysis shows that the chaotic sequences generated by this algorithm are independent of plaintext image, and there exist equivalent permutation key and equivalent diffusion key. Therefore, according to chosen-plaintext attack, the equivalent diffusion key and the equivalent permutation key can be obtained by choosing two special plaintext images and the corresponding ciphertext images, respectively, and the plaintext image is further recovered from the ciphertext image. Theoretical analysis and numerical simulation experiment results verify the effectiveness of the analytical method. Finally, some improved suggestions for the original encryption algorithm are proposed to promote the security.