Distinguishing Attack Research Articles

New Practical Attacks on GEA-1 Based on a New-Found Weakness

GEA-1, a proprietary stream cipher, was initially designed and used to protect against eavesdropping general packet radio service (GPRS) between the phone and the base station. Now, a variety of current mobile phones still support this standard cipher. In this paper, a structural weakness of the GEA-1 stream cipher that has not been found in previous works is discovered and analyzed. That is the probability that two different inputs of GEA-1 generate the identical keystream can be up to 2−7.30, which is quite high compared with an ideal stream cipher that generates random sequences. Based on this newfound weakness, a new practical distinguishing attack on GEA-1 is proposed, which shows that the keystreams generated by GEA-1 are far from random and can be easily distinguished with a practical time cost. After then, a new practical key recovery attack on GEA-1 is presented. It has a time complexity of 221.02 GEA-1 encryptions and requires only seven related keys, which is much less than the existing related key attack on GEA-1. The experimental results show that GEA-1 can be broken within about 41.75 s on a common PC in the related key setting. These cryptanalytic results show that GEA-1 cannot provide enough security and should be immediately prohibited to be supported in the massive GPRS devices.

Cascading Four Round LRW1 is Beyond Birthday Bound Secure

In CRYPTO’02, Liskov et al. introduced the concept of a tweakable block cipher, a novel symmetric key primitive with promising applications. They put forth two constructions for designing such tweakable block ciphers from conventional block ciphers: LRW1 and LRW2. While subsequent efforts extended LRW2 to achieve security beyond the birthday bound (e.g., cascaded LRW2 in CRYPTO’12 by Landecker et al.), the extension of LRW1 remained unexplored until Bao et al.’s work in EUROCRYPT’20 that considered cascaded LRW1, a one-round extension of LRW1 - entailing masking the LRW1 output with the given tweak and re-encrypting it with the same block cipher. They showed that CLRW1 offers security up to 22n/3 queries. However, this result was challenged by Khairallah’s recent birthday bound distinguishing attack on cascaded LRW1, effectively refuting the security claim of Bao et al. Consequently, a pertinent research question emerges: How many rounds of cascaded LRW1 are required to obtain security beyond the birthday bound? This paper addresses this question by establishing that cascading LRW1 for four rounds suffices to ensure security beyond the birthday bound. Specifically, we demonstrate that 4 rounds of CLRW1 guarantees security for up to 23n/4 queries. Our security analysis is based from recent advancements in the mirror theory technique for tweakable random permutations, operating within the framework of the Expectation Method.

Generic attacks on small-state stream cipher constructions in the multi-user setting

Small-state stream ciphers (SSCs), which violate the principle that the state size should exceed the key size by a factor of two, still demonstrate robust security properties while maintaining a lightweight design. These ciphers can be classified into several constructions and their basic security requirement is to resist generic attacks, i.e., the time–memory–data tradeoff (TMDTO) attack. In this paper, we investigate the security of small-state constructions in the multi-user setting. Based on it, the TMDTO distinguishing attack and the TMDTO key recovery attack are developed for such a setting. It is shown that SSCs which continuously use the key can not resist the TMDTO distinguishing attack. Moreover, SSCs based on the continuous-IV-key-use construction cannot withstand the TMDTO key recovery attack when the key length is shorter than the IV length, no matter whether the keystream length is limited or not. Finally, we apply these two generic attacks to TinyJAMBU and DRACO in the multi-user setting. The TMDTO distinguishing attack on TinyJAMBU with a 128-bit key can be mounted with time, memory, and data complexities of 2^{64}, 2^{48}, and 2^{32}, respectively. This attack is comparable with a recent work on ToSC 2022, where partial key bits of TinyJAMBU are recovered with more than 2^{50} users (or keys). As DRACO’s IV length is smaller than its key length, it is vulnerable to the TMDTO key recovery attack. The resulting attack has a time and memory complexity of both 2^{112}, which means DRACO does not provide 128-bit security in the multi-user setting.

A new distinguishing attack on reduced round ChaCha permutation

This work concentrates on differential-linear distinguishing attacks on the prominent ARX-based permutation ChaCha. Here, we significantly improve the 7-round differential-linear distinguisher for ChaCha permutation by introducing a new path of linear approximation. We first introduce a new single-bit differential distinguisher for the 3.5th round of the permutation that assists us in inventing a new path for the differential-linear distinguisher. We show that one can distinguish a 7-round ChaCha permutation with time complexity of 2^{207}. This improves the recent work of Coutinho et al. (in: Advances in Cryptology—ASIACRYPT 2022—28nd International Conference on the Theory and Application of Cryptology and Information Security, Taipei, Taiwan, December 5–9, 2012, Springer, 2022), which achieved time complexity 2^{214}. We also propose a distinguisher for the 7.25-round of ChaCha permutation and this is the first distinguishing attack for more than 7-round of ChaCha permutation. We provide theoretical proofs and the corresponding experimental results for the linear approximations that we use for differential-linear distinguisher. We point out that the existing multibit distinguishing attacks on the cipher ChaCha are invalid. These attacks are worked only for the ChaCha permutation.

On the resistance of new lightweight block ciphers against differential cryptanalysis

Many recently proposed lightweight block ciphers lack security evaluation against generic cryptanalytic attacks such as differential cryptanalysis. In this paper, we contribute towards security evaluation efforts by investigating four lightweight Feistel-based block ciphers including SLIM, LBC-IoT, SCENERY, and LCB. SLIM claims resistance to differential cryptanalysis since, using a heuristic technique, its designers could only find a 7-round differential trail. Despite having no analysis of security against attacks such as differential cryptanalysis, the designers of LBC-IoT and LCB claimed that their ciphers are secure. Meanwhile, the designers of SCENERY claim that the best 11-round differential trail for the cipher has a probability of 2−66. To substantiate these claims, we propose attacks on all four ciphers based on differential cryptanalysis. We presented practical key recovery attacks on SLIM which can retrieve the final round key for up to 14 rounds with a time complexity of 232. LBC-IoT was found to be weaker against differential cryptanalysis despite sharing many similarities with SLIM, whereby a key recovery attack of up to 19 rounds is possible with time complexity 231. For SCENERY, we found a differential trail of up to 12 rounds with probability 2−60, which was used as the distinguisher for a 13-round key recovery attack. We also discovered that LCB's design lacks nonlinearity, allowing us to easily derive deterministic differential trails regardless of the number of rounds. This flaw allowed us to perform a trivial distinguishing attack using a single known ciphertext. By using a different S-box to address this flaw, LCB is now more resilient to differential cryptanalysis than SLIM and LBC-IoT when using the same number of rounds. Our paper presents new independent cryptanalysis results for these ciphers.

MILP‐based security evaluation for AEGIS/Tiaoxin‐346/Rocca

AbstractIn this paper, the security of Advanced Encryption Standard‐based authenticated encryption schemes, including AEGIS family, Tiaoxin‐346, and Rocca by mixed integer linear programming tools is examined. Specifically, for the initialisation phase of AEGIS, Tiaoxin‐346, and Rocca, the security against differential attacks and integral attacks is evaluated by estimating the lower bounds for the number of active S‐boxes and utilising division property, respectively. In addition to the estimations of initialisation phases, the security of the encryption phases of AEGIS, Tiaoxin‐346, and Rocca against distinguishing attacks on keystream is evaluated by exploiting integral properties. As a result, the authors show that the initialisation phases of AEGIS‐128/128L/256, Tiaoxin‐346, and Rocca are secure against differential attacks after 4/3/6, 5, and 6 rounds, respectively. Regarding integral attacks, the distinguisher is found on 6/6/7, 15, and 7 rounds in the initialisation phases of AEGIS‐128/128L/256, Tiaoxin‐346, and Rocca, respectively. Additionally, the integral distinguisher is presented on 2/2/4, 4, and 4 rounds in the encryption phases of AEGIS‐128/128L/256, Tiaoxin‐346, and Rocca, respectively. As far as it is known, this study’s results are the first distinguishing attacks on the keystream on AEGIS, Tiaoxin‐346, and Rocca without relying on weak keys.

An Attack on a Proposed Construction of Small-State Stream Ciphers and Proposals for New Constructions

Abstract Small-state stream ciphers (SSCs) idea is based on using key bits not only in the initialization but also continuously in the keystream generation phase. A time-memory-data tradeoff (TMDTO) distinguishing attack was successfully applied against all SSCs in 2017 by Hamann et al. They suggested using not only key bits but also initial value (IV) bits continuously in the keystream generation phase to strengthen SSCs against TMDTO attacks. Then, Hamann and Krause proposed a construction based on using only IV bits continuously in the packet mode. They suggested an instantiation of an SSC and claimed that it is resistant to TMDTO attacks. We point out that accessing IV bits imposes an overhead on cryptosystems that might be unacceptable in some applications. More importantly, we show that the proposed SSC remains vulnerable to TMDTO attacks 1. To resolve this security threat, the current paper proposes constructions based on storing key or IV bits that are the first to provide full security against TMDTO attacks. Five constructions are proposed for different applications by considering efficiency. Designers can obtain each construction’s minimum volatile state length according to the desirable keystream, key and IV lengths.

Improved differential attacks on the reduced-round SNOW-V and SNOW-Vi stream cipher

The SNOW-V stream cipher is a candidate cipher for 5G mobile communication system, and the SNOW-Vi stream cipher is a faster variant of SNOW-V. In this paper, we analyze the resistance of the reduced-round SNOW-V and SNOW-Vi against the chosen IV differential distinguishing attacks in the initialization phase. Firstly, we use the divide-and-conquer strategy to give a Mixed-integer Linear Programming (MILP) model to describe the probabilities within the Differential Distribution Table (DDT) of large S-boxes, which can more accurately search the best differential characteristics of SNOW-V and SNOW-Vi than using the probability lower bound of the DDT in the original MILP model. Secondly, we point out that the registers R1,R2,R3 of SNOW-Vi filled with 0 were not considered in the original MILP model, resulting in the MILP model may return impossible differential characteristics. Then, we give the splicing search technology of C program and MILP model to solve this problem. Thirdly, based on these two studies, we present a more efficient and accurate MILP model for searching the best differential characteristics of the reduced-round SNOW-V and SNOW-Vi. The improved MILP model reduces the complexity of the distinguishing attacks. Finally, we give two multiple differential attack techniques on SNOW-V/SNOW-Vi structure, and apply them to the reduced-round SNOW-V and SNOW-Vi, respectively. While improving the results of single differential attacks, we also reduce the complexity of differential attack on the 4-round SNOW-V from 297 to 259.985, which can give the effective attack under the data limitation 264 for the single key. In addition, we give the first differential attack on 5-round SNOW-Vi, and the time complexity and data complexity is 296.84. The success rate is 0.97725. Although this has exceeded the data complexity limitation of the single key attack, it is meaningful for us to analyze the security of SNOW-Vi.

A new idea in response to fast correlation attacks on small-state stream ciphers

In the conference “Fast Software Encryption 2015”, a new line of research was proposed by introducing the first small-state stream cipher (SSC). The goal was to design lightweight stream ciphers for hardware applications by going beyond the rule that the internal state size must be at least twice the intended security level. Fast correlation attack (FCA) was successfully applied to all proposed SSCs which can be implemented by less than 1000 gate equivalents in hardware. It is possible to increase the security of stream ciphers against FCA by exploiting more complicated functions for the nonlinear feedback shift register and the output function, but we use lightweight functions to design the lightest SSC in the world while providing more security against FCA. Our proposed cipher provides 80-bit security against all types of Time-memory-data trade-off (TMDTO) attacks, while Lizard and Plantlet provide only 60-bit and 58-bit security against TMDTO distinguishing attacks, respectively. Our main contribution is to propose a lightweight round key function with a very long period that increases the security of SSCs against FCA.

Cryptanalysis of Rocca and Feasibility of Its Security Claim

Rocca is an authenticated encryption with associated data scheme for beyond 5G/6G systems. It was proposed at FSE 2022/ToSC 2021(2), and the designers make a security claim of achieving 256-bit security against key-recovery and distinguishing attacks, and 128-bit security against forgery attacks (the security claim regarding distinguishing attacks was subsequently weakened in the full version in ePrint 2022/116). A notable aspect of the claim is the gap between the privacy and authenticity security. In particular, the security claim regarding key-recovery attacks allows an attacker to obtain multiple forgeries through the decryption oracle. In this paper, we first present a full key-recovery attack on Rocca. The data complexity of our attack is 2128 and the time complexity is about 2128, where the attack makes use of the encryption and decryption oracles, and the success probability is almost 1. The attack recovers the entire 256-bit key in a single-key and nonce-respecting setting, breaking the 256-bit security claim against key-recovery attacks. We then extend the attack to various security models and discuss several countermeasures to see the feasibility of the security claim. Finally, we consider a theoretical question of whether achieving the security claim of Rocca is possible in the provable security paradigm. We present both negative and positive results to the question.

New Cryptanalysis of ZUC-256 Initialization Using Modular Differences

ZUC-256 is a stream cipher designed for 5G applications by the ZUC team. Together with AES-256 and SNOW-V, it is currently being under evaluation for standardized algorithms in 5G mobile telecommunications by Security Algorithms Group of Experts (SAGE). A notable feature of the round update function of ZUC-256 is that many operations are defined over different fields, which significantly increases the difficulty to analyze the algorithm.As a main contribution, with the tools of the modular difference, signed difference and XOR difference, we develop new techniques to carefully control the interactions between these operations defined over different fields. At first glance, our techniques are somewhat similar to those developed by Wang et al. for the MD-SHA hash family. However, as ZUC-256 is quite different from the MD-SHA hash family and its round function is much more complex, we are indeed dealing with different problems and overcoming new obstacles.As main results, by utilizing complex input differences, we can present the first distinguishing attacks on 31 out of 33 rounds of ZUC-256 and 30 out of 33 rounds of the new version of ZUC-256 called ZUC-256-v2 with low time and data complexities, respectively. These attacks target the initialization phase and work in the related-key model with weak keys. Moreover, with a novel IV-correcting technique, we show how to efficiently recover at least 16 key bits for 15-round ZUC-256 and 14-round ZUC-256-v2 in the related-key setting, respectively. It is unpredictable whether our attacks can be further extended to more rounds with more advanced techniques. Based on the current attacks, we believe that the full 33 initialization rounds provide marginal security.

Attacks on the Firekite Cipher

Firekite is a synchronous stream cipher using a pseudo-random number generator (PRNG) whose security is conjectured to rely on the hardness of the Learning Parity with Noise (LPN) problem. It is one of a few LPN-based symmetric encryption schemes, and it can be very efficiently implemented on a low-end SoC FPGA. The designers, Bogos, Korolija, Locher and Vaudenay, demonstrated appealing properties of Firekite, such as requiring only one source of cryptographically strong bits, small key size, high attainable throughput, and an estimate for the bit level security depending on the selected practical parameters.We propose distinguishing and key-recovery attacks on Firekite by exploiting the structural properties of its PRNG. We adopt several birthday-paradox techniques to show that a particular sum of Firekite’s output has a low Hamming weight with higher probability than the random case. We achieve the best distinguishing attacks with complexities 266.75 and 2106.75 for Firekite’s parameters corresponding to 80-bit and 128-bit security, respectively. By applying the distinguishing attacks and an additional algorithm we describe, one can also recover the secret matrix used in the Firekite PRNG, which is built from the secret key bits. This key recovery attack works on most large instances of Firekite parameters and has slightly larger complexity, for instance, 269.87 on the 80-bit security parameters n = 16,384, m = 216, k = 216.

Rotational Differential-Linear Attack on Chaskey

Rotational/Rotational-XOR differential-linear attack is a kind of powerful attack on ARX primitives. In this paper, we analyse the message authentication code algorithm—Chaskey—by using rotational differential-linear attack and using partitioning technique for key recovery. We presentthe results of distinguishing attack under weak-key and related-key settingswith correlation 2 − 55.636 for 9-round Chaskey. This is for the first time rotational differential-linear distinguisher has been used to analyse Chaskey. It is concluded that Chaskey can resist against rotational differential-linear attack.

Practical distinguishing attack against the IoT‐friendly block cipher ALLPC

The issue of security and privacy plays an important role in the Internet of Things (IoT) and directly affects its wide applications. In order to meet the security requirements in the IoT environment, a series of lightweight encryption schemes have been proposed. Meanwhile, cryptanalysis against these schemes is critical to the security of IoT. In this paper, a practical distinguishing attack on an IoT-friendly lightweight cipher ALLPC is presented. Specifically, it is found that there exists a fixed point in the differential of ALLPC's S-box, then a differential trail with a period of 14-round has been proposed. By connecting to the periodic differential trail, a differential trail is constructed for the full-round ALLPC with a probability of 2−24. Applying such property, one can distinguish the full-round ALLPC block cipher from a random permutation in about 10 min on a laptop.

Cube attacks on round-reduced TinyJAMBU

Lightweight cryptography has recently gained importance as the number of Internet of things (IoT) devices connected to Internet grows. Its main goal is to provide cryptographic algorithms that can be run efficiently in resource-limited environments such as IoT. To meet the challenge, the National Institute of Standards and Technology (NIST) announced the Lightweight Cryptography (LWC) project. One of the finalists of the project is the TinyJAMBU cipher. This work evaluates the security of the cipher. The tool used for the evaluation is the cube attack. We present five distinguishing attacks DA1–DA5 and two key recovery attacks KRA1–KRA2. The first two distinguishing attacks (DA1 and DA2) are launched against the initialisation phase of the cipher. The best result achieved for the attacks is a distinguisher for an 18-bit cube, where the cipher variant consists of the full initialisation phase together with 438 rounds of the encryption phase. The key recovery attacks (KRA1 and KRA2) are also launched against the initialisation phase of the cipher. The best key recovery attack can be applied for a cipher variant that consists of the full initialisation phase together with 428 rounds of the encryption phase. The attacks DA3–DA5 present a collection of distinguishers up to 437 encryption rounds, whose 32-bit cubes are chosen from the plaintext, nonce, or associated data bits. The results are confirmed experimentally. A conclusion from the work is that TinyJAMBU has a better security margin against cube attacks than claimed by the designers.

Linear Attacks On SNOW 3G And SNOW-V Using Automatic Search

Abstract In this paper, a linear attack model of SNOW 3G and SNOW-V based on automatic search technology is proposed. We first describe the linear approximation of Finite State Machine transformation, which allows a wider range of automatic search, then model it with the automatic search technology based on SAT/SMT program. Adopting this generic method, we seek out a binary linear approximation of SNOW 3G with correlation of $2^{-21.92}$ which has been verified by test. Treating this binary approximation as a mask of an 8-bit distribution in a fixed field, we provide a method to obtain the 8-bit distribution. The binary approximation is used in a fast correlation attack with expected time and memory complexity $2^{184.67}$, given $2^{173.96}$ key stream words. For the full version of SNOW-V, considering the linear relationship between Linear Feedback Shift Register parts at three successive moments, we search out a distinguisher with correlation of $2^{-175.51}$, which results in a distinguishing attack with an expected complexity of $2^{351.02}$.

Improved guess-and-determine and distinguishing attacks on SNOW-V

In this paper, we investigate the security of SNOW-V, demonstrating two guess-and-determine (GnD) attacks against the full version with complexities 2384 and 2378, respectively, and one distinguishing attack against a reduced variant with complexity 2303. Our GnD attacks use enumeration with recursion to explore valid guessing paths, and try to truncate as many invalid guessing paths as possible at early stages of the recursion by carefully designing the order of guessing. In our first GnD attack, we guess three 128-bit state variables, determine the remaining four according to four consecutive keystream words. We finally use the next three keystream words to verify the correct guess. The second GnD attack is similar but exploits one more keystream word as side information helping to truncate more guessing paths. Our distinguishing attack targets a reduced variant where 32-bit adders are replaced with exclusive-OR operations. The samples can be collected from short keystream sequences under different (key, IV) pairs. These attacks do not threaten SNOW-V, but provide more in-depth details for understanding its security and give new ideas for cryptanalysis of other ciphers.

A necessary condition for CPA-security of randomized symmetric code cryptosystems

We investigate a class of symmetric code cryptosystems constructed similarly to the well-known randomized (asymmetric) McEliece cryptosystem. A necessary condition for CPA- security of such cryptosystems is obtained (that is, their security against arbitrary distinguishing chosen-plaintext attacks). To each randomized code cryptosystem of specified type correspond its shortening, which is its reduced version. It is proved that the CPA-security of the input cryptosystem imply the CPA-security of its shortening. To a certain extent, this makes it possible to reduce the question about the CPA-security of randomized code cryptosystems to similar question about cryptosystems that have simpler structure. The obtained result can be used in further research in the construction of provable secure symmetric code cryptosystems.

Modeling for Three-Subset Division Property without Unknown Subset

A division property is a generic tool to search for integral distinguishers, and automatic tools such as MILP or SAT/SMT allow us to evaluate the propagation efficiently. In the application to stream ciphers, it enables us to estimate the security of cube attacks theoretically, and it leads to the best key-recovery attacks against well-known stream ciphers. However, it was reported that some of the key-recovery attacks based on the division property degenerate to distinguishing attacks due to the inaccuracy of the division property. Three-subset division property (without unknown subset) is a promising method to solve this inaccuracy problem, and a new algorithm using automatic tools for the three-subset division property was recently proposed at Asiacrypt2019. In this paper, we first show that this state-of-the-art algorithm is not always efficient and we cannot improve the existing key-recovery attacks. Then, we focus on the three-subset division property without unknown subset and propose another new efficient algorithm using automatic tools. Our algorithm is more efficient than existing algorithms, and it can improve existing key-recovery attacks. In the application to Trivium, we show a 842-round key-recovery attack. We also show that a 855-round key-recovery attack, which was proposed at CRYPTO2018, has a critical flaw and does not work. As a result, our 842-round attack becomes the best key-recovery attack. In the application to Grain-128AEAD, we show that the known 184-round key-recovery attack degenerates to a distinguishing attack. Then, the distinguishing attacks are improved up to 189 rounds, and we also show the best key-recovery attack against 190 rounds. In the application to ACORN, we prove that the 772-round key-recovery attack at ISC2019 is in fact a constant-sum distinguisher. We then give new key-recovery attacks mounting to 773-, 774- and 775-round ACORN. We verify the current best key-recovery attack on 892-round Kreyvium and recover the exact superpoly. We further propose a new attack mounting to 893 rounds.

Bit-wise cryptanalysis on AND-RX permutation Friet-PC

This paper presents three attack vectors of bit-wise cryptanalysis including rotational, bit-wise differential, and zero-sum distinguishing attacks on the AND-RX permutation Friet-PC, which is implemented in a lightweight authenticated encryption scheme Friet. First, we propose a generic procedure for a rotational attack on AND-RX cipher with round constants. By applying the proposed attack to Friet-PC, we can construct an 8-round rotational distinguisher with a time complexity of 2102. Next, we explore single- and dual-bit differential biases, which are inspired by the existing study on Salsa and ChaCha, and observe the best bit-wise differential bias with 2−9.552. This bias allows us to practically construct a 9-round bit-wise differential distinguisher with a time complexity of 220.044. Finally, we construct 13-, 15-, and 17-round zero-sum distinguishers with time complexities of 231, 263, and 2127, respectively. To summarize our study, we apply three attack vectors of bit-wise cryptanalysis to Friet-PC and show their superiority as effective attacks on AND-RX ciphers.