Exhaustive Search Attack Research Articles

Algebraic Attacks on RAIN and AIM Using Equivalent Representations

Designing novel symmetric-key primitives for advanced protocols like secure multiparty computation (MPC), fully homomorphic encryption (FHE) and zero-knowledge proof systems (ZK), has been an important research topic in recent years. Many such existing primitives adopt quite different design strategies from conventional block ciphers. Notable features include that many of these ciphers are defined over a large finite field, and that a power map is commonly used to construct the nonlinear component due to its efficiency in these applications as well as its strong resistance against the differential and linear cryptanalysis. In this paper, we target the MPC-friendly ciphers AIM and RAIN used for the post-quantum signature schemes AIMer (CCS 2023 and NIST PQC Round 1 Additional Signatures) and Rainier (CCS 2022), respectively. Specifically, we can find equivalent representations of 2-round RAIN and full-round AIM, respectively, which make them vulnerable to either the polynomial method, or the crossbred algorithm, or the fast exhaustive search attack. Consequently, we can break 2-round RAIN with the 128/192/256-bit key in only 2111/2170/2225 bit operations. For full-round AIM with the 128/192/256-bit key, we could break them in 2136.2/2200.7/2265 bit operations, which are equivalent to about 2115/2178/2241 calls of the underlying primitives. In particular, our analysis indicates that AIM does not reach the required security levels by the NIST competition.

New Low-Memory Algebraic Attacks on LowMC in the Picnic Setting

The security of the post-quantum signature scheme Picnic is highly related to the difficulty of recovering the secret key of LowMC from a single plaintext-ciphertext pair. Since Picnic is one of the alternate third-round candidates in NIST post-quantum cryptography standardization process, it has become urgent and important to evaluate the security of LowMC in the Picnic setting. The best attacks on LowMC with full S-box layers used in Picnic3 were achieved with Dinur’s algorithm. For LowMC with partial nonlinear layers, e.g. 10 S-boxes per round adopted in Picnic2, the best attacks on LowMC were published by Banik et al. with the meet-in-the-middle (MITM) method.In this paper, we improve the attacks on LowMC in a model where memory consumption is costly. First, a new attack on 3-round LowMC with full S-box layers with negligible memory complexity is found, which can outperform Bouillaguet et al.’s fast exhaustive search attack and can achieve better time-memory tradeoffs than Dinur’s algorithm. Second, we extend the 3-round attack to 4 rounds to significantly reduce the memory complexity of Dinur’s algorithm at the sacrifice of a small factor of time complexity. For LowMC instances with 1 S-box per round, our attacks are shown to be much faster than the MITM attacks. For LowMC instances with 10 S-boxes per round, we can reduce the memory complexity from 32GB (238 bits) to only 256KB (221 bits) using our new algebraic attacks rather than the MITM attacks, while the time complexity of our attacks is about 23.2 ∼ 25 times higher than that of the MITM attacks. A notable feature of our new attacks (apart from the 4-round attack) is their simplicity. Specifically, only some basic linear algebra is required to understand them and they can be easily implemented.

Cascading Failure Vulnerability Analysis in Interdependent Power Communication Networks

Future smart grids represent interdependent cyber-physical systems that involve multiple interactions between a power grid and a communication network. Such a mutual dependence increases the risk of large-scale cascading failures. Thus, it is important to conduct a joint vulnerability analysis. Unfortunately, existing works failed to identify the combination of power nodes and communication nodes that present the greatest damage impact. In this article, we first present a model that captures the interdependence between the two subsystems using stochastic geometry; then, we conduct a joint vulnerability analysis. We propose an attack strategy that targets the most influential nodes in both subsystems. We show that, based on six joint targeted nodes, this strategy presents a comparable and, in some cases, larger damage impact compared to the traditional exhaustive search attack and with very low complexity. Our investigations reveal that 1) the proposed joint attack strategy presents a large damage impact at a significantly small simulation runtime and 2) attacking the most influential communication nodes solely or the most influential power nodes solely achieves a comparable damage impact to that of the proposed joint attack.

LPsec: a fast and secure cryptographic system for optical connections

High capacity and low latency of optical connections are ideal for supporting current and future communication services, including 5G and beyond. Although some of those services are already secured at the packet layer using standard stream ciphers, like the Advanced Encryption Standard and ChaCha, secure transmission at the optical layer is still not implemented. To secure the optical layer, cryptographic methods need to be fast enough to support high-speed optical transmission and cannot introduce significant delay. Moreover, methods for key exchange, key generation, and key expansion are required, which can be implemented on standard coherent transponders. In this paper, we propose Light Path SECurity (LPsec), a secure cryptographic solution for optical connections that involves fast data encryption using stream ciphers and key exchange using Diffie–Hellman protocol through the optical channel. To support encryption of high-speed data streams, a fast, general-purpose pseudorandom number generator is used. Moreover, to make the scheme more secure against exhaustive search attacks, an additional substitution cipher is proposed. In contrast to the limited encryption speeds that standard stream ciphers can support, LPsec can support high-speed rates. Numerical simulation for 16 quadrature amplitude modulation (QAM), 32-QAM, and 64-QAM show that LPsec provides a sufficient security level while introducing only negligible delay.

Key lengths revisited: GPU-based brute force cryptanalysis of DES, 3DES, and PRESENT

Lightweight cryptographic algorithms that are tailored for resource-constrained devices sometimes use short keys which might be susceptible to brute force attacks. Such attacks using CPU or GPU might be costly because some lightweight algorithms are hardware-oriented and use bit-level operations. In this work we provide table-based CUDA optimizations for bit-oriented block ciphers DES/3DES and ISO/IEC standard PRESENT to provide software implementations without bit operations and show that cryptographic algorithms with short keys are susceptible to exhaustive search attacks on distributed multiple GPU settings. Our best optimizations provide 3.87 and 1.89 billion key searches per second for DES/3DES and PRESENT on an RTX 3070, respectively. These results outperform FPGA clusters like COPACOBANA in terms of price-performance ratio showing that exhaustive search on short keys might be practical without special devices. Therefore, an RTX 3070 can capture a DES key in 215 days and 20 million RTX 3070 GPUs can capture an 80-bit PRESENT key in a year. Thus, we recommend the removal of algorithms with 80-bit or shorter keys from the standards. Moreover, our optimizations provide 278.32 Gbps DES, 92.77 Gbps 3DES, and 115.73 Gbps PRESENT encryption throughput on an RTX 3070 when the ciphers are used in counter mode.

Accounting Data Encryption Processing Based on Data Encryption Standard Algorithm

With the application of computer and network technology in the field of accounting, the development of accounting informationization is an inevitable trend, and the construction of accounting statement data into the data warehouse will be the basis of intelligent decision-making. The complexity of industry accounting statements and the arbitrariness and diversity of users’ needs for obtaining information using statements limit the development, popularization, and application of industry accounting statements. As a block encryption algorithm, the Data Encryption Standard (DES) algorithm uses 64-bit packet data for encryption and decryption. Each eighth bit of the key is used as a parity bit; that is, the actual key length is 56 bits. Encryption and decryption use the same algorithm structure, but the order in which the subkeys are used is reversed. Under the control of the subkey, inputting 64-bit plaintext can produce 64-bit ciphertext output; otherwise, inputting 64-bit ciphertext can produce 64-bit plaintext output. The confidentiality of the DES algorithm depends on the key, and only a very small number of keys are considered weak keys, which can be easily avoided in practical applications. The 3DES algorithm is a cascade of the DES algorithm, and its encryption process is based on the DES algorithm principle. This article explains the encryption process of the DES algorithm and introduces the composition of the 3DES algorithm. The experimental results show that the 3DES encryption algorithm still has a better encryption effect and “avalanche effect” than before the improvement. In addition, for the 3DES algorithm, its encryption efficiency has not been greatly affected. The 3DES encryption algorithm achieves one encryption process at a time to some extent, can effectively resist exhaustive search attacks, and enhance the security of the DES algorithm.

White-Box Implementation of ECDSA Based on the Cloud Plus Side Mode

White-box attack context assumes that the running environments of algorithms are visible and modifiable. Algorithms that can resist the white-box attack context are called white-box cryptography. The elliptic curve digital signature algorithm (ECDSA) is one of the most widely used digital signature algorithms which can provide integrity, authenticity, and nonrepudiation. Since the private key in the classical ECDSA is plaintext, it is easy for attackers to obtain the private key. To increase the security of the private key under the white-box attack context, this article presents an algorithm for the white-box implementation of ECDSA. It uses the lookup table technology and the “cloud plus side” mode to protect the private key. The residue number system (RNS) theory is used to reduce the size of storage. Moreover, the article analyzes the security of the proposed algorithm against an exhaustive search attack, a random number attack, a code lifting attack, and so on. The efficiency of the proposed scheme is compared with that of the classical ECDSA through experiments.

An efficient image encryption scheme for TMIS based on elliptic curve integrated encryption and linear cryptography

Nowadays, diagnosing patient diseases remotely is a routine and digital medical images analysis as a part of Telecare Medical Information Systems (TMIS) play a fundamental role in early diagnosing and treating most common and serious diseases such as breast cancer. In this context, altering or distorting even a single pixel of a medical image during its transmission over an unsure channel could lead to a wrong diagnosis and harm patient health, induce damaging delays. Therefore the security and privacy of the transmitted medical images must be addressed most seriously. Several techniques are proposed in the literature to address these issues using different techniques such as chaos theory, more recently, elliptic curves cryptography (ECC) or improved classical methods such as linear cryptography. In this paper, we address the security level concern of an image encryption technique combining ECC with Hill cipher (ECCHC) which has been recently proposed by Dawahdeh et al [13]. Our study rises concerns about some weaknesses and flaws of the analyzed encryption scheme against some plain-text and known plain-text attacks. In addition, and not least issue, it is found that the key length used in Dawahdeh et al. scheme is not sufficiently large to be robust against brute force attack. To fix the found flaws and to improve the encryption scheme, a generalized cryptosystem is suggested. In the enhanced version, the key matrix negotiation is redefined to a cipher that combines a modified EC Integrated Encryption Scheme (ECIES) and the linear multiplication matrix is generalized to key matrix of (2n × 2n), n > 2 to counter efficiently the exhaustive search attack. The effectiveness of the proposed version is evaluated and verified through extensive experimentation and most recent available security tools. Compared with the state-of-the art techniques, the proposed version exhibits excellent security features and can resist to various knowing attacks.

Classical Cryptanalysis Attacks on Logic Locking Techniques

Logic locking is a protection technique for outsourced integrated circuit (IC) designs that thwarts IC piracy and IC counterfeiting by untrusted foundries. In this technique, the IC design house locks the correct functionality of the circuit using a key that is known only to the trusted entities in the design house. As the correct key values are provided by the design house after production, a malicious adversary in the foundry house will not be able to unlock overproduced or counterfeit ICs. In this paper, we mount linear approximation attacks and differential attacks on random logic locking (RLL), fault-analysis based logic locking (FLL), and strong logic locking (SLL) techniques. We present a formal approach to mount the linear approximation attack on multiple circuit partitions and thereafter combining the approximations to form the attack on a locked logic cone of the circuit. We present our results on ISCAS’85 benchmark circuits. In linear approximation attack, the combinatorial blocks are partitioned and expressed as linear expressions to derive a relation between the primary inputs and the primary outputs of the circuit. The attack aims to determine the linear approximation that has the highest probability of occurrence for the correct key input. In differential attacks, we could recover the embedded secret key in device with attack effort lesser than exhaustive search attack.

A New variant of the McEliece cryptosystem based on the Smith form of convolutional codes

ABSTRACTIn this article, the authors propose a new version of the McEliece cryptosystem based on the Smith form of convolutional codes. They use the Smith form to hide a part of the code in the public matrix, and they leave the other part secret. The secret part will then be used for decryption. They hide this part by multiplying it on the left by a random matrix, and they add a random matrix which has a few conditions. Their scheme has a small public key size compared to the original McEliece scheme and resists the unique decoding attack against convolutional structure presented at the conference PQCrypto 2013 by Landais and Tillich. Further, the exhaustive search attack is infeasible on their system.

A methodology for secure recovery of spacecrafts based on a trusted hardware platform

This paper proposes a methodology for the secure recovery of spacecrafts and the recovery of its cryptographic capabilities in emergency scenarios recurring from major unintentional failures and malicious attacks. The proposed approach employs trusted modules to achieve higher reliability and security levels in space missions due to the presence of integrity check capabilities as well as secure recovery mechanisms. Additionally, several recovery protocols are thoroughly discussed and analyzed against a wide variety of attacks. Exhaustive search attacks are shown in a wide variety of contexts and are shown to be infeasible and totally independent of the computational power of attackers. Experimental results have shown that the proposed methodology allows for the fast and secure recovery of spacecrafts, demanding minimum implementation area, power consumption and bandwidth.

Elementary Algorithms Analysis of Megrelishvili Protocol

This article presents an investigation of asymptotic time complexities of several algorithms related to Megrelishvili protocol. The analysis are carried out for the private keys computations and public exchange of values, public key constructions, as well as an elementary exhaustive search attack algorithm. We show that the complexities of these algorithms are higher than the complexities of elementary algorithms involved in the conventional Diffie - Hellman protocol (DHP) or its variant on elliptic curves (ECDHP). This condition also implies that Megrelishvili protocol is more secure than DHP and ECDHP against exhaustive search attack.

On the Number of Linear Finite Transducers

The notion of linear finite transducer (LFT) plays a crucial role in some cryptographic systems. However, as far as we know, no study was ever conducted to count and enumerate these transducers, which is essential to verify if the size of the key space, of the aforementioned systems, is large enough to prevent an exhaustive search attack. In this work we present a way to estimate the number and percentage of injective equivalence classes by introducing a canonical form for LFTs and a procedure to test LFTs equivalence.

Security Analysis and Improvement on Two RFID Authentication Protocols

Several lightweight RFID authentication protocols have been proposed to settle the security and privacy problems. Nevertheless, most of these protocols are analyzed and they are not successful in their attempt to achieve the claimed security objectives. In this paper, we consider the security of two recently proposed typical RFID authentication protocols: RAPLT protocol and SRP+ protocol. RAPLT protocol is a new ultra-lightweight RFID protocol based on two new operations named $$merge$$merge and $$separation$$separation. Utilizing the linear property of the $$merge$$merge operation, we present a passive disclosure attack on RAPLT protocol, and we can deduce the shared secrets with overwhelming probability after eavesdropping about 100 round authentication sessions. SRP+ protocol is a novel secure RFID authentication protocol conforming to the EPC C-1 G-2 standard, and we present efficient de-synchronization attack and passive disclosure attack through exhaustive search. Our disclosure attack only needs one run of the protocol, and the attack complexity is $$O(2^{16})$$O(216) evaluation of the PRNG function in off-line analysis mode. In addition, to counteract the vulnerabilities, we propose a new modified version of SRP+ protocol, denoted by $$ SRP ^{++}$$SRP++, conforming to the EPC C-1 G-2 standard. Our security analysis demonstrates that $$ SRP ^{++}$$SRP++ protocol can resist the exhaustive search attack with the complexity $$O(2^{32})$$O(232), which is the optimal security bound.

The Security of Key Derivation Functions in WINRAR

In various versions of WINRAR, the file security is mainly protected by user authentication and files encryption. Password based key derivation function (PBKDF) is the core of the WINRAR security mechanism. In this paper, the security of PBKDF algorithm and the encrypted file in WINRAR are analyzed by the Game-Playing approach. We show the upper boundary of the Adversary’s Advantage over the random function. With the theoretical derivation, the actual safety of the WINRAR encrypted files has been discussed. According to the latest developments for GPU-based exhaustive password search attacks, we do some experiments and draw a conclusion that if the length of password is longer than 6, the WINRAR and later versions are secure.

A cryptography system and its parameterized vlsi generator for real-time multimedia

In this paper, a new cryptography system is proposed, which combines the methods of position permutation and value transformation for encryption/decryption. Three good features are involved in this system: (1) High security evaluated with the measure of fractal dimension, (2) Content of encrypted image is sensitive to the initial key, and (3) this system can easily defense against the exhaustive search attack. For the applications with real-time in multimedia system, the parameterized hardware design and its very large-scale integrated circuit (VLSI) generator software are developed. The proposed VLSI generator can be parameterized by the parameters of system-type, packet size, throughput, and security to create proper architecture for the application. All the architectures generated from the VLSI generator have been verifi ed strictly. Except for passing the entire coding guideline check and 100% code coverage, with the 0.18 um cell library, all the confi gurations of architecture are synthesized and verifi ed for speed, area, and power consumption as well as delivering the essential scripts. Regarding verifi cation of all confi gurations, the throughput can be ranged between 1.59 and 2.25 Gbps with the hardware cost of 0.54 and 3.92 mm 2 . Compared with the existing designs, the proposed design possesses wide range of performance and benefi t for most of applications in multimedia system.

An improved bit shuffling pixels-based image scrambling method

Compared with the Arnold transform, the image scrambling method based on bit shuffling pixels is much more secure, and has higher efficiency and speed. However, the key space of this bit shuffling pixels based method is too small to resist exhaustive search attack. Therefore, an improved method based on chaos is proposed in this paper. The security of the improved scheme is enhanced by increasing the number of the keys. Theoretical analysis and experimental results show that the proposed method is effective and has higher security.

Heuristic guess-and-determine attacks on stream ciphers

Guess-and-determine (GD) attacks are general attacks on stream ciphers, which have often been implemented in an ad hoc manner. The authors introduce a heuristic approach to the design of GD attacks, that is a dynamic programming method using a Viterbi-like algorithm which is a well-known decoding algorithm for convolutional codes. The authors also show that with this method, the resulting GD attacks, named heuristic GD (HGD) attacks, on TIPSY, SNOW1 and SNOW2 lead to less computational complexity than the previously known GD attacks. The main advantage of HGD attacks, over ad hoc GD attacks, is that while being powerful, they can be designed algorithmically for classes of stream ciphers, holding a certain condition. Using this method, the authors examine the resistance of SOSEMANUK, a word-oriented stream cipher proposed for the Ecrypt Stream Cipher Project. The complexity of the designed GD attack, O(2224), is much less than the complexity of exhaustive search attack on the internal state, O(2384), but larger than the claimed security level, that is O(2128).

Enhanced Exhaustive Search Attack on Randomized BSD Type Countermeasure

We propose a new analysis technique against a class of countermeasure using randomized binary signed digit (BSD) representations. We also introduce some invariant properties between BSD representations. The proposed analysis technique can directly recover the secret key from power measurements without information for algorithm because of the invariant properties of BSD representation. Thus the proposed attack is applicable to all countermeasures using BSD representations. Finally, we give the simulation results against some countermeasures using BSD representation such as Ha-Moon method, Ebeid-Hasan method, and the method of Agagliate et al. The results show that the proposed attack is practical analysis method.

Proposal of a Transformation Method for Iris Codes in Iris Scanning Verification

In this paper, we propose a transformation function for a user's raw data, an iris in scanning verification on the server, since the code requires to be hidden from even a server administrator. We then show that the user can be properly authenticated on the server, even though the code is transformed by the proposed function. reason is that the function has a characteristic, The (normalized) Hamming distances between the enrolled codes and the verified codes are conserved before and after the computation of the that is, the normalized Hamming distance in this scheme is equal to that in the existing scheme. We also show that the transformed code is sufficiently secure to hide the original code, even if a stronger attack model is supposed than the previously described model. That can be explained from the following two reasons. One reason is that nonlinear function, which consists of the three-dimensional rotation about the x-axis and the y-axis with the code lengthened bit by bit, and the cyclic shift, does not enable an attacker to conjecture the code. other reason is that the success probabilities for the exhaustive search attack concerning the code in the supposed attack models are lower than those of the previously proposed methods and are negligible.