Family Of Ciphers Research Articles

(Quantum) Time-Memory-Data Tradeoff Attacks on the SNOW-V Stream Cipher

Symmetric cryptosystems (i.e., stream ciphers and block ciphers) have always played an important part in securing the various generations of 3GPP (3rd Generation Partnership Project) mobile telephony systems. The SNOW-V stream cipher, published in September 2019, is the most recent member of the well-known SNOW family of ciphers. It is designed to provide confidentiality and integrity for 5G communications. There have been no time-memory-data tradeoff (TMDTO) attacks on the cipher published so far. By combining with the BSW sampling technique, we propose TMDTO attacks on SNOW-V. The results show that the attacker can mount a TMDTO attack, where none of the online time complexity, the memory complexity and the offline time complexity are bigger than 2256, if the keystream sequences generated by the secret key, together with different IVs, are provided to the attacker. Furthermore, we analyze the security of SNOW-V against quantum TMDTO attacks, and the results show that a quantum TMDTO attack offers, strictly, better online time complexity than Grover’s algorithm, when the available memory space is bigger than 2170.67. These results are helpful in evaluating the security of SNOW-V against (quantum) TMDTO attacks.

The differential fault analysis on block cipher KLEIN-96

KLEIN is a new family of lightweight block ciphers designed for resource-constrained devices. Compared to other schemes, it also has great advantages in both software and hardware performances. In recent works, many researchers have studied its security against differential fault analysis (DFA). Note that all the works only focused on the scheme KLEIN-64, which only has 64 bits key length. In fact, the 64-bit's security is obviously not enough for the current ciphers. In this paper, we investigate the differential fault attack on the key schedule of KLEIN-96, which has 96 bits key length. More specifically, by deeply developing the inner-relationship of input-output differentials for its S-box, we reduce the complexity of exhaustive searching from the original 296 to an acceptable boundary by injecting a certain number of byte-faults. Finally, we also demonstrate the efficiency of our proposed attack by simulations, which show that our method has great advantages over other cryptanalysis on KLEIN cipher.

Improved rotational‐XOR cryptanalysis of Simon‐like block ciphers

Rotational-XOR (RX) cryptanalysis is a cryptanalytic method aimed at finding distinguishable statistical properties in Addition-Rotation-XOR-C ciphers, that is, ciphers that can be described only by using modular addition, cyclic rotation, XOR and the injection of constants. In this study, we extend RX-cryptanalysis to AND-RX ciphers, a similar design paradigm where the modular addition is replaced by vectorial bitwise AND; such ciphers include the block cipher families Simon and Simeck. We analyse the propagation of RX-differences through AND-RX rounds and develop a closed form formula for their expected probability. Inspired by the MILP verification model proposed by Sadeghi et al., we develop a SAT/SMT model for searching compatible RX-characteristics in Simon-like ciphers, that is, that there is at least one right pair of messages/keys to satisfy the RK-characteristics. To the best of our knowledge, this is the first model that takes the RX-difference transitions and value transitions simultaneously into account in Simon-like ciphers. Meanwhile, we investigate how the choice of the round constants affects the resistance of Simon-like ciphers against RX-cryptanalysis. Finally, we show how to use an RX-distinguisher for a key recovery attack. Evaluating our model we find compatible RX-characteristics of up to 20, 27 and 34 rounds with respective probabilities of 2−26, 2−44 and 2−56 for versions of Simeck with block sizes of 32, 48 and 64 bits, respectively, for large classes of weak keys in the related-key model. In most cases, these are the longest published distinguishers for the respective variants of Simeck. In the case of Simon, we present compatible RX-characteristics for round-reduced versions of all 10 instances. We observe that for equal block and key sizes, the RX-distinguishers cover fewer rounds in Simon than in Simeck. Concluding the paper, we present a key recovery attack on Simeck 64 reduced to 28 rounds using a 23-round RX-characteristic.

On Grain-Like Small State Stream Ciphers Against Fast Correlation Attacks: Cryptanalysis of Plantlet, Fruit-v2 and Fruit-80

Abstract The fast correlation attack (FCA) is one of the most important cryptanalytic techniques against LFSR-based stream ciphers. In CRYPTO 2018, Todo et al. found a new property for the FCA and proposed a novel algorithm which was successfully applied to the Grain family of stream ciphers. Nevertheless, these techniques cannot be directly applied to Grain-like small state stream ciphers with keyed update, such as Plantlet, Fruit-v2 and Fruit80. In this paper, we study the security of Grain-like small state stream ciphers by the FCA. We first observe that the number of required parity-check equations can be reduced when there are multiple different parity-check equations. With exploiting the Skellam distribution, we introduce a sufficient condition to identify the correct LFSR initial state and derive a new relationship between the number and bias of the required parity-check equations. Then, a modified algorithm is presented based on this new relationship, which can recover the LFSR initial state no matter what the round key bits are. Under the condition that the LFSR initial state is known, an algorithm is given against the degraded system and to recover the NFSR state at some time instant, along with the round key bits. As cases study, we apply our cryptanalytic techniques to Plantlet, Fruit-v2 and Fruit-80. As a result, for Plantlet, our attack takes $ 2^{73.75} $ time complexity and $ 2^{73.06} $ keystream bits to recover the full 80-bit key. Regarding Fruit-v2, $ 2^{55.34} $ time complexity and $ 2^{55.62} $ keystream bits are needed to determine the secret key. As for Fruit-80, $2^{64.47}$ time complexity and $2^{62.82}$ keystream bits are required to recover the secret key. More flexible attacks can be obtained with lower data complexity at the cost of increasing the attack time. Especially, for Fruit-v2, a key recovery attack can be launched with data complexity of $2^{42.38}$ and time complexity of $2^{73.31}$. Moreover, we have implemented our attack methods on a toy version of Fruit-v2. The attack matches the expected complexities predicted by our theoretical analysis quite well, which proves the validity of our cryptanalytic techniques.

An efficient differential fault attack against SIMON key schedule

SIMON, a family of lightweight block ciphers, has received much attention from the cryptology community due to its improved performance for hardware compared with that of other ciphers. A popular physical attack method, differential fault attack (DFA), works for SIMON. With the aim of improving the efficiency of attacks applied to the SIMON family, in this work, an efficient DFA against SIMON key schedule is presented under a random bit fault model. First, we analyze in detail how to identify the fault induction position. Then, on the basis of the position, we show in detail how to recover 4 bits, 7.5 bits, and 2 bits of KT-1 (the (T-1)th round key), KT-2 (the (T-2)th round key) and KT-3 (the (T-3)th round key), respectively, by inducing a one-bit fault on average in KT-5 (the (T-5)th round key). As a result, by inducing one round of faults, our attack can recover three rounds of keys. Compared with previously developed DFAs on SIMON under the random bit fault model, to recover the full keys of the SIMON family, our attack requires the fewest fault inductions and locations of the induced fault. Moreover, when the value of key words m is 2 or 3, our attack can reduce the number of required rounds of fault induction to one. Finally, simulation experiments and comparisons are carried out to demonstrate the correctness and effectiveness of our attack.

Evaluating the Performance of Lightweight Ciphers in Constrained Environments—The Case of Saturnin

The use of lightweight cryptographic algorithms is essential for addressing security in highly constrained environments such as the Internet of Things. In this paper, the performance of lightweight block ciphers in such highly constrained environments is studied. More precisely, focusing—as a case study—on an important family of lightweight ciphers called “Saturnin”, which has been evaluated as a candidate for standardization in the relative ongoing NIST’s competition, we analyze its efficiency in case that it is implemented in a specific resource-constrained environment. To evaluate the results, a comparative study with the Advanced Encryption Standard (AES) is performed, through an appropriate experimental environment. Our results illustrate that significant gain in performance can be achieved, since Saturnin—whose design is inspired by the design of AES—can be almost two times faster than AES in such restricted environments.

Perfect Trees: Designing Energy-Optimal Symmetric Encryption Primitives

Energy efficiency is critical in battery-driven devices, and designing energyoptimal symmetric-key ciphers is one of the goals for the use of ciphers in such environments. In the paper by Banik et al. (IACR ToSC 2018), stream ciphers were identified as ideal candidates for low-energy solutions. One of the main conclusions of this paper was that Trivium, when implemented in an unrolled fashion, was by far the most energy-efficient way of encrypting larger quantity of data. In fact, it was shown that as soon as the number of databits to be encrypted exceeded 320 bits, Trivium consumed the least amount of energy on STM 90 nm ASIC circuits and outperformed the Midori family of block ciphers even in the least energy hungry ECB mode (Midori was designed specifically for energy efficiency).In this work, we devise the first heuristic energy model in the realm of stream ciphers that links the underlying algebraic topology of the state update function to the consumptive behaviour. The model is then used to derive a metric that exhibits a heavy negative correlation with the energy consumption of a broad range of stream cipher architectures, i.e., the families of Trivium-like, Grain-like and Subterranean-like constructions. We demonstrate that this correlation is especially pronounced for Trivium-like ciphers which leads us to establish a link between the energy consumption and the security guarantees that makes it possible to find several alternative energy-optimal versions of Trivium that meet the requirements but consume less energy. We present two such designs Trivium-LE(F) and Trivium-LE(S) that consume around 15% and 25% less energy respectively making them the to date most energy-efficient encryption primitives. They inherit the same security level as Trivium, i.e., 80-bit security. We further present Triad-LE as an energy-efficient variant satisfying a higher security level. The simplicity and wide applicability of our model has direct consequences for the conception of future hardware-targeted stream ciphers as for the first time it is possible to optimize for energy during the design phase. Moreover, we extend the reach of our model beyond plain encryption primitives and propose a novel energy-efficient message authentication code Trivium-LE-MAC.

A real-time related key attack on the WG-16 stream cipher for securing 4G-LTE networks

The WG-16 stream cipher proposed in 2013 is an efficient variant of the well-known WG stream cipher family. WG-16 inherits good randomness properties of the WG stream cipher family and is intended for use in confidentiality and integrity algorithms in mobile communications, such as 4G-LTE networks. This paper finds that there exist related Key-IV pairs for the WG-16 stream cipher that can generate keystreams which are exact shifts of each other throughout the keystream generation. By exploiting this slide property, a real-time related key attack on WG-16 is proposed, which recovers all 128 key bits with time complexity of about 235.81, requiring 235.81 chosen IVs and 6 related keys. We verify this attack on a common PC, which shows that our attack can recover all 128 key bits of WG-16 within four days. The experimental results indicate that WG-16 can be broken in real time in the multiple related key setting and is not secure as claimed by the designers. This is the first attack that defeats the practical security of WG-16.

A Fault Attack on the Family of Enocoro Stream Ciphers

A differential fault attack framework for the Enocoro family of stream ciphers is presented. We only require that the attacker can reset the internal state and inject a random byte-fault, in a random register, during a known time period. For a single fault injection, we develop a differential clocking algorithm that computes a set of linear equations in the in- and output differences of the non-linear parts of the cipher and relates them to the differential keystream. The usage of these equations is two-fold. Firstly, one can determine those differentials that can be computed from the faulty keystream, and secondly they help to pin down the actual location and timing of the fault injection. Combining these results, each fault injection gives us information on specific small parts of the internal state. By encoding the information we gain from several fault injections using the weighted Horn clauses, we construct a guessing path that can be used to quickly retrieve the internal state using a suitable heuristic. Finally, we evaluate our framework with the ISO-standardized and CRYPTREC candidate recommended cipher Enocoro-128v2. Simulations show that, on average, the secret key can be retrieved within 20 min on a standard workstation using less than five fault injections.

Integral Distinguishers of the Full-Round Lightweight Block Cipher SAT_Jo

Integral cryptanalysis based on division property is a powerful cryptanalytic method whose range of successful applications was recently extended through the use of Mixed-Integer Linear Programming (MILP). Although this technique was demonstrated to be efficient in specifying distinguishers of reduced round versions of several families of lightweight block ciphers (such as SIMON, PRESENT, and few others), we show that this method provides distinguishers for a full-round block cipher SAT_Jo. SAT_Jo cipher is very similar to the well-known PRESENT block cipher, which has successfully withstood the known cryptanalytic methods. The main difference compared to PRESENT, which turns out to induce severe weaknesses of SAT_Jo algorithm, is its different choice of substitution boxes (S-boxes) and the bit-permutation layer for the reasons of making the cipher highly resource-efficient. Even though the designers provided a security analysis of this scheme against some major generic cryptanalytic methods, an application of the bit-division property in combination with MILP was not considered. By specifying integral distinguishers for the full-round SAT_Jo algorithm using this method, we essentially disapprove its use in intended applications. Using a 30-round distinguisher, we also describe a subkey recovery attack on the SAT_Jo algorithm whose time complexity is about 2 66 encryptions (noting that SAT_Jo is designed to provide 80 bits of security). Moreover, it seems that the choice of bit-permutation induces weak division properties since replacing the original bit-permutation of SAT_Jo by the one used in PRESENT immediately renders integral distinguishers inefficient.

The SPEEDY Family of Block Ciphers

We introduce SPEEDY, a family of ultra low-latency block ciphers. We mix engineering expertise into each step of the cipher’s design process in order to create a secure encryption primitive with an extremely low latency in CMOS hardware. The centerpiece of our constructions is a high-speed 6-bit substitution box whose coordinate functions are realized as two-level NAND trees. In contrast to other low-latency block ciphers such as PRINCE, PRINCEv2, MANTIS and QARMA, we neither constrain ourselves by demanding decryption at low overhead, nor by requiring a super low area or energy. This freedom together with our gate- and transistor-level considerations allows us to create an ultra low-latency cipher which outperforms all known solutions in single-cycle encryption speed. Our main result, SPEEDY-6-192, is a 6-round 192-bit block and 192-bit key cipher which can be executed faster in hardware than any other known encryption primitive (including Gimli in Even-Mansour scheme and the Orthros pseudorandom function) and offers 128-bit security. One round more, i.e., SPEEDY-7-192, provides full 192-bit security. SPEEDY primarily targets hardware security solutions embedded in high-end CPUs, where area and energy restrictions are secondary while high performance is the number one priority.

Six shades lighter: a bit-serial implementation of the AES family

Recently, cryptographic literature has seen new block cipher designs such as PRESENT, GIFT or SKINNY that aim to be more lightweight than the current standard, i.e., AES. Even though AES family of block ciphers were designed two decades ago, they still remain as the de facto encryption standard, with AES-128 being the most widely deployed variant. In this work, we revisit the combined one-in-all implementation of the AES family, namely both encryption and decryption of each AES-128/192/256 as a single ASIC circuit. A preliminary version appeared in Africacrypt 2019 by Balli and Banik, where the authors design a byte-serial circuit with such functionality. We improve on their work by reducing the size of the compact circuit to 2268 GE through 1-bit-serial implementation, which achieves 38% reduction in area. We also report stand-alone bit-serial versions of the circuit, targeting only a subset of modes and versions, e.g., AES-192 and AES-256. Our results imply that, in terms of area, AES-192 and AES-256 can easily compete with the larger members of recently designed SKINNY family, e.g., SKINNY-128-256, SKINNY-128-384. Thus, our implementations can be used interchangeably inside authenticated encryption candidates such as SKINNY-AEAD/-HASH, ForkAE or Romulus in place of SKINNY.

Cryptanalysis of Image Ciphers With Permutation-Substitution Network and Chaos

In recent decades, the introduction of chaos to image encryption has drawn worldwide attention. The permutation-substitution architecture has been widely applied, and chaotic systems are generally employed to produce the required encryption elements. Although many security assessment tests have been conducted, some chaotic image ciphers are being cryptanalyzed. In this article, we evaluate the security of a family of image ciphers whose encryption kernel consists of a bit-level or pixel-level permutation and a bit-wise exclusive OR substitution. After investigating the intrinsic linearity inside the outfitted structures and encryption techniques, we find that each ciphertext-plaintext pair can be represented as a combination of a set of ciphertext-plaintext bases. A chosen-ciphertext attack is proposed to construct the ciphertext-plaintext bases rather than the traditional solution to retrieve equivalent encryption elements. We further reveal that such weakness cannot be remedied by common enhancements such as more chaotic dynamics, complex permutation methods, and random pixel insertion during encryption. In addition, applications of the proposed attack to break 12 ciphers are theoretically presented and experimentally verified.

Improved fault analysis on SIMECK ciphers

The advances of Internet of Things (IoT) have had a fundamental impact and influence on sharping our rich living experiences. However, since IoT devices are usually resource-constrained, lightweight block ciphers have played a major role in serving as a building block for secure IoT protocols. In CHES 2015, SIMECK, a family of block ciphers, was designed for resource-constrained IoT devices. Since its publication, there have been many analyses on its security. In this paper, under the one bit-flip model, we propose a new efficient fault analysis attack on SIMECK ciphers. Compared to those previously reported attacks, our attack can recover the full master key by injecting faults into only a single round of all SIMECK family members. This property is crucial, as it is infeasible for an attacker to inject faults into different rounds of a SIMECK implementation on IoT devices in the real world. Specifically, our attack is characterized by exercising a deep analysis of differential trail between the correct and faulty immediate ciphertexts. Extensive simulation evaluations are conducted, and the results demonstrate the effectiveness and correctness of our proposed attack.

High-throughput configurable SIMON architecture for flexible security

As the Internet of Things applications become mission-critical and their data more valuable, it becomes more and more essential to paramount their security. The security can be improved by using emerging light-weight ciphers. SIMON is a relatively recent family of light-weight ciphers which is proposed by the National Security Agency optimized for hardware platforms. In this paper, we propose an optimized hardware architecture for SIMON for high-throughput resource-constrained applications with multiple levels of security. Moreover, a configurable architecture with different operating modes is introduced for utilizing in applications requiring higher resistance to fault and power attacks. This architecture also supports an ultra-high-throughput mode for different key sizes. Implementation results of the proposed architectures on both ASIC and FPGA are reported. The comparison results show that our proposals outperform similar architectures in terms of some design metrics, e.g. throughput, which make it suitable for IoT applications. Finally, we implement practically our architecture on the Digilent-ZYBO board and report the experimental results.

A new result on irreducible NFSRs with respect to cascade connection

Nonlinear feedback shift registers (NFSRs) are widely used in stream cipher design as building blocks. The cascade connection of NFSRs, known as an important architecture, has been adopted in Grain family of stream ciphers. In this paper, a new sufficient condition under which an NFSR cannot be decomposed into the cascade connection of two smaller NFSRs is presented, which is easy to be verified from the algebraic normal form (ANF) of the characteristic function. In fact, our results are also applicable to nonsingular Boolean functions, which actually improve a previous research of Rhodes [6] where the characteristic functions of NFSRs cannot be contained.

Resistance of SNOW-V against Fast Correlation Attacks

SNOW-V is a new member in the SNOW family of stream ciphers, hoping to be competitive in the 5G mobile communication system. In this paper, we study the resistance of SNOW-V against bitwise fast correlation attacks by constructing bitwise linear approximations. First, we propose and summarize some efficient algorithms using the slice-like techniques to compute the bitwise linear approximations of certain types of composition functions composed of basic operations like ⊞, ⊕, Permutation, and S-box, which have been widely used in word-oriented stream ciphers such as SNOW-like ciphers. Then, using these algorithms, we find a number of stronger linear approximations for the FSM of the two variants of SNOW-V given in the design document, i.e., SNOW-V σ0 and SNOW-V⊞8, ⊞8. For SNOW-V σ0, where there is no byte-wise permutation, we find some bitwise linear approximations of the FSM with the SEI (Squared Euclidean Imbalance) around 2−37.34 and mount a bitwise fast correlation attack with the time complexity 2251.93 and memory complexity 2244, given 2103.83 keystream outputs, which improves greatly the results in the design document. For SNOW-V⊞8, ⊞8, where both of the two 32-bit adders in the FSM are replaced by 8-bit adders, we find our best bitwise linear approximations of the FSM with the SEI 2−174.14, while the best byte-wise linear approximation in the design document of SNOW-V has the SEI 2−214.80. Finally, we study the security of a closer variant of SNOW-V, denoted by SNOW-V⊞32, ⊞8, where only the 32-bit adder used for updating the first register is replaced by the 8-bit adder, while everything else remains identical. For SNOW-V⊞32, ⊞8, we derive many mask tuples yielding the bitwise linear approximations of the FSM with the SEI larger than 2−184. Using these linear approximations, we mount a fast correlation attack with the time complexity 2377.01 and a memory complexity 2363, given 2253.73 keystream outputs. Note that neither of our attack threatens the security of SNOW-V. We hope our research could further help in understanding bitwise linear approximation attacks and also the structure of SNOW-like stream ciphers.

Accelerating the Search of Differential and Linear Characteristics with the SAT Method

The introduction of the automatic search boosts the cryptanalysis of symmetric-key primitives to some degree. However, the performance of the automatic search is not always satisfactory for the search of long trails or ciphers with large state sizes. Compared with the extensive attention on the enhancement for the search with the mixed integer linear programming (MILP) method, few works care for the acceleration of the automatic search with the Boolean satisfiability problem (SAT) or satisfiability modulo theories (SMT) method. This paper intends to fill this vacancy. Firstly, with the additional encoding variables of the sequential counter circuit for the original objective function in the standard SAT method, we put forward a new encoding method to convert the Matsui’s bounding conditions into Boolean formulas. This approach does not rely on new auxiliary variables and significantly reduces the consumption of clauses for integrating multiple bounding conditions into one SAT problem. Then, we evaluate the accelerating effect of the novel encoding method under different sets of bounding conditions. With the observations and experience in the tests, a strategy on how to create the sets of bounding conditions that probably achieve extraordinary advances is proposed. The new idea is applied to search for optimal differential and linear characteristics for multiple ciphers. For PRESENT, GIFT-64, RECTANGLE, LBlock, TWINE, and some versions in SIMON and SPECK families of block ciphers, we obtain the complete bounds (full rounds) on the number of active S-boxes, the differential probability, as well as the linear bias. The acceleration method is also employed to speed up the search of related-key differential trails for GIFT-64. Based on the newly identified 18-round distinguisher with probability 2−58, we launch a 26-round key-recovery attack with 260.96 chosen plaintexts. To our knowledge, this is the longest attack on GIFT-64. Lastly, we note that the attack result is far from threatening the security of GIFT-64 since the designers recommended users to double the number of rounds under the related-key attack setting.

Atom: A Stream Cipher with Double Key Filter

It has been common knowledge that for a stream cipher to be secure against generic TMD tradeoff attacks, the size of its internal state in bits needs to be at least twice the size of the length of its secret key. In FSE 2015, Armknecht and Mikhalev however proposed the stream cipher Sprout with a Grain-like architecture, whose internal state was equal in size with its secret key and yet resistant against TMD attacks. Although Sprout had other weaknesses, it germinated a sequence of stream cipher designs like Lizard and Plantlet with short internal states. Both these designs have had cryptanalytic results reported against them. In this paper, we propose the stream cipher Atom that has an internal state of 159 bits and offers a security of 128 bits. Atom uses two key filters simultaneously to thwart certain cryptanalytic attacks that have been recently reported against keystream generators. In addition, we found that our design is one of the smallest stream ciphers that offers this security level, and we prove in this paper that Atom resists all the attacks that have been proposed against stream ciphers so far in literature. On the face of it, Atom also builds on the basic structure of the Grain family of stream ciphers. However, we try to prove that by including the additional key filter in the architecture of Atom we can make it immune to all cryptanalytic advances proposed against stream ciphers in recent cryptographic literature.

Robustness Test of SIMON-32, SPECK-32, and SIMECK-32 Algorithms Using Fixed-Point Attacks

SIMON-32 and SPECK-32 are a family of lightweight block ciphers publicly released by the National Security Agency (NSA) in June 2013. Meanwhile, SIMECK-32 is a lightweight block cipher based on the combination of good design components from SIMON- 32 and SPECK-32 block ciphers. In this paper, we tested the robustness of the SIMON-32, SPECK-32, and SIMECK-32 algorithms against fixed-point attacks. Block cipher fixed-points may facilitate fixed-point attacks if an adversary can control the block cipher key input. The results of fixed-point attacks on the SIMON-32, SPECK-32, and SIMECK-32 algorithms show that all three variants of the algorithm have fixed-points.