Practical Key Recovery Attack Research Articles

New Practical Attacks on GEA-1 Based on a New-Found Weakness

GEA-1, a proprietary stream cipher, was initially designed and used to protect against eavesdropping general packet radio service (GPRS) between the phone and the base station. Now, a variety of current mobile phones still support this standard cipher. In this paper, a structural weakness of the GEA-1 stream cipher that has not been found in previous works is discovered and analyzed. That is the probability that two different inputs of GEA-1 generate the identical keystream can be up to 2−7.30, which is quite high compared with an ideal stream cipher that generates random sequences. Based on this newfound weakness, a new practical distinguishing attack on GEA-1 is proposed, which shows that the keystreams generated by GEA-1 are far from random and can be easily distinguished with a practical time cost. After then, a new practical key recovery attack on GEA-1 is presented. It has a time complexity of 221.02 GEA-1 encryptions and requires only seven related keys, which is much less than the existing related key attack on GEA-1. The experimental results show that GEA-1 can be broken within about 41.75 s on a common PC in the related key setting. These cryptanalytic results show that GEA-1 cannot provide enough security and should be immediately prohibited to be supported in the massive GPRS devices.

A practical key recovery attack on the lightweight WG-5 stream cipher

WG-5 is a lightweight stream cipher proposed for usage in the resource-constrained devices, e.g., passive RFID tags, industrial controllers, contactless smart cards and sensors. In this paper, a weakness called slide property of WG-5 which has not been discovered in previous works is for the first time explored and analyzed. The result shows that the probability that two related key-IV pairs of WG-5 generate the shifted keystreams can be up to 2−20, which is significantly high compared with an ideal stream cipher that generates the random keystreams. The correctness and accuracy of this theoretical probability is confirmed experimentally. Based on the slide property of WG-5, some key recovery attacks on WG-5 in the related key setting are proposed. The cryptanalytic result shows that the 80-bit secret key of WG-5 can be recovered with a time complexity of 225.615, requiring 6 related keys and 80 keystream bits for each of 224.585 chosen IVs. The experimental result validates our attack and shows that WG-5 can be broken within about 92.054 seconds on a common PC in the related key setting. These results imply that the design of WG-5 is far from optimal and needs to be strengthened to provide enough security for the lightweight constrained applications.

On the resistance of new lightweight block ciphers against differential cryptanalysis

Many recently proposed lightweight block ciphers lack security evaluation against generic cryptanalytic attacks such as differential cryptanalysis. In this paper, we contribute towards security evaluation efforts by investigating four lightweight Feistel-based block ciphers including SLIM, LBC-IoT, SCENERY, and LCB. SLIM claims resistance to differential cryptanalysis since, using a heuristic technique, its designers could only find a 7-round differential trail. Despite having no analysis of security against attacks such as differential cryptanalysis, the designers of LBC-IoT and LCB claimed that their ciphers are secure. Meanwhile, the designers of SCENERY claim that the best 11-round differential trail for the cipher has a probability of 2−66. To substantiate these claims, we propose attacks on all four ciphers based on differential cryptanalysis. We presented practical key recovery attacks on SLIM which can retrieve the final round key for up to 14 rounds with a time complexity of 232. LBC-IoT was found to be weaker against differential cryptanalysis despite sharing many similarities with SLIM, whereby a key recovery attack of up to 19 rounds is possible with time complexity 231. For SCENERY, we found a differential trail of up to 12 rounds with probability 2−60, which was used as the distinguisher for a 13-round key recovery attack. We also discovered that LCB's design lacks nonlinearity, allowing us to easily derive deterministic differential trails regardless of the number of rounds. This flaw allowed us to perform a trivial distinguishing attack using a single known ciphertext. By using a different S-box to address this flaw, LCB is now more resilient to differential cryptanalysis than SLIM and LBC-IoT when using the same number of rounds. Our paper presents new independent cryptanalysis results for these ciphers.

Conditional differential analysis on the KATAN ciphers based on deep learning

AbstractKATAN ciphers are block ciphers using non‐linear feedback shift registers. In this study, the authors improve the results of conditional differential analysis on KATAN by using deep learning. Multi‐differential neural distinguishers are built to improve the accuracy of the neural distinguishers and increase the number of its rounds. Moreover, a conditional differential analysis framework is proposed based on deep learning with the multi‐differential neural distinguishers, resulting in a significant improvement than the previous. We present a practical key recovery attack on the 97‐round KATAN32 with 215.5 data complexity and 220.5 time complexity. The attack of the 82‐round KATAN48 and 70‐round KATAN64 are also presented as the best known practical results.

A cluster-based practical key recovery attack on reduced-round AES using impossible-differential cryptanalysis

A cluster-based practical key recovery attack on reduced-round AES using impossible-differential cryptanalysis

Don’t Reject This: Key-Recovery Timing Attacks Due to Rejection-Sampling in HQC and BIKE

Well before large-scale quantum computers will be available, traditional cryptosystems must be transitioned to post-quantum (PQ) secure schemes. The NIST PQC competition aims to standardize suitable cryptographic schemes. Candidates are evaluated not only on their formal security strengths, but are also judged based on the security with regard to resistance against side-channel attacks. Although round 3 candidates have already been intensively vetted with regard to such attacks, one important attack vector has hitherto been missed: PQ schemes often rely on rejection sampling techniques to obtain pseudorandomness from a specific distribution. In this paper, we reveal that rejection sampling routines that are seeded with secretdependent information and leak timing information result in practical key recovery attacks in the code-based key encapsulation mechanisms HQC and BIKE.Both HQC and BIKE have been selected as alternate candidates in the third round of the NIST competition, which puts them on track for getting standardized separately o the finalists. They have already been specifically hardened with constant-time decoders to avoid side-channel attacks. However, in this paper, we show novel timing vulnerabilities in both schemes: (1) Our secret key recovery attack on HQC requiresonly approx. 866,000 idealized decapsulation timing oracle queries in the 128-bit security setting. It is structurally different from previously identified attacks on the scheme: Previously, exploitable side-channel leakages have been identified in the BCH decoder of a previously submitted HQC version, in the ciphertext check as well as in the pseudorandom function of the Fujisaki-Okamoto transformation. In contrast, our attack uses the fact that the rejection sampling routine invoked during the deterministic re-encryption of the decapsulation leaks secret-dependent timing information, which can be efficiently exploited to recover the secret key when HQC is instantiated with the (now constant-time) BCH decoder, as well as with the RMRS decoder of the current submission. (2) From the timing information of the constant weight word sampler in the BIKE decapsulation, we demonstrate how to distinguish whether the decoding step is successful or not, and how this distinguisher is then used in the framework of the GJS attack to derive the distance spectrum of the secret key, using 5.8 x 107 idealized timing oracle queries. We provide details and analyses of the fully implemented attacks, as well as a discussion on possible countermeasures and their limits.

Practical key recovery attacks on FlexAEAD

FlexAEAD is a block cipher candidate submitted to the NIST Lightweight Cryptography standardization project, based on repeated application of an Even-Mansour construction. In order to optimize performance, the designers chose a relatively small number of rounds, using properties of the mode and bounds on differential and linear characteristics to substantiate their security claims. Due to a forgery attack with complexity of $$2^{46}$$ , FlexAEAD was not selected to the second round of evaluation in the NIST project. In this paper we present a practical key recovery attack on FlexAEAD, using clusters of differentials for the internal permutation and the interplay between different parts of the mode. Our attack, that was fully verified in practice, allows recovering the secret subkeys of FlexAEAD-64 with time complexity of less than $$2^{31}$$ encryptions (with experimental success rate of 75%). This is the first practical key recovery attack on a candidate of the NIST standartization project.

Practical Attacks on Reduced-Round 3D and Saturnin

Abstract 3D, an advanced encryption standard-like cipher employed three-dimensional structure, was proposed in 2008. Its recommended number of rounds is 22. Although the longest key recovery attack can currently reach 13 rounds, the complexity of existing attacks for >6 rounds seems to exceed the practically feasible complexity. Thus, a practical attack for 7-round 3D has yet to be developed. Recently, a lightweight block cipher called Saturnin has been selected as a second-round candidate in the National Institute of Standards and Technology standardization for lightweight cryptography. Saturnin also employs a three-dimensional structure and provides high security against quantum and classic attacks. In this paper, we investigate the yoyo attack on these two ciphers. Combined with the meet-in-the-middle technique, we apply the yoyo trick to 7-round 3D and recover the whole 512-bit secret key with $2^{15}$ plaintexts and adaptively chosen ciphertexts and $2^{16.5}$ complexity of full encryptions. To our best knowledge, it is the first practical key recovery attack for 7-round 3D to date. For Saturnin, we found a minor typo in its design report. The designers intended to make a super round containing two S-layers, but one was inadvertently omitted in the algorithm description. We propose a 5-super-round key recovery attack, which is suitable for both one-S-layer version and two-S-layer version. Since the round function of Saturnin has better diffusion, which leads that the meet-in-the-middle technique cannot be applied to this cipher directly. For the one-S-layer version, we address this problem by proposing a new technique called reducing key sets. This technique will fail on the other version, which proves the necessity of containing two S-layers in one-super-round. Finally, our attack requires $2^{39.1}$ plaintext pairs and adaptively chosen ciphertext pairs and $2^{46}$ one-round encryptions.

Improved Conditional Differential Analysis on NLFSR-Based Block Cipher KATAN32 with MILP

In this paper, a new method for constructing a Mixed Integer Linear Programming (MILP) model on conditional differential cryptanalysis of the nonlinear feedback shift register- (NLFSR-) based block ciphers is proposed, and an approach to detecting the bit with a strongly biased difference is provided. The model is successfully applied to the block cipher KATAN32 in the single-key scenario, resulting in practical key-recovery attacks covering more rounds than the previous. In particular, we present two distinguishers for 79 and 81 out of 254 rounds of KATAN32. Based on the 81-round distinguisher, we recover 11 equivalent key bits of 98-round KATAN32 and 13 equivalent key bits of 99-round KATAN32. The time complexity is less than 2 31 encryptions of 98-round KATAN32 and less than 2 33 encryptions of 99-round KATAN32, respectively. Thus far, our results are the best known practical key-recovery attacks for the round-reduced variants of KATAN32 regarding the number of rounds and the time complexity. All the results are verified experimentally.

Block Cipher Invariants as Eigenvectors of Correlation Matrices

A new approach to invariant subspaces and nonlinear invariants is developed. This results in both theoretical insights and practical attacks on block ciphers. It is shown that, with minor modifications to some of the round constants, Midori-64 has a nonlinear invariant with $$2^{96} + 2^{64}$$ corresponding weak keys. Furthermore, this invariant corresponds to a linear hull with maximal correlation. By combining the new invariant with integral cryptanalysis, a practical key-recovery attack on ten rounds of unmodified Midori-64 is obtained. The attack works for $$2^{96}$$ weak keys and irrespective of the choice of round constants. The data complexity is $$1.25 \cdot 2^{21}$$ chosen plaintexts, and the computational cost is dominated by $$2^{56}$$ block cipher calls. The validity of the attack is verified by means of experiments.

Gain: Practical Key-Recovery Attacks on Round-Reduced PAEQ

This work presents practical key-recovery attacks on round-reduced variants of CAESAR Round 2 candidate PAEQ by analyzing it in the light of guess-and-determine analysis. The attack developed here targets the mode of operation along with diffusion inside the AES based internal permutation AESQ. The first attack uses a guess-and-invert technique leading to a meet-in-the-middle attack that is able to recover the key for 6 out of the 20 rounds of paeq-64/80/128 with reduced key entropy of 1, 216 and 232, respectively. The second analysis extends the attack to 7 rounds using a invert-and-guess strategy which results in reduced key space of 224, 232, and 240 for the same PAEQ variants. Then, an 8-round attack (without the last shuffle operation) is mounted using a guess-invert-guess strategy which works on any of the three variants with a complexity of 248. Moreover, unlike the CICO attack mounted by the designers which works with only AESQ, our 8-round attack additionally takes into account the mode of operation of PAEQ. Finally, combining guess-and-determine with internal differential cryptanalytic strategies a full 8-round attack is devised which recovers the key for paeq-64/80/128 with time complexities of 234, 266, and 298, respectively.

A Practical Attack on KeeLoq

KeeLoq is a lightweight block cipher with a 32-bit block size and a 64-bit key. Despite its short key size, it is used in remote keyless entry systems and other wireless authentication applications. For example, there are indications that authentication protocols based on KeeLoq are used, or were used by various car manufacturers in anti-theft mechanisms. This paper presents a practical key recovery attack against KeeLoq that requires 216 known plaintexts and has a time complexity of 244.5 KeeLoq encryptions. It is based on the principle of slide attacks and a novel approach to meet-in-the-middle attacks. We investigated the way KeeLoq is intended to be used in practice and conclude that our attack can be used to subvert the security of real systems. In some scenarios the adversary may even reveal the master secret used in an entire class of devices from attacking a single device. Our attack has been fully implemented. We have built a device that can obtain the data required for the attack in less than 100 minutes, and our software experiments show that, given the data, the key can be found in 7.8 days of calculations on 64 CPU cores.

Practical key-recovery attack against APOP, an MD5-based challenge-response authentication

Hash functions are used in many cryptographic constructions under various assumptions, and the practical impact of collision attacks is often unclear. In this paper, we show how collisions can be used to recover part of the password used in the APOP authentication protocol. Since we actually need a little more than mere collisions, we look into the details of MD5 collisions. In Wang's attack, message modifications allow to deterministically satisfy certain sufficient conditions to find collisions efficiently. Unfortunately, message modifications significantly change the messages and one has little control over the colliding blocks. In this paper, we show how to choose small parts of the colliding messages, which will allow to build the APOP attack. This shows that collision attacks can be used to attack real protocols, which means that finding collisions is a real threat.

A key recovery attack on the 802.11b wired equivalent privacy protocol (WEP)

In this paper, we present a practical key recovery attack on WEP, the link-layer security protocol for 802.11b wireless networks. The attack is based on a partial key exposure vulnerability in the RC4 stream cipher discovered by Fluhrer, Mantin, and Shamir. This paper describes how to apply this flaw to breaking WEP, our implementation of the attack, and optimizations that can be used to reduce the number of packets required for the attack. We conclude that the 802.11b WEP standard is completely insecure, and we provide recommendations on how this vulnerability could be mitigated and repaired.