Related-key Differential Attacks Research Articles

Practical Related-Key Forgery Attacks on Full-Round TinyJAMBU-192/256

TinyJAMBU is one of the finalists in the NIST lightweight cryptography competition. It is considered to be one of the more efficient ciphers in the competition and has undergone extensive analysis in recent years as both the keyed permutation as well as the mode are new designs. In this paper we present a related-key forgery attack on the updated TinyJAMBU-v2 scheme with 256- and 192-bit keys. We introduce a high probability related-key differential attack where the differences are only introduced into the key state. Therefore, the characteristic is applicable to the TinyJAMBU mode and can be used to mount a forgery attack. The time and data complexity of the forgery are 233 using 214 related-keys for the 256-bit key version, and 243 using 216 related-keys for the 192-bit key version.For the 128-bit key we construct a related-key differential characteristic on the full keyed permutation of TinyJAMBU with a probability of 2−16. We extend the relatedkey differential characteristics on TinyJAMBU to practical-time key-recovery attacks that extract the full key from the keyed permutation with a time and data complexity of 224, 221, and 219 for respectively the 128-, 192-, and 256-bit key variants.All characteristics are experimentally verified and we provide key nonce pairs that produce the same tag to show the feasibility of the forgery attack. We note that the designers do not claim related-key security, however, the attacks proposed in this paper suggest that the scheme is not key-commiting, which has been recently identified as a favorable property for AEAD schemes.

Related-Key Differential Attacks on Reduced-Round LBlock

LBlock, as one of the typical lightweight encryption schemes, is a 32-round block cipher with 64 bit block and 80 bit master key. It can be widely applied in the IoT environment because of its friendly software and hardware implementations. Since it came out, it has encountered many attacks. In this paper, we evaluate LBlock’s ability against related-key differential attack more accurately based on SMT method. On the one hand, we propose tighter lower bounds on the minimal number of active S-boxes for up to 19 rounds of LBlock, which are 8 more rounds than previous ones. Then, we propose the upper bounds of total probabilities for up to 19 rounds of LBlock for the first time. On the other hand, with a suitable 17-round related-key differential distinguisher, we propose attacks on 22- and 23-round LBlock. Each of these attacks has lower time complexity and data complexity than previous ones for the same rounds of LBlock.

Security of Related-Key Differential Attacks on TWINE, Revisited

Security of Related-Key Differential Attacks on TWINE, Revisited

Computing AES related-key differential characteristics with constraint programming

Cryptanalysis aims at testing the properties of encryption processes, and this usually implies solving hard optimization problems. In this paper, we focus on related-key differential attacks for the Advanced Encryption Standard (AES), which is the encryption standard for block ciphers. To mount these attacks, cryptanalysts need to solve the optimal related-key differential characteristic problem. Dedicated approaches do not scale well for this problem, and need weeks to solve its hardest instances.In this paper, we improve existing Constraint Programming (CP) approaches for computing optimal related-key differential characteristics: we add new constraints that detect inconsistencies sooner, and we introduce a new decomposition of the problem in two steps. These improvements allow us to compute all optimal related-key differential characteristics for AES-128, AES-192 and AES-256 in a few hours.

Revisiting AES related-key differential attacks with constraint programming

The Advanced Encryption Standard (AES) is one of the most studied symmetric encryption schemes. During the last years, several attacks have been discovered in different adversarial models. In this paper, we focus on related-key differential attacks, where the adversary may introduce differences in plaintext pairs and also in keys. We show that Constraint Programming (CP) can be used to model these attacks, and that it allows us to efficiently find all optimal related-key differential characteristics for AES-128, AES-192 and AES-256. In particular, we improve the best related-key differential for the whole AES-256 and give the best related-key differential on 10 rounds of AES-192, which is the differential trail with the longest path. Those results allow us to improve existing related-key distinguishers, basic related-key attacks and q-multicollisions on AES-256.

Related-Key Differential Attack on Round-Reduced Bel-T-256

Bel-T is the national block cipher encryption standard of the Republic of Belarus. It operates on 128-bit blocks and uses either 128, 192 or 256-bit keys. Bel-T combines a Feistel network with a Lai-Massey scheme and it has a complex round function with 7 S-box layers. In this work, we use a Mixed Integer Linear Programming (MILP) approach to find a a related-key differential characteristic that extends for 4 rounds and 5 S-box layers ($4 \frac{5}{7}$ rounds) with probability higher than 2-128. To build an MILP model of Bel-T that a solver can practically handle, we use a partial Difference Distribution Table (DDT) based on the Hamming weight of the input and output differences. The identified differential characteristic is used to mount a key recovery attack on 5 rounds and 6 S-box layers ($5 \frac{6}{7}$ out of 8 rounds) of Bel-T-256 with 2123.28 chosen plaintexts and 2228.4 encryptions. According to the best of our knowledge, this is the first public cryptanalysis of Bel-T in the black-box attack model.

NEW KEY EXPANSION FUNCTION OF RIJNDAEL 128-BIT RESISTANCE TO THE RELATED-KEY ATTACKS

A master key of special length is manipulated based on the key schedule to create round sub-keys in most block ciphers. A strong key schedule is described as a cipher that will be more resistant to various forms of attacks, especially in related-key model attacks. Rijndael is the most common block cipher, and it was adopted by the National Institute of Standards and Technology, USA in 2001 as an Advance Encryption Standard. However, a few studies on cryptanalysis revealed that a security weakness of Rijndael refers to its vulnerability to related-key differential attack as well as the related-key boomerang attack, which is mainly caused by the lack of nonlinearity in the key schedule of Rijndael. In relation to this, constructing a key schedule that is both efficient and provably secure has been an ongoing open problem. Hence, this paper presents a method to improve the key schedule of Rijndael 128-bit for the purpose of making it more resistance to the related-key differential and boomerang attacks. In this study, two statistical tests, namely the Frequency test and the Strict Avalanche Criterion test were employed to respectively evaluate the properties of bit confusion and bit diffusion. The results showed that the proposed key expansion function has excellent statistical properties and agrees with the concept of Shannon’s diffusion and confusion bits. Meanwhile, the Mixed Integer Linear Programming based approach was adopted to evaluate the resistance of the proposed approach towards the related-key differential and boomerang attacks. The proposed approach was also found to be resistant against the two attacks discovered in the original Rijndael. Overall, these results proved that the proposed approach is able to perform better compared to the original Rijndael key expansion function and that of the previous research.

Cryptanalysis of full PRIDE block cipher

PRIDE is a lightweight block cipher proposed at CRYPTO 2014 by Albrecht et al., who claimed that the construction of linear layers is efficient and secure. In this paper, we investigate the key schedule and find eight 2-round iterative related-key differential characteristics, which can be used to construct 18-round related-key differentials. A study of the first subkey derivation function reveals that there exist three weak-key classes, as a result of which all the differences of subkeys for each round are identical. For the weak-key classes, we also find eight 2-round iterative related-key differential characteristics. Based on one of the related-key differentials, we launch an attack on the full PRIDE block cipher. The data and time complexity are $2^{39}$ chosen plaintexts and $2^{92}$ encryptions, respectively. Moreover, by using multiple related-key differentials, we improve the cryptanalysis, which then requires $2^{41.6}$ chosen plaintexts and $2^{42.7}$ encryptions, respectively. Finally, we use two 17-round related-key differentials to analyze full PRIDE, which requires $2^{35}$ plaintexts and $2^{54.7}$ encryptions. These are the first results on full PRIDE, and show that the PRIDE block cipher is not secure against related-key differential attack.

Multiple Related‐Key Differential Attacks on Pure DDP‐Based Cipher

By constructing three types of related-key differential characteristics, we present three corresponding related-key differential attacks on the cipher. As the independence of the characteristics, we could recover 64 bits of the cipher's master key with 258.6 chosen plain-texts, 258.8 full-round DDP-64 encryptions and 212.8 bits of storage resources. To break the cipher, we only need to implement an exhaustive search for the rest 64 bits of the master key.

Security analysis of Khudra: a lightweight block cipher for FPGAs

Khudra is a lightweight block cipher for field-programmable gate arrays, which appeared in SPACE 2014. In this paper, we consider the security of Khudra against the related-key attack. Firstly, we give some observations of F-function. Then we design a simple searching algorithm for related-key differential characteristics. By utilizing the observations and the searching algorithm, we launch related-key differential attacks on 16-round Khudra and full Khudra without whitening keys. Furthermore, we build a 13-round related-key rectangle distinguisher and attack on 16-round Khudra, which requires 253 chosen plaintexts and 264.08 encryptions. Moreover, with the 13-round distinguisher, there exists an attack on full Khudra without whitening keys. Then, we present a 14-round related-key impossible differential distinguisher. However, the 14-round distinguisher cannot work well, we propose a 11-round related-key impossible differential, which lead to an attack on 14-round Khudra without the pre-whitening keys. These results provide a helpful understanding of Khudra security evaluation against related-key attack. Copyright © 2015 John Wiley & Sons, Ltd.

Related-Key Differential Attacks on COSB-128

COSB-128 (Moldovyan et al., 2002) is a block cipher with 128-bit and 256-bit secret keys, which use key and data-dependent operational substitutions in fast controllable permutation blocks (CPB) concept. It is designed with a simple key schedule to ensure a high speed of data transformation by fast block encryption algorithms and expected to be high stability to all known methods of cryptanalysis, especially differential and linear attacks. In this paper, we show that the COSB-128 block cipher still remains weaknesses to differential related-key cryptanalysis, by constructing two full 10-round related-key differential characteristics (DCs) of COSB-128 with high probabilities, and thence propose our two related-key differential attacks. The attacks require about 224 data and time complexities to recover 63-bit key information and 222 data and time complexities to recover 6-bit key information. This study is the first known cryptanalytic result on COSB-128 until now. From this study, the new potential for the cryptanalysis on these types of block cipher will be further revealed.

Related-Key Differential Attacks on CHESS-64

With limited computing and storage resources, many network applications of encryption algorithms require low power devices and fast computing components. CHESS-64 is designed by employing simple key scheduling and Data-Dependent operations (DDO) as main cryptographic components. Hardware performance for Field Programmable Gate Arrays (FPGA) and for Application Specific Integrated Circuits (ASIC) proves that CHESS-64 is a very flexible and powerful new cipher. In this paper, the security of CHESS-64 block cipher under related-key differential cryptanalysis is studied. Based on the differential properties of DDOs, we construct two types of related-key differential characteristics with one-bit difference in the master key. To recover 74 bits key, two key recovery algorithms are proposed based on the two types of related-key differential characteristics, and the corresponding data complexity is about 2 42.9 chosen-plaintexts, computing complexity is about 2 42.9 CHESS-64 encryptions, storage complexity is about 2 26.6 bits of storage resources. To break the cipher, an exhaustive attack is implemented to recover the rest 54 bits key. These works demonstrate an effective and general way to attack DDO-based ciphers.

The resistance of PRESENT-80 against related-key differential attacks

We examine the security of the 64-bit lightweight block cipher PRESENT-80 against related-key differential attacks. With a computer search we are able to prove that for any related-key differential characteristic on full-round PRESENT-80, the probability of the characteristic only in the 64-bit state is not higher than 2−64. To overcome the exponential (in the state and key sizes) computational complexity of the search we use truncated differences, however as the key schedule is not nibble oriented, we switch to actual differences and apply early abort techniques to prune the tree-based search. With a new method called extended split approach we are able to make the whole search feasible and we implement and run it in real time. Our approach targets the PRESENT-80 cipher however,with small modifications can be reused for other lightweight ciphers as well.

Parallelisable variants of Camellia and SMS4 block cipher: p-Camellia and p-SMS4

We propose two parallelisable variants of Camellia and SMS4 block ciphers based on the n-cell GF-NLFSR. The n-cell generalised Feistel-non-linear feedback shift register GF-NLFSR structure Choy et al., 2009a is a generalised unbalanced Feistel network that can be considered as a generalisation of the outer function FO of the KASUMI block cipher. An advantage of this cipher over other n-cell generalised Feistel networks, e.g., SMS4 Diffe and Ledin, 2008 and Camellia Aokiet al., 2001, is that it is parallelisable for up to n rounds. In hardware implementations, the benefits translate to speeding up encryption by up to n times while consuming similar area and significantly less power. At the same time, n-cell GF-NLFSR structures offer similar proofs of security against differential cryptanalysis as conventional n-cell Feistel structures. In this paper, we prove security against differential, linear and boomerang attacks. We also show that the selected number of rounds are conservative enough to provide high security margin against other known attacks such as integral, impossible differential, higher order differential, interpolation, slide, XSL and related-key differential attacks.

Security analysis of pure DDP-based cipher proper for multimedia and ubiquitous device

DDP-64, based on various controlled operations, is a 64-bit Feistel-like block cipher consisting of 10 rounds with a 128-bit key. It was designed to attempt to have a high security level and a high speed performance in hardware on ubiquitous computing systems and multimedia. In this paper, however, we show that DDP-64 doesn't have a high security level, more precisely, we show that it is vulnerable to related-key differential attack. This attack, which is much faster than the key exhaustive search, requires about 254 data and 254 time complexities. This work is the first known cryptanalytic result on DDP-64 so far.

Security analysis of the SCO-family using key schedules

The COS-based ciphers SCO-1, SCO-2 and SCO-3 (called the SCO-family) have been designed to improve the security of DDP-based ciphers which are all broken by related-key attacks. In this paper we show that the SCO-family is still vulnerable to related-key attacks: we present related-key differential attacks on a full-round SCO-1, a full-round SCO-2 and an 11-round reduced SCO-3, respectively. The attack on SCO-1 requires 2 61 related-key chosen ciphertexts and 2 120.59 full-round SCO-1 decryptions. For the attack on SCO-2, we require 2 59 related-key chosen plaintexts and 2 118.42 full-round SCO-2 encryptions, and the 11-round attack on SCO-3 works with 2 58 related-key chosen plaintexts and 2 117.54 11-round SCO-3 encryptions. This work is the first known cryptanalytic results on the SCO-family.

Related-Key Impossible Differential Attacks on Reduced-Round AES-256

In this paper,the strength of AES-256 against the related-key impossible differential attack is examined. Firstly,a carefully chosen relation between the related keys is presented,which can be extended to 8-round(even more rounds)subkey differences.Then,a 5.5-round related-key impossible differential is constructed.Finally,an attack on 7-round AES-256 and four attacks on 8-round AES-256 are presented.