Related-key Differential Characteristics Research Articles

Practical Related-Key Forgery Attacks on Full-Round TinyJAMBU-192/256

TinyJAMBU is one of the finalists in the NIST lightweight cryptography competition. It is considered to be one of the more efficient ciphers in the competition and has undergone extensive analysis in recent years as both the keyed permutation as well as the mode are new designs. In this paper we present a related-key forgery attack on the updated TinyJAMBU-v2 scheme with 256- and 192-bit keys. We introduce a high probability related-key differential attack where the differences are only introduced into the key state. Therefore, the characteristic is applicable to the TinyJAMBU mode and can be used to mount a forgery attack. The time and data complexity of the forgery are 233 using 214 related-keys for the 256-bit key version, and 243 using 216 related-keys for the 192-bit key version.For the 128-bit key we construct a related-key differential characteristic on the full keyed permutation of TinyJAMBU with a probability of 2−16. We extend the relatedkey differential characteristics on TinyJAMBU to practical-time key-recovery attacks that extract the full key from the keyed permutation with a time and data complexity of 224, 221, and 219 for respectively the 128-, 192-, and 256-bit key variants.All characteristics are experimentally verified and we provide key nonce pairs that produce the same tag to show the feasibility of the forgery attack. We note that the designers do not claim related-key security, however, the attacks proposed in this paper suggest that the scheme is not key-commiting, which has been recently identified as a favorable property for AEAD schemes.

A generalized framework for accelerating exhaustive search utilizing deterministic related-key differential characteristics

A generalized framework for accelerating exhaustive search utilizing deterministic related-key differential characteristics

Computing AES related-key differential characteristics with constraint programming

Cryptanalysis aims at testing the properties of encryption processes, and this usually implies solving hard optimization problems. In this paper, we focus on related-key differential attacks for the Advanced Encryption Standard (AES), which is the encryption standard for block ciphers. To mount these attacks, cryptanalysts need to solve the optimal related-key differential characteristic problem. Dedicated approaches do not scale well for this problem, and need weeks to solve its hardest instances.In this paper, we improve existing Constraint Programming (CP) approaches for computing optimal related-key differential characteristics: we add new constraints that detect inconsistencies sooner, and we introduce a new decomposition of the problem in two steps. These improvements allow us to compute all optimal related-key differential characteristics for AES-128, AES-192 and AES-256 in a few hours.

Related-Key Differential Cryptanalysis of the Reduced-Round Block Cipher GIFT

GIFT is a lightweight block cipher that was proposed by Banik et al. at CHES 2017, which is said to be a direct improvement over PRESENT since “that provides a much increased efficiency in all domains (smaller and faster)” and improves the security weaknesses of the latter. At Asiacrypt in 2014, Sun et al. introduced a bit-oriented mixed integer linear programming (MILP) method to search for the differential characteristics of block ciphers. In this paper, we use the differential cryptanalysis method based on this automated tool to analyse GIFT. We propose 12-round and 13-round related-key differential characteristics of GIFT- 64 and 7-round and 10-round related-key differential characteristics of GIFT- 128. By using them as distinguishers, we apply key recovery attacks on the 19-round and 20-round reduced GIFT-64 with data complexities of 2 47 and 2 56 plaintexts, respectively, which mean that the data complexities are lower. Furthermore, we improve the GIFT-64 key recovery attack using differential cryptanalysis by one round over the previous differential cryptanalysis.

Cryptanalysis on SDDO-Based BM123-64 Designs Suitable for Various IoT Application Targets

BM123-64 block cipher, which was proposed by Minh, N.H. and Bac, D.T. in 2014, was designed for high speed communication applications factors. It was constructed in hybrid controlled substitution–permutation network (CSPN) models with two types of basic controlled elements (CE) in distinctive designs. This cipher is based on switchable data-dependent operations (SDDO) and covers dependent-operations suitable for efficient primitive approaches for cipher constructions that can generate key schedule in a simple way. The BM123-64 cipher has advantages including high applicability, flexibility, and portability with different algorithm selection for various application targets with internet of things (IoT) as well as secure protection against common types of attacks, for instance, differential attacks and linear attacks. However, in this paper, we propose methods to possibly exploit the BM123-64 structure using related-key attacks. We have constructed a high probability related-key differential characteristics (DCs) on a full eight rounds of BM123-64 cipher. The related-key amplified boomerang attack is then proposed on all three different cases of operation-specific designs with effective results in complexity of data and time consumptions. This study can be considered as the first cryptographic results on BM123-64 cipher.

Revisiting AES related-key differential attacks with constraint programming

The Advanced Encryption Standard (AES) is one of the most studied symmetric encryption schemes. During the last years, several attacks have been discovered in different adversarial models. In this paper, we focus on related-key differential attacks, where the adversary may introduce differences in plaintext pairs and also in keys. We show that Constraint Programming (CP) can be used to model these attacks, and that it allows us to efficiently find all optimal related-key differential characteristics for AES-128, AES-192 and AES-256. In particular, we improve the best related-key differential for the whole AES-256 and give the best related-key differential on 10 rounds of AES-192, which is the differential trail with the longest path. Those results allow us to improve existing related-key distinguishers, basic related-key attacks and q-multicollisions on AES-256.

Related-Key Differential Attack on Round-Reduced Bel-T-256

Bel-T is the national block cipher encryption standard of the Republic of Belarus. It operates on 128-bit blocks and uses either 128, 192 or 256-bit keys. Bel-T combines a Feistel network with a Lai-Massey scheme and it has a complex round function with 7 S-box layers. In this work, we use a Mixed Integer Linear Programming (MILP) approach to find a a related-key differential characteristic that extends for 4 rounds and 5 S-box layers ($4 \frac{5}{7}$ rounds) with probability higher than 2-128. To build an MILP model of Bel-T that a solver can practically handle, we use a partial Difference Distribution Table (DDT) based on the Hamming weight of the input and output differences. The identified differential characteristic is used to mount a key recovery attack on 5 rounds and 6 S-box layers ($5 \frac{6}{7}$ out of 8 rounds) of Bel-T-256 with 2123.28 chosen plaintexts and 2228.4 encryptions. According to the best of our knowledge, this is the first public cryptanalysis of Bel-T in the black-box attack model.

Refined Probability of Differential Characteristics Including Dependency Between Multiple Rounds

The current paper studies the probability of differential characteristics for an unkeyed (or with a fixed key) construction. Most notably, it focuses on the gap between two probabilities of differential characteristics: probability with independent S-box assumption, p_ind, and exact probability, p_exact. It turns out that p_exact is larger than p_ind in Feistel network with some S-box based inner function. The mechanism of this gap is then theoretically analyzed. The gap is derived from interaction of S-boxes in three rounds, and the gap depends on the size and choice of the S-box. In particular the gap can never be zero when the S-box is bigger than six bits. To demonstrate the power of this improvement, a related-key differential characteristic is proposed against a lightweight block cipher RoadRunneR. For the 128-bit key version, p_ind of 2^-48 is improved to p_exact of 2^-43. For the 80-bit key version, p_ind of 2^-68 is improved to p_exact of 2^-62. The analysis is further extended to SPN with an almost-MDS binary matrix in the core primitive of the authenticated encryption scheme Minalpher: p_ind of 2^-128 is improved to p_exact of 2^-96, which allows to extend the attack by two rounds.

Refined Probability of Differential Characteristics Including Dependency Between Multiple Rounds

The current paper studies the probability of differential characteristics for an unkeyed (or with a fixed key) construction. Most notably, it focuses on the gap between two probabilities of differential characteristics: probability with independent S-box assumption, pind, and exact probability, pexact. It turns out that pexact is larger than pind in Feistel network with some S-box based inner function. The mechanism of this gap is then theoretically analyzed. The gap is derived from interaction of S-boxes in three rounds, and the gap depends on the size and choice of the S-box. In particular the gap can never be zero when the S-box is bigger than six bits. To demonstrate the power of this improvement, a related-key differential characteristic is proposed against a lightweight block cipher RoadRunneR. For the 128-bit key version, pind of 2−48 is improved to pexact of 2−43. For the 80-bit key version, pind of 2−68 is improved to pexact of 2−62. The analysis is further extended to SPN with an almost-MDS binary matrix in the core primitive of the authenticated encryption scheme Minalpher: pind of 2−128 is improved to pexact of 2−96, which allows to extend the attack by two rounds.

Cryptanalysis of full PRIDE block cipher

PRIDE is a lightweight block cipher proposed at CRYPTO 2014 by Albrecht et al., who claimed that the construction of linear layers is efficient and secure. In this paper, we investigate the key schedule and find eight 2-round iterative related-key differential characteristics, which can be used to construct 18-round related-key differentials. A study of the first subkey derivation function reveals that there exist three weak-key classes, as a result of which all the differences of subkeys for each round are identical. For the weak-key classes, we also find eight 2-round iterative related-key differential characteristics. Based on one of the related-key differentials, we launch an attack on the full PRIDE block cipher. The data and time complexity are $2^{39}$ chosen plaintexts and $2^{92}$ encryptions, respectively. Moreover, by using multiple related-key differentials, we improve the cryptanalysis, which then requires $2^{41.6}$ chosen plaintexts and $2^{42.7}$ encryptions, respectively. Finally, we use two 17-round related-key differentials to analyze full PRIDE, which requires $2^{35}$ plaintexts and $2^{54.7}$ encryptions. These are the first results on full PRIDE, and show that the PRIDE block cipher is not secure against related-key differential attack.

Multiple Related‐Key Differential Attacks on Pure DDP‐Based Cipher

By constructing three types of related-key differential characteristics, we present three corresponding related-key differential attacks on the cipher. As the independence of the characteristics, we could recover 64 bits of the cipher's master key with 258.6 chosen plain-texts, 258.8 full-round DDP-64 encryptions and 212.8 bits of storage resources. To break the cipher, we only need to implement an exhaustive search for the rest 64 bits of the master key.

Security analysis of Khudra: a lightweight block cipher for FPGAs

Khudra is a lightweight block cipher for field-programmable gate arrays, which appeared in SPACE 2014. In this paper, we consider the security of Khudra against the related-key attack. Firstly, we give some observations of F-function. Then we design a simple searching algorithm for related-key differential characteristics. By utilizing the observations and the searching algorithm, we launch related-key differential attacks on 16-round Khudra and full Khudra without whitening keys. Furthermore, we build a 13-round related-key rectangle distinguisher and attack on 16-round Khudra, which requires 253 chosen plaintexts and 264.08 encryptions. Moreover, with the 13-round distinguisher, there exists an attack on full Khudra without whitening keys. Then, we present a 14-round related-key impossible differential distinguisher. However, the 14-round distinguisher cannot work well, we propose a 11-round related-key impossible differential, which lead to an attack on 14-round Khudra without the pre-whitening keys. These results provide a helpful understanding of Khudra security evaluation against related-key attack. Copyright © 2015 John Wiley & Sons, Ltd.

Related-Key Differential Attacks on COSB-128

COSB-128 (Moldovyan et al., 2002) is a block cipher with 128-bit and 256-bit secret keys, which use key and data-dependent operational substitutions in fast controllable permutation blocks (CPB) concept. It is designed with a simple key schedule to ensure a high speed of data transformation by fast block encryption algorithms and expected to be high stability to all known methods of cryptanalysis, especially differential and linear attacks. In this paper, we show that the COSB-128 block cipher still remains weaknesses to differential related-key cryptanalysis, by constructing two full 10-round related-key differential characteristics (DCs) of COSB-128 with high probabilities, and thence propose our two related-key differential attacks. The attacks require about 224 data and time complexities to recover 63-bit key information and 222 data and time complexities to recover 6-bit key information. This study is the first known cryptanalytic result on COSB-128 until now. From this study, the new potential for the cryptanalysis on these types of block cipher will be further revealed.

Related-Key Differential Attacks on CHESS-64

With limited computing and storage resources, many network applications of encryption algorithms require low power devices and fast computing components. CHESS-64 is designed by employing simple key scheduling and Data-Dependent operations (DDO) as main cryptographic components. Hardware performance for Field Programmable Gate Arrays (FPGA) and for Application Specific Integrated Circuits (ASIC) proves that CHESS-64 is a very flexible and powerful new cipher. In this paper, the security of CHESS-64 block cipher under related-key differential cryptanalysis is studied. Based on the differential properties of DDOs, we construct two types of related-key differential characteristics with one-bit difference in the master key. To recover 74 bits key, two key recovery algorithms are proposed based on the two types of related-key differential characteristics, and the corresponding data complexity is about 2 42.9 chosen-plaintexts, computing complexity is about 2 42.9 CHESS-64 encryptions, storage complexity is about 2 26.6 bits of storage resources. To break the cipher, an exhaustive attack is implemented to recover the rest 54 bits key. These works demonstrate an effective and general way to attack DDO-based ciphers.