Single-key Attacks Research Articles

Improved Single-Key Attacks on 2-GOST

GOST, known as GOST-28147-89, was standardized as the Russian encryption standard in 1989. It is a lightweight-friendly cipher and suitable for the resource-constrained environments. However, due to the simplicity of GOST’s key schedule, it encountered reflection attack and fixed point attack. In order to resist such attacks, the designers of GOST proposed a modification of GOST, namely, 2-GOST. This new version changes the order of subkeys in the key schedule and uses concrete S-boxes in round function. But regarding single-key attacks on full-round 2-GOST, Ashur et al. proposed a reflection attack with data of 2 32 on a weak-key class of size 2 224 , as well as the fixed point attack and impossible reflection attack with data of 2 64 for all possible keys. Note that the attacks applicable for all possible keys need the entire plaintext space. In other words, these are codebook attacks. In this paper, we propose single-key attacks on 2-GOST with only about 2 32 data instead of codebook. Firstly, we apply 2-dimensional meet-in-the-middle attack combined with splice-cut technique on full-round 2-GOST. This attack is applicable for all possible keys, and its data complexity reduces from previous 2 64 to 2 32 . Besides that, we apply splice-cut meet-in-the-middle attack on 31-round 2-GOST with only data of 2 32 . In this attack, we only need 8 bytes of memory, which is negligible.

Improved integral attacks on 24‐round LBlock and LBlock‐s

LBlock is a lightweight block cipher with Feistel-SP structure proposed by Wu and Zhang in Applied Cryptography and Network Security 2011, and a modified version LBlock-s is used later in the design of the lightweight authenticated encryption cipher LAC, one of the CAESAR candidates. The best known integral attack on LBlock is presented by Zhang and Wu which can attack 23-round LBlock based on a 16-round integral distinguisher found with division property. In Selected Areas in Cryptography 2018, Eskandari et al. further presented a 17-round integral distinguisher of LBlock with bit-based division property using SAT solver. Using their method, the authors further find some new 17-round integral distinguishers of LBlock and use one of them to present a 24-round integral attack on LBlock. Similarly, they also find some 17-round integral distinguishers of LBlock-s and select one to present a 24-round integral attack on LBlock-s. In this way, they have improved known single-key attacks on LBlock and LBlock-s by one round.

Key recovery attacks on reduced-round Joltik-BC in the single-key setting

Joltik-BC is a tweakable block cipher used in the CAESAR candidate Joltik. In this paper, we propose meet-in-the-middle attacks on Joltik-BC in the single-key setting. Our attacks are constructed utilizing the freedom of the tweak and differential enumeration technique. As a result, we get an attack on 8-round Joltik-BC-64-64 with a data complexity of 253.5, a memory complexity of 253 and a time complexity of 253.6. We also present an attack on 10-round Joltik-BC-128-64 with a data complexity of 256.1, a memory complexity of 2123.5 and a time complexity of 2126.5. As far as we know, these are the best single-key attacks on Joltik-BC.

Single key MITM attack and biclique cryptanalysis of full round Khudra

Khudra, an efficient lightweight block cipher for FPGAs, requires at least around 45% less slices and 29% less AT product compared to round wise implementation of any of the contemporary lightweight block cipher. Though a few attacks on Khudra, mostly on meet-in-the-middle (MITM) attack, rectangle attack etc. with reduced rounds having high data complexity, are reported in the literature of cryptanalysis, none have been reported for single key attack on full round Khudra. In this paper, up to the best of our knowledge, we for the first time, present two single-key attacks on full round Khudra. In the first attack, we propose MITM attack on full round Khudra having time complexity 279.61 and data complexity 2. Next we find a 3-round biclique in the plaintext side which we utilize to attack full round Khudra with a reduced time complexity of 279.36.

CRYPTANALYSIS OF GOST IN THE MULTIPLE-KEY SCENARIO

ABSTRACT GOST 28147-89 is a well-known 256-bit block cipher. In 2010 GOST was submitted to ISO, to become an international standard. Then many academic attacks which allow to break full GOST faster than brute force have been found. The fastest known single-key attack on GOST for 264 of data is 2179 of [Courtois, N.: An improved differential attack on full GOST, Cryptology ePrint Archive, Report 2012/138, http://eprint.iacr.org/2012/138] and for 232 of data it is 2191 of [Courtois, N.: Algebraic complexity reduction and cryptanalysis of GOST, Preprint, 2010-13, http://eprint.iacr.org/2011/626]. Other results are slower but require significantly less memory [Courtois, N.: Algebraic complexity reduction and cryptanalysis of GOST, Preprint, 2010-2013, http://eprint.iacr.org/2011/626], [Dinur, I.-Dunkelman, O.-Shamir, A.: Improved attacks on full GOST, in: Fast Software Encryption-FSE ’12, 19th Internat. Workshop, Washington, USA, 2012, Lecture Notes in Comput. Sci., Vol. 7549, Springer, Berlin, 2012, pp. 9-28, http://eprint.iacr.org/2011/558/]. The common stereotype is that these will be “the best” attacks on GOST. However, ciphers are not used in practice with single keys, on the contrary. In this paper we intend to show that there exist attacks on GOST which are more versatile and even somewhat more “practical” than the best single key attack. We argument that multiple random key attacks not single key attacks, are more practical and more likely to be executed in the real life. They recover keys when other attacks recover none. One can break some (weaker) GOST keys in a population of 256-bit keys generated at random with a TOTAL computational effort as low as 2120, this including the cost to examine also the cases in which the attack does not work. All our attacks are based on special non-trivial properties of data inside the cipher which however are such that keys for which the property does not hold can be rejected efficiently.

Improved Single-Key Attacks on 8-Round AES-192 and AES-256

AES is the most widely used block cipher today, and its security is one of the most important issues in cryptanalysis. After 13 years of analysis, related-key attacks were recently found against two of its flavors (AES-192 and AES-256). However, such a strong type of attack is not universally accepted as a valid attack model, and in the more standard single-key attack model at most 8 rounds of these two versions can be currently attacked. In the case of 8-round AES-192, the only known attack (found 10 years ago) is extremely marginal, requiring the evaluation of essentially all the 2128 possible plaintext/ciphertext pairs in order to speed up exhaustive key search by a factor of 16. In this paper we introduce three new cryptanalytic techniques, and use them to get the first non-marginal attack on 8-round AES-192 (making its time complexity about a million times faster than exhaustive search, and reducing its data complexity to about 1/32,000 of the full codebook). In addition, our new techniques can reduce the best known time complexities for all the other combinations of 7-round and 8-round AES-192 and AES-256.

A Practical-Time Related-Key Attack on the KASUMI Cryptosystem Used in GSM and 3G Telephony

Over the last 20 years, the privacy of most GSM phone conversations was protected by the A5/1 and A5/2 stream ciphers, which were repeatedly shown to be cryptographically weak. They are being replaced now by the new A5/3 and A5/4 algorithms, which are based on the block cipher KASUMI. In this paper we describe a new type of attack called a sandwich attack, and use it to construct a simple related-key distinguisher for 7 of the 8 rounds of KASUMI with an amazingly high probability of 2?14. By using this distinguisher and analyzing the single remaining round, we can derive the complete 128-bit key of the full KASUMI with a related-key attack which uses only 4 related keys, 226 data, 230 bytes of memory, and 232 time. These completely practical complexities were experimentally verified by performing the attack in less than two hours on a single-core of a PC. Interestingly, neither our technique nor any other published attack can break the original MISTY block cipher (on which KASUMI is based) significantly faster than exhaustive search. Our results thus indicate that the modifications made by ETSI's SAGE group in moving from MISTY to KASUMI made it extremely weak when related-key attacks are allowed, but do not imply anything about its resistance to single-key attacks. Consequently, there is no indication that the way KASUMI is implemented in GSM and 3G networks is practically vulnerable in any realistic attack model.