Slide Attack Research Articles

Cryptanalysis of Strumok Cipher Initialization

Abstract The initialization of the Strumok cipher is analyzed in this paper. A modified cipher initialization procedure is constructed for the Strumok-512 cipher, which allows to show that the cipher initialization is not injective. Security against slide attacks is proved. Furthermore, the Guess-and-Determine attack on the Strumok-512 cipher is constructed with complexity 2448.

Similarity Property and Slide Attack of Block Cipher FESH

This paper focuses on similarity properties and extension of the classical slide property of block ciphers. Taking FESH, an award-winning block cipher of the National Cryptographic Algorithm Design Competition 2019, as an example, similarity properties of the encryption and key transformation are found, owing to the similar structures that the encryption and key transformation adopted, and the constants generation. Based on the similarity properties, extended slide properties can be constructed for FESH. Slide attacks of FESH are then proposed. The similarity properties and extended slide property are immune to the increasing of iterated rounds, i.e., it cannot be avoided by increasing the round number of FESH. Furthermore, extended slide property helps relaxing the strict requirements of the subkeys in slide attacks. Taking Feistel and SPN structures as examples, frameworks of slide attacks based on the extended slide properties are presented. Slide attack of FESH is exactly a concrete example of SPN structure.

Components and kay features of the analisis symmetric cryptocircuit

This article discusses the key aspects and technologies of applying many cryptanalysis methods for assessing the stability of symmetric block encryption algorithms. The following aspects of analysis methods such as linear, differential, slide attack, algebraic analyzes are also considered. Approaches to the analysis of the AES standard are compared. Also, when considering the approaches to the analysis of modern symmetric cryptosystems, special attention is paid to special questions regarding the possibility of using distributed multiprocessor calculations in order to reduce the analysis time.

Slide Attack on Full-Round ULC Lightweight Block Cipher Designed for IoT

To meet the security demand for IoT devices, many new lightweight block ciphers are proposed. ULC is a lightweight block cipher designed for the IoT. It has many advantages in terms of memory use, efficiency, and security. In this paper, a slide attack on full-round ULC is proposed in a related key setting. First, two properties on ULC are discovered. The first property is presented to illustrate the property of a slid pair for ULC. The second property is introduced to construct a link between some round key bits and some master key bits. Based on these properties, a key recovery attack on ULC is proposed. In this attack, with the condition of one related key, all the 80 master key bits can be recovered with the data complexity of O(232), the memory complexity of O(232), and the time complexity of O(263). The result of this paper indicates that ULC can’t resist slide attack in related key settings.

Quantum Attacks on 1K-AES and PRINCE

Abstract By introducing the BHT algorithm into the slide attack on 1K-AES and the related-key attack on PRINCE, we present the corresponding quantum attacks in this paper. In the proposed quantum attacks, we generalize the BHT algorithm to the situation where the number of marked items is unknown ahead of time. Moreover, we give an implementation scheme of classifier oracle based on Quantum Phase Estimation algorithm in presented quantum attacks. The complexity analysis shows that the query complexity, time complexity and memory complexity of the presented quantum attacks are all $\mathcal{O}(2^{n/3})$ when the success probability is about $63\%$, where $n$ is the block size. Compared with the corresponding classical attacks, the proposed quantum attacks can achieve subquadratic speed-up under the same success probability no matter on query complexity, time complexity or memory complexity. Furthermore, the query complexity of the proposed quantum slide attack on 1K-AES is less than Grover search on 1K-AES by a factor of $2^{n/6}.$ When compared with the Grover search on PRINCE, the query complexity of the presented quantum attack on PRINCE is reduced from $\mathcal{O}(2^{n})$ to $\mathcal{O}(2^{n/2}).$ When compared with the combination of Grover and Simon’s algorithms on PRINCE, the query complexity of our quantum attack on PRINCE is reduced from $\mathcal{O}(n\cdot 2^{n/2})$ to $\mathcal{O}(2^{n/2}).$ Besides, the proposed quantum slide attack on 1K-AES indicates that the quantum slide attack could also be applied on Substitution-Permutation Network construction, apart from the iterated Even-Mansour cipher and Feistel constructions.

A study on slide attacks after reception in volleyball games

A study on slide attacks after reception in volleyball games

Some aspects with the use of improved slide attack to the standard Encryption algorithm GOST 28147-89

Some aspects with the use of improved slide attack to the standard Encryption algorithm GOST 28147-89

Quantum attacks on some feistel block ciphers

Post-quantum cryptography has attracted much attention from worldwide cryptologists. However, most research works are related to public-key cryptosystem due to Shor’s attack on RSA and ECC ciphers. At CRYPTO 2016, Kaplan et al. showed that many secret-key (symmetric) systems could be broken using a quantum period finding algorithm, which encouraged researchers to evaluate symmetric systems against quantum attackers. In this paper, we continue to study symmetric ciphers against quantum attackers. First, we convert the classical advanced slide attacks (introduced by Biryukov and Wagner) to a quantum one, that gains an exponential speed-up in time complexity. Thus, we could break 2/4K-Feistel and 2/4K-DES in polynomial time. Second, we give a new quantum key-recovery attack on full-round GOST, which is a Russian standard, with $$2^{114.8}$$ quantum queries of the encryption process, faster than a quantum brute-force search attack by a factor of $$2^{13.2}$$.

Key-recovery attacks on LED-like block ciphers

Asymmetric cryptographic schemes, represented by RSA, have been shown to be insecure under quantum computing conditions. Correspondingly, there is a need to study whether the symmetric cryptosystem can still guarantee high security with the advent of quantum computers. In this paper, based on the basic principles of classical slide attacks and Simon's algorithm, we take LED-like lightweight block ciphers as research objects to present a security analysis under both classical and quantum attacks, fully considering the influence on the security of the ciphers of adding the round constants. By analyzing the information leakage of round constants, we can introduce the differential of the round constants to propose a classical slide attack on full-round LED-64 with a probability of 1. The analysis result shows that LED-64 is unable to resist this kind of classical slide attack, but that attack method is not applicable to LED-128. As for quantum attacks, by improving on existing quantum attack methods we demonstrate a quantum single-key slide attack on LED-64 and a quantum related-key attack on LED- 128, and indicators of the two attack algorithms are analyzed in detail. The attack results show that adding round constants does not completely improve the security of the ciphers, and quantum attacks can provide an exponential speed-up over the same attacks in the classical model. It further illustrates that the block cipher that is proved to be safe under classical settings is not necessarily secure under quantum conditions.

A Practical Forgery Attack on Lilliput-AE

Lilliput-AE is a tweakable block cipher submitted as a candidate to the NIST lightweight cryptography standardization process. It is based upon the lightweight block cipher Lilliput, whose cryptanalysis so far suggests that it has a large security margin. In this note, we present an extremely efficient forgery attack on Lilliput-AE: Given a single arbitrary message of length about $$2^{36}$$ bytes, we can instantly produce another valid message that leads to the same tag, along with the corresponding ciphertext. The attack uses a weakness in the tweakey schedule of Lilliput-AE which leads to the existence of a related-tweak differential characteristic with probability 1 in the underlying block cipher. The weakness we exploit, which does not exist in Lilliput, demonstrates the potential security risk in using a very simple tweakey schedule in which the same part of the key/tweak is reused in every round, even when round constants are employed to prevent slide attacks. Following this attack, the Lilliput-AE submission to NIST was tweaked.

How Many Weak-Keys Exist in T-310 ?

Abstract T-310 is an important Cold War cipher. The cipher is extremely complex and it outputs extremely few bits from the internal state. A recent paper [Courtois, N. T.: Decryption oracle slide attacks on T-310, Cryptologia, 42 (2018), no. 3, 191–204] shows an example of a highly anomalous key such that T-310 can be broken by a slide attack with a decryption oracle. In this paper, we show that the same attacks are ALSO possible for regular keys which satisfy all the official KT1 requirements. Two other recent papers [Courtois, N. T.—Georgiou, M.—Scarlata, M.: Slide attacks and LC-weak keys in T-310, Cryptologia 43 (2019), no. 3, 175–189]; [Courtois, N. T.—Oprisanu, M. B.—Schmeh, K.: Linear cryptanalysis and block cipher design in East Germany in the 1970s, Cryptologia (published online), December 5, 2018] show that some of the KT1 keys are very weak w.r.t. Linear Cryptanalysis. In this paper, we show that a vast number of such weak keys exist and study the exact pre-conditions which make them weak. In addition we introduce a new third class of weak keys for RKDC (Related-Key Differential Cryptanalysis). We show that the original designers in the 1970s have ensured that these RKDC properties cannot happen for 4 rounds. We have discovered that these properties can happen for as few as 5 rounds for some keys, and for 10 to 16 rounds they become hard to avoid. The main reason why we study weak keys is to show that none of these properties occur by accident, rather that they are governed by precise pre-conditions which guarantee their existence, and countless other keys with the same properties exist. Eventually, this is how interesting attacks can be found.

Slide attacks and LC-weak keys in T-310

T-310 is an important Cold War cipher (Cryptologia 2006). In a recent article (Cryptologia 2018), researchers show that, in spite of specifying numerous very technical requirements, the designers do not protect the cipher against linear cryptanalysis and some 3% of the keys are very weak. However, such a weakness does not necessarily allow breaking the cipher because it is extremely complex and extremely few bits from the internal state are used for the actual encryption. In this article, we finally show a method that allows recovering a part of the secret key for about half of such weak keys in a quasi-realistic setting. For this purpose, we revisit another recent article from Cryptologia from 2018 and introduce a new peculiar variant of the decryption oracle slide attack with d = 0.

On Quantum Related-Key Attacks on Iterated Even-Mansour Ciphers

The impacts that quantum computers will have on cryptography have become more and more important to study for not only public key cryptography but also symmetric key cryptography. For example, at ISITA 2012, Kuwakado and Morii showed that an adversary with a quantum computer can recover keys of the Even-Mansour construction in polynomial time by applying Simon’s algorithm. In addition, at CRYPTO 2016, Kaplan et al. showed that Simon’s algorithm can also be used to perform forgery attacks against MACs and exponentially speed-up a slide attack. This paper introduces a tool for finding the period of a function that is periodic up to constant addition and shows that a quantum adversary can use the tool to perform a related-key attack in polynomial time. Our quantum related-key attack is an extension of the quantum slide attack by Kaplan et al. against iterated Even-Mansour ciphers that are implemented on quantum circuits. Although the relationships among keys are strong, our algorithm can recover all the keys of a two-round iterated Even-Mansour cipher in polynomial time.

Decryption oracle slide attacks on T-310

ABSTRACTT-310 is an important Cold War cipher (Schmeh 2006). It was the principal encryption algorithm used to protect various state communication lines in Eastern Germany throughout the 1980s. The cipher seems to be quite robust, and until now no researcher has proposed an attack on T-310. This article studies decryption oracle and slide attacks on T-310.

HeW: AHash Function based on Lightweight Block Cipher FeW

<p class="p1">A new hash function <em>HeW: </em>A hash function based on light weight block cipher <em>FeW </em>is proposed in this paper. The compression function of <em>HeW </em>is based on block cipher <em>FeW</em>. It is believed that key expansion algorithm of block cipher slows down the performance of the overlying hash function. Thereby, block ciphers become a less favourable choice to design a compression function. As a countermeasure, we cut down the key size of <em>FeW </em>from 80-bit to 64-bit and provide a secure and efficient key expansion algorithm for the modified key size. <em>FeW </em>based compression function plays a vital role to enhance the efficiency of <em>HeW</em>. We test the hash output for randomness using the NIST statistical test suite and test the avalanche effect, bit variance and near collision resistance. We also give the security estimates of <em>HeW </em>against differential cryptanalysis, length extension attack, slide attack and rotational distinguisher.<span class="Apple-converted-space"> </span></p>

Efficient Slide Attacks

The slide attack, presented by Biryukov and Wagner, has already become a classical tool in cryptanalysis of block ciphers. While it was used to mount practical attacks on a few cryptosystems, its practical applicability is limited, as typically, its time complexity is lower bounded by $$2^n$$ (where n is the block size). There are only a few known scenarios in which the slide attack performs better than the $$2^n$$ bound. In this paper, we concentrate on efficient slide attacks, whose time complexity is less than $$2^n$$ . We present a number of new attacks that apply in scenarios in which previously known slide attacks are either inapplicable, or require at least $$2^n$$ operations. In particular, we present the first known slide attack on a Feistel construction with a 3-round self-similarity, and an attack with practical time complexity of $$2^{40}$$ on a 128-bit key variant of the GOST block cipher with unknown S-boxes. The best previously known attack on the same variant, with known S-boxes (by Courtois), has time complexity of $$2^{91}$$ .

Cryptanalysis of the XO-64 Suitable for Wireless Systems

Data-dependent operations (DDOs) that were introduced by Moldovyan in 2003 (Moldovyan in MMM-ACNS 2003, LNCS, 2776: 316---327, Springer, Heidelberg, 5; Moldovyan et al. in Int J Netw Secur 2(2):114---225, 6, in Proceedings of CCCT04, VII:123---128, 7), have been proposed as a primitive suitable for designing efficient ciphers with simple key scheduling. DDOs solve problems arising due to the weaknesses in key change process, and also the DDO-based ciphers provide a better performance with smaller hardware requirement for implementation. Along with Eagle-64 (Moldovyan et al. 7), Eagle-128 (Moldovyan et al. 6), MD-64 (Minh et al. in Int J Comput Sci Netw Secur 10(3):54---60, 15), KT-64 (Minh et al. in IJCSNS 19(1):10---18, 13) ? block ciphers are being designed, XO-64 (Minh et al. in Advanced Technologies for Communications, ATC, 409---412, 1) is a block cipher of this type which is better in terms of applicability, flexibility in fast and efficient wireless system, as well as security against known attack methods, such as slide attack and differential attack. In this paper, by applying a way of related-key attacks, we present the possibility to break the XO-64 cipher with high probability. We propose a related-key amplified boomerang attack using the differential characteristics on a 7-round reduced XO-64, requiring complexities of 244 in data, 247 bytes in memory, and 265 in computational time. This study can be considered as the first cryptographic result on XO-64.

Observing biases in the state: case studies with Trivium and Trivia-SC

One generic model of stream cipher considers updating the states and then combining the state bits to produce the key-stream. In case there are biases in the state bits, that may be reflected on the key-stream bits resulting certain weaknesses (distinguisher and/or key recovery) of the cipher. In this context, we study the state biases as well as key-stream biases with great details. We first experiment with cube testers and heuristically obtain several distinguishers for Trivium running more than 800 rounds (maximum 829) with cube sizes not exceeding 27. Further, we apply our techniques to analyze Trivia-SC (the stream cipher used in TriviA-ck AEAD scheme, selected in second round of CAESAR competition) and obtain distinguishers till 950 rounds with a cube size of 25 only. On Trivia-SC, our results refute certain claims made by the designers against both cube and slide attacks. Our detailed empirical analysis provides new results in reduced-round cryptanalysis of Trivium and Trivia-SC.

Dynamic load indicators for take-off-landing sequence in blocks and attacks of elite female volleyball players.

Dynamic loads during landings determined by the ground reaction forces (GRFs) may elaborate internal loads and increase the risk of overload knee injuries as a result of performing volleyball jumps many times. The study dealt with a biomechanical assessment of dynamic load indicators in female volleyball players for the motion sequence of take-off-landing in blocks and attacks. Twelve professional female volleyball players participated in the study. Blocks and attacks were filmed by two cameras. GRFs vs. time graphs were recorded with the use of a force platform. Values of dynamic load indicators in terms of the relations of peak of vertical component of GRF, build-up index of this force (BIF), and power output (P) during landing to the vGRF, BIF and P during take-off (L/T) were calculated. The statistically significant ( p < 0.05) highest values of L/T indicators were found for back row attack spikes: 2.4 (vGRF), 12.2 (BIF) and 3.1 (P). In the case of blocks, slide attack spikes and attack line spikes, results of these variables were in range: 1.8÷2.1, 5.9÷7.6 and 2.1÷2.9, respectively. The reduction of GRFs during landings contributes to decreasing the level of the load indicators L/T which should minimize the incidence of anterior cruciate ligament and patellar tendon injuries in female volleyball players.

Security analysis of SDDO-based block cipher for wireless sensor network

Switchable data-dependent operations (SDDOs) that were introduced by Moldovyan (MMM-ACNS 2003, LNCS, vol 2776, pp 316---327. Springer, Heidelberg, 2003), have been proposed as a primitive suitable to designing efficient ciphers with simple key scheduling. These solve the problems of the weakness of key change process, and also the SDDO-based ciphers provide a high performance with smaller hardware requirement in implementation. Since Hawk-64, MD-64 (Bac et al. in Int J Comput Sci Netw Secur 10(3):54---60, 2010), KT-64 (Minh et al. in IJCSNS 19(1):10---18, 2010) are being used have block size of 64 bits, the BMD-128 (Bac et al. in Int J Comput Netw Inf Secur 11:1---10, 2012) has extended the size of block to 128 bits, show the improvement with high applicability, flexibility in fast and highly efficient telecommunication system, and high security against most known attack methods, such as slide attack, differential attack. In this paper, however, we indicate that the BMD-128 block cipher is still possible to be exploited with the related-key differential cryptanalysis. By constructing the related-key amplified boomerang differential characteristic with high probability on a 7-round reduced BMD-128, we can propose the related-key amplified boomerang attack on it with complexities of $$2^{79}$$279 in data, $$2^{82}$$282 bytes in memory, and $$2^{129}$$2129 in computational time.