Weak Keys Research Articles

Improvement the International Data Encryption Algorithm(IDEA)based on Chaos Theory

Background: The (IDEA), which represents International Data Encryption Algorithm is a widely used cipher algorithm that has raised concerns due to the discovery of numerous weak keys, as highlighted in previous research. These weak keys, specifically those containing consecutive sequences of single digits, have been found to impede the algorithm's evolution and result in a sluggish avalanche effect. To address these vulnerabilities, this research aims to develop an enhanced and secure encryption algorithm by incorporating Chaos Theory principles into IDEA. Materials and methods: The primary objective is to address the weaknesses associated with IDEA's key generation process by leveraging Chaos Theory to generate strong, highly random keys that replace the algorithm's weak keys t. The study also aims to assess the security and cryptographic strength of the enhanced IDEA algorithm through evaluations and comparisons with the original algorithm. Results: The results showed that the proposed key passed 11 tests out of the 15 total tests, while the Traditional key of IDEA passed only 7. This indicates that the proposed method is superior by 4 tests over the Traditional method of generating keys. Also, cipher text 1 with the proposed key passed 10 tests out of the 15 total tests, while with the Traditional key passed only 8 . Conclusion: This indicates the superiority of the proposed method of IDEA in encryption over the traditional method of IDEA.

Successful cryptanalysis on RSA type modulus [formula omitted]

As internet technology advances and our interactions increasingly take place online, cryptography emerges as a valuable tool to address security concerns. Cryptography serves as a means to guarantee the protection of privacy and confidential information, thereby instilling confidence when sharing and exchanging such data with other parties. One of the benefits of cryptography is providing confidentiality, which protects our information; either data in transit or data at ease. Three new attacks have been proposed on RSA type modulus N=p2q. The equation eX−NY=Z−(p2k+q2m)Y is the basis for the first attack involves random values of k and m such that k being a multiple of 2 and m being a multiple of 3, both being integers with |p2k+q2m|<N1/2 and gcd(X,Y)=1. If Z<|p2k−q2m|3(p2k+q2m|)N1/3Y and XY<N4|p2k+q2m|, then by using continued fractions, factoring N can be accomplished within polynomial time.This paper also suggested the vulnerabilities t RSA cryptosystem moduli Ns=ps2qs for t≥2 and s=1,...,t for the second and third attack. The attacks are effective if there exists a relationship between t RSA public keys (Nt,et) expressed as esx−Nsys=zs−(ps2k+qs2m)ys or esxs−Nsy=zs−(ps2k+qs2m)y, where the variables x, xs, y, ys, and zs are sufficiently small. The importance lies in the presence of an algorithm that operates within probabilistic polynomial time, which is capable of accepting public parameters as input and yield the factors p and q as output. By employing this algorithm, one can verify whether a key falls within the vulnerable class or not. This characteristic can be valuable when designing a cryptosystem during the key generation process, as it helps prevent the inadvertent creation of weak keys.

Finding Impossible Differentials in ARX Ciphers under Weak Keys

Impossible differential cryptanalysis is very important in the field of symmetric ciphers. Currently, there are many automatic search approaches to find impossible differentials. However, these methods have two underlying assumptions: Markov cipher assumption and key independence assumption. Actually, these two assumptions are not true in ARX ciphers, especially lightweight ones. In this paper, we study the impossible differentials in ARX cipher under weak keys for the first time. Firstly, we propose several accurate difference propagation properties on consecutive two and three modular additions. Then, these properties are applied to four typical local constructions composed of two consecutive modular additions, two modular additions with a rotation operation, xoring secret key or constant in the middle, to find impossible differentials under weak keys or special constants. What’s more, we propose a more accurate difference propagation property on three consecutive modular additions. It can be used to find impossible differentials on more complex local constructions under weak keys or special constants. In practical ciphers, these impossible differentials on local constructions can be used to find contradictions. Lastly, combining our new findings with traditional automatic search methods for impossible differentials, we propose a framework to find impossible differentials in ARX ciphers under weak keys. As applications, we apply the framework to SPECK-32/64, LEA and CHAM-64/128. As a result, we find two 8-round impossible differentials for SPECK-32/64 under 260 weak keys, and one 11-round impossible differential for LEA under 2k−1 weak keys, where k is the key size. These impossible differentials can start from any round. Furthermore, we find two 22-round impossible differentials for CHAM-64/128 under 2127 weak keys starting from certain rounds. As far as we know, all these impossible differentials are longer than previous ones.

Cryptanalysis of the SHMW signature scheme

In recent research, Durandal, a signature scheme based on rank metrics following Schnorr's approach, was introduced to conceal secret key information by selectively manipulating the vector subspace of signatures. Later, an enhancement, namely the SHMW signature scheme, with smaller keys and signatures while maintaining EUF-CMA security, was proposed. Both Durandal and SHMW require adversaries to solve hard problems (i.e., Rank Support Learning, Rank Syndrome Decoding, and Affine Rank Syndrome Decoding) for secret key retrieval, in which the parameters are designed to withstand at least 128-bit computational complexity. The authors claimed that the security of the SHMW scheme is deemed superior to that of the original Durandal scheme. In this paper, we introduce a novel approach to identifying weak keys within the Durandal framework to prove the superiority of the SHMW scheme. This approach exploits the extra information in the signature to compute an intersection space that contains the secret key. Consequently, a cryptanalysis of the SHMW signature scheme was carried out to demonstrate the insecurity of the selected keys within the SHWM scheme. In particular, we proposed an algorithm to recover an extended support that contains the secret key used in the signature schemes. Applying our approach to the SHMW scheme, we can recover its secret key with only 97-bit complexity, although it was claimed that the proposed parameters achieve a 128-bit security level. The results of our proposed approaches show that the security level of the SHMW signature scheme is inferior compared to that of the original Durandal scheme.

On the weak key of post-quantum key agreement SAA-5

On the weak key of post-quantum key agreement SAA-5

MILP‐based security evaluation for AEGIS/Tiaoxin‐346/Rocca

AbstractIn this paper, the security of Advanced Encryption Standard‐based authenticated encryption schemes, including AEGIS family, Tiaoxin‐346, and Rocca by mixed integer linear programming tools is examined. Specifically, for the initialisation phase of AEGIS, Tiaoxin‐346, and Rocca, the security against differential attacks and integral attacks is evaluated by estimating the lower bounds for the number of active S‐boxes and utilising division property, respectively. In addition to the estimations of initialisation phases, the security of the encryption phases of AEGIS, Tiaoxin‐346, and Rocca against distinguishing attacks on keystream is evaluated by exploiting integral properties. As a result, the authors show that the initialisation phases of AEGIS‐128/128L/256, Tiaoxin‐346, and Rocca are secure against differential attacks after 4/3/6, 5, and 6 rounds, respectively. Regarding integral attacks, the distinguisher is found on 6/6/7, 15, and 7 rounds in the initialisation phases of AEGIS‐128/128L/256, Tiaoxin‐346, and Rocca, respectively. Additionally, the integral distinguisher is presented on 2/2/4, 4, and 4 rounds in the encryption phases of AEGIS‐128/128L/256, Tiaoxin‐346, and Rocca, respectively. As far as it is known, this study’s results are the first distinguishing attacks on the keystream on AEGIS, Tiaoxin‐346, and Rocca without relying on weak keys.

A novel conservative chaos driven dynamic DNA coding for image encryption

Recently, many image encryption algorithms based on hybrid DNA and chaos have been developed. Most of these algorithms utilize chaotic systems exhibiting dissipative dynamics and periodic windows/patterns in the bifurcation diagrams along with co-existing attractors in the neighborhoods of parameter space. Therefore, such algorithms generate several weak keys, thereby making them prone to various chaos- specific attacks. In this paper, we propose a novel conservative chaotic standard map-driven dynamic DNA coding (encoding, addition, subtraction and decoding) for image encryption. It is the first hybrid DNA and conservative chaos-based image encryption algorithm having effectively infinite key space. The proposed image encryption algorithm is a dynamic DNA coding algorithm i.e., for the encryption of each pixel different rules for encoding, addition/subtraction, decoding etc. are randomly selected based on the pseudorandom sequences generated with the help of the conservative chaotic standard map. We propose a novel way to generate pseudo-random sequences through the conservative chaotic standard map and also test them rigorously through the most stringent test suite of pseudo-randomness, the NIST test suite, before using them in the proposed image encryption algorithm. Our image encryption algorithm incorporates unique feed-forward and feedback mechanisms to generate and modify the dynamic one-time pixels that are further used for the encryption of each pixel of the plain image, therefore, bringing in the desired sensitivity on plaintext as well as ciphertext. All the controlling pseudorandom sequences used in the algorithm are generated for a different value of the parameter (part of the secret key) with inter-dependency through the iterates of the chaotic map (in the generation process) and therefore possess extreme key sensitivity too. The performance and security analysis has been executed extensively through histogram analysis, correlation analysis, information entropy analysis, DNA sequence-based analysis, perceptual quality analysis, key sensitivity analysis, plaintext sensitivity analysis, classical attack analysis, etc. The results are promising and prove the robustness of the algorithm against various common cryptanalytic attacks.

An evaluation of the RSA private keys and the presence of weak keys

Numerous applications that rely on asymmetric cryptography use the RSA algorithm. It can be applied to digital signatures and the encryption of sensitive data. The secure storage of the private key is essential for the algorithm’s strength. Finding ways to use factorization or other heuristics to determine the value of the private key, was the goal of several academic efforts. Both the Euler totient and the Carmichael functions are used in this study to analyze the private key properties and demonstrate the existence of many private keys for the same public key. We further demonstrate that a universal private key that complies with the FIPS standard exists. Moreover, by taking advantage of a condition imposed by FIPS recommendations, we present a new method for attacking the RSA modulus (N).

Best Fit DNA-Based Cryptographic Keys: The Genetic Algorithm Approach.

DNA (Deoxyribonucleic Acid) Cryptography has revolutionized information security by combining rigorous biological and mathematical concepts to encode original information in terms of a DNA sequence. Such schemes are crucially dependent on corresponding DNA-based cryptographic keys. However, owing to the redundancy or observable patterns, some of the keys are rendered weak as they are prone to intrusions. This paper proposes a Genetic Algorithm inspired method to strengthen weak keys obtained from Random DNA-based Key Generators instead of completely discarding them. Fitness functions and the application of genetic operators have been chosen and modified to suit DNA cryptography fundamentals in contrast to fitness functions for traditional cryptographic schemes. The crossover and mutation rates are reducing with each new population as more keys are passing fitness tests and need not be strengthened. Moreover, with the increasing size of the initial key population, the key space is getting highly exhaustive and less prone to Brute Force attacks. The paper demonstrates that out of an initial 25 × 25 population of DNA Keys, 14 keys are rendered weak. Complete results and calculations of how each weak key can be strengthened by generating 4 new populations are illustrated. The analysis of the proposed scheme for different initial populations shows that a maximum of 8 new populations has to be generated to strengthen all 500 weak keys of a 500 × 500 initial population.

New Cryptanalysis of ZUC-256 Initialization Using Modular Differences

ZUC-256 is a stream cipher designed for 5G applications by the ZUC team. Together with AES-256 and SNOW-V, it is currently being under evaluation for standardized algorithms in 5G mobile telecommunications by Security Algorithms Group of Experts (SAGE). A notable feature of the round update function of ZUC-256 is that many operations are defined over different fields, which significantly increases the difficulty to analyze the algorithm.As a main contribution, with the tools of the modular difference, signed difference and XOR difference, we develop new techniques to carefully control the interactions between these operations defined over different fields. At first glance, our techniques are somewhat similar to those developed by Wang et al. for the MD-SHA hash family. However, as ZUC-256 is quite different from the MD-SHA hash family and its round function is much more complex, we are indeed dealing with different problems and overcoming new obstacles.As main results, by utilizing complex input differences, we can present the first distinguishing attacks on 31 out of 33 rounds of ZUC-256 and 30 out of 33 rounds of the new version of ZUC-256 called ZUC-256-v2 with low time and data complexities, respectively. These attacks target the initialization phase and work in the related-key model with weak keys. Moreover, with a novel IV-correcting technique, we show how to efficiently recover at least 16 key bits for 15-round ZUC-256 and 14-round ZUC-256-v2 in the related-key setting, respectively. It is unpredictable whether our attacks can be further extended to more rounds with more advanced techniques. Based on the current attacks, we believe that the full 33 initialization rounds provide marginal security.

Row, Row, Row Your Boat: How to Not Find Weak Keys in Pilsung

Abstract The Pilsung cipher is part of the North Korean Red Star operating system, which was leaked to the West in 2014. Initial analysis by Kryptos Logic reported a possibility of a class of weak keys due to the use of pseudo-random diffusion. Following this lead, we analyzed the cipher and identified a small class of such weak keys. We developed techniques for searching for a key that belongs to the class. After spending thousands of CPU hours, we found a supposedly weak key for a slightly weaker version of Pilsung, but the key did not behave as we expected. On further investigation we found out a crucial misunderstanding in a critical part of the cipher and that no such class of weak keys exists in Pilsung. Thus, this paper makes two main contributions to the art of cryptanalysis. First, it identifies and shows how to investigate a potential weakness in randomizing diffusion, which although does not exist in Pilsung, may affect future designs. Second, it highlights the need for early verification of results in order to identify errors before expending significant resources.

Improved rotational‐XOR cryptanalysis of Simon‐like block ciphers

Rotational-XOR (RX) cryptanalysis is a cryptanalytic method aimed at finding distinguishable statistical properties in Addition-Rotation-XOR-C ciphers, that is, ciphers that can be described only by using modular addition, cyclic rotation, XOR and the injection of constants. In this study, we extend RX-cryptanalysis to AND-RX ciphers, a similar design paradigm where the modular addition is replaced by vectorial bitwise AND; such ciphers include the block cipher families Simon and Simeck. We analyse the propagation of RX-differences through AND-RX rounds and develop a closed form formula for their expected probability. Inspired by the MILP verification model proposed by Sadeghi et al., we develop a SAT/SMT model for searching compatible RX-characteristics in Simon-like ciphers, that is, that there is at least one right pair of messages/keys to satisfy the RK-characteristics. To the best of our knowledge, this is the first model that takes the RX-difference transitions and value transitions simultaneously into account in Simon-like ciphers. Meanwhile, we investigate how the choice of the round constants affects the resistance of Simon-like ciphers against RX-cryptanalysis. Finally, we show how to use an RX-distinguisher for a key recovery attack. Evaluating our model we find compatible RX-characteristics of up to 20, 27 and 34 rounds with respective probabilities of 2−26, 2−44 and 2−56 for versions of Simeck with block sizes of 32, 48 and 64 bits, respectively, for large classes of weak keys in the related-key model. In most cases, these are the longest published distinguishers for the respective variants of Simeck. In the case of Simon, we present compatible RX-characteristics for round-reduced versions of all 10 instances. We observe that for equal block and key sizes, the RX-distinguishers cover fewer rounds in Simon than in Simeck. Concluding the paper, we present a key recovery attack on Simeck 64 reduced to 28 rounds using a 23-round RX-characteristic.

Weak Tweak-Keys for the CRAFT Block Cipher

CRAFT is a lightweight tweakable Substitution-Permutation-Network (SPN) block cipher optimized for efficient protection of its implementations against Differential Fault Analysis (DFA) attacks. In this paper, we present an equivalent description of CRAFT up to a simple mapping on the plaintext, ciphertext and round tweakeys. We show that the new representation, for a sub-class of keys, leads to a new structure which is a Feistel network, with non-linear operation and key addition only on half the state. Consequently, it reveals a class of weak keys for which CRAFT is less resistant against differential and linear cryptanalyses. As a result, we present one weak-key single-tweak differential attack on 23 rounds (with time complexity of 294 encryptions and data complexity of 274 chosen plaintext/tweak/ciphertext tuples and works for 2112 weak keys) and one weak-key related-tweak attack on 26 rounds of the cipher (with time complexity of 2105 encryptions and data complexity 273 chosen plaintext/tweak/ciphertext tuples and works for 2108 weak keys). Note that these attacks do not break the security claim of the CRAFT block cipher.

Report on the First DES Fixed Points for Non-Weak Keys: Case-Study of Hacking an IoT Environment

Fixed points can be defined as <i>E_K</i>(<i>P</i>) = <i>P</i> for a key <i>K</i> and plaintext <i>P</i> where <i>E</i> is the encryption function. For the Data Encryption Standard (DES) algorithm there are four weak keys, such that <i>E_K</i>(<i>E_K</i>(<i>P</i>)) = <i>P</i> for all <i>P</i>. For each weak key there are 2³² fixed points where all the sixteen round keys are the same. While there is a high probability that DES has fixed points for non-weak keys, nobody has reported such (<i>P,K</i>) pairs until now. Performing 1000 &#x00D7; 2⁵⁶ DES encryption operations using 256 Xlinix Spartan-6 parallel cost-effective FPGAs we answer the question of Judy H. Moore and Gustavus J. Simmons: we report the first known DES fixed points where all round keys are different. A case study is presented where an IoT based Sensor Device Authentication Algorithm (<i>SDAA</i>) can be exploited using DES fixed points.

Diving Deep into the Weak Keys of Round Reduced Ascon

At ToSC 2021, Rohit et al. presented the first distinguishing and key recovery attacks on 7 rounds Ascon without violating the designer’s security claims of nonce-respecting setting and data limit of 264 blocks per key. So far, these are the best attacks on 7 rounds Ascon. However, the distinguishers require (impractical) 260 data while the data complexity of key recovery attacks exactly equals 264. Whether there are any practical distinguishers and key recovery attacks (with data less than 264) on 7 rounds Ascon is still an open problem.In this work, we give positive answers to these questions by providing a comprehensive security analysis of Ascon in the weak key setting. Our first major result is the 7-round cube distinguishers with complexities 246 and 233 which work for 282 and 263 keys, respectively. Notably, we show that such weak keys exist for any choice (out of 64) of 46 and 33 specifically chosen nonce variables. In addition, we improve the data complexities of existing distinguishers for 5, 6 and 7 rounds by a factor of 28, 216 and 227, respectively. Our second contribution is a new theoretical framework for weak keys of Ascon which is solely based on the algebraic degree. Based on our construction, we identify 2127.99, 2127.97 and 2116.34 weak keys (out of 2128) for 5, 6 and 7 rounds, respectively. Next, we present two key recovery attacks on 7 rounds with different attack complexities. The best attack can recover the secret key with 263 data, 269 bits of memory and 2115.2 time. Our attacks are far from threatening the security of full 12 rounds Ascon, but we expect that they provide new insights into Ascon’s security.

Information Transmission Scheme between Train and RBC Based on AES-ECC Algorithm

The existing information encryption scheme between the Radio Block Center (RBC) and the ground has problems such as weak keys, and the vehicle-ground information has a potential threat of being stolen. In order to ensure the safety of driving, on the basis of ensuring the correct transmission of train and ground information, research on more efficient encryption schemes has become the focus of work. In response to this trend, a hybrid encryption scheme based on AES and ECC encryption algorithms is proposed. The AES algorithm replaces the original 3DES algorithm, and the elliptic curve encryption algorithm ECC is used to encrypt the session key to improve the encryption security level. The encryption simulation, avalanche effect verification and execution efficiency test of fixed-length data are completed on Visual Stduio 2013 platform, and compared with the original encryption scheme. The results show that the scheme can meet the avalanche effect and the accuracy of data transmission, and it takes less time than the original encryption scheme, and is more suitable for two-way large-capacity information transmission between vehicles and ground.

Selection of Sampling Keys for Cryptographic Tests

Abstract The keys of modern cryptographic algorithms have an enormous size, so the testing of the algorithm performance for all key combinations, will take practically an infinite time. To avoid this, the sampling method is used, where a much smaller number of keys is tested and then the estimation of the algorithm performance for all the keys is calculated with a predetermined sampling error. For each sampling key, an output sample of the algorithm must be generated and tested. Therefore, in order to have sampling results as close as possible to the real performance of the algorithm, the key question is whether the selection of the keys should be random or it must follow some rules. If the selection of the keys is completely random, there is a high probability that the tests will not find some "weak" or "equivalent" keys, which give non-random or similar outputs and therefore reduce the total number of active keys. But if the sampling keys are selected with some specific criteria, there is a much greater probability of detecting any weak or equivalent key. In this study an optimal key selection methodology is proposed, which combines the random and the non-random key selection. Keywords: Cryptography, Data encryption, Communication security, Computer security, Data security, Information security.

Weak Keys in Reduced AEGIS and Tiaoxin

AEGIS-128 and Tiaoxin-346 (Tiaoxin for short) are two AES-based primitives submitted to the CAESAR competition. Among them, AEGIS-128 has been selected in the final portfolio for high-performance applications, while Tiaoxin is a third-round candidate. Although both primitives adopt a stream cipher based design, they are quite different from the well-known bit-oriented stream ciphers like Trivium and the Grain family. Their common feature consists in the round update function, where the state is divided into several 128-bit words and each word has the option to pass through an AES round or not. During the 6-year CAESAR competition, it is surprising that for both primitives there is no third-party cryptanalysis of the initialization phase. Due to the similarities in both primitives, we are motivated to investigate whether there is a common way to evaluate the security of their initialization phases. Our technical contribution is to write the expressions of the internal states in terms of the nonce and the key by treating a 128-bit word as a unit and then carefully study how to simplify these expressions by adding proper conditions. As a result, we find that there are several groups of weak keys with 296 keys each in 5-round AEGIS-128 and 8-round Tiaoxin, which allows us to construct integral distinguishers with time complexity 232 and data complexity 232. Based on the distinguisher, the time complexity to recover the weak key is 272 for 5-round AEGIS-128. However, the weak key recovery attack on 8-round Tiaoxin will require the usage of a weak constant occurring with probability 2−32. All the attacks reach half of the total number of initialization rounds. We expect that this work can advance the understanding of the designs similar to AEGIS and Tiaoxin.

Accounting Data Encryption Processing Based on Data Encryption Standard Algorithm

With the application of computer and network technology in the field of accounting, the development of accounting informationization is an inevitable trend, and the construction of accounting statement data into the data warehouse will be the basis of intelligent decision-making. The complexity of industry accounting statements and the arbitrariness and diversity of users’ needs for obtaining information using statements limit the development, popularization, and application of industry accounting statements. As a block encryption algorithm, the Data Encryption Standard (DES) algorithm uses 64-bit packet data for encryption and decryption. Each eighth bit of the key is used as a parity bit; that is, the actual key length is 56 bits. Encryption and decryption use the same algorithm structure, but the order in which the subkeys are used is reversed. Under the control of the subkey, inputting 64-bit plaintext can produce 64-bit ciphertext output; otherwise, inputting 64-bit ciphertext can produce 64-bit plaintext output. The confidentiality of the DES algorithm depends on the key, and only a very small number of keys are considered weak keys, which can be easily avoided in practical applications. The 3DES algorithm is a cascade of the DES algorithm, and its encryption process is based on the DES algorithm principle. This article explains the encryption process of the DES algorithm and introduces the composition of the 3DES algorithm. The experimental results show that the 3DES encryption algorithm still has a better encryption effect and “avalanche effect” than before the improvement. In addition, for the 3DES algorithm, its encryption efficiency has not been greatly affected. The 3DES encryption algorithm achieves one encryption process at a time to some extent, can effectively resist exhaustive search attacks, and enhance the security of the DES algorithm.

Observations on the Security of COMET

Abstract This paper investigates the security of counter mode encryption with authentication tag (COMET), one of the 32 second-round candidates in National Institute of Standards and Technology’s lightweight cryptography standardization process, against differential cryptanalysis. CHAM-64/128 is a block cipher chosen as one of the underlying block ciphers in COMET for hardware-oriented applications, and a differential characteristic with a high probability for CHAM-64/128 is useful for forgery attacks on COMET. However, we find that the optimal $\mathbf{39}$-round differential characteristic for CHAM-64/128 proposed by Roh et al., which is the longest differential characteristic of CHAM-64/128, is invalid. Then, we propose a new method of distinguishing an $\mathbf{m}$-bit block cipher from an $\mathbf{m}$-bit random permutation using a differential characteristic with a probability not higher than $\mathbf{2^{-m}}$. Using our method, we use two $\mathbf{39}$-round differential characteristics with a probability of $\mathbf{2^{-64}}$ for CHAM-64/128 to distinguish $\mathbf{39}$-round-reduced CHAM-64/128 from a $\mathbf{64}$-bit random permutation, respectively. Furthermore, we refine the probabilities of two differentials with the same input and output differential masks as the two $\mathbf{39}$-round differential characteristics, respectively. Finally, we present the first forgery attacks on COMET with the two differentials without using weak keys. Our forgery attacks follow the nonce-misuse scenario. It should be noticed that this attack does not invalidate the security claims of the designers.