Search

This paper analyzes the subspace trail of Midori-64 and uses the propagation law and mutual relationship of the subspaces of Midori-64 to provide a 6-round Midori-64 subspace trail-based impossible differential key recovery attack. The data complexity of the attack is 2 54.6 chosen plaintexts, and the computational complexity is 2 58.2 lookup operations. Its overall complexity is less than that of the known 6-round truncated impossible differential distinguisher. This distinguisher is also applicable to Midori-128 with a secret S -box. Additionally, utilizing the properties of subspaces, we prove that a subspace trail-based impossible differential distinguisher of Midori-64 contains at most 7 rounds. This is 1 more than the upper bound of Midori-64’s truncated impossible differential distinguisher which is 6. According to the Hamming weights of the starting and ending subspaces, we classify all 7-round Midori-64 subspace trail-based impossible differential distinguishers into two types and they need 2 59.6 and 2 51.4 chosen plaintexts, respectively.

Salsa and ChaCha are two of the most well-known stream ciphers in last two decades. These two ciphers came into the picture when a massively used cipher RC4 was going through severe cryptanalysis and a significant number of observed weaknesses of it showed the requirement of new stream ciphers in the market. Later, ChaCha was adopted by Google as their encryption algorithm, which further increased the importance of research work on these two ciphers. Salsa and ChaCha have gone through differential key recovery attack up to the 8-th and 7-th round respectively. Initially, this attack used an experimentally observed distinguisher by observing a single bit position up to the 4th round for Salsa and 3rd round for ChaCha. Later, Maitra (2016) improved the attack complexity by minimizing the propagation of the difference after the first round using properly chosen IV values. Also, using this distinguisher, Choudhuri et al. (FSE 2016) provided a technique to construct a distinguisher for the next round of both the ciphers by observing multiple bits. Among all these attacks which were mostly based on experimental observations, theoretical works did not get much importance for these two ciphers. In this paper, we aim to theoretically investigate the reason behind these experimentally observed distinguishers for these chosen IV distinguishers, where the difference propagation is minimized up to the first round. We provide a mathematical proof of the observed probabilities for the distinguishers of both the ciphers in the single and multiple bits.

We propose an attack on the recent attempt by Li, Xing and Yeo to produce a code-based signature scheme using the Schnorr-Lyubashevsky approach in the Hamming metric, and verify its effectiveness through numerical simulations. Differently from other (unsuccessful) proposals, this new scheme exploits rejection sampling along with dense noise vectors to hide the secret key structure in produced signatures. We show that these measures, besides yielding very slow signing times and rather long signatures, do not succeed in protecting the secret key. We are indeed able to prove the existence of a strong correlation between produced signatures, which ultimately leaks information about the secret key. To support this claim, we use both theoretical arguments and numerical evidences. Finally, we employ such a weakness to mount a full key recovery attack, which is able to recover the secret key after the observation of a bunch of signatures. Our results show that the considered scheme may be secure only for one-time usage.

When analyzing a block cipher, the first step is to search for some valid distinguishers, for example, the differential trails in the differential cryptanalysis and the linear trails in the linear cryptanalysis. A distinguisher is advantageous if it can be utilized to attack more rounds and the amount of the involved key bits during the key-recovery process is small, as this leads to a long attack with a low complexity. In this article, we propose a two-step strategy to search for such advantageous distinguishers. This strategy is inspired by the intuition that if a differential is advantageous only when some properties are satisfied, then we can predefine some constraints describing these properties and search for the differentials in the small set.As applications, our strategy is used to analyze GIFT-128, which was proposed in CHES 2017. Based on some 20-round differentials, we give the first 27-round differential attack on GIFT-128, which covers one more round than the best previous result. Also, based on two 17-round linear trails, we give the first linear hull attack on GIFT-128, which covers 22 rounds. In addition, we also give some results on two GIFT-128 based AEADs GIFT-COFB and SUNDAE-GIFT.

In this study, the authors take advantage of feeding the SMT solver by extra information provided through middle state cube characteristics to introduce a new method which they call SMT-based cube attack, and apply it to improve the success of the solver in attacking reduced-round versions of Simeck32/64 lightweight block cipher. The key idea is to search for and utilise all found middle state characteristics of a cube at one round of attack. They first propose a new algorithm to find cubes with most number of middle state characteristics. Then, they apply these obtained cubes and their characteristics as extra information in the SMT definition of the cryptanalysis problem, to evaluate its effectiveness. Their cryptanalysis results in a full key recovery attack by 64 plaintext/ciphertext pairs on 12 rounds of the cipher in just 122.17 s. This is the first algebraic attack so far presented against the reduced-round versions of Simeck32/64, and also with practical complexities. They also conduct the cube attack on the Simeck32/64 to compare with the SMT-based cube attack. The results indicate that the proposed attack is more powerful than the cube attack.

Digital signature schemes have been extensively studied in the literature, where a large number of such schemes with different properties have been designed for different applications. For example, identity-based signature (IBS) schemes can efficiently map a user’s digital public key to his/her real-world identity (e.g., e-mail address). However, existing implementations of IBS schemes are not generally designed for white-box security (WBS), particularly concerning the protection of the private key when special attackers have full access to the execution environment. Therefore, in this paper, we propose the first white-box implementation for the classical Shamir’s IBS scheme. The basic idea is to utilize a mathematical transformation for embedding private key into some special tables, such that the original private key could be “invisible” during the execution process. We then analyze the security requirements achieved in our implementation, including the conventional black-box security under the random oracle model and WBS (e.g., key recovery attack resilience). This is the first IBS scheme implementation that satisfies WBS. It is also shown from the simulation that the implementation incurs a constant computational cost, which is realistic in deployments where a high security level is required.

Salsa and ChaCha are two of the most famous stream ciphers in recent times. Most of the attacks available so far against these two ciphers are differential attacks, where a difference is given as an input in the initial state of the cipher and in the output some correlation is investigated. This correlation works as a distinguisher. All the key recovery attacks against these ciphers are based on these observed distinguishers. However, the distinguisher in the differential attack was purely an experimental observation, and the reason for this bias was unknown so far. In this paper, we provide a full theoretical proof of both the observed distinguishers for Salsa and ChaCha. In the key recovery attack, the idea of probabilistically neutral bit also plays a vital role. Here, we also theoretically explain the reason of a particular key bit of Salsa to be probabilistically neutral. This is the first attempt to provide a theoretical justification of the idea of differential key recovery attack against these two ciphers.

Multivariate quadratic (MQ) equations-based cryptography is one of the most promising alternatives for currently used public-key cryptographic algorithms in the post-quantum era. It is important to design practical public-key signature schemes on embedded processors and resource-constrained devices for emerging applications in Internet of Things. The MQ-signature schemes are suitable for low-cost constrained devices since they require only modest computational resources. In this paper, we propose an efficient MQ-signature scheme, SOV, using sparse polynomials with a shorter secret key and give its security analysis against known algebraic attacks. Compared to Rainbow, the secret key of SOV has reduced by a factor of 90% without increasing the public key size. In particular, SOV requires signatures of 52 bytes, while ECDSA-256 requires signatures of 64 bytes.

International audience; This article discusses the security of McEliece-like encryption schemes using subspace subcodes of Reed-Solomon codes, i.e. subcodes of Reed-Solomon codes over $\mathbb{F}_{q^m}$ whose entries lie in a fixed collection of $\mathbb{F}_q$-subspaces of $\mathbb{F}_{q^m}$. These codes appear to be a natural generalisation of Goppa and alternant codes and provide a broader flexibility in designing code based encryption schemes. For the security analysis, we introduce a new operation on codes called the twisted product which yields a polynomial time distinguisher on such subspace subcodes as soon as the chosen $\mathbb{F}_q$-subspaces have dimension larger than $m/2$. From this distinguisher, we build an efficient attack which in particular breaks some parameters of a recent proposal due to Khathuria, Rosenthal and Weger.

The article shows the method on how to improve encryption algorithm in MST3 cryptosystem for the generalized Suzuki 2 - groups. The well-known MST cryptosystem based on Suzuki groups is built on a logarithmic signature (LS) at the center of the group, resulting in a large array of logarithmic signatures. An encryption scheme based on multi-parameter noncommutative groups is proposed. The multi-parameter generalized Suzuki 2 - groups are chosen as one of the group constructions. In this case, the logarithmic signature is established for the entire group, and the secrecy of the cipher depends on the order in the group. This design allows encryption to be built that is optimized for implementation costs, which are determined by the size of the logarithmic signature and secrecy, which is dependent on the size of the keys and the final field of group representation. The main difference between the presented encryption implementation lies in the step-by-step de-encapsulation of the key from the ciphertext and associated keys using logarithmic signatures. The complexity of a key recovery attack for evaluating the secrecy of a cipher is determined by enumerating all keys using an enumeration method.

In this paper we introduce the strictly zero-correlation attack. We extend the work of Ashur and Posteuca in BalkanCryptSec 2018 and build a 0-correlation key-dependent linear trail covering the full DES. We show how this approximation can be used for a key recovery attack and empirically verify our claims through a series of experiments. To the best of our knowledge, this paper is the first to use this kind of property to leverage a meaningful attack against a symmetric-key algorithm. ispartof: pages:448-467 ispartof: Security and Cryptography for Networks. SCN 2020 vol:12238 pages:448-467 ispartof: Security and Cryptography for Networks. SCN 2020. location:Amalfi, Italy date:14 Sep - 16 Sep 2020 status: published

The quantum security of lightweight block ciphers is receiving more and more attention. However, the existing quantum attacks on lightweight block ciphers only focused on the quantum exhaustive search, while the quantum attacks combined with classical cryptanalysis methods haven’t been well studied. In this paper, we study quantum key recovery attack on SIMON32/64 using Quantum Amplitude Amplification algorithm in Q1 model. At first, we reanalyze the quantum circuit complexity of quantum exhaustive search on SIMON32/64. We estimate the Clifford gates count more accurately and reduce the T gate count. Also, the T-depth and full depth is reduced due to our minor modifications. Then, using four differentials given by Biryukov in FSE 2014 as our distinguisher, we give our quantum key recovery attack on 19-round SIMON32/64. We treat the two phases of key recovery attack as two QAA instances separately, and the first QAA instance consists of four sub-QAA instances. Then, we design the quantum circuit of these two QAA instances and estimate their corresponding quantum circuit complexity. We conclude that the quantum circuit of our quantum key recovery attack is lower than quantum exhaustive search. Our work firstly studies the quantum dedicated attack on SIMON32/64. And this is the first work to study the complexity of quantum dedicated attacks from the perspective of quantum circuit complexity, which is a more fine-grained analysis of quantum dedicated attacks’ complexity.

Algorithms for secure encryption in a post-quantum world are currently receiving a lot of attention in the research community. One of the most promising such algorithms is the code-based scheme called QC-MDPC, which has excellent performance and a small public key size. In this paper, we present a very efficient key recovery attack on the QC-MDPC scheme using the fact that decryption uses an iterative decoding step, and this can fail with some small probability. We identify a dependence between the secret key and the failure in decoding. This can be used to build what we refer to as a distance spectrum for the secret key, which is the set of all distances between any two ones in the secret key. In a reconstruction step, we then determine the secret key from the distance spectrum. The attack has been implemented and tested on a proposed instance of QC-MDPC for 80-bit security. It successfully recovers the secret key in minutes. A slightly modified version of the attack can be applied on proposed versions of the QC-MDPC scheme that provides IND-CCA security. The attack is a bit more complex in this case, but still very much below the security level. The reason why we can break schemes with proved CCA security is that the model for these proofs typically does not include the decoding error possibility. At last, we present several algorithms for key reconstruction from an empirical distance spectrum. We first improve the naive algorithm for key reconstruction by a factor of about 3 0000, when the parameters for 80-bit security are implemented. We further develop the algorithm to deal with errors in the distance spectrum. This ultimately reduces the requirement on the number of ciphertexts that need to be collected for a successful key recovery.

Midori is a family of lightweight block ciphers presented by Banik et al . at Asiacrypt 2015. Biclique cryptanalysis is a typical key-recovery attack that is proposed to attack the full AES by Bogdanov et al . in ASIACRYPT 2011. The method can attack a great deal of ciphers utilising the main idea of MITM attack and the basic principle of the biclique structure. In this study, the authors first provide an unbalanced biclique attack on full round Midori with partial matching and precomputation. They demonstrate that full round Midori64/128 are not secure against unbalanced biclique attacks. They construct a five-round 4×8 unbalanced biclique on Midori64, with data complexity of 2 36 and time complexity of 2 126.25 by investigating the simple key schedule and the encryption structure. Furthermore, they present a four-round 8×16 unbalanced biclique on Midori128 with data complexity of 2 72 and computational complexity of 2 126.91 . To the best of authors' knowledge, the result is the best single-key cryptanalytic result of Midori.

Due to the limited computation and memory capabilities of the identification tags, RFID systems are susceptible to various attacks. In 2014, a lightweight mutual authentication RFID protocol that supports key update was proposed by Qian et al., and it was claimed to be secure against several known attacks. In this paper, however, we show that their protocol cannot resist key recovery attack, where an adversary, after interacting with the tag several times, can recover the authentication keys of the system in polynomial time with non-negligible probability. Additionally, we also prove that their protocol cannot provide strong backward security or strong forward security: an adversary who has compromised some continuous authentication keys, can successfully recover all the future authentication keys and some of the previous authentication keys, which completely breaks the security of the authentication protocol. We then propose a new protocol which provides key recovery resilience, both strong backward security and strong forward security, and also resistance against various known types of attacks.

In this paper, we study the relation of related-tweak/key impossible differentials with single-key ones. Following a heuristic strategy, we can derive longer related-tweak/key impossible differentials from single-key ones. We implement this strategy with the MILP technique and apply it to search related-tweak/key impossible differentials of two tweakable block ciphers: QARMA-64 and Joltik-BC-128. For QARMA-64, we find several 7-round related-tweak impossible differential distinguishers and use them to mount a 10-round key recovery attack including the outer whitening key; for Joltik-BC-128, we find two 6-round related-tweakey impossible differential distinguishers and use them attack 9-round and 10-round Joltik-BC-128 respectively.

GIFT is a lightweight block cipher that was proposed by Banik et al. at CHES 2017, which is said to be a direct improvement over PRESENT since “that provides a much increased efficiency in all domains (smaller and faster)” and improves the security weaknesses of the latter. At Asiacrypt in 2014, Sun et al. introduced a bit-oriented mixed integer linear programming (MILP) method to search for the differential characteristics of block ciphers. In this paper, we use the differential cryptanalysis method based on this automated tool to analyse GIFT. We propose 12-round and 13-round related-key differential characteristics of GIFT- 64 and 7-round and 10-round related-key differential characteristics of GIFT- 128. By using them as distinguishers, we apply key recovery attacks on the 19-round and 20-round reduced GIFT-64 with data complexities of 247 and 256 plaintexts, respectively, which mean that the data complexities are lower. Furthermore, we improve the GIFT-64 key recovery attack using differential cryptanalysis by one round over the previous differential cryptanalysis.

In this paper, we present improved meet-in-the-middle key-recovery attacks on six-round and seven-round Feistel constructions separately. The attacks are based on Guo et al. ’s work which appends one round to the five-round distinguisher to attack the six-round Feistel construction through the meet-in-the-middle method. The proposed method stores only target sequences instead of all the possible sequences, which reduces the memory complexity from ${2^{({3}/{4})n}}$ blocks to ${2^{({n}/{2})}}$ blocks. A new key-recovery attack method on the seven-round Feistel construction is proposed by appending one another round after a five-round distinguisher. What is more, is that we propose a new method called the impossible-differential pairs sieve technique which reduces the data complexity from ${2^{n}}$ chosen plaintexts to $3\times {2^{n-2}}$ chosen plaintexts so that the attack complexity is lower than the exhaustive attack. The time complexity is equivalent to about $3\times {2^{n-2}}$ encryptions, and the memory complexity is optimized to ${2^{({3}/{4})n}}$ blocks of ${2^{({n}/{2})}}$ bits. To the best of our knowledge, it is the first known generic key-recovery attack on the seven-round Feistel construction with a lower attack complexity when compared with the exhaustive attack.

In 2018, an attack named fast-near-collision attack (FNCA) was proposed, which is an improved version of near-collision attack (NCA) on Grain-v1, one of the three hardware-oriented finalists of the eSTREAM project. FNCA is designed as a key recovery attack and takes a divide-and-conquer strategy that needs a merging phase. We propose an improved FNCA where the merging phase is optimized by a linear programming based strategy. It decreases the candidates of the internal state vectors (ISVs) in each step of merging and has a reduction in the overall time complexity. Since the merging phase is vital for a divide-and-conquer strategy, where the most of bits of the full internal state are recovered, other analyses on Grain family with FNCA can get optimized by our method in varying degrees. This paper offers an experiment on a reduced Grain and a theoretical analysis on Grain-v1 to confirm the results. In the case of the reduced Grain of an 80-bit internal state, the time complexity is 237.1096, which has a 27.8% reduction. For Grain-v1, its theoretical time complexity is around 273.4, which is reduced by 79.4% compared with the original one.

The article describes an improved implementation of the encryption scheme based on the automorphism group of Ree function field. Our proposal is to use the Ree function field automorphism group to encrypt the whole group with key bindings. We extended the logarithmic signature to the entire group and got changed the encryption algorithm to protect against a sequential key recovery attack.

Simon’s algorithm is a well-known quantum algorithm which can achieve an exponential acceleration over classical algorithm. It has been widely used in quantum cryptanalysis of many cryptographic primitives. This paper concentrates on studying the applications of Simon’s algorithm in analyzing the security of Feistel variants, several well-known cryptographic structures derived from the Feistel structure. First, we propose a definition of weakly periodic function to relax the original strong Simon’s promise. Based on this definition, we define and analyze several extensions of Simon’s problem which expand the application of Simon’s algorithm. Furthermore, based on one extended Simon’s problem, we show new polynomial-time quantum distinguishing attacks on several Feistel variants: MISTY L/R, CAST256-like, CLEFIA-like, MARS-like, SMS4-like and Skipjack-A/B-like schemes. These new results show that classically secure schemes may be no longer secure in the Q2 model. Finally, based on the quantum distinguishers introduced above, we extend several rounds forward or backward to propose corresponding quantum all subkeys recovery attacks that can recover all subkeys in the Q2 model with lower query complexities than those in the Q1 model by using Grover’s algorithm.

The Internet of Things (IoT) is one of the growing digital applications in modern times. With the increase of the application of IoT in the fields of networked mobile robotics, Smart Grid, etc., the concern about the security protocols also rises along with it. Cybersecurity is one of the most important network security protocols for the safety of IoT-enabled devices as all the devices are connected and inter-exchanging various data over the internet. Various encryption algorithms for securing data in cybersecurity management are already in existence. RSA, ECC, and other existing encryption algorithms are frequently used in various fields of IoT applications such, however, they have many shortcomings. Among the existing algorithm, AES is one of the best algorithms because it can provide an excellent level of security and its encryption speed is much faster than others. But AES is vulnerable to Key Recovery Attack. In order to overcome this shortcoming and to provide a more secured security protocol, Hybrid Encryption Algorithm (HEA) has been introduced in this paper and implemented in an ESP32 based IoT-enabled mobile robot. The HEA consist of base64 and AES, which is double-layered encryption for data security. The level of security is much higher than the commonly used encryption algorithm. The complexity and runtime are less than other encryption topology. The proposed technique has been computed in ESP32 and the performance was observed to be much better in terms of security level, complexity, execution time, and power consumption of the device.