Algebraic and Slide Attacks on KeeLoq

Abstract

Abstract. KeeLoq is a block cipher used in wireless devices that unlock the doors and alarms in cars manufactured by Chrysler, Daewoo, Fiat, GM, Honda, Jaguar, Toyota, Volvo, Volkswagen, etc [8,9,33,34]. KeeLoq is inexpensive to implement and economical in gate count, yet according to Microchip [33] it should have "a level of security comparable to DES".In this paper we present several distinct attacks on KeeLoq, each of them is interesting for different reasons. First we show that when about 2 32 known plaintexts are available, KeeLoq is very weak and for example for 30 % of all keys the full key can be recovered with complexity of 2 28KeeLoq encryptions. Then we turn our attention to algebraic attacks with the major challenge of breaking KeeLoq given potentially a very small number of known plaintexts.Our best "direct" algebraic attack can break up to 160 rounds of KeeLoq. Much better results are achieved in combination with slide attacks. Given about 2 16 known plaintexts, we present a slide-algebraic attack that uses a SAT solver with the complexity equivalent to about 2 53 KeeLoq encryptions. To the best of our knowledge, this is the first time that a full-round real-life block cipher is broken using an algebraic attack.

A Comparison between Two Off-the-Shelf Algebraic Tools for Extraction of Cryptographic Keys from Corrupted Memory Images

“…Courtois et al [13] demonstrated a weakness in KeeLog by presenting an attack which requires about 2 32 known plaintexts. For 30% of all keys, the full key can be recovered against a complexity of 2 28 KeeLoq encryptions.…”

Using SAT Solving to Improve Differential Fault Analysis of Trivium

“…Recently SAT solvers have made a great progress in algebraic cryptanalysis. In [5], Bard et al used a SAT solver combined with the slide attack to break Keeloq block cipher. Using SAT solvers, Eibach et al [6] attacked Bivium, a scaled version of Trivium.…”

Sparse Boolean equations and circuit lattices

“…So any CL should have 2 × 56 + 2 × 128 = 368 input contacts for the DES and 2 × 112 + 2 × 128 = 480 input contacts for the Triple DES. Tables 3 and 4 show main characteristics of Circuit Lattices for DES and Triple DES: the number of necessary switches, wires and input contacts, which are computed by formulas (5) and (6) and in Sect. 4.…”

“…In spite of relatively high worst case bound on l-SAT problem complexity, there exist a number of efficient l-SAT solvers. They became useful tools in cryptanalysis [4,5]. However, an efficient hardware version of the approach is still unknown.…”