Analysis of the Authenticated Cipher MORUS (v1)

Mileva, Aleksandra; Dimitrova, Vesna; Velichkov, Vesselin

doi:10.1007/978-3-319-29172-7_4

Cited by 12 publications

(11 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The main focus is on differential properties, and not many details are given for other attack vectors. In third-party analysis, Mileva et al [13] propose a distinguisher in the nonce-reuse setting and practically evaluate the differential behaviour of toy variants of MORUS. Shi et al [16] analyze the differential properties of the finalization reduced to 2 out of 10 steps, but find no attacks.…”

Section: Introductionmentioning

confidence: 99%

Cryptanalysis of MORUS

Ashur

Eichlseder

Lauridsen³

et al. 2018

Lecture Notes in Computer Science

View full text Add to dashboard Cite

MORUS is a high-performance authenticated encryption algorithm submitted to the CAESAR competition, and recently selected as a finalist. There are three versions of MORUS: MORUS-640 with a 128-bit key, and MORUS-1280 with 128-bit or 256-bit keys. For all versions the security claim for confidentiality matches the key size. In this paper, we analyze the components of this algorithm (initialization, state update and tag generation), and report several results. As our main result, we present a linear correlation in the keystream of full MORUS, which can be used to distinguish its output from random and to recover some plaintext bits in the broadcast setting. For MORUS-1280, the correlation is 2 −76 , which can be exploited after around 2 152 encryptions, less than would be expected for a 256-bit secure cipher. For MORUS-640, the same attack results in a correlation of 2 −73 , which does not violate the security claims of the cipher. To identify this correlation, we make use of rotational symmetries in MORUS using linear masks that are invariant by word-rotations of the state. This motivates us to introduce single-word versions of MORUS called MiniMORUS, which simplifies the analysis. The attack has been implemented and verified on MiniMORUS, where it yields a correlation of 2 −16. We also study reduced versions of the initialization and finalization of MORUS, aiming to evaluate the security margin of these components. We show a forgery attack when finalization is reduced from 10 steps to 3, and a key-recovery attack in the nonce-misuse setting when initialization is reduced from 16 steps to 10. These additional results do not threaten the full MORUS, but studying all aspects of the design is useful to understand its strengths and weaknesses.

show abstract

Section: Introductionmentioning

confidence: 99%

Cryptanalysis of MORUS

Ashur

Eichlseder

Lauridsen³

et al. 2018

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…Bost and Sanders found a flaw in the masking shceme of an earlier version of OTR [BS16], Huang and Wu described a collision based forgery [HW]. Mileva et al describe a nonce misusing distinguisher attack for MORUS [MDV16]. The collision-based forgeries on NORX, Ascon and Keyak are matching Lemma 2 of the work on provable generic security of full-state keyed duplex by Daemen et al [DMA17].…”

Section: Introductionmentioning

confidence: 83%

Can Caesar Beat Galois?

Vaudenay

Vizár

2018

Applied Cryptography and Network Security

View full text Add to dashboard Cite

The Competition for Authenticated Encryption: Security, Applicability and Robustness (CAESAR) has as its official goal to "identify a portfolio of authenticated ciphers that offer advantages over AES-GCM and are suitable for widespread adoption." Each of the 15 candidate schemes competing in the currently ongoing 3 rd round of CAESAR must clearly declare its security claims, i.a. whether or not it can tolerate nonce misuse, and what is the maximal data complexity for which security is guaranteed. These claims appear to be valid for all 15 candidates. Interpreting "Robustness" in CAESAR as the ability to mitigate damage even if security guarantees are void, we describe attacks with birthday complexity or beyond, and/or with nonce reuse for each of the 15 candidates. We then sort the candidates into classes depending on how powerful does an attacker need to be to mount (semi-)universal forgeries, decryption attacks, or key recoveries. Rather than invalidating the security claims of any of the candidates, our results provide an additional criterion for evaluating the security that candidates deliver, which can be useful for e.g. breaking ties in the final CAESAR discussions.

show abstract

“…Three MORUS versions: MORUS-640-128, MORUS-1280-128, and MORUS-1280-256 are recommended with different internal state and key sizes. Mileva et al [10] have proposed a distinguisher attack on MORUS in non-reuse setting. And Zhang et al [11] researched on the confusion and diffusion properties of the initialization of MORUS.…”

Section: Introductionmentioning

confidence: 99%

Improved Collision Cryptanalysis of Authenticated Cipher MORUS

Shi¹,

Guan²,

Li³

et al. 2016

Proceedings of the 2016 2nd International Conference on Artificial Intelligence and Industrial Engineering (AIIE 2016)

View full text Add to dashboard Cite

Abstract-MORUS is an authenticated stream cipher designed by Wu et al. and submitted for the third-round of the CAESAR competition. The collision properties of MORUS-640-128 are studied. We propose the necessary conditions for an internal state collision after two-step update, i.e., the Hamming weight of the input difference is at least 5 and the difference is distributed in at least three 32-bit words, which provide the theoretical support for MORUS's resistance against collision attack.

show abstract

Analysis of the Authenticated Cipher MORUS (v1)

Cited by 12 publications

References 2 publications

Cryptanalysis of MORUS

Cryptanalysis of MORUS

Can Caesar Beat Galois?

Improved Collision Cryptanalysis of Authenticated Cipher MORUS

Contact Info

Product

Resources

About