Biclique Attack on the Full HIGHT

Hong, Deukjo; Koo, Bonwook; Kwon, Daesung

doi:10.1007/978-3-642-31912-9_24

Cited by 32 publications

(28 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…With respect to preimage resistance, the same authors report that 2 3n/2 calls suffice for finding a preimage for f MDC-4 and 2 7n/4 calls result in a preimage for MDC-4. The latter result is recently improved to 2 3n/2 by Hong and Kwon [12]. These results are summarized in Table 1.…”

Section: Return (Y Z)mentioning

confidence: 77%

“…The same probability bound is obtained for winning queries to appear at (tr = br). Consequently, a preimage is found in this case with probability at most 12 2 n .…”

Section: A1 Proof Of Lemmentioning

confidence: 98%

“…The results printed in bold are derived in this work. collision preimage ideal primitives security attack security attack [12] half (for Fig. 1 this means A = B and Y = Z, and consequently S = T , U = V , and W = X), and the security boils down to the security of two subsequent MMO evaluations.…”

Section: Our Contributionsmentioning

confidence: 99%

See 2 more Smart Citations

On the collision and preimage security of MDC-4 in the ideal cipher model

Mennink

2013

Des. Codes Cryptogr.

View full text Add to dashboard Cite

Abstract. We present a collision and preimage security analysis of MDC-4, a 24 years old construction for transforming an n-bit block cipher into a 2n-bit hash function. We start with MDC-4 based on one single block cipher, and prove that any adversary with query access to the underlying block cipher requires at least 2 5n/8 queries (asymptotically) to find a collision. For the preimage resistance, we present a surprising negative result: for a target image with the same left and right half, a preimage for the full MDC-4 hash function can be found in 2 n queries. Yet, restricted to target images with different left and right halves, we prove that at least 2 5n/4 queries (asymptotically) are required to find a preimage. Next, we consider MDC-4 based on two independent block ciphers, a model that is less general but closer to the original design, and prove that the collision bound of 2 5n/8 queries and the preimage bound of 2 5n/4 queries apply to the MDC-4 compression function and hash function design. With these results, we are the first to formally confirm that MDC-4 offers a higher level of provable security compared to MDC-2.

show abstract

Section: Return (Y Z)mentioning

confidence: 77%

“…The same probability bound is obtained for winning queries to appear at (tr = br). Consequently, a preimage is found in this case with probability at most 12 2 n .…”

Section: A1 Proof Of Lemmentioning

confidence: 98%

See 1 more Smart Citation

On the collision and preimage security of MDC-4 in the ideal cipher model

Mennink

2013

Des. Codes Cryptogr.

View full text Add to dashboard Cite

show abstract

“…Security One of the best known attack in the unknown key settings against HIGHT is an impossible differential attack proposed in [11] against 27 rounds of HIGHT with a complexity slightly lower than the exhaustive search. In [22], the authors propose a biclique attack against the full rounds of HIGHT with a computational complexity of 2 126.4 encryptions, faster than exhaustive search based on 8-round bicliques. In [33], the authors propose a related key attack against the full rounds of HIGHT faster than an exhaustive key search using 4 related keys.…”

Section: Desl and Desxl Desl And Desxl Are Two Lightweight Variants Omentioning

confidence: 99%

Survey and Benchmark of Lightweight Block Ciphers for Wireless Sensor Networks

Cazorla

Marquet

Minier

2013

Proceedings of the 10th International Conference on Security and Cryptography

View full text Add to dashboard Cite

Abstract. For security applications in wireless sensor networks (WSNs), choosing best algorithms in terms of energy-efficiency and of small memory requirements is a real challenge because the sensor networks must be autonomous. In [17,35], the authors have benchmarked on a dedicated platform some block-ciphers and have deduced the best candidates to use in the context of small embedded platforms. This article proposes to study on a dedicated platform of sensors most of the recent lightweight block ciphers as well as some conventional block ciphers. First, we describe the design of the chosen block ciphers with a security summary and we then present some implementation tests performed on our platform.

show abstract

“…Biclique key recovery may be considered as an advancement in the field of symmetric-key cryptography but it has been prepared by a considerable number of works in the area of meet-in-themiddle (MITM) attacks on block ciphers [7,8,10,14,17] and hash function cryptanalysis [3,4,15] including the introduction of initial structures [22] and bicliques for preimage search in hash functions [20]. Since the introduction of bicliques, an entire line of research emerged aiming to apply the technique to various block ciphers [1,2,11,12,16,18,19,21,23]. The original work [6] introducing biclique key recovery leaves Shorter version of the work published in the proceedings of ICISC 2014 several questions unanswered though, which are crucial to judge the real-world security of AES and implications of the biclique cryptanalysis in general:…”

Section: Introductionmentioning

confidence: 99%

Bicliques with Minimal Data and Time Complexity for AES

Bogdanov

Chang

Ghosh

et al. 2015

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Biclique cryptanalysis is a recent technique that has been successfully applied to AES resulting in key recovery faster than brute force. However, a major hurdle in carrying out biclique cryptanalysis on AES is that it requires very high data complexity. This naturally warrants questions over the practical feasibility of implementing biclique attack in the real world. In Crypto'13, Canteaut et al. proposed biclique attack where the data complexity of the attack was reduced to a single plaintext-ciphertext pair. However, no application of the same on AES was suggested. In this paper, we re-evaluate the security-bound of full round AES against biclique attack. Under some reasonable restrictions, we exhaustively analyze the most promising class of biclique cryptanalysis as applied to AES through a computer-assisted search and find optimal attacks towards lowest computational and data complexities:-Among attacks with the minimal data complexity of the unicity distance, the ones with computational complexity 2 126.67 (for AES-128), 2 190.9 (for AES-192) and 2 255 (for AES-256) are the fastest. Each attack just requires 2 (for AES-128 and AES-192) or 3 (for AES-256) known plaintexts for success probability 1. We obtain these results using the improved biclique attack proposed in Crypto'13.-Among attacks with data complexity less than the full codebook, for AES-128, the ones of computational complexity 2 126.16 are fastest. Within these, the one with data complexity 2 64 requires the smallest amount of data. Thus, the original attack (with data complexity 2 88 ) did not have the optimal data complexity for AES-128. Similar findings are observed for AES-192 as well (data complexity 2 48 as against 2 80 in the original attack). For AES-256, we find an attack that has a lower computational complexity of 2 254.31 as compared to the original attack complexity of 2 254.42 . -Among all attacks covered, the ones of computational complexity 2 125.56 (for AES-128), 2 189.51 (for AES-192) and 2 253.87 (for AES-256) are fastest, though requiring the full codebook. This can be considered as an indication of the limitations of the independent-biclique attack approach as applied to AES.

show abstract

Biclique Attack on the Full HIGHT

Cited by 32 publications

References 9 publications

On the collision and preimage security of MDC-4 in the ideal cipher model

On the collision and preimage security of MDC-4 in the ideal cipher model

Survey and Benchmark of Lightweight Block Ciphers for Wireless Sensor Networks

Bicliques with Minimal Data and Time Complexity for AES

Contact Info

Product

Resources

About