Biclique‐based cryptanalysis of the block cipher SQUARE

Mala, Hamid

doi:10.1049/iet-ifs.2011.0332

Cited by 10 publications

(12 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Cryptanalysis of AES employed algorithms for biclique construction which are partly covered in Section 3. In this context we also mention new and improved results on Kasumi by Jia et al [14] and IDEA by Biham et al [7] as well as more results announced both publicly [12,19,30] and privately.…”

Section: Status Of Sha-2 and Skein-512mentioning

confidence: 82%

See 1 more Smart Citation

Bicliques for Preimages: Attacks on Skein-512 and the SHA-2 Family

Khovratovich

Rechberger

Savelieva

2012

Lecture Notes in Computer Science

102

View full text Add to dashboard Cite

We present a new concept of biclique as a tool for preimage attacks, which employs many powerful techniques from differential cryptanalysis of block ciphers and hash functions.The new tool has proved to be widely applicable by inspiring many authors to publish new results of the full versions of AES, KASUMI, IDEA, and Square. In this paper, we show how our concept leads to the first cryptanalysis of the round-reduced Skein hash function, and describe an attack on the SHA-2 hash function with more rounds than before.

show abstract

Section: Status Of Sha-2 and Skein-512mentioning

confidence: 82%

“…4. Fix a group of 2-round trails (the one based on 3-bit difference is given in Table 7) (ΔW 17 → ΔS 19 ) as a Δ-trail (Equation (6)) in rounds 17-19. 5.…”

Section: C1 Biclique Constructionmentioning

confidence: 99%

Bicliques for Preimages: Attacks on Skein-512 and the SHA-2 Family

Khovratovich

Rechberger

Savelieva

2012

Lecture Notes in Computer Science

102

View full text Add to dashboard Cite

show abstract

“…Soon after publishing the seminal paper of AES cryptanalysis, lots of cryptanalytical results on the other block ciphers were proposed [2][3][4][5]. Biclique cryptanalysis often breaks the full version of the cipher with a reasonable data and memory complexities but marginal computations.…”

Section: Introductionmentioning

confidence: 99%

“…To minimize the number of active Sboxes, we construct a biclique with d 1 = d 2 , and call it asymmetric biclique. This approach has been used only in the biclique cryptanalysis of IDEA [2] whereas the biclique cryptanalyses of all the SPN-based ciphers [1,[3][4][5][6][7] are symmetric. In the case of KLEIN, the asymmetric approach significantly works more efficient than the symmetric one.…”

Section: Introductionmentioning

confidence: 99%

Biclique cryptanalysis of the full‐round KLEIN block cipher

Ahmadian¹,

Salmasizadeh²,

Aref

2015

IET Information Security

View full text Add to dashboard Cite

Abstract. In this paper we present a biclique attack on the newly proposed block cipher KLEIN-64. We first introduce some weaknesses of the diffusion layer and key schedule of this algorithm. Then we exploit them to present a full round attack on KLEIN-64 using an asymmetric biclique. The (worst case) computations and data complexity of this attack are 2 62.84 and 2 39 , respectively. A modified version of this attack is also presented which is slightly faster at the expense of the data required.

show abstract

“…Biclique key recovery may be considered as an advancement in the field of symmetric-key cryptography but it has been prepared by a considerable number of works in the area of meet-in-themiddle (MITM) attacks on block ciphers [7,8,10,14,17] and hash function cryptanalysis [3,4,15] including the introduction of initial structures [22] and bicliques for preimage search in hash functions [20]. Since the introduction of bicliques, an entire line of research emerged aiming to apply the technique to various block ciphers [1,2,11,12,16,18,19,21,23]. The original work [6] introducing biclique key recovery leaves Shorter version of the work published in the proceedings of ICISC 2014 several questions unanswered though, which are crucial to judge the real-world security of AES and implications of the biclique cryptanalysis in general:…”

Section: Introductionmentioning

confidence: 99%

Bicliques with Minimal Data and Time Complexity for AES

Bogdanov

Chang

Ghosh

et al. 2015

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Biclique cryptanalysis is a recent technique that has been successfully applied to AES resulting in key recovery faster than brute force. However, a major hurdle in carrying out biclique cryptanalysis on AES is that it requires very high data complexity. This naturally warrants questions over the practical feasibility of implementing biclique attack in the real world. In Crypto'13, Canteaut et al. proposed biclique attack where the data complexity of the attack was reduced to a single plaintext-ciphertext pair. However, no application of the same on AES was suggested. In this paper, we re-evaluate the security-bound of full round AES against biclique attack. Under some reasonable restrictions, we exhaustively analyze the most promising class of biclique cryptanalysis as applied to AES through a computer-assisted search and find optimal attacks towards lowest computational and data complexities:-Among attacks with the minimal data complexity of the unicity distance, the ones with computational complexity 2 126.67 (for AES-128), 2 190.9 (for AES-192) and 2 255 (for AES-256) are the fastest. Each attack just requires 2 (for AES-128 and AES-192) or 3 (for AES-256) known plaintexts for success probability 1. We obtain these results using the improved biclique attack proposed in Crypto'13.-Among attacks with data complexity less than the full codebook, for AES-128, the ones of computational complexity 2 126.16 are fastest. Within these, the one with data complexity 2 64 requires the smallest amount of data. Thus, the original attack (with data complexity 2 88 ) did not have the optimal data complexity for AES-128. Similar findings are observed for AES-192 as well (data complexity 2 48 as against 2 80 in the original attack). For AES-256, we find an attack that has a lower computational complexity of 2 254.31 as compared to the original attack complexity of 2 254.42 . -Among all attacks covered, the ones of computational complexity 2 125.56 (for AES-128), 2 189.51 (for AES-192) and 2 253.87 (for AES-256) are fastest, though requiring the full codebook. This can be considered as an indication of the limitations of the independent-biclique attack approach as applied to AES.

show abstract

Biclique‐based cryptanalysis of the block cipher SQUARE

Cited by 10 publications

References 14 publications

Bicliques for Preimages: Attacks on Skein-512 and the SHA-2 Family

Bicliques for Preimages: Attacks on Skein-512 and the SHA-2 Family

Biclique cryptanalysis of the full‐round KLEIN block cipher

Bicliques with Minimal Data and Time Complexity for AES

Contact Info

Product

Resources

About