Biclique cryptanalysis on block cipher Midori

Abstract

Contents:IJES is a refereed international journal providing an international forum to report, discuss and exchange experimental or theoretical results, novel designs, work-in-progress, experience, case studies, and trend-setting ideas. Papers should be of a quality that represents the latest advances in embedded systems in time-to-market, cost, code size, weight, testability, power, real-time behaviour, and stimulating future trends.

Unbalanced biclique cryptanalysis of a full round Midori

“…The two differential trails do not share active state cells in the last four rounds. We can easily verify that f (S j ) K [i, j]C i is consistently true for all i ∈ {0, 1} 8 and j ∈ {0, 1} 16 as demonstrated in Fig. 6.…”

“…Step 3. The attacker decrypts C 0 under different keys K [0, j] for j ∈ {0, 1} 16 (Fig. 6c) to obtain the corresponding intermediate states S j .…”

“…7 (left part), K [1] influences the vertical stripes cells that should be calculated 2 8 times, and K [2] causes the diagonal crosshatch cells that should be calculated 2 8 times. The grey cells are influenced by K [1] and K [2]; thus, these cells should be computed 2 16 times. The point fill cells are computed once and the white cells must not be computed.…”

“…We check 2 24 keys by the 16-bit matching variable of V i, j and V i, j for all i ∈ {0, 1} 8 and j ∈ {0, 1} 16 . Thus, the number of remaining key candidates in each key group is 2 8 on average.…”

“…The biclique attack has been applied to many block ciphers such as TWINE [5,6], Piccolo [7,8], LED [9], Skinny [10], IDEA [11], PRESENT [12,13], HIGHT [14], KLEIN [15] and Midori [16]. After that, IDEA was attacked utilising the narrow biclique technique [17] which is an extension of independent biclique attack.…”