Breaking Grain-128 with Dynamic Cube Attacks

Abstract

We present a new variant of cube attacks called a dynamic cube attack. Whereas standard cube attacks [4] find the key by solving a system of linear equations in the key bits, the new attack recovers the secret key by exploiting distinguishers obtained from cube testers. Dynamic cube attacks can create lower degree representations of the given cipher, which makes it possible to attack schemes that resist all previously known attacks. In this paper we concentrate on the well-known stream cipher Grain-128 [6], on which the best known key recovery attack [15] can recover only 2 key bits when the number of initialization rounds is decreased from 256 to 213. Our first attack runs in practical time complexity and recovers the full 128-bit key when the number of initialization rounds in Grain-128 is reduced to 207. Our second attack breaks a Grain-128 variant with 250 initialization rounds and is faster than exhaustive search by a factor of about 2 28. Finally, we present an attack on the full version of Grain-128 which can recover the full key but only when it belongs to a large subset of 2 −10 of the possible keys. This attack is faster than exhaustive search over the 2 118 possible keys by a factor of about 2 15. All of our key recovery attacks are the best known so far, and their correctness was experimentally verified rather than extrapolated from smaller variants of the cipher. This is the first time that a cube attack was shown to be effective against the full version of a well known cipher which resisted all previous attacks.

Cube Attacks and Cube-Attack-Like Cryptanalysis on the Round-Reduced Keccak Sponge Function

“…Another possible approach it to carefully select the cube such that we obtain a practical distinguisher (as in Section 5.1). Then, we can try to apply several techniques that were developed to exploit similar distinguishers for key recovery (such as conditional differential cryptanalysis [19] and dynamic cube attacks [15]). However, these techniques seem to be better suited for stream ciphers built using feedback shift registers, rather than the SP-network design of Keccak.…”

Cryptanalysis of the Atmel Cipher in SecureMemory, CryptoMemory and CryptoRF

“…Hence, with a complexity of 2 14 , we can determine the candidates of Q 0 = {m 7 , m 0 } satisfying (6). Similarly, we can determine Q 1 = {m 8 , m 7 }, Q 2 = {m 9 , m 8 }, Q 3 = {m 10 , m 9 }, Q 4 = {m 11 , m 10 }, Q 5 = {m 12 , m 11 }, Q 6 = {m 13 , m 12 }, Q 7 = {m 14 , m 13 } and Q 8 = {m 15 , m 14 } from (7).…”

“…Thus, the techniques requiring chosen nonces, e.g. the differential-like chosen nonces attacks and the cube attacks [5,6] will not work in this realistic setting, neither will fast correlation attacks [11] which usually require large amounts of keystream.…”

On the Security of LBlock against the Cube Attack and Side Channel Cube Attack

“…In 2010, Li et al worked on cube testers on Bivium [20]. Shamir et al worked on Grain-128 [21] and gave results for cube testers and dynamic cube attack in [22] and [23]. Conditional differential cryptanalysis by Knellwolf et al is a predecessor to dynamic cube attack [24].…”