Conditional Differential Cryptanalysis of NLFSR-Based Cryptosystems

Abstract

Non-linear feedback shift registers are widely used in lightweight cryptographic primitives. For such constructions we propose a general analysis technique based on differential cryptanalysis. The essential idea is to identify conditions on the internal state to obtain a deterministic differential characteristic for a large number of rounds. Depending on whether these conditions involve public variables only, or also key variables, we derive distinguishing and partial key recovery attacks. We apply these methods to analyse the security of the eSTREAM finalist Grain v1 as well as the block cipher family KATAN/KTANTAN. This allows us to distinguish Grain v1 reduced to 104 of its 160 rounds and to recover some information on the key. The technique naturally extends to higher order differentials and enables us to distinguish Grain-128 up to 215 of its 256 rounds and to recover parts of the key up to 213 rounds. All results are the best known thus far and are achieved by experiments in practical time.

Cube Attacks and Cube-Attack-Like Cryptanalysis on the Round-Reduced Keccak Sponge Function

“…Another possible approach it to carefully select the cube such that we obtain a practical distinguisher (as in Section 5.1). Then, we can try to apply several techniques that were developed to exploit similar distinguishers for key recovery (such as conditional differential cryptanalysis [19] and dynamic cube attacks [15]). However, these techniques seem to be better suited for stream ciphers built using feedback shift registers, rather than the SP-network design of Keccak.…”

An All-In-One Approach to Differential Cryptanalysis for Small Block Ciphers

“…For KATAN-32 we present the best known differential attack. 1 In particular, our attack allows us to break 115 rounds of KATAN-32, which is 37 rounds more than previous work [13]. For this, our attack exploits the non-uniformity of the difference distribution after 91 rounds which is 20 rounds more than the previously best known differential characteristic.…”

“…We refer to [9] for more information. The currently best know differential attack on KATAN-32 is a conditional differential attack that can break up to 78 rounds (see [13]). The best attack overall breaks the full cipher slightly faster than exhaustive key search [12].…”

Fault Analysis of the KATAN Family of Block Ciphers

“…Cryptanalytical results on the KATAN family have been presented in [12,2]. Recall that all three members of the KATAN family (i.e.…”

“…KATAN32, KATAN48, and KATAN64) have 254 rounds. Knellwolf et al [12] presented partial key recovery attacks (called "conditional differential cryptanalysis") against 78 rounds of KATAN32, 70 rounds of KATAN48, and 68 rounds of KATAN64 and concluded that the full versions of these ciphers seem to have sufficiently large number of rounds (254 rounds) to provide a confident security margin against their proposed attack. Bard et al [2] presented cube attacks against 60, 40, and 30 rounds, and algebraic attacks against 79, 64, 60 rounds of KATAN32, KATAN48 and KATAN64, respectively.…”