Cube Testers and Key Recovery Attacks on Reduced-Round MD6 and Trivium

Abstract

Abstract. CRYPTO 2008 saw the introduction of the hash function MD6 and of cube attacks, a type of algebraic attack applicable to cryptographic functions having a low-degree algebraic normal form over GF(2). This paper applies cube attacks to reduced round MD6, finding the full 128-bit key of a 14-round MD6 with complexity 2 22 (which takes less than a minute on a single PC). This is the best key recovery attack announced so far for MD6. We then introduce a new class of attacks called cube testers, based on efficient property-testing algorithms, and apply them to MD6 and to the stream cipher Trivium. Unlike the standard cube attacks, cube testers detect nonrandom behavior rather than performing key extraction, but they can also attack cryptographic schemes described by nonrandom polynomials of relatively high degree. Applied to MD6, cube testers detect nonrandomness over 18 rounds in 2 17 complexity; applied to a slightly modified version of the MD6 compression function, they can distinguish 66 rounds from random in 2 24 complexity. Cube testers give distinguishers on Trivium reduced to 790 rounds from random with 2 30 complexity and detect nonrandomness over 885 rounds in 2 27 , improving on the original 767-round cube attack.

Advanced Algebraic Attack on Trivium

“…For the sake of completeness we mention some distinguisher attacks based on cube testers in [27,6,35]. The best covers up to 961 rounds working in a reduced key space of 2 26 keys (out of 2 80 ).…”

Cube Attacks and Cube-Attack-Like Cryptanalysis on the Round-Reduced Keccak Sponge Function

“…Since its introduction, the cube attack was applied to many different cryptographic primitives such as [3,4,21]. Below we give a brief description of the cube attack, and refer the reader to [14] for more details.…”

“…The notion of cube testers was introduced in [3], as an extension of the cube attack. Unlike standard cube attacks, cube testers aim at detecting a non-random behaviour (rather than performing key recovery), e.g., by observing that the cube sums are always equal to zero, regardless of the value of the secret key.…”

“…. , v 32 in A [2,2] and A [2,3], such that the column parities of A[2, * ] remain constant for the 2 32 possible values of the variables (similarly to Section 5.1). This careful selection of the cube variables leads to two properties on which our attack is based: We now describe the attack which exploits the two properties to retrieve the value of A[0, 0].…”

“…As previously mentioned, in order to recover A[1, 0], we independently apply the same attack but this time using 32 public variables in A [4,2] and A [4,3]. Thus, for the full key recovery, the total data complexity is 2 33 and the online time complexity is 2 33 (assuming that we do not have too many suggestions in Step 3).…”