Efficient Dissection of Composite Problems, with Applications to Cryptanalysis, Knapsacks, and Combinatorial Search Problems

Abstract

Abstract. In this paper we show that a large class of diverse problems have a bicomposite structure which makes it possible to solve them with a new type of algorithm called dissection, which has much better time/memory tradeoffs than previously known algorithms. A typical example is the problem of finding the key of multiple encryption schemes with r independent n-bit keys. All the previous error-free attacks required time T and memory M satisfying T M = 2 rn , and even if "false negatives" are allowed, no attack could achieve T M < 2 3rn/4 . Our new technique yields the first algorithm which never errs and finds all the possible keys with a smaller product of T M , such as T = 2 4n time and M = 2 n memory for breaking the sequential execution of r=7 block ciphers. The improvement ratio we obtain increases in an unbounded way as r increases, and if we allow algorithms which can sometimes miss solutions, we can get even better tradeoffs by combining our dissection technique with parallel collision search. To demonstrate the generality of the new dissection technique, we show how to use it in a generic way in order to attack hash functions with a rebound attack, to solve hard knapsack problems, and to find the shortest solution to a generalized version of Rubik's cube with better time complexities (for small memory complexities) than the best previously known algorithms.

Quantum attacks against iterated block ciphers

“…While this may not be a surprise from the point of view of quantum complexity theory (see e.g. the conclusion of [3]), this suggests that the time-space product, a common way of evaluating classical attacks [7], may not be the correct figure of merit to evaluate quantum attacks.…”

Sieve-in-the-Middle: Improved MITM Attacks

“…The problem of merging two large lists with respect to a group-wise Boolean relation has been defined and addressed by Naya-Plasencia in [33,Section 2]. Here, we focus on three algorithms proposed in [33], namely instant matching, gradual matching and an improvement of the parallel matching due to [19]. We provide general and precise formulas for the average time and memory complexities of these three algorithms.…”

“…The details are provided by Algo 3. This algorithm applies an idea from [19] to the parallel matching algorithm from [33]: instead of building a big auxiliary list as in the original parallel matching, we here build small ones which do not need any additional memory. In parallel matching, the elements in both lists are decomposed into three parts: the first t 1 groups, the next t 2 groups, and the remaining (t − t 1 − t 2 ) groups.…”

Multidimensional meet-in-the-middle attack and its applications to KATAN32/48/64

“…The papers [6,9] have the basic idea of guessing one internal state in MITM attacks, but their attacks only succeed in improving memory and data complexities, but not time complexity, of the previous work in [12]. We also note that there is an independent work [8] with similar ideas, but the authors focus on optimizing time-memory trade-offs for composite problems, and their analysis is only applied to the cases where all sub-ciphers have independent keys.…”