Finding the Impossible: Automated Search for Full Impossible-Differential, Zero-Correlation, and Integral Attacks

Hadipour, Hosein; Sadeghi, Sadegh; Eichlseder, Maria

doi:10.1007/978-3-031-30634-1_5

Cited by 14 publications

(35 citation statements)

References 43 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Our modeling of deterministic linear trails follows the method introduced in [HSE23, HGSE24]. For more details on encoding deterministic linear trails at the cell level, one can refer to [HSE23,HGSE24].…”

Section: Search For Distinguishersmentioning

confidence: 99%

“…Then, as visualized by Figure 8b, we define some constraints to encode the propagation of the deterministic linear trails in forward and backward direction over r d rounds independently. For more details on the constraints, please refer to [HSE23,HGSE24]. We also add the constraints…”

Section: Cp Model For Integral Distinguishers In [Hse23 Hgse24]mentioning

confidence: 99%

“…Modeling the distinguisher in [HSE23]. We define the integer variables ASTK r [i] ∈ {0, 1, 2, 3} to encode the activation pattern of ST K r [i].…”

Section: Cp Model For Integral Distinguishers In [Hse23 Hgse24]mentioning

confidence: 99%

“…For instance, the designers used the method introduced initially in [HBS21, HNE22] to provide some bounds for the number of attacked rounds in boomerang analysis. They also used the methods introduced very recently at EUROCRYPT 2023 [HSE23] to provide some concrete impossible differential and zero-correlation distinguishers. As another example, they used division property [Tod15,XZBL16] to provide concrete integral distinguishers for up to 5 rounds of QARMAv2-64.…”

Section: Introductionmentioning

confidence: 99%

“…The longest concrete distinguishers for QARMAv2 up to now are the integral distinguishers proposed in [HGSE24]. The authors of [HGSE24] exploited the control of the adversary over the tweak part and improved the automatic tool introduced in [HSE23] to find integral distinguishers for up to 10 (resp. 12) rounds of QARMAv2-64 (resp.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Cryptanalysis of QARMAv2

Hadipour,

Todo

2024

ToSC

View full text Add to dashboard Cite

QARMAv2 is a general-purpose and hardware-oriented family of lightweight tweakable block ciphers (TBCs) introduced in ToSC 2023. QARMAv2, as a redesign of QARMAv1 with a longer tweak and tighter security margins, is also designed to be suitable for cryptographic memory protection and control flow integrity. The designers of QARMAv2 provided a relatively comprehensive security analysis in the design specification, e.g., some bounds for the number of attacked rounds in differential and boomerang analysis, together with some concrete impossible differential, zerocorrelation, and integral distinguishers. As one of the first third-party cryptanalysis of QARMAv2, Hadipour et al., [HGSE24] significantly improved the integral distinguishers of QARMAv2, and provided the longest concrete distinguishers of QARMAv2 up to now. However, they provided no key recovery attack based on their distinguishers. This paper delves into the cryptanalysis of QARMAv2 to enhance our understanding of its security. Given that the integral distinguishers of QARMAv2 are the longest concrete distinguishers for this cipher so far, we focus on integral attack. To this end, we first further improve the automatic tool introduced by Hadipour et al. [HSE23,HGSE24] for finding integral distinguishers of TBCs following the TWEAKEY framework. This new tool exploits the MixColumns property of QARMAv2 to find integral distinguishers more suitable for key recovery attacks. Then, we combine several techniques for integral key recovery attacks, e.g., Meet-in-the-middle and partial-sum techniques to build a fine-grained integral key recovery attack on QARMAv2. Notably, we demonstrate how to leverage the low data complexity of the integral distinguishers of QARMAv2 to reduce the memory complexity of the meet-in-the-middle technique. As a result, we successfully present the first concrete key recovery attacks on reduced-round versions of QARMAv2. This includes attacking 13 rounds of QARMAv2-64-128 with a single tweak block (T = 1), 14 rounds of QARMAv2-64-128 with two independent tweak blocks (T = 2), and 16 rounds of QARMAv2-128-256 with two independent tweak blocks (T = 2), all in an unbalanced setting. Our attacks do not compromise the claimed security of QARMAv2, but they shed more light on the cryptanalysis of this cipher.

show abstract

Section: Search For Distinguishersmentioning

confidence: 99%

Section: Cp Model For Integral Distinguishers In [Hse23 Hgse24]mentioning

confidence: 99%

“…Modeling the distinguisher in [HSE23]. We define the integer variables ASTK r [i] ∈ {0, 1, 2, 3} to encode the activation pattern of ST K r [i].…”

Section: Cp Model For Integral Distinguishers In [Hse23 Hgse24]mentioning

confidence: 99%