Improved Cryptanalysis of Reduced-Version QARMA-64/128

Abstract

QARMA is a new tweakable block cipher used for memory encryption, the generation of short tags and the construction of the keyed hash functions in future. It adopts a three-round Even-Mansour scheme and supports 64 and 128 bits of block size, denoted by QARMA-64 and QARMA-128, respectively. Their tweak lengths equal the block sizes and their keys are twice as long as the blocks. In this paper, we improve the security analysis of reduced-version QARMA against impossible differential and meet-in-the-middle attacks. Specifically, first exploit some properties of its linear operations and the redundancy of key schedule. Based on them, we propose impossible differential attacks on 11-round QARMA-64/128, and meet-in-themiddle attacks on 10-round symmetric QARMA-128 and the last 12 rounds of asymmetric QARMA-128. Compared with the previously best known results on QARMA-64, our attack can recover 16 more bits of master key with the almost complexities. Compared with the previously best known results on symmetric QARMA-128, the memory complexity of our attack in Section IV is reduced by a factor of 2 48. Moreover, the meet-in-the-middle attack on 12-round QARMA-128 is the best known attack on QARMA-128 in terms of the number of rounds. INDEX TERMS Tweakable block ciphers, QARMA, meet-in-the-middle attacks, impossible differential cryptanalysis, tweaks.

An Application of the Khumbelo Function on the Camellia Algorithm to Prevent Attacks in IoT Devices

“…According to Wang et al [50] and Liu et al [70], the Camellia algorithm was attacked using the boomerang. Wang et al [50] and Liu et al [70] converted the traditional Feistel structure into a two-cell GF-NLFSR network while preserving all other building blocks, such as S-Boxes and linear distribution mapping. Compared to the Camellia algorithm, the p-Camellia was more resistant to boomerang attacks [50], [70].…”

“…Wang et al [50] and Liu et al [70] converted the traditional Feistel structure into a two-cell GF-NLFSR network while preserving all other building blocks, such as S-Boxes and linear distribution mapping. Compared to the Camellia algorithm, the p-Camellia was more resistant to boomerang attacks [50], [70].…”

“…Liu et al [67] presented a truncated dierential cryptanalysis attack of altered Camellia that was reduced to 7 and 8 rounds. Liu et al [67] discovered the 8-Bit key on 7-round and the 16-Bit key on 8-round, with 3*281 and 3*282 plaintext, respectively. The other component of the boomerang attack is the truncated dierential cryptanalysis attack [59], [60].…”

“…Wang et al [50] and Liu et al [70] discovered several nontransmissible 8-round Camellia attacks using impossible dierentials. WWang et al [50] and Liu et al [70] indicated that the intruders were aware of the maximum number of 7-round attacks, which was feasible using impossible dierentials.…”

“…Wang et al [50] and Liu et al [70] discovered several nontransmissible 8-round Camellia attacks using impossible dierentials. WWang et al [50] and Liu et al [70] indicated that the intruders were aware of the maximum number of 7-round attacks, which was feasible using impossible dierentials. According to Wang et al [50] and Liu et al [70], the impossible dierentials attack attacked the 12 rounds of Camellia with the chosen plaintext of 2 120 and 2 181 .…”