Improved Meet-in-the-Middle Attacks on Reduced-Round Kiasu-BC and Joltik-BC

Abstract

Kiasu-BC and Joltik-BC are internal tweakable block ciphers of authenticated encryption algorithms Kiasu and Joltik submitted to the CAESAR competition. Kiasu-BC is a 128-bit block cipher, of which tweak and key sizes are 64 and 128 bits, respectively. Joltik-BC-128 is a 64-bit lightweight block cipher supporting 128 bits tweakey. Its designers recommended the key and tweak sizes are both 64 bits. In this paper, we propose improved meet-in-the-middle attacks on 8-round Kiasu-BC, 9-round and 10-round Joltik-BC-128 by exploiting properties of their structures and using precomputation tables and the differential enumeration. For Kiasu-BC, we build a 5-round distinguisher to attack 8-round Kiasu-BC with $2^{109}$ plaintext–tweaks, $2^{112.8}$ encrytions and $2^{92.91}$ blocks. Compared with previously best known cryptanalytic results on 8-round Kiasu-BC under chosen plaintext attacks, the data and time complexities are reduced by $2^{7}$ and $2^{3.2}$ times, respectively. For the recommended version of Joltik-BC-128, we construct a 6-round distinguisher to attack 9-round Joltik-BC-128 with $2^{53}$ plaintext–tweaks, $2^{56.6}$ encryptions and $2^{52.91}$ blocks, respectively. Compared with previously best known results, the data and time complexities are reduced by $2^7$ and $2^{5.1}$ times, respectively. In addition, we present a 6.5-round distinguisher to attack 10-round Joltik-BC-128 with $2^{53}$ plaintext–tweaks, $2^{101.4}$ encryptions and $2^{76.91}$ blocks.

Improved meet‐in‐the‐middle attacks on reduced‐round Joltik‐BC

“…Theorem [8] Let and be two b ‐ δ ‐ sets where b = 4 and satisfy . Meanwhile, the truncated differential characteristic needs to be generated by a pair of message–tweak combinations , as outlined in Figure 3.…”

“…The authors analyse the security of Joltik‐BC‐64‐64 and Joltik‐BC‐128‐64 against the meet‐in‐the‐middle attack. Firstly, they clearly distinguish the tweak and the key to propose a precise six‐round meet‐in‐the‐middle distinguisher using the subtweakey difference cancellation property, the tweak difference and the differential enumeration technique, based on the results of Joltik‐BC‐64‐64 given in [8]. Then, by adding one round to the top and two to the bottom, they present a meet‐in‐the‐middle attack with 2 53 plaintext–tweak combinations, 2 52.91 Joltik‐BC blocks and 2 54.1 nine‐round Joltik‐BC‐64‐64 encryptions.…”

MILP-Aided Related-Tweak/Key Impossible Differential Attack and its Applications to QARMA, Joltik-BC

“…In [13], the authors propose a meet-in-the-middle attack on 10-round Joltik-BC-128 with a data complexity of 2 56.1 , a time complexity of 2 126.5 under the single-key setting. In [14], they attack 9-round Joltik-BC-128 with a data complexity of 2 53 , a time complexity of 2 56.6 , a memory complexity of 2 52.91 blocks and 10-round Joltik-BC-128 with a data complexity of 2 53 , a time complexity of 2 101.4 and a memory complexity of 2 76.91 blocks, using the related-key meet-inthe-middle methodology. The related work and our results are shown in Table 1.…”

“…Since then, many proposals, for example, Deoxys-BC [17], Joltik-BC [18], SKINNY [19] and QARMA [20], have followed the TWEAKEY framework and thus take a unified tweakey input instead of a pair key/tweak. For these proposals, many works [14], [21]- [23] have shown the risky of the related-tweakey setting. There are two reasons:…”

“…For QARMA-64, a plaintext P can be expressed as: [4] p [5] p [6] p [7] p [8] p [9] p [10] p [11] p [12] p [13] p [14] p [15]    …”