Linear Cryptanalysis of PRINTcipher – Trails and Samples Everywhere

Abstract

PRINTcipher is a recent lightweight block cipher designed by Knudsen et al. Some noteworthy characteristics are a burnt-in key, a key-dependent permutation layer and identical round keys. Independent work on PRINTcipher has identified weak key classes that allow for a key recovery-the obvious countermeasure is to avoid these weak keys at the cost of a small loss of key entropy. This paper identifies several larger classes of weak keys. We show how to distinguish classes of keys and give a 28-round linear attack applicable to half the keys. We show that there are several similar attacks, each focusing on a specific class of keys. We also observe how some specific properties of PRINTcipher allow us to collect several samples from each plaintext-ciphertext pair. We use this property to construct an attack on 29-round PRINTcipher applicable to a fraction 2 −5 of the keys.

О Классах Слабых Ключей Обобщенной Шифрсистемы PRINT

“…Трудоемкость атаки линейным методом оценивается аналогично работе [6]. При проведении атаки используется 2 2(t+1) шифрований, число пар открытых текстов и соответствующих им шифртекстов также равно 2 2(t+1) , где число атакуемых раундов есть t, t < n 2 .…”

“…Основная идея атаки заключается в поиске подмножеств открытых текстов и ключей шифрования, сохраняемых раундовой функцией алгоритма шифрования. Также предложены атаки на основе нескольких методов: разностного [5], линейного [6], их комбинации [7]. В работе [8] рассматривается стойкость шифрсистемы относительно алгебраического метода.…”

Combined Differential and Linear Cryptanalysis of Reduced-Round PRINTcipher

“…Counting the keys in the key space of PRINTcipher-48 which satisfies at least one of the conditions in Table 4 we find out that 0.036% of the key space of the PRINTcipher-48 is vulnerable to at least one of the combined characteristics. [15] = 0. Using the differential characteristic powered by linear characteristics for 28 rounds in Section 3.3 we have been able to attack on 31-round version of the cipher and recover the key bits sk 2 [25 − 22], sk 2 [19 − 16], sk 1 [47 − 39].…”

“…Recently, Leander et al [21] have announced an attack on the full round PRINTcipher-48 for a class of 2 52 keys. Also Ågren et al [15] have applied a linear attack on 28-round PRINTcipher-48 which works for half of the keys. Differential [7] and linear cryptanalysis [25] are the most used cryptanalysis techniques for block ciphers.…”

Differential fault analysis on PRINT cipher

“…This block cipher is an substitution-permutation (SP)-network-based cipher and two block lengths of 48 and 96 bits are supported, denoted by PRINTCIPHER-48 and PRINTCIPHER-96, respectively. Several basic attacks such as differential cryptanalysis, linear cryptanalysis and their variants have been applied on PRINTCIPHER already [29][30][31]. In this paper, we concentrate on the security of PRINTCIPHER-48 against DFA attack.…”