Linear Cryptanalysis of RC5 and RC6

Abstract

Abstract. In this paper we evaluate the resistance of the block cipher RC5 against linear cryptanalysis. We describe a known plaintext attack that can break RC5-32 (blocksize 64) with 10 rounds and RC5-64 (blocksize 128) with 15 rounds. In order to do this we use techniques related to the use of multiple linear approximations. Furthermore the success of the attack is largely based on the linear hull-effect. To our knowledge, at this moment these are the best known plaintext attacks on RC5, which have negligible storage requirements and do not make any assumption on the plaintext distribution. Furthermore we discuss the impact of our attacking method on the AES-candidate RC6, whose design was based on RC5.

Provable security of block ciphers against linear cryptanalysis: a mission impossible?

“…practical) block sizes. We note that it is not necessarily the case for block ciphers with a more "exotic" structure, as illustrated in the case of RC5 and RC6 in [4,30,31]. On the other hand, experiments by Selçuk [31] on SP-structured Feistel ciphers seem to match ours.…”

Optimization of Message Encryption for Real-Time Applications in Embedded Systems

“…An estimate of the number of plaintexts required to mount an attack on RC5 and RC6 with varying number of rounds can be used to quantify security strength [27], [28]. time and resources required for the attacker to successfully mount a cryptanalysis attack on the system should be considerably (often, exponentially) more than the time and resources required for encryption/decryption.…”

“…Coefficients α i and ω i are constants and depend on the importance of each application (determined by the system designer) as well as the word size [27] and the length of the encryption key [23], [28]. Motivated by the results in Table 1 [27]- [29], and as shown graphically in Figure 2, the exponent (α i r i + ω i ) is modeled as a linear function of r i .…”

“…In this section, we illustrate the problem tackled in this paper based on an SAE benchmark [32], equipped with security parameters from [27]. The Society of Automotive Engineers (SAE) has released a set of requirements and a control benchmark, i.e., the control system of an electric vehicle, to be able to compare the effectiveness of new solutions for safety critical automotive systems [32].…”

“…This SAE benchmark, however, does not specify any security parameters. Therefore, here, this SAE benchmark is equipped with security parameters from [27]. According to [27], the longer the word size, the more the number of plaintexts required to mount a successful cryptanalysis attack on the system.…”