On Differential and Linear Cryptanalysis of the RC5 Encryption Algorithm

Abstract

This paper analyzes the security of the RC5 encryption algorithm against differential and linear cryptanalysis. RC5 is a new block cipher recently designed by Ron Rivest. It has a variable word size, a variable number of rounds, and a variable-length secret key. In RC5, the secret key is used to fill an expanded key table which is then used in encryption. Both our differential and linear attacks on RC5 recover every bit of the expanded key table without any exhaustive search. However, the plaintext requirement is strongly dependent on the number of rounds. For 64-bit block size, our differential attack on nine-round RC5 uses 2*5 chosen plaintext pairs (about the same as DES), while 2" pairs are needed for 12-round RC5. Similarly, our linear attack on five-round RC5 uses 2*' known plaintexts (about the same as DES), and the plaintext requirement is impractical for more than six rounds. We conjecture that the linear approximations used in our linear cryptanalysis are optimal. Thus, we conclude that Rivest's suggested use of 12 rounds is sufficient to make differential and linear cryptanalysis of RC5 impractical.

Linear Cryptanalysis of RC5 and RC6

“…Because of the fact that (14) has a bigger bias than (15), 'traditionally' approximations on the LSB have been considered to be most useful for a linear attack (see [KY95,KY98]). Using Approximations (9), (10) and (14) one can derive the following iterative approximation for one round of RC5.…”

Probing Attacks On Tamper-Resistant Devices

“…RC5 has been extensively studied from a regular cryptanalysis point of view. See for example [9,8,18].…”

On the Design and Security of RC2

“…Furthermore in our analysis we shall be interested in how single-bit differences behave within RC2. The decision to restrict our attention to single-bit differences facilitates analysis but is also motivated by a typical assumption that characteristics involving multiple-bit differences over integer addition will generally hold with lower probability than single-bit characteristics [6]. We note that other more complex techniques [2,7] might open new avenues for the analysis of RC2.…”

“…Such attacks appear to be ineffective for ciphers that mix integer addition and bitwise operations unless the approximation can be limited to the least significant bits across an addition [6]. Such a restriction appears unlikely as an extension of the current approximation into a third MIXING round illustrates: Nevertheless, there are complex interactions between the individual steps of RC2 and these often provide unintuitive results.…”