Optimized Interpolation Attacks on LowMC

Abstract

Abstract. LowMC is a collection of block cipher families introduced at Eurocrypt 2015 by Albrecht et al. Its design is optimized for instantiations of multi-party computation, fully homomorphic encryption, and zero-knowledge proofs. A unique feature of LowMC is that its internal affine layers are chosen at random, and thus each block cipher family contains a huge number of instances. The Eurocrypt paper proposed two specific block cipher families of LowMC, having 80-bit and 128-bit keys. In this paper, we mount interpolation attacks (algebraic attacks introduced by Jakobsen and Knudsen) on LowMC, and show that a practically significant fraction of 2 −38 of its 80-bit key instances could be broken 2 23 times faster than exhaustive search. Moreover, essentially all instances that are claimed to provide 128-bit security could be broken about 1000 times faster. In order to obtain these results, we had to develop novel techniques and optimize the original interpolation attack in new ways. While some of our new techniques exploit specific internal properties of LowMC, others are more generic and could be applied, in principle, to any block cipher.

Private Set Intersection for Unequal Set Sizes with Mobile Applications

“…Alternatively, we could use the LowMC cipher of [1] with only 2,268 AND gates. Due to recent attacks on LowMC [16,17], we choose to instantiate the PRF with AES. Recently, [29] proposed "MPC-friendly" PRFs that might provide more efficient primitives for OPRF-based PSI.…”

Stream Ciphers: A Practical Solution for Efficient Homomorphic-Ciphertext Compression

“…Indeed, the best attacks on round-reduced versions of KATAN so far [29] are meet-in-the-middle attacks, that exploit the knowledge of the values of the first and the last internal states (due to the block-cipher setting). As this is not the case here, such attacks, as well as the recent interpolation attacks against LowMC [21], do not apply. The best attacks against KATAN, when excluding MitM techniques, are conditional differential attacks [40,41].…”

“…However, the proposed instances of LowMC, namely LowMC-80 and LowMC-128, have recently had some security issues [21]. They actually present some weaknesses inherent in their low multiplicative complexity.…”

“…[20,22,5]. While these attacks are rather general, the improved variant used for breaking LowMC [21], named interpolation attack [38], specifically applies to block ciphers. Indeed it exploits the sparse algebraic normal form of some intermediate bit within the cipher using that this bit can be evaluated both from the plaintext in the forward direction and from the ciphertext in the backward direction.…”

“…Interpretation. First, we would like to recall that LowMC-128 must be considered in a different category because of the existence of a key-recovery attack with time complexity 2 118 and data complexity 2 73 [21]. However, it has been included in the table in order to show that the performances achieved by Trivium and Kreyvium are of the same order of magnitude.…”