Reflection Cryptanalysis of PRINCE-Like Ciphers

Soleimany, Hadi; Blondeau, Céline; Yu, Xinge; Wu, Wenling; Nyberg, Kaisa; Zhang, Huiling; Zhang, Lei; Wang, Yanfeng

doi:10.1007/s00145-013-9175-4

Cited by 30 publications

(11 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In spite of the fact that PRINCE is an SPN cipher, it is efficiently implemented even when implementing a decryption function due to its novel property called α-reflection. However, as pointed out by the designers, it has been known that α-reflection reduces the security of the cipher [12,23,35] and thus the cipher having α-reflection does not have optimal security. Meanwhile, it has been known that a Feistel cipher, another traditional structure of block cipher, is suitable for a lightweight block cipher especially when supporting both encryption and decryption, since it does not require an inverse function.…”

Section: Introductionmentioning

confidence: 99%

Generic Key Recovery Attack on Feistel Scheme

Isobe

Shibutani

2013

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. We propose new generic key recovery attacks on Feistel-type block ciphers. The proposed attack is based on the all subkeys recovery approach presented in SAC 2012, which determines all subkeys instead of the master key. This enables us to construct a key recovery attack without taking into account a key scheduling function. With our advanced techniques, we apply several key recovery attacks to Feistel-type block ciphers. For instance, we show 8-, 9-and 11-round key recovery attacks on n-bit Feistel ciphers with 2n-bit key employing random keyed F-functions, random F-functions, and SP-type F-functions, respectively. Moreover, thanks to the meet-in-the-middle approach, our attack leads to low-data complexity. To demonstrate the usefulness of our approach, we show a key recovery attack on the 8-round reduced CAST-128, which is the best attack with respect to the number of attacked rounds. Since our approach derives the lower bounds on the numbers of rounds to be secure under the single secret key setting, it can be considered that we unveil the limitation of designing an efficient block cipher by a Feistel scheme such as a low-latency cipher.

show abstract

Section: Introductionmentioning

confidence: 99%

Generic Key Recovery Attack on Feistel Scheme

Isobe

Shibutani

2013

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…As a result, Feistel block ciphers are natural targets against reflection cryptanalysis and they have been studied widely [4,19,20]. In [14], this approach is extended to the involution block ciphers with the Substitution-Permutation Network (SPN) structure. In this section, we briefly introduce the basic reflection cryptanalysis.…”

Section: Basic Ideamentioning

confidence: 99%

“…The described distinguisher is converted to key-recovery cryptanalysis for numerous weak-key classes in [13]. In [14], it is shown that the security of PRINCE-like ciphers is not independent from the reflection parameter. A novel framework to enhance the slide cryptanalysis against the Even-Mansour scheme with a single key is introduced by Soleimany [15], which exploits a relation between the round constants.…”

Section: Introductionmentioning

confidence: 99%

Self‐similarity cryptanalysis of the block cipher ITUbee

Soleimany¹

2015

IET Information Security

Self Cite

View full text Add to dashboard Cite

Recent developments in the resource constrained devices have led to a renewed interest in designing light-weight primitives with inventive and unconventional structures. Using round-dependent constants instead of a strong key schedule is one of the most widely used trick against the self-similarity cryptanalysis in recent cipher proposals. So far there has been little discussion about the effect of the round constants on the security of the ciphers. In this study, the authors identify several weaknesses in round-reduced versions of the block cipher ITUbee, which was presented recently at LightSec 2013. These weaknesses allow to build relations between the round constants. The author's technique leads to several cryptanalysis in the weak-key, related-key and single-key models and shows that the resistance of ITUbee against self-similarity cryptanalysis is not independent of the values of round constants. They show that the round-reduced cipher under a fraction of the keys is distinguishable from an ideal random permutation. Then they utilise a similar technique to show there exists a deterministic related-key differential distinguisher for up to eight rounds of the cipher. This observation leads to the decrease of the security of 8-round ITUbee in the single-key model by one bit.

show abstract

“…Though being very recent, it has already waked the interest of many cryptanalysts [37,26,1]. The best known attacks so far on the proposed cipher, including the security analysis performed by the authors, reach 6 rounds.…”

Section: Application To Princementioning

confidence: 99%

Sieve-in-the-Middle: Improved MITM Attacks

Canteaut

Naya-Plasencia

Vayssière

2013

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. This paper presents a new generic technique, named sieve-in-the-middle, which improves meet-in-the-middle attacks in the sense that it provides an attack on a higher number of rounds. Instead of selecting the key candidates by searching for a collision in an intermediate state which can be computed forwards and backwards, we here look for the existence of valid transitions through some middle sbox. Combining this technique with short bicliques allows to freely add one or two more rounds with the same time complexity. Moreover, when the key size of the cipher is larger than its block size, we show how to build the bicliques by an improved technique which does not require any additional data (on the contrary to previous biclique attacks). These techniques apply to PRESENT, DES, PRINCE and AES, improving the previously known results on these four ciphers. In particular, our attack on PRINCE applies to 8 rounds (out of 12), instead of 6 in the previous cryptanalyses. Some results are also given for theoretically estimating the sieving probability provided by some subsets of the input and output bits of a given sbox.

show abstract

Reflection Cryptanalysis of PRINCE-Like Ciphers

Cited by 30 publications

References 17 publications

Generic Key Recovery Attack on Feistel Scheme

Generic Key Recovery Attack on Feistel Scheme

Self‐similarity cryptanalysis of the block cipher ITUbee

Sieve-in-the-Middle: Improved MITM Attacks

Contact Info

Product

Resources

About