A cryptanalytic time-memory trade-off

Abstract

A&M&-Aprobabilistic method is presented wtdcb cryptanalyzes any N key cryptosystem in N2i3 operations with N2j3 words of memory (average vale) after a precomputatioo which requires N operations. If tke precomputation cao be performed in a reasooable time period (e.g* several years), the additional computation reqoired to recover e& key compares very favorably wltb the N operations reqdred by an exkaostive sear& and the N words of memory reqoircd by table lookup. When applied to the Data Enqption Standard (DES) osed lo block mode, it imlicatea tbat soluths should cost between $1 and $100 esck. Themethod worksinachosenplaintextattackand,itcipherbloekchainingisnotused, am also be osed in a ciphertext-only attack.

Cryptanalysis on Block Ciphers

“…In recent years, a variety of cryptanalytic methods have been proposed, of which differential cryptanalysis [12] and linear cryptanalysis [83] are probably the best known. All of these techniques are tradeoffs between data, time and/or memory complexities [36], compared with the above three elementary cryptanalytic techniques.…”

“…This attack has a data complexity of 2 k ciphertexts, a 2 k n-bit memory complexity and a negligible time complexity. Moreover, it requires a one-off precomputation to generate the table, which has a time complexity of 2 k encryptions; however, the time complexity of the precomputation is typically not counted as part of the time complexity of an attack, since it can be performed at the cryptanalyst's leisure [36].…”

Analysis of the Parallel Distinguished Point Tradeoff

“…Rather than using exactly t tables, we allow more flexibility and use ℓ tables, where ℓ ≈ t. Flexibility is also given to the matrix stopping rule, so that mt 2 = D msc N , with a matrix stopping constant D msc ≈ 1. The condition D msc ≈ 1 can be justified as was originally done by Hellman [8] or through a birthday paradox argument as given in [5,6]. In all cases, we assume that the parameters are reasonable in the sense that m, t ≫ 0, which, in particular, implies t ≪ √ N through the matrix stopping rule.…”

“…The first explicit time memory tradeoff algorithm was invented by Hellman [8]. Shortly thereafter, the distinguished point (DP) technique was introduced.…”

The State of Cryptographic Hash Functions

“…Note that this model does not take into account precomputation, which can be used to speed the computation of many preimages (as for example in Hellman [49]). …”