A Practical Attack on KeeLoq

Indesteege, Sebastiaan; Keller, Nathan; Dunkelman, Orr; Biham, Eli; Preneel, Bart

doi:10.1007/978-3-540-78967-3_1

Cited by 66 publications

(43 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It was initially formulated as early as 1949 by Shannon [29]. Algebraic attacks, since the controversial paper of [11], have been applied to several stream ciphers [1,9,10] and is able to break some of them but it has not been successful in breaking real-life block ciphers, except Keeloq [7,21]. Compared to statistical analysis, such as linear and differential cryptanalysis, algebraic attacks require a comparatively small number of text pairs.…”

Section: Algebraic Attacks Using Sat Solversmentioning

confidence: 99%

Algebraic, AIDA/Cube and Side Channel Analysis of KATAN Family of Block Ciphers

Bard

Courtois

Nakahara

et al. 2010

Progress in Cryptology - INDOCRYPT 2010

View full text Add to dashboard Cite

Abstract. This paper presents the first results on AIDA/cube, algebraic and sidechannel attacks on variable number of rounds of all members of the KATAN family of block ciphers. Our cube attacks reach 60, 40 and 30 rounds of KATAN32, KATAN48 and KATAN64, respectively. In our algebraic attacks, we use SAT solvers as a tool to solve the quadratic equations representation of all KATAN ciphers. We introduced a novel pre-processing stage on the equations system before feeding it to the SAT solver. This way, we could break 79, 64 and 60 rounds of KATAN32, KATAN48, KATAN64, respectively. We show how to perform side channel attacks on the full 254-round KATAN32 with one-bit information leakage from the internal state by cube attacks. Finally, we show how to reduce the attack complexity by combining the cube attack with the algebraic attack to recover the full 80-bit key. Further contributions include new phenomena observed in cube, algebraic and side-channel attacks on the KATAN ciphers. For the cube attacks, we observed that the same maxterms suggested more than one cube equation, thus reducing the overall data and time complexities. For the algebraic attacks, a novel pre-processing step led to a speed up of the SAT solver program. For the side-channel attacks, 29 linearly independent cube equations were recovered after 40-round KATAN32. Finally, the combined algebraic and cube attack, a leakage of key bits after 71 rounds led to a speed up of the algebraic attack.

show abstract

Section: Algebraic Attacks Using Sat Solversmentioning

confidence: 99%

Algebraic, AIDA/Cube and Side Channel Analysis of KATAN Family of Block Ciphers

Bard

Courtois

Nakahara

et al. 2010

Progress in Cryptology - INDOCRYPT 2010

View full text Add to dashboard Cite

show abstract

“…There are some applications of MITM principles to block ciphers like DES or AES, see e.g. [7,11,12,14,15,20] for dedicated attacks, and e.g. [25,26] for meet-in-the-middle attacks on a higher level.…”

Section: Basic Mitm Attackmentioning

confidence: 99%

A 3-Subset Meet-in-the-Middle Attack: Cryptanalysis of the Lightweight Block Cipher KTANTAN

Bogdanov

Rechberger

2011

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. In this paper we describe a variant of existing meet-in-themiddle attacks on block ciphers. As an application, we propose meet-inthe-middle attacks that are applicable to the full 254-round KTANTAN family of block ciphers accepting a key of 80 bits. The attacks are due to some weaknesses in its bitwise key schedule. We report an attack of time complexity 2 75.170 encryptions on the full KTANTAN32 cipher with only 3 plaintext/ciphertext pairs and well as 2 75.044 encryptions on the full KTANTAN48 and 275.584 encryptions on the full KTANTAN64 with 2 plaintext/ciphertext pairs 1 . All these attacks work in the classical attack model without any related keys. In the differential related-key model, we demonstrate 218-and 174-round differentials holding with probability 1. This shows that a strong relatedkey property can translate to a successful attack in the non-related-key setting. Having extremely low data requirements, these attacks are valid even in RFID-like environments where only a very limited amount of text material may be available to an attacker.

show abstract

“…Converting these equations to Boolean expressions in Conjunctive Normal Form (CNF) [9] and deploying various SAT-solver programs is another strategy [14]. Algebraic attacks since the controversial paper of [7] has gotten considerable attention, has been applied to several stream ciphers (see [8]) and is able to break some of them but it has not been successful in breaking real life block ciphers, except Keeloq [11,18].…”

Section: Algebraic Analysismentioning

confidence: 99%

Linear (Hull) and Algebraic Cryptanalysis of the Block Cipher PRESENT

Nakahara

Sepehrdad

Zhang

et al. 2009

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. The contributions of this paper include the first linear hull and a revisit of the algebraic cryptanalysis of reduced-round variants of the block cipher PRESENT, under known-plaintext and ciphertextonly settings. We introduce a pure algebraic cryptanalysis of 5-round PRESENT and in one of our attacks we recover half of the bits of the key in less than three minutes using an ordinary desktop PC. The PRESENT block cipher is a design by Bogdanov et al., announced in CHES 2007 and aimed at RFID tags and sensor networks. For our linear attacks, we can attack 25-round PRESENT with the whole code book, 2 96.68 25-round PRESENT encryptions, 2 40 blocks of memory and 0.61 success rate. Further we can extend the linear attack to 26-round with small success rate. As a further contribution of this paper we computed linear hulls in practice for the original PRESENT cipher, which corroborated and even improved on the predicted bias (and the corresponding attack complexities) of conventional linear relations based on a single linear trail.

show abstract

A Practical Attack on KeeLoq

Cited by 66 publications

References 9 publications

Algebraic, AIDA/Cube and Side Channel Analysis of KATAN Family of Block Ciphers

Algebraic, AIDA/Cube and Side Channel Analysis of KATAN Family of Block Ciphers

A 3-Subset Meet-in-the-Middle Attack: Cryptanalysis of the Lightweight Block Cipher KTANTAN

Linear (Hull) and Algebraic Cryptanalysis of the Block Cipher PRESENT

Contact Info

Product

Resources

About