An Improved Differential Attack on Full GOST

Abstract

Abstract. GOST 28147-89 is a well-known block cipher and the official encryption standard of the Russian Federation. A 256-bit block cipher considered as an alternative for AES-256 and triple DES, having an amazingly low implementation cost and it is becoming increasingly popular [51,36]. Until 2010 researchers unanimously agreed that: "despite considerable cryptanalytic efforts spent in the past 20 years, GOST is still not broken", see [51] and in 2010 it was submitted to ISO 18033 to become a worldwide industrial encryption standard. In 2011 it was suddenly discovered that GOST can be broken and it is insecure on more than one account. There is a substantial variety of recent innovative attacks on GOST [9, 26, 37, 10-12, 31, 21, 19, 20]. We have reflection attacks [37,26], attacks with double, triple and even quadruple reflections [26,20], a large variety of self-similarity and black-box reduction attacks [9,26,19,20], some of which do not use any reflections whatsoever [26, 9] and few other. The final key recovery step in various attacks is in many cases a software algebraic attack [26, 9,20] or/and a Meet-In-The-Middle attack [37,26,31,21]. In differential attacks key bits are guessed and confirmed by the differential properties [54,[10][11][12][13][14]49] and there have already been quite a few papers about advanced differential attacks on GOST [54, 10-13, 49, 14, 22, 15]. There is also several even more advanced "combination" attacks which combine the complexity reduction approach based on high-level self-similarity of [26,19, 9] with various advanced differential properties with 2,3 or 4 points, see [26,20]. In this paper we consider some recent differential attacks on GOST [54, 10-14, 49, 15] and show how to further improve them. We present a single-key attack against full 32-round 256-bit GOST with time complexity of 2 179 which is substantially faster than any previous single key attack on GOST. * Note: This paper is a new extended and updated version of a paper with the same title [27] to appear in LNCS 9100, Springer in March 2016. This paper is substantially expanded compared to the earlier version from 2012. The main attack remains the same and also the same as in the Springer version [27]. The introduction, preliminary study and exploration of underlying cipher structure and properties attacks are however greatly expanded in order to show a bigger picture and provide useful insights. We explain in details the philosophy and the structure of our attacks, and the methodology of how one can find such attacks, cf. Part I, "Discovery of Advanced Differential Attacks on GOST", pages 9-24. We also cite recent related and follow-up work.

On Multiple Symmetric Fixed Points in GOST

“…At first sight, this attack has only limited interest. However, a large number of very good attacks have been discovered, and more than half of them use this reflection property [12], sometimes two, three, or four times [7].…”

“…In one sense, we revisit this attack from [15], and propose very important variants which are based on highly non-trivial facts that are somewhat impossible to expect from [15]. We are going to deduce them from other major results on GOST [7,[9][10][11]24], even though it is safe to say that nobody would expect that these attacks could be related in any way.…”

“…We consider the following standard situation that has been introduced [11] and further studied in [7,[9][10][11]. Let D ¼ 0x80700700 which mask has seven active bits out of 32.…”

“…Numerous recent works have tried to understand, evaluate, and improve the resistance of GOST against differential cryptanalysis, in view of the standardization of GOST [1,17,22]. At the same time, in 2011-2012, many improved differential attacks on GOST were found, allowing finally to break full 32-round GOST faster than by brute force, see [7,[9][10][11]. We also exploit these properties in this article.…”

Can GOST Be Made Secure Against Differential Cryptanalysis?

“…Since 2011, some 50 distinct attacks on GOST faster than brute force have been proposed [12,14] and a few other, including advanced differential attacks [12,13,[17][18][19]34]. This is particularly interesting because differential cryptanalysis (DC) is one of the oldest classical attacks on modern ciphers.…”