Automatic Search of Attacks on Round-Reduced AES and Applications

Abstract

Abstract. In this paper, we describe versatile and powerful algorithms for searching guess-and-determine and meet-in-the-middle attacks on byte-oriented symmetric primitives. To demonstrate the strengh of these tool, we show that they allows to automatically discover new attacks on round-reduced AES with very low data complexity, and to find improved attacks on the AES-based MACs Alpha-MAC and Pelican-MAC, and also on the AES-based stream cipher LEX. Finally, the tools can be used in the context of fault attacks. These algorithms exploit the algebraically simple byte-oriented structure of the AES. When the attack found by the tool are practical, they have been implemented and validated.

Faster Chosen-Key Distinguishers on Reduced-Round AES

“…Consequently, the input and output of the AddRoundKey operation are known, which determines the four bytes of k. In the end, we find the 2 16 solutions of Problem 1 in time 2 16 operations. To apply this strategy to the 8-round truncated differential characteristic of Figure 9, we start by randomizing the difference ∆y 2 , the difference ∆w 5 and the values in the first column of w 5 . Due to the linear operations involved, we deduce ∆x 3 = ∆w 2 from ∆y 2 and ∆y 4 from ∆w 4 .…”

“…We continue by observing that the randomization of the bytes in w 4 actually sets the value of two diagonal bytes in k 5 , k 5 [0] and k 5 [5], which imposes constraints of the elements in the lists L i . We start by considering the 2 16 elements of L 3 , and for each of them, we .…”

“…Again, this adds an 8-bit constraint on the elements of L 1 : we expect 2 8 of them to match the condition on k 4 [5]. In total, we could construct a list L 0,1,3 of size 2 24+8 = 2 32 , whose elements would be the columns 0, 1 and 3 of x 4 and k 4 , but as soon as we get 2 24 elements in that list, we stop and discard the remaining possibilities.…”

“…This allows to deduce ∆x 2 , ∆y 2 , and ∆x 3 . Then, we also set random values for ∆w 5 and for the diagonal of x 5 to obtain both ∆x 5 and ∆y 4 . Now, we find a value for ∆x 4 , which is compatible with ∆x 3 and ∆y 4 .…”

“…Related-key attacks and meet-in-the-middle attacks that begin in the middle of the cipher (also known as splice-and-cut attacks) have been proposed to attack the full number of rounds for each AES versions [1,2,4], while other techniques exist for smaller version [5]. This interesting connection between hash functions and block ciphers shows that any improvement on hash function cryptanalysis can be useful for attacking block ciphers and vice-versa.…”