Can GOST Be Made Secure Against Differential Cryptanalysis?

Abstract

GOST is a well-known Russian government standard block cipher which was submitted to ISO in 2010 to become an international standard. A number of advanced differential attacks on GOST have been proposed including the best known single-key attack on GOST to date in 2 179 [14]. This attack, however, was designed for the oldest known set of GOST S-boxes hoping that similar attacks should exist for other versions of GOST. This claim was bitterly disputed by Russian researchers as recently as July 2012, who stated that ''S-boxes heavily affect security'' and ''with 'good' S-boxes the attack fails'' [32].Nothing can be more mistaken. In this article, the authors review 40 years of development of block ciphers in order to resist differential attacks. They study all ten known sets of GOST S-boxes. It appears that the choice of S-boxes has a limited effect on the actual security of GOST against advanced differential attacks. There is no evidence that the version of GOST submitted to ISO in 2011 is stronger than any previous version of GOST.

An Improved Differential Attack on Full GOST

“…A lot of research about Boolean functions and optimal resistance against DC have been done, in a totally unrealistic settings where small components of ciphers are studied in isolation regardless of how they are connected inside a cipher. This research leads to highly misleading results about types of strong or "optimal" S-boxes which [47,[50][51][52]13] are expected to protect ciphers against DC. In contrast in this paper we are going to make a rather very surprising claim that the security of a cipher such as GOST against DC does not depend that much on the S-boxes, but rather on the connections of the cipher, see Section 4 and [53,13,14,49,22,15,23,24].…”

“…Reportedly, Don Coppersmith has explained that defending against DC had been a design goal when DES was designed in 1970s and after discussions with NSA it was decided this technique should be kept confidential, in the context of the "competitive advantage" the United States enjoyed (compared to other countries) in the field of cryptography, cf. [28,13].…”

“…It is one of the oldest classical attacks on modern block ciphers, if not the oldest. We refer to [13] for a short historical survey. In cryptographic literature it was first described and analysed by Biham and Shamir [4,5,45] and applied to DES algorithm in early 1990s, and has been studied ever since [45,7].…”

“…On the contrary. Recent research shows that differential attacks on GOST work quite well across all (known or alternative] sets of S-boxes see [13,14,22,49].…”

“…The final key recovery step in various attacks is in many cases a software algebraic attack [26, 9,20] or/and a Meet-In-The-Middle attack [37,26,31,21]. In differential attacks key bits are guessed and confirmed by the differential properties [54,[10][11][12][13][14]49] and there have already been quite a few papers about advanced differential attacks on GOST [54, 10-13, 49, 14, 22, 15]. There is also several even more advanced "combination" attacks which combine the complexity reduction approach based on high-level self-similarity of [26,19, 9] with various advanced differential properties with 2,3 or 4 points, see [26,20].…”