Constructing a Set of Weak Values for Full-round MD4 Hash Function

Gribanova, Irina; Семенов, А. А.

doi:10.23919/mipro48935.2020.9245337

Cited by 4 publications

(3 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In particular, we studied the problem of inversion of function f Biv : {0, 1} 177 → {0, 1} 200 . The cryptanalysis of Trivium was considered as the problem of finding a secret key with a known initial value (IV) of length 80 and the known keystream fragment of length 300 bits, thus in the case of Trivium we analyzed the inversion problem for function f Triv−M : {0, 1} 80 → {0, 1} 300 , where M is the number of initialization steps (the corresponding parameter is a part of the specification of the Trivium algorithm [35]).…”

Section: A Considered Functions and Their Encodingsmentioning

confidence: 99%

“…After the initialization phase, Trivium can generate keystream of an arbitrary length. We considered the problems of the kind f Triv−M : {0, 1} 80 → {0, 1} 300 , where by Trivium-M we denote a variant of Trivium with the number of initialization steps equal to M.…”

Section: E Linearizing Set Attacks On Weakened Variants Of Triviummentioning

confidence: 99%

“…In recent years, there appeared a number of papers on SAT-based cryptographic attacks which employ the ideas of cube-andconquer and SAT partitioning, see e.g. [23], [79], [80], and [81], etc.…”

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

Using Linearizing Sets to Solve Multivariate Quadratic Equations in Algebraic Cryptanalysis

Semenov,

Antonov,

Kochemazov

et al. 2023

IEEE Access

Self Cite

View full text Add to dashboard Cite

In this paper we describe a class of cryptographic guess-and-determine attacks which is based on the notion of a linearizing set. A linearizing set-based attack is applied to a system of Multivariate Quadratic equations (MQ) over GF(2) field, which encodes how a considered cryptographic function works. By substituting into such MQ system a random (in some strict sense) assignment of variables from a linearizing set we aim to transform the system into a linear one. We introduce a probability of such an event and call it a probability of linearization. Then we describe a guess-and-determine attack, the hardness of which can be expressed via a probability of linearization. To estimate the latter it is possible to use a simple Monte Carlo algorithm. Also we describe a technique that allows to augment a considered MQ system by new linear equations and to construct a new MQ system, for which the probability of linearization is usually larger than that for an original one. For this purpose we apply a SAT oracle to a Boolean formula that is naturally associated with a considered MQ system. Finally, we reduce the problem of searching for a linearizing set that yields the best effectiveness of a constructed guess-and-determine attack to a pseudo-Boolean optimization problem, which can be solved using metaheuristic optimization algorithms. The important consequence of this is that this way we can construct guess-and-determine attacks automatically by solving the corresponding optimization problem. In the computational experiments we used the proposed methodology to construct attacks on several well-known stream ciphers. The runtime estimations of some of the attacks make it possible to implement them in reasonable time.INDEX TERMS Algebraic cryptanalysis, guess-and-determine attack, system of multivariate quadratic equations, Boolean satisfiability, pseudo-Boolean optimization, evolutionary algorithm.

show abstract

Section: A Considered Functions and Their Encodingsmentioning

confidence: 99%

Section: E Linearizing Set Attacks On Weakened Variants Of Triviummentioning

confidence: 99%