Cryptanalysis of MORUS

Ashur, Tomer; Eichlseder, Maria; Lauridsen, Martin M.; Leurent, Gaëtan; Minaud, Brice; Rotella, Yann; Sasaki, Yu; Viguier, Benoît

doi:10.1007/978-3-030-03329-3_2

Cited by 7 publications

(36 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The model we proposed is generic and can be applied to many other schemes, which is of independent interest. Eventually, using MILP based approach, we identify trails of all versions of MORUS which lead to significant improvement over the previous attack on MORUS-1280-256 presented by Ashur et al [2]. Generally, the complexity is reduced from 2 152 to 2 76 .…”

Section: Introductionmentioning

confidence: 93%

“…A major breakthrough on the cryptanalysis of MORUS was made at ASI-ACRYPT 2018 [2]. In this work, based on rotational-invariant linear approximations, Ashur et al transfered linear approximations for a state-reduced version of MORUS (named as MiniMORUS) to linear approximations for MORUS.…”

Section: Introductionmentioning

confidence: 99%

“…In this work, we investigate the problem of computing the correlation of quadratic Boolean functions. By transforming a quadratic Boolean function into its so-called disjoint quadratic form, we propose, to the best of our knowledge, the first polynomial time algorithm that can determine the correlation of an arbitrary quadratic Boolean function, while in previous work (e.g., [2]), such correlations are computed with exhaustive or quite ad-hoc approaches which intrinsically limits their effectiveness.…”

Section: Introductionmentioning

confidence: 99%

“…We verify the attacks on a reduced version of MORUS. Also, following Ashur et al's approach [2], we verify all trail fragments for all versions of full MORUS.…”

Section: Introductionmentioning

confidence: 99%

“…Along the way, we make an interesting observation that the condition imposed on Ashur et al's attack can be relaxed. Specifically, the attacks actually only require that enough plaintexts with a common prefix of certain size are encrypted, rather than the same plaintext is encrypted enough times as stated in [2]. This observation motivates us to find trails involving a smaller number of ciphertext blocks, since the common-prefix assumption does occur in some practical protocols.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Correlation of Quadratic Boolean Functions: Cryptanalysis of All Versions of Full $$\mathsf {MORUS}$$

Shi

Sun

Sasaki³

et al. 2019

Advances in Cryptology – CRYPTO 2019

Self Cite

View full text Add to dashboard Cite

We show that the correlation of any quadratic Boolean function can be read out from its so-called disjoint quadratic form. We further propose a polynomial-time algorithm that can transform an arbitrary quadratic Boolean function into its disjoint quadratic form. With this algorithm, the exact correlation of quadratic Boolean functions can be computed efficiently.We apply this method to analyze the linear trails of MORUS (one of the seven finalists of the CAESAR competition), which are found with the help of a generic model for linear trails of MORUS-like key-stream generators. In our model, any tool for finding linear trails of block ciphers can be used to search for trails of MORUS-like key-stream generators. As a result, a set of trails with correlation 2 −38 is identified for all versions of full MORUS, while the correlations of previously published best trails for MORUS-640 and MORUS-1280 are 2 −73 and 2 −76 respectively (ASIACRYPT 2018). This significantly improves the complexity of the attack on MORUS-1280-256 from 2 152 to 2 76 . These new trails also lead to the first distinguishing and message-recovery attacks on MORUS-640-128 and MORUS-1280-128 with surprisingly low complexities around 2 76 . Moreover, we observe that the condition for exploiting these trails in an attack can be more relaxed than previously thought, which shows that the new trails are superior to previously published ones in terms of both correlation and the number of ciphertext blocks involved.

show abstract

Section: Introductionmentioning

confidence: 93%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

“…We verify the attacks on a reduced version of MORUS. Also, following Ashur et al's approach [2], we verify all trail fragments for all versions of full MORUS.…”

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Correlation of Quadratic Boolean Functions: Cryptanalysis of All Versions of Full $$\mathsf {MORUS}$$

Shi

Sun

Sasaki³

et al. 2019

Advances in Cryptology – CRYPTO 2019

Self Cite

View full text Add to dashboard Cite

show abstract

Algebraic Cryptanalysis of Variants of Frit

Dobraunig

Eichlseder

Mendel

et al. 2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Security analysis of Subterranean 2.0

Song

Shi

et al. 2021

Des. Codes Cryptogr.

View full text Add to dashboard Cite

Subterranean 2.0 is a cipher suite that can be used for hashing, authenticated encryption, MAC computation, etc. It was designed by Daemen, Massolino, Mehrdad, and Rotella, and has been selected as a candidate in the second round of NIST’s lightweight cryptography standardization process. Subterranean 2.0 is a duplex-based construction and utilizes a single-round permutation in the duplex. It is the simplicity of the round function that makes it an attractive target of cryptanalysis. In this paper, we examine the single-round permutation in various phases of Subterranean 2.0 and specify three related attack scenarios that deserve further investigation: keystream biases in the keyed squeezing phase, state collisions in the keyed absorbing phase, and one-round differential analysis in the nonce-misuse setting. To facilitate cryptanalysis in the first two scenarios, we novelly propose a set of size-reduced toy versions of Subterranean 2.0: Subterranean-m. Then we make an observation for the first time on the resemblance between the non-linear layer in the round function of Subterranean 2.0 and SIMON’s round function. Inspired by the existing work on SIMON, we propose explicit formulas for computing the exact correlation of linear trails of Subterranean 2.0 and other ciphers utilizing similar non-linear operations. We then construct our models for searching trails to be used in the keystream bias evaluation and state collision attacks. Our results show that most instances of Subterranean-m are secure in the first two attack scenarios but there exist instances that are not. Further, we find a flaw in the designers’ reasoning of Subterranean 2.0’s linear bias but support the designers’ claim that there is no linear bias measurable from at most $$2^{96}$$ 2 96 data blocks. Due to the time-consuming search, the security of Subterranean 2.0 against the state collision attack in keyed modes still remains an open question. Finally, we observe that one-round differentials allow to recover state bits in the nonce-misuse setting. By proposing nested one-round differentials, we obtain a sufficient number of state bits, leading to a practical state recovery with only 20 repetitions of the nonce and 88 blocks of data. It is noted that our work does not threaten the security of Subterranean 2.0.

show abstract

Cryptanalysis of MORUS

Cited by 7 publications

References 13 publications

Correlation of Quadratic Boolean Functions: Cryptanalysis of All Versions of Full $$\mathsf {MORUS}$$

Correlation of Quadratic Boolean Functions: Cryptanalysis of All Versions of Full $$\mathsf {MORUS}$$

Algebraic Cryptanalysis of Variants of Frit

Security analysis of Subterranean 2.0

Contact Info

Product

Resources

About