Cryptanalysis of Reduced sLiSCP Permutation in Sponge-Hash and Duplex-AE Modes

Abstract

This paper studies security of a family of lightweight permutations sLiSCP that was proposed by AlTawy et al. at SAC 2017. sLiSCP also specifies an authenticated encryption (AE) mode and a hashing mode based on the sponge framework, however the designers' analysis focuses on the indistinguishability of the permutation, and there is no analysis for those modes. This paper presents the first analysis of reduced-step sLiSCP in the AE and hashing modes fully respecting the recommended parameters and usage by the designers. Forgery and collision attacks are presented against 6 (out of 18) steps of the AE and hashing modes. Moreover, rebound distinguishers are presented against 15 steps of the permutation. We believe that those results especially about the AE and hashing modes provide a better understanding of sLiSCP, and bring more confidence about the lightweight version sLiSCP-light.

A Comprehensive Review of Lightweight Authenticated Encryption for IoT Devices

“…It occurs when the mechanism is prone to causing message payload manipulation but the message tag is accepted as valid [46]. The attack exploits the algorithm leaked state information to improve the differential success [74,75] and modify message payload and its packet header [76]. The adverse H launches a chosen plaintext forgery by obtaining the corresponding ciphertext of different consecutive blocks of the last algorithm block.…”

Improved Attacks on sLiSCP Permutation and Tight Bound of Limited Birthday Distinguishers

“…Liu et al [LSSW18] analyzed the differential properties of the sLiSCP permutation and presented a 15-step distinguisher for sLiSCP-192 and sLiSCP-256. They first focused on a 6-step iterative differential characteristic that maps a difference (0, 0, 0, α) to a difference (0, 0, 0, α).…”

“…According to the designers, the best distinguisher for sLiSCP-light is a zero-sum distinguisher for 14 steps. The designers of Spix and SpoC cited the work by Liu et al [LSSW18] but did not mention the possibility of applying the rebound attack on sLiSCP to sLiSCP-light.…”

“…To the best of our knowledge, there exists only a single third-party security analysis against sLiSCP [LSSW18] and no third-party analysis exists against sLiSCP-light. Liu et al [LSSW18] provided a forgery attack and a collision attack against 6-step sLiSCP in the AEAD mode and the hash mode. In addition, a LBD was presented against 15-step sLiSCP permutation.…”

“…For sLiSCP-light, the designers of Spix and SpoC argued that the best known distinguisher is a zero-sum distinguisher with a start-from-the-middle approach, which works up to 14 steps but requires data and time complexities equal to that of the exhaustive search. Although the designers of Spix and SpoC cited the work by Liu et al [LSSW18], no word is given on the possibility of applying the LBDs on sLiSCP to sLiSCP-light. In this paper we formally claim, for the first time, that 16-step sLiSCP-light can be attacked, using a similar procedure to the one on sLiSCP.…”