Cryptographic Schemes Based on the ASASA Structure: Black-Box, White-Box, and Public-Key (Extended Abstract)

Biryukov, Alex; Bouillaguet, Charles; Khovratovich, Dmitry

doi:10.1007/978-3-662-45611-8_4

Cited by 85 publications

(114 citation statements)

References 44 publications

(61 reference statements)

Supporting

Mentioning

113

Contrasting

Order By: Relevance

“…The first attack on an ASASA scheme from [BBK14] was a decomposition attack targeting the expanding public-key scheme [GPT15], as mentioned in the introduction. Our techniques are entirely different, and target all ASASA schemes from [BBK14] except the one already broken in [GPT15].…”

Section: Related Workmentioning

confidence: 99%

“…Their approach focuses on small-block ASASA instances, and is thus only applicable to the white-box scheme of [BBK14]. Section 5 of [DDKL15] is essentially the same attack as ours, minus the heuristic improvements from our Section 6.3, which allow us, for instance, to break the 20-bit instance in practice with very limited means using this approach.…”

Section: Related Workmentioning

confidence: 99%

“…The attack technique is unrelated to the previous ones, and it relies on heuristics rather than a theoretical model. On the other hand it is very effective on the smallest white-box instances of [BBK14] (with a security level of 64 bits), which we break under a minute on a laptop computer. Thus it seems that the security offered by small-block ASASA is much lower than anticipated.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Key-Recovery Attacks on ASASA

et al. 2017

View full text Add to dashboard Cite

Abstract. The ASASA construction is a new design scheme introduced at Asiacrypt 2014 by Biryukov, Bouillaguet and Khovratovich. Its versatility was illustrated by building two public-key encryption schemes, a secret-key scheme, as well as super S-box subcomponents of a white-box scheme. However one of the two public-key cryptosystems was recently broken at Crypto 2015 by Gilbert, Plût and Treger. As our main contribution, we propose a new algebraic key-recovery attack able to break at once the secret-key scheme as well as the remaining public-key scheme, in time complexity 2 63 and 2 39 respectively (the security parameter is 128 bits in both cases). Furthermore, we present a second attack of independent interest on the same public-key scheme, which heuristically reduces the problem of breaking the scheme to an LPN instance with tractable parameters. This allows key recovery in time complexity 2 56 . Finally, as a side result, we outline a very efficient heuristic attack on the white-box scheme, which breaks instances claiming 64 bits of security under one minute on a laptop computer.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Key-Recovery Attacks on ASASA

et al. 2017

View full text Add to dashboard Cite

show abstract

“…For example, the attack targeting the SASAS construction has been recently extended to larger constructions [1]. The ASASA structure, which might look weaker at first glance due to its lower number of non-linear layers, has actually proved to be a challenging target; it was even proposed as the basis for public key encryption and white-box scheme [2]. Attacking this generic structure requires sophisticated methods presented in [3] and [4].…”

Section: Introductionmentioning

confidence: 99%

Algebraic Insights into the Secret Feistel Network

Perrin

Udovenko

2016

Fast Software Encryption

View full text Add to dashboard Cite

Abstract. We introduce the high-degree indicator matrix (HDIM), an object closely related with both the linear approximation table and the algebraic normal form (ANF) of a permutation. We show that the HDIM of a Feistel Network contains very specific patterns depending on the degree of the Feistel functions, the number of rounds and whether the Feistel functions are 1-to-1 or not. We exploit these patterns to distinguish Feistel Networks, even if the Feistel Network is whitened using unknown affine layers. We also present a new type of structural attack exploiting monomials that cannot be present at round − 1 to recover the ANF of the last Feistel function of a -round Feistel Network. Finally, we discuss the relations between our findings, integral attacks, cube attacks, Todo's division property and the congruence modulo 4 of the Linear Approximation Table.

show abstract

“…in [5]. In this paper, Biryukov et al describe a memory-hard white-box encryption scheme relying on a SPN with large S-Boxes built like smaller SPN.…”

Section: Introductionmentioning

confidence: 99%

Cryptanalysis of Feistel Networks with Secret Round Functions

Biryukov

Leurent

Perrin

2016

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Abstract. Generic distinguishers against Feistel Network with up to 5 rounds exist in the regular setting and up to 6 rounds in a multi-key setting. We present new cryptanalyses against Feistel Networks with 5, 6 and 7 rounds which are not simply distinguishers but actually recover completely the unknown Feistel functions. When an exclusive-or is used to combine the output of the round function with the other branch, we use the so-called yoyo game which we improved using a heuristic based on particular cycle structures. The complexity of a complete recovery is equivalent to O(2 2n ) encryptions where n is the branch size. This attack can be used against 6-and 7-round Feistel Networks in time respectively O(2 n2 n−1 +2n ) and O(2 n2 n +2n ). However when modular addition is used, this attack does not work. In this case, we use an optimized guess-and-determine strategy to attack 5 rounds with complexity O(2 n2 3n/4 ). Our results are, to the best of our knowledge, the first recovery attacks against generic 5-, 6-and 7-round Feistel Networks.

show abstract

Cryptographic Schemes Based on the ASASA Structure: Black-Box, White-Box, and Public-Key (Extended Abstract)

Cited by 85 publications

References 44 publications

Key-Recovery Attacks on ASASA

Key-Recovery Attacks on ASASA

Algebraic Insights into the Secret Feistel Network

Cryptanalysis of Feistel Networks with Secret Round Functions

Contact Info

Product

Resources

About