Cube Attacks on Non-Blackbox Polynomials Based on Division Property

Todo, Yosuke; Isobe, Takanori; Hao, Yonglin; Meier, Willi

doi:10.1007/978-3-319-63697-9_9

Cited by 72 publications

(134 citation statements)

References 25 publications

Supporting

Mentioning

134

Contrasting

Order By: Relevance

“…By using a 72-dimensional cube, Todo et al propose a theoretic cube attack on 832-round Trivium. They also largely improve the previous best attacks on other primitives namely Acorn, Grain-128a and Kreyvium [14,24]. It is not until recently that the result on Trivium has been improved by Liu et al [6] mounting to 835 rounds with a new method called the correlation cube attack.…”

Section: Introductionmentioning

confidence: 78%

“…Due to [14,24], the power of cube attacks has been enhanced significantly, however, there are still problems remaining unhandled that we will reveal explicitly.…”

Section: Motivationsmentioning

confidence: 96%

“…So the sizes of the cubes are largely confined. Breakthroughs have been made by Todo et al in [14] where they introduce the bit-based division property, a tool for conducting integral attacks 1 , to the realm of cube attack. With the help of mixed integer linear programming (MILP) aided division property, they can identify the variables excluded from the superpoly and explore cubes with larger size, e.g.,72 for 832-round Trivium.…”

Section: Introductionmentioning

confidence: 99%

“…In [14], Todo et al adapt Xiang et al's method by taking key bits into the MILP model. With this technique, a set of key indices J = {j 1 , j 2 , .…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Improved Division Property Based Cube Attacks Exploiting Algebraic Properties of Superpoly

Hao

Isobe

Jiao³

et al. 2019

IEEE Trans. Comput.

Self Cite

View full text Add to dashboard Cite

The cube attack is an important technique for the cryptanalysis of symmetric key primitives, especially for stream ciphers. Aiming at recovering some secret key bits, the adversary reconstructs a superpoly with the secret key bits involved, by summing over a set of the plaintexts/IV which is called a cube. Traditional cube attack only exploits linear/quadratic superpolies. Moreover, for a long time after its proposal, the size of the cubes has been largely confined to an experimental range, e.g., typically 40. These limits were first overcome by the division property based cube attacks proposed by Todo et al. at CRYPTO 2017. Based on MILP modelled division property, for a cube (index set) I, they identify the small (index) subset J of the secret key bits involved in the resultant superpoly. During the precomputation phase which dominates the complexity of the cube attacks, 2 |I|+|J| encryptions are required to recover the superpoly. Therefore, their attacks can only be available when the restriction |I| + |J| < n is met. In this paper, we introduced several techniques to improve the division property based cube attacks by exploiting various algebraic properties of the superpoly. 1. We propose the "flag" technique to enhance the preciseness of MILP models so that the proper non-cube IV assignments can be identified to obtain a non-constant superpoly. 2. A degree evaluation algorithm is presented to upper bound the degree of the superpoly. With the knowledge of its degree, the superpoly can be recovered without constructing its whole truth table. This enables us to explore larger cubes I's even if |I| + |J| ≥ n. Corresponding authors. 3. We provide a term enumeration algorithm for finding the monomials of the superpoly, so that the complexity of many attacks can be further reduced. As an illustration, we apply our techniques to attack the initialization of several ciphers. To be specific, our key recovery attacks have mounted to 839-round Trivium, 891-round Kreyvium, 184-round Grain-128a and 750-round Acorn respectively.

show abstract

Section: Introductionmentioning

confidence: 78%

“…Due to [14,24], the power of cube attacks has been enhanced significantly, however, there are still problems remaining unhandled that we will reveal explicitly.…”

Section: Motivationsmentioning

confidence: 96%

Section: Introductionmentioning

confidence: 99%

“…In [14], Todo et al adapt Xiang et al's method by taking key bits into the MILP model. With this technique, a set of key indices J = {j 1 , j 2 , .…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Improved Division Property Based Cube Attacks Exploiting Algebraic Properties of Superpoly

Hao

Isobe

Jiao³

et al. 2019

IEEE Trans. Comput.

Self Cite

View full text Add to dashboard Cite

show abstract

“…Among the most challenging cryptanalytic problems that we want to look at, we may cite the ones studied in [CHP + 18] that directly implement particular attacks from related key differential characteristics and the recent results obtained using ILP solvers for studying the so-called division properties in an other symmetric key encryption primitive, the stream ciphers [TIHM17].…”

Section: Resultsmentioning

confidence: 99%

Computing AES related-key differential characteristics with constraint programming

Gerault

Lafourcade

Minier

et al. 2020

Artificial Intelligence

View full text Add to dashboard Cite

Cryptanalysis aims at testing the properties of encryption processes, and this usually implies solving hard optimization problems. In this paper, we focus on related-key differential attacks for the Advanced Encryption Standard (AES), which is the encryption standard for block ciphers. To mount these attacks, cryptanalysts need to solve the optimal related-key differential characteristic problem. Dedicated approaches do not scale well for this problem, and need weeks to solve its hardest instances. In this paper, we improve existing Constraint Programming (CP) approaches for computing optimal related-key differential characteristics: we add new constraints that detect inconsistencies sooner, and we introduce a new decomposition of the problem in two steps. These improvements allow us to compute all optimal related-key differential characteristics for AES-128, AES-192 and AES-256 in a few hours.

show abstract

Higher Order Differentials, Integral Attacks and Variants

CANTEAUT

2023

Symmetric Cryptography 2

View full text Add to dashboard Cite

Cube Attacks on Non-Blackbox Polynomials Based on Division Property

Cited by 72 publications

References 25 publications

Improved Division Property Based Cube Attacks Exploiting Algebraic Properties of Superpoly

Improved Division Property Based Cube Attacks Exploiting Algebraic Properties of Superpoly

Computing AES related-key differential characteristics with constraint programming

Higher Order Differentials, Integral Attacks and Variants

Contact Info

Product

Resources

About