Fast Key Recovery Attack on ARMADILLO1 and Variants

Abstract

Abstract. The ARMADILLO cryptographic primitive is a multi-purpose cryptographic primitive for RFID devices proposed at CHES'10. The main purpose of the primitive is to provide a secure authentication in a challenge-response protocol. It has two versions, named ARMADILLO (subsequently denoted by AR-MADILLO1) and ARMADILLO2. However, we found a fatal weakness in the design which allows a passive attacker to recover the secret key in polynomial time, of ARMADILLO1 and some generalizations. We introduce some intermediate designs which try to prevent the attack and link ARMADILLO1 to ARMADILLO2. Considering the fact that the attack against ARMADILLO1 is polynomial, this brings about some concerns into the security of the second version ARMADILLO2, although it remains unbroken so far.

Multipurpose Cryptographic Primitive ARMADILLO3

“…The ARMADILLO3 is the third generation of the multipurpose cryptographic function ARMADILLO [3] introduced at CHES'10. The new version ARMADILLO3 prevents all known attacks against the ARMADILLO [22] design and the attack against ARMADILLO2 based on parallel matching [1], and Hamming weight preservation in PRNG mode [19]. We provide a security analysis against known types of attacks and discuss some dedicated attacks and counter-measures.…”

“…That is, we use an internal function P defined by P (p b, Z) = P (p, S(Z σ b )) iteratively, where b is the tailing bit of the first operand p b, S is a substitution layer, σ b is a permutation (σ 0 or σ 1 ) and Z σ b denotes the transposition of Z based on permutation σ b . The extension ARMADILLO3 adopts a preprocessing to prevent the known attacks against ARMADILLO1 reported in [22], and it introduces a reduced-size S-box layer to improve the confusion of ARMADILLO2 which lead to a practical low complexity attack reported in [19].…”

Cryptanalysis of ARMADILLO2

“…For both primitives, several applications are proposed: fixed input-length MAC (FIL-MAC), pseudo-random number generator/pseudo-random function (PRNG/PRF), and hash function. In [6], authors present a polynomial attack on ARMADILLO1. Even if the design of ARMADILLO2 is similar to the design of the first version, authors of [6] claim that this attack can not be applied on ARMADILLO2.…”

“…In [6], authors present a polynomial attack on ARMADILLO1. Even if the design of ARMADILLO2 is similar to the design of the first version, authors of [6] claim that this attack can not be applied on ARMADILLO2.…”

Practical Cryptanalysis of ARMADILLO2

“…Originally, two versions were proposed, ARMADILLO and ARMADILLO2, the later being the recommended one. A key recovery attack on ARMADILLO was rapidly published by a subset of the designers [9]. ARMADILLO2 remained unbroken until Abdelraheem et al [1] found a meet-in-the-middle technique that allows to invert the ARMADILLO2 main function.…”