Improved Key Recovery Attacks on Simplified Version of K2 Stream Cipher

Abstract

The K2 stream cipher, designed for 32-bit words, is an ISO/IEC 18033 standard and is listed as a recommended algorithm used by the Japanese government in the CRYPTREC project. The main feature of the K2 algorithm is the use of a dynamic feedback control mechanism between the two linear feedback shift registers, which makes the analysis of the K2 algorithm more difficult. In this paper, for its simplified version algorithm, a key recovery attack is performed by using differential attacks. Firstly, for the unknown key, the same IV is fixed in two chosen IV differential attacks, and we use the input differences and the output differences of the S-box to recover the input of S-box; the internal state values can be uniquely determined by taking intersection of the input of S-box. This technology is used to improve the key recovery attack of seven-round algorithm proposed by Deike Priemuth-Schmid. Secondly, we find the constraint relationship between the keystream equations and the unknown differences by introducing the guess difference bit and eliminate the impossible differences by the constraint relationship. Thus, we expand the key recovery attack from seven to nine rounds. The time complexity of the attack is $\boldsymbol{O} \boldsymbol{(2^{113.93})}$, the data complexity is $\boldsymbol{O}\boldsymbol{(2^{8.71})}$ and the success rate is $\textbf{99.07\%}$.

Features of Using Large Keys in "Kalyna" Algorithm

“…Taking into account the positive world experience of cryptographic competitions CRYPTREC [13], NESSIE [14], AES [15] and SHA3 [16], the State Service for Special Communications and Data Protection of Ukraine successfully held a national open competition of symmetric block cryptographic algorithms in 2007-2010 [17], which defeated the algorithm "Kalyna" [18], Kharkiv developers of the Institute of Information Technology [19], on the basis of which the national standard of Ukraine was developed [20]. As it has been described above, the new algorithm should provide greater cryptographic transformation speed compared to the AES algorithm [5], as well as have a higher level of stability against AES [5].…”

Key-Dependent Feedback Configuration Matrix of Primitive σ–LFSR and Resistance to Some Known Plaintext Attacks

“…This converts the deterministic linear recurrence of some registers into a probabilistic recurrence. However, key recovery attacks on K2 and A5 have been reported in literature ( [23])( [24]).…”