Integral and impossible‐differential attacks on the reduced‐round Lesamnta‐LW‐BC

Abstract

Lesamnta-LW-BC is the internal block cipher of the Lesamnta-LW lightweight hash function, specified in ISO/IEC 29192-5:2016. It is based on the unbalanced Feistel network and Advanced Encryption Standard round function. In this study, the security of Lesamnta-LW-BC against integral and impossible-differential attacks is evaluated. Specifically, the authors searched for the integral distinguishers and impossible differentials with Mixed-Integer Linear Programming-based methods. As a result, the discovered impossible differential can reach up to 21 rounds, while three integral distinguishers reaching 18, 19 and 25 rounds are obtained, respectively. Moreover, it is also feasible to construct a 47-round integral distinguisher in the known-key setting. Finally, a 20-round key-recovery attack is proposed based on the discovered 18-round integral distinguisher and a 19-round key-recovery attack using a 17-round impossible differential. To the best of the authors' knowledge, this is the first third-party cryptanalysis of Lesamnta-LW-BC.

Security evaluation on type‐1 and type‐1‐like 4‐branch generalized Feistel structures and application to reduced‐round Lesamnta‐LW‐BC

“…Since it contains more impossible differentials than that in Ref. [19], it is more suitable to attack Lesamnta‐LW‐BC. By exploiting this 21‐round truncated impossible differential, 27‐round impossible differential attack on Lesamnta‐LW‐BC will be mounted.…”

“…In addition, compared with the previous distinguisher whose α = ( a 0 , 0, 0, 0, 0, 0, 0, 0) and β = ( b 0 , 0, 0, 0, 0, 0, 0, 0) in Ref. [19], the input differences of ours are the same, while the output differences β = ( b 0 , b 1 , b 2 , b 3 , 0, 0, 0, 0) can be any non‐zero 32‐bit word for the first 4 bytes instead of being restricted to the first byte. Obviously, our truncated distinguisher contains more impossible differentials than before.…”

“…Given that the key schedule does not affect the construction of the impossible differentials, it is omitted in this paper and can be referred to Ref. [19]. Furthermore, the F function of Lesamnta‐LW‐BC is given as shown in Figure 2.…”

“…Lesamnta-LW is a lightweight hash function specified in ISO/ IEC 29192-5:2016 [18]. Its internal block cipher is named Lesamnta-LW-BC [19]. In 2021, Shiba, R., et al showed the first third-party cryptanalysis of Lesamnta-LW-BC against integral and impossible differential attacks [19] as shown in Table 2.…”

“…Its internal block cipher is named Lesamnta-LW-BC [19]. In 2021, Shiba, R., et al showed the first third-party cryptanalysis of Lesamnta-LW-BC against integral and impossible differential attacks [19] as shown in Table 2. Specifically, for the impossible differential attack, they found 21-round impossible differentials and attacked 19-round Lesamnta-LW-BC with a 17-round distinguisher.…”