Internal Differential Boomerangs: Practical Analysis of the Round-Reduced Keccak- $$f$$ f Permutation

Jean, Jérémy; Nikolić, Ivica

doi:10.1007/978-3-662-48116-5_26

Cited by 20 publications

(9 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Since the competition SHA-3, the Keccak-p permutation (described in 2.3) has been widely analyzed [BCC11,DGPW12,JN15]. In the literature, reduced versions of Ketje have been cryptanalyzed with cube attacks [DLWQ17] and linearization techniques [GLS16].…”

Section: Related Workmentioning

confidence: 99%

State-Recovery Attacks on Modified Ketje Jr

Fuhr¹,

Naya-Plasencia²,

Rotella³

2018

ToSC

View full text Add to dashboard Cite

In this article we study the security of the authenticated encryption algorithm Ketje against divide-and-conquer attacks. Ketje is a third-round candidate in the ongoing CAESAR competition, which shares most of its design principles with the SHA-3 hash function. Several versions of Ketje have been submitted, with different sizes for its internal state. We describe several state-recovery attacks on the smaller variant, called Ketje Jr. We show that if one increases the amount of keystream output after each round from 16 bits to 40 bits, Ketje Jr becomes vulnerable to divide-and-conquer attacks with time complexities 271.5 for the original version and 282.3 for the current tweaked version, both with a key of 96 bits. We also propose a similar attack when considering rates of 32 bits for the non-tweaked version. Our findings do not threaten the security of Ketje, but should be taken as a warning against potential future modifications that would aim at increasing the performance of the algorithm.

show abstract

Section: Related Workmentioning

confidence: 99%

State-Recovery Attacks on Modified Ketje Jr

Fuhr¹,

Naya-Plasencia²,

Rotella³

2018

ToSC

View full text Add to dashboard Cite

show abstract

“…While arguably the majority of the analyses focuses on the 1600-bit variant of the Keccak-f permutation, the similarity in structure of the permutation usually allows to apply the same techniques on smaller permutation variants. A good overview on existing analysis results on Keccak can be found in [JN15]. In this section, we recapitulate the from our point of view most relevant attacks on Keccak and discuss the applicability to our schemes.…”

Section: Security Analysismentioning

confidence: 99%

ISAP – Towards Side-Channel Secure Authenticated Encryption

Dobraunig

Eichlseder

Mangard

et al. 2017

ToSC

View full text Add to dashboard Cite

Side-channel attacks and in particular differential power analysis (DPA) attacks pose a serious threat to cryptographic implementations. One approach to counteract such attacks are cryptographic schemes based on fresh re-keying. In settings of pre-shared secret keys, such schemes render DPA attacks infeasible by deriving session keys and by ensuring that the attacker cannot collect side-channel leakage on the session key during cryptographic operations with different inputs. While these schemes can be applied to secure standard communication settings, current re-keying approaches are unable to provide protection in settings where the same input needs to be processed multiple times. In this work, we therefore adapt the re-keying approach and present a symmetric authenticated encryption scheme that is secure against DPA attacks and that does not have such a usage restriction. This means that our scheme fully complies with the requirements given in the CAESAR call and hence, can be used like other noncebased authenticated encryption schemes without loss of side-channel protection. Its resistance against side-channel analysis is highly relevant for several applications in practice, like bulk storage settings in general and the protection of FPGA bitfiles and firmware images in particular.

show abstract

“…As one of the most important cryptographic standards, Keccak attracts a lot of attention from world wide researchers and engineers. Till now, many cryptanalysis results [BCC11,DDS12,DDS13,DGPW12,GLS16,JN15,MPS13] and evaluation tools [DA12,DEM15,MDA17] have been proposed, including the recent impressive collision attacks [QSLG17,SLG17].…”

Section: Introductionmentioning

confidence: 99%

New Conditional Cube Attack on Keccak Keyed Modes

Li¹,

Dong²,

Bi³

et al. 2019

ToSC

View full text Add to dashboard Cite

The conditional cube attack on round-reduced Keccak keyed modes was proposed by Huang et al. at EUROCRYPT 2017. In their attack, a conditional cube variable was introduced, whose diffusion was significantly reduced by certain key bit conditions. The attack requires a set of cube variables which are not multiplied in the first round while the conditional cube variable is not multiplied with other cube variables (called ordinary cube variables) in the first two rounds. This has an impact on the degree of the output of Keccak and hence gives a distinguisher. Later, the MILP method was applied to find ordinary cube variables. However, for some Keccak based versions with few degrees of freedom, one could not find enough ordinary cube variables, which weakens or even invalidates the conditional cube attack.In this paper, a new conditional cube attack on Keccak is proposed. We remove the limitation that no cube variables multiply with each other in the first round. As a result, some quadratic terms may appear in the first round. We make use of some new bit conditions to prevent the quadratic terms from multiplying with other cube variables in the second round, so that there will be no cubic terms in the first two rounds. Furthermore, we introduce the kernel quadratic term and construct a 6-2-2 pattern to reduce the diffusion of quadratic terms significantly, where the Θ operation even in the second round becomes an identity transformation (CP-kernel property) for the kernel quadratic term. Previous conditional cube attacks on Keccak only explored the CP-kernel property of Θ operation in the first round. Therefore, more degrees of freedom are available for ordinary cube variables and fewer bit conditions are used to remove the cubic terms in the second round, which plays a key role in the conditional cube attack on versions with very few degrees of freedom. We also use the MILP method in the search of cube variables and give key-recovery attacks on round-reduced Keccak keyed modes.As a result, we reduce the time complexity of key-recovery attacks on 7-round Keccak-MAC-512 and 7-round Ketje Sr v2 from 2111, 299 to 272, 277, respectively. Additionally, we have reduced the time complexity of attacks on 9-round KMAC256 and 7-round Ketje Sr v1. Besides, practical attacks on 6-round Ketje Sr v1 and v2 are also given in this paper for the first time.

show abstract

Internal Differential Boomerangs: Practical Analysis of the Round-Reduced Keccak- $$f$$ f Permutation

Cited by 20 publications

References 27 publications

State-Recovery Attacks on Modified Ketje Jr

State-Recovery Attacks on Modified Ketje Jr

ISAP – Towards Side-Channel Secure Authenticated Encryption

New Conditional Cube Attack on Keccak Keyed Modes

Contact Info

Product

Resources

About