Low-Memory Attacks Against Two-Round Even-Mansour Using the 3-XOR Problem

Abstract

The iterated Even-Mansour construction is an elegant construction that idealizes block cipher designs such as the AES. In this work we focus on the simplest variant, the 2-round Even-Mansour construction with a single key. This is the most minimal construction that offers security beyond the birthday bound: there is a security proof up to 2 2n/3 evaluations of the underlying permutations and encryption, and the best known attacks have a complexity of roughly 2 n /n operations. We show that attacking this scheme with block size n is related to the 3-XOR problem with element size = 2n, an important algorithmic problem that has been studied since the nineties. In particular the 3-XOR problem is known to require at least 2 /3 queries, and the best known algorithms require around 2 /2 / operations: this roughly matches the known bounds for the 2-round Even-Mansour scheme. Using this link we describe new attacks against the 2-round Even-Mansour scheme. In particular, we obtain the first algorithms where both the data and the memory complexity are significantly lower than 2 n. From a practical standpoint, previous works with a data and/or memory complexity close to 2 n are unlikely to be more efficient than a simple brute-force search over the key. Our best algorithm requires just λn known plaintext/ciphertext pairs, for some constant 0 < λ < 1, 2 n /λn time, and 2 λn memory. For instance, with n = 64 and λ = 1/2, the memory requirement is practical, and we gain a factor 32 over brute-force search. We also describe an algorithm with asymptotic complexity O(2 n ln 2 n/n 2), improving the previous asymptotic complexity of O(2 n /n), using a variant of the 3-SUM algorithm of Baran, Demaine, and Pǎtraşcu.

Computational records with aging hardware: Controlling half the output of SHA-256

“…This problem has recently seen a renewed interest because of its potential use in cryptanalysis: it is used as a building block in a generic attack [Nan15] against the COPA [ABL + 13] mode of operation for authenticated encryption. Another recent attack [LS19] against the two-round single-key Even-Mansour cipher [EM91] also works by reducing it to a 3XOR computation. An instance of the 3XOR problem can be solved by several algorithms summarized in Table 1.…”

Fine-Grained Cryptanalysis: Tight Conditional Bounds for Dense k-SUM and k-XOR

“…The first line of work is the quest for designing better algorithms for generalized birthday problems, where the goal is to find a single k-SUM or k-XOR solution out of many. The systematic analysis of this problem was initiated by Wagner [35] in his k-tree algorithm, 2 and has led to numerous refined algorithms and applications thereof [13,22,24,29,31].…”

“…Similarly to 3-SUM, a simple filtering algorithm has complexity T = Õ(N/r) for N 1/3 ≤ r ≤ N 1/2 . The dense 3-XOR problem has various applications in cryptography and cryptanalysis [9,14,22,24,31]. While mild (logarithmic in N ) improvements to the simple filtering algorithm are known [22,24,31], any substantial (i.e., polynomial in N ) improvement would be considered a breakthrough.…”

“…Then |M p,q,r (S)| ≤ O(1/(pq)).Proof. By (21) we haveM p,q,r (S) = p 2 Pr[ S, x = S, y = 0] − 1 (p − 1) 2 .By(24) we have Pr[ S, x = S, y = 0] ≤ O(1/(pq)).These two estimates yield the desirable |M p,q,r (S)| = O(1/(pq) + 1/p 2 ) = O(1/(pq)).…”

Cryptanalysis of LowMC instances using single plaintext/ciphertext pair

“…This attack was later refined in [NS15], using an improved 3-xor algorithm, to 2 n/2− queries and 2 n/2− )operations, for small . In [LS19], the authors attacked the 2-round Even Mansour algorithm using this problem with data and time both lower than 2 n . However, the algorithm we use was proposed by Joux [Jou09, Section 8.3.3.1], which is the best algorithm for the 3-xor problem to this day.…”