On Multiple Symmetric Fixed Points in GOST

Abstract

In this article the author revisits the oldest attack on GOST known, the Kara Reflection attack, and another totally unrelated truncated differential attack by Courtois and Misztal. It is hard to imagine that there could be any relationship between two so remote attacks which have nothing in common. However, there is one: Very surprisingly, both properties can be combined and lead the fastest attack on GOST ever found, which is nearly feasible to execute in practice.

An Improved Differential Attack on Full GOST

“…Basically the cost of computing the first 3+ and the last 3+ rounds of GOST can be neglected. More precisely it will be amortized in 2 20 sub-cases of the 2 96 cases, in which we just need to evaluate 4 S-boxes in round 3 and 4 S-boxes in round 30, which is roughly feasible to do in most an equivalent of 1 round of GOST. Therefore we estimate that we need only about 2 116+64 · 8 CPU clocks, which could be seen as an equivalent of roughly about 2 174 GOST encryptions.…”

“…This paper does NOT cover the whole spectrum of what differential properties can bring in terms interesting or/and efficient attacks on GOST. In this paper we do not consider multiple key attacks [17,19,26,20, 39] and we do not try to develop or at more advanced "combination" attacks which combine the complexity reduction approach based on high-level self-similarity of [26,19,9] with advanced differential properties with 2,3 and 4 points, [26,20]. This paper is essentially a technical paper on simple yet highly-optimized truncated differential attacks in a single key scenario.…”

“…There is a substantial variety of recent innovative attacks on GOST [9, 26, 37, 10-12, 31, 21, 19, 20]. We have reflection attacks [37,26], attacks with double, triple and even quadruple reflections [26,20], a large variety of self-similarity and black-box reduction attacks [9,26,19,20], some of which do not use any reflections whatsoever [26, 9] and few other. The final key recovery step in various attacks is in many cases a software algebraic attack [26, 9,20] or/and a Meet-In-The-Middle attack [37,26,31,21].…”

“…In differential attacks key bits are guessed and confirmed by the differential properties [54,[10][11][12][13][14]49] and there have already been quite a few papers about advanced differential attacks on GOST [54, 10-13, 49, 14, 22, 15]. There is also several even more advanced "combination" attacks which combine the complexity reduction approach based on high-level self-similarity of [26,19, 9] with various advanced differential properties with 2,3 or 4 points, see [26,20]. In this paper we consider some recent differential attacks on GOST [54, 10-14, 49, 15] and show how to further improve them.…”

“…We have reflection attacks [37,26], attacks with double, triple and even quadruple reflections [26,20], a large variety of self-similarity and black-box reduction attacks [9,26,19,20], some of which do not use any reflections whatsoever [26, 9] and few other. The final key recovery step in various attacks is in many cases a software algebraic attack [26, 9,20] or/and a Meet-In-The-Middle attack [37,26,31,21]. In differential attacks key bits are guessed and confirmed by the differential properties [54,[10][11][12][13][14]49] and there have already been quite a few papers about advanced differential attacks on GOST [54, 10-13, 49, 14, 22, 15].…”