Practical Cryptanalysis of ARMADILLO2

Abstract

Abstract. The ARMADILLO2 primitive is a very innovative hardwareoriented multi-purpose design published at CHES 2010 and based on data-dependent bit transpositions. In this paper, we first show a very unpleasant property of the internal permutation that allows for example to obtain a cheap distinguisher on ARMADILLO2 when instantiated as a stream-cipher. Then, we exploit the very weak diffusion properties of the internal permutation when the attacker can control the Hamming weight of the input values, leading to a practical free-start collision attack on the ARMADILLO2 compression function. Moreover, we describe a new attack so-called local-linearization that seems to be very efficient on datadependent bit transpositions designs and we obtain a practical semifree-start collision attack on the ARMADILLO2 hash function. Finally, we provide a related-key recovery attack when ARMADILLO2 is instantiated as a stream cipher. All collision attacks have been verified experimentally, they require negligible memory and a very small number of computations (less than one second on an average computer), even for the high security versions of the scheme.

RAMHU: A New Robust Lightweight Scheme for Mutual Users Authentication in Healthcare Applications

“…Linear and differential attacks are the most powerful attacks in the MD analysis of hash functions. Compared to PHOTON, ARMADILLO and SPONGENT-256 also offer signature features, but both are vulnerable to attacks, where ARMIDLLO2 has been attacked by local linearization (practical semi-free-start collision attack) [47] and SPONGENT has been attacked by linear distinguishers (23 rounds) [48] and (13 rounds) [49] for all SPONGENT versions; and additionally, they need the most computations (3281 GE and 8653 GE) compared PHOTON-256 (2177 GE). PHOTON is a reliable algorithm against linear and differential attacks [41].…”

Multipurpose Cryptographic Primitive ARMADILLO3

“…The ARMADILLO3 is the third generation of the multipurpose cryptographic function ARMADILLO [3] introduced at CHES'10. The new version ARMADILLO3 prevents all known attacks against the ARMADILLO [22] design and the attack against ARMADILLO2 based on parallel matching [1], and Hamming weight preservation in PRNG mode [19]. We provide a security analysis against known types of attacks and discuss some dedicated attacks and counter-measures.…”

“…That is, we use an internal function P defined by P (p b, Z) = P (p, S(Z σ b )) iteratively, where b is the tailing bit of the first operand p b, S is a substitution layer, σ b is a permutation (σ 0 or σ 1 ) and Z σ b denotes the transposition of Z based on permutation σ b . The extension ARMADILLO3 adopts a preprocessing to prevent the known attacks against ARMADILLO1 reported in [22], and it introduces a reduced-size S-box layer to improve the confusion of ARMADILLO2 which lead to a practical low complexity attack reported in [19].…”