Revisiting Gilbert’s known-key distinguisher

Abstract

Known-key distinguishers have been introduced by Knudsen and Rijmen in 2007 to better understand the security of block ciphers in situations where the key can not be considered to be secret, i.e. the "thing between secret-key model and hash function use-cases". Trying to find a rigorous model to fit this intuition is still ongoing. The most recent advance by Gilbert (Asiacrypt 2014) describes a new model that-even if it is well justified-seemingly does not match this intuition. AES is often considered as a target of such analyses, simply because AES or its building blocks are used in many settings that go beyond classical encryption. Consider AES-128. Results in the secret-key model cover up to 6 rounds, while results in the chosen-key model reach up to 9 rounds. Gilbert however showed a result in the knownkey model that goes even further, covering 10 rounds. Does it mean that the use cases corresponding to the cryptanalysis of hash-function use-cases are inherently less efficient, or is it rather an artifact of the new model? In this paper we give strong evidence for the latter. In Gilbert's work, two types of arguments or rather conjectures are put forward suggesting that the new model is meaningful. Firstly that the number of "extension rounds" due to the new model is limited to two. And secondly that only a distinguisher that exploits the uniform distribution property can be extended in such way. We disprove both conjectures and arrive at the following results: First, we are also able to show that more than two extension rounds are possible. As a result of this, we describe the first known-key distinguishers on 12 rounds of AES that fit into Gilbert's model. The second conjecture is disproven by showing that the technique proposed by Gilbert can also be used to extend a known-key distinguisher based on another property: truncated differentials. A potential conclusion of this work would be that the counter-intuitive gap between Gilbert's known-key model and the chosen-key model is wider than initially thought. We however conclude that results in Gilbert's model are due to an artifact in the model. To remedy this situation, we propose a refinement of the known-key model which restores its original intent to fit the original intuition. Communicated by T. Iwata.

Post-quantum attacks against symmetric-key cryptography systems

“…Therefore, one compatible di erential characteristic is found in roughly 2 31 time, which leads to 2 31 solutions for the active bytes of px 3 , x 4 , x 5 q. Moreover, since we can randomly assign k 5 r12s (Step 3 (b)), we totally have about 2 31`8 " 2 39 starting points, which is lower than the final time 2 56 . Briefly speaking, for a given p x 3 , y 3 q, p x 4 , y 4 q, p x 5 , y 5 q and k 5 r12s, we find one starting point with time complexity of 1 on average.…”

“…For a hash function, the three basic secure properties should be ensured, i.e., the resistance of collision attacks, preimage attacks, and second preimage attacks. For AES, the known-key attacks already reach full round AES-128 [32,54,56] by expoiting statistical non-random properties, which can also be extended into known-key distinguishers on Kiasu-BC. However, those non-random properties on block ciphers can hardly threat the three basic secure properties of corresponding hash functions.…”

“…In this point of view, it is still meaningful to find chosen-key attacks based on related-key (truncated) di erentials, although there are already known-key attacks. Therefore, we bring in the first full chosen-key attack on Kiasu-BC based on a novel 10-round related-key (truncated) di erentials, although known-key distinguishers on full Kiasu-BC are trivially derived with previous known-key distinguishers on full round AES-128 [32,54,56].…”