State-Recovery Attacks on Modified Ketje Jr

Abstract

In this article we study the security of the authenticated encryption algorithm Ketje against divide-and-conquer attacks. Ketje is a third-round candidate in the ongoing CAESAR competition, which shares most of its design principles with the SHA-3 hash function. Several versions of Ketje have been submitted, with different sizes for its internal state. We describe several state-recovery attacks on the smaller variant, called Ketje Jr. We show that if one increases the amount of keystream output after each round from 16 bits to 40 bits, Ketje Jr becomes vulnerable to divide-and-conquer attacks with time complexities 271.5 for the original version and 282.3 for the current tweaked version, both with a key of 96 bits. We also propose a similar attack when considering rates of 32 bits for the non-tweaked version. Our findings do not threaten the security of Ketje, but should be taken as a warning against potential future modifications that would aim at increasing the performance of the algorithm.

Security analysis of Subterranean 2.0

“…In the squeezing phase, Subterranean 2.0 outputs a block of 32 bits, each of which is the sum of two state bits: Z i = s 12 4i + s −12 4i , for 0 ≤ i < 32. Instead of outputting state bits directly, this extraction function is meant to frustrate state recovery attacks [10] in the nonce respected setting. In our one-round differential analysis, this extraction function allows more state bits…”

Improved State-Recovery Attacks on Modified KETJE JR

“…The security claimed by the authors for KETJE JR is determined by (96 ) for a key of size k. Based on the idea of meet-in-the-middle and the divide-and-conquer strategy, Ref. [12] gives state-recovery attacks on modified KETJE JR whose computation complexities are lower than exhaustive attack by using several consecutive blocks of keystream. The following is a brief introduction to the basic idea of this attack.…”

“…For details, please refer to Ref. [12]. Assume that the size of each keystream block is 40 bits, i.e.…”

“…Since each bit of [ ] is a nonlinear function of , in order to meet the conditions of divide-and-conquer, Ref. [12] gives a method called preliminary guessing. By guessing partial values of , the representations of some bits in [ ] can be derived from the function of front half and the function of back half of , and then we can combine 0 [ ] to sieve the guessed internal state values.…”

“…In addition, by introducing the kernel quadratic term to overcome the problem of few degrees of freedom, Li et al [10] further improved the results of conditional cube attacks on KETJE SR. Based on the same idea, Zhou et al [11] gave a practical key recovery attack on 5-round KETJE JR. In addition, in 2018, Fuhr et al [12] proposed a state-recovery attack on the modified KETJE JR with the usage of the divide-and-conquer method.…”