Abstract:A division property is a generic tool to search for integral distinguishers, and automatic tools such as MILP or SAT/SMT allow us to evaluate the propagation efficiently. In the application to stream ciphers, it enables us to estimate the security of cube attacks theoretically, and it leads to the best key-recovery attacks against well-known stream ciphers. However, it was reported that some of the key-recovery attacks based on the division property degenerate to distinguishing attacks due to the inaccuracy of the division property. Three-subset division property (without unknown subset) is a promising method to solve this inaccuracy problem, and a new algorithm using automatic tools for the three-subset division property was recently proposed at Asiacrypt2019. In this paper, we first show that this state-of-the-art algorithm is not always efficient and we cannot improve the existing key-recovery attacks. Then, we focus on the three-subset division property without unknown subset and propose another new efficient algorithm using automatic tools. Our algorithm is more efficient than existing algorithms, and it can improve existing key-recovery attacks. In the application to Trivium, we show a 842-round key-recovery attack. We also show that a 855-round key-recovery attack, which was proposed at CRYPTO2018, has a critical flaw and does not work. As a result, our 842-round attack becomes the best key-recovery attack. In the application to Grain-128AEAD, we show that the known 184-round key-recovery attack degenerates to a distinguishing attack. Then, the distinguishing attacks are improved up to 189 rounds, and we also show the best key-recovery attack against 190 rounds. In the application to ACORN, we prove that the 772-round key-recovery attack at ISC2019 is in fact a constant-sum distinguisher. We then give new key-recovery attacks mounting to 773-, 774- and 775-round ACORN. We verify the current best key-recovery attack on 892-round Kreyvium and recover the exact superpoly. We further propose a new attack mounting to 893 rounds.

Improved related-key boomerang attacks on round-reduced threefish-512

The Boomerang Attacks on the Round-Reduced Skein-512.

The Boomerang Attacks on Round-Reduced Skein-1024

Partial-Collision Attack on the Round-Reduced Compression Function of Skein-256.

Improved Boomerang Attacks on Round-Reduced SM3 and Keyed Permutation of BLAKE-256

Improved Related Key Attack on 44-Round SHACAL-2

Improved Single-Key Attacks on 9-Round AES-192/256.

Related-Key Multiple Impossible Differential Cryptanalysis on Full-Round LiCi-2 Designed for IoT

Modeling for Three-Subset Division Property Without Unknown Subset - Improved Cube Attacks Against Trivium and Grain-128AEAD.

Evaluate the Security Margins of SHA-512, SHA-256and DHA-256 Against the Boomerang Attack

Modeling for Three-Subset Division Property Without Unknown Subset

Weak Keys in Reduced AEGIS and Tiaoxin

Conditional cube attack on round-reduced River Keyak

Improved Related-Tweakey Rectangle Attacks On Reduced-Round Deoxys-Bc-384 And Deoxys-I-256-128

Correlation Cube Attacks: From Weak-Key Distinguisher to Key Recovery.

Automated Search Oriented To Key Recovery On Ciphers With Linear Key Schedule Applications To Boomerangs In Skinny And Forkskinny

Real-Time Related-Key Attack on Full-Round Shadow Designed for IoT Nodes

Impossible Differential Attack On Reduced-Round Twine

Improved related-key attack on 7-round AES-128/256

Generalized Related-Key Rectangle Attacks on Block Ciphers with Linear Key Schedule: Applications to SKINNY and GIFT.

Links Between Division Property and Other Cube Attack Variants