Abstract:Algebraically simple PRFs, ciphers, or cryptographic hash functions are becoming increasingly popular, for example due to their attractive properties for MPC and new proof systems (SNARKs, STARKs, among many others). In this paper, we focus on the algebraically simple construction MiMC, which became an attractive cryptanalytic target due to its simplicity, but also due to its use as a baseline in a competition for more recent algorithms exploring this design space. For the first time, we are able to describe key-recovery attacks on all full-round versions of MiMC over $${\mathbb {F}}_{2^n}$$ , requiring half the code book. In the chosen-ciphertext scenario, recovering the key from this data for the n-bit full version of MiMC takes the equivalent of less than $$2^{n-\log _2(n) +1}$$ calls to MiMC and negligible amounts of memory. The attack procedure is a generalization of higher-order differential cryptanalysis, and it is based on two main ingredients. First, we present a higher-order distinguisher which exploits the fact that the algebraic degree of MiMC grows significantly slower than originally believed. Secondly, we describe an approach to turn this distinguisher into a key-recovery attack without guessing the full subkey. Finally, we show that approximately $$\lceil \log _3(2\cdot R)\rceil $$ more rounds (where $$R = \lceil n \cdot \log _3(2)\rceil $$ is the current number of rounds of MiMC-n/n) can be necessary and sufficient to restore the security against the key-recovery attack presented here. The attack has been practically verified on toy versions of MiMC. Note that our attack does not affect the security of MiMC over prime fields.

Generic Attacks on the Lai–Massey Scheme

Yoyo attack on 4-round Lai-Massey scheme with secret round functions

Pseudorandomness Analysis of the Lai-Massey Scheme.

Pseudorandomness analysis of the (extended) Lai–Massey scheme

The Pseudorandomness of Many-Round Lai-Massey Scheme.

New Demiric–Selçuk meet-in-the-middle attacks on Misty and Feistel schemes

CCA security for contracting (quasi-)Feistel constructions with tight round complexity

Algebraic Attacks on Round-Reduced RAIN and Full AIM-III.

Automated Meet-in-the-Middle Attack Goes to Feistel

A generic attack to ciphers

Method Of Attacking A New Diffie-Hellman Like Public-Key Scheme

Security on Generalized Feistel Scheme with SP Round Function.

Advanced Slide Attacks on the Even-Mansour Scheme.

Improved Integral Attacks on MISTY1

An Algebraic Attack on Ciphers with Low-Degree Round Functions: Application to Full MiMC

Method for attacking a new public-key scheme based on cubic finite field extensions

Improved Integral Attacks Without Full Codebook.

Security Analysis of the Pomykala-Barabasz Scheme.

MB+: Enhanced Multibridge Attack for Even-Mansour Schemes

Security Analysis of Public Key Encryption Scheme Based on Attack Classification

Further Analysis and Improvements of a Lattice-Based Anonymous PAKE Scheme