Abstract:Conditional cube attack is an efficient key-recovery attack on Keccak keyed modes proposed by Huang et al. at EUROCRYPT 2017. By assigning bit conditions, the diffusion of a conditional cube variable is reduced. Then, using a greedy algorithm (Algorithm 4 in Huang et al.'s paper), Huang et al. find some ordinary cube variables, that do not multiply together in the 1st round and do not multiply with the conditional cube variable in the 2nd round. Then the key-recovery attack is launched. The key part of conditional cube attack is to find enough ordinary cube variables. Note that, the greedy algorithm given by Huang et al. adds ordinary cube variable without considering its bad effect, i. e. the new ordinary cube variable may result in that many other variables could not be selected as ordinary cube variable (they multiply with the new ordinary cube variable in the first round). In this paper, we bring out a new MILP model to solve the above problem. We show how to model the CP-like-kernel and model the way that the ordinary cube variables do not multiply together in the 1st round as well as do not multiply with the conditional cube variable in the 2nd round. Based on these modeling strategies, a series of linear inequalities are given to restrict the way to add an ordinary cube variable. Then, by choosing the objective function of the maximal number of ordinary cube variables, we convert Huang et al.'s greedy algorithm into an MILP problem and the maximal ordinary cube variables are found. Using this new MILP tool, we improve Huang et al.'s key-recovery attacks on reduced-round Keccak-MAC-384 and Keccak-MAC-512 by 1 round, get the first 7-round and 6-round key-recovery attacks, respectively. For Ketje Major, we conclude that when the nonce is no less than 11 lanes, a 7-round key-recovery attack could be achieved. In addition, for Ketje Minor, we use conditional cube variable with 6-6-6 pattern to launch 7-round key-recovery attack.

MILP-Aided Related-Tweak/Key Impossible Differential Attack and Its Applications to QARMA, Joltik-BC

Related-Tweakey Impossible Differential Attack on Reduced-Round Deoxys-BC-256.

MILP-based Related-Key Rectangle Attack and Its Application to GIFT, Khudra, MIBS

SAT-based Analysis of Related-key Impossible Distinguishers on Piccolo and (Tweakable) TWINE

Quantum Automated Tools for Finding Impossible Differentials

A Quantum Automatic Tool for Finding Impossible Differentials

New Automatic Tool for Finding Impossible Differentials and Zero-Correlation Linear Approximations

MILP Based Differential Attack on Round Reduced WARP

Quantum impossible differential attacks: applications to AES and SKINNY

Impossible Differential Attack On Reduced-Round Twine

Improved Impossible Differential Attack on Reduced-Round LBlock.

Quantum Rectangle Attack and Its Application on Deoxys-BC

Improved Conditional Cube Attacks on Keccak Keyed Modes with MILP Method

MILP-Based Differential Attack on Round-Reduced GIFT

MILP-based differential cryptanalysis on full-round shadow

Algebraic Attack on the MQQ Public Key Cryptosystem

Automatic Search of Meet-in-the-Middle Differential Fault Analysis on AES-like Ciphers.

MILP-aided Cube-attack-like Cryptanalysis on Keccak Keyed Modes.

Differential-Linear Approximation Semi-unconstrained Searching and Partition Tree: Application to LEA and Speck

Improved Related-Tweakey Rectangle Attacks On Reduced-Round Deoxys-Bc-384 And Deoxys-I-256-128

Automated Search Oriented to Key Recovery on Ciphers with Linear Key Schedule