Abstract:AEGIS-128 and Tiaoxin-346 (Tiaoxin for short) are two AES-based primitives submitted to the CAESAR competition. Among them, AEGIS-128 has been selected in the final portfolio for high-performance applications, while Tiaoxin is a third-round candidate. Although both primitives adopt a stream cipher based design, they are quite different from the well-known bit-oriented stream ciphers like Trivium and the Grain family. Their common feature consists in the round update function, where the state is divided into several 128-bit words and each word has the option to pass through an AES round or not. During the 6-year CAESAR competition, it is surprising that for both primitives there is no third-party cryptanalysis of the initialization phase. Due to the similarities in both primitives, we are motivated to investigate whether there is a common way to evaluate the security of their initialization phases. Our technical contribution is to write the expressions of the internal states in terms of the nonce and the key by treating a 128-bit word as a unit and then carefully study how to simplify these expressions by adding proper conditions. As a result, we find that there are several groups of weak keys with 296 keys each in 5-round AEGIS-128 and 8-round Tiaoxin, which allows us to construct integral distinguishers with time complexity 232 and data complexity 232. Based on the distinguisher, the time complexity to recover the weak key is 272 for 5-round AEGIS-128. However, the weak key recovery attack on 8-round Tiaoxin will require the usage of a weak constant occurring with probability 2−32. All the attacks reach half of the total number of initialization rounds. We expect that this work can advance the understanding of the designs similar to AEGIS and Tiaoxin.

Related-Tweakey Impossible Differential Attack on Reduced-Round Deoxys-BC-256.

Improved Related-Tweakey Rectangle Attacks On Reduced-Round Deoxys-Bc-384 And Deoxys-I-256-128

Improved Meet-in-the-Middle Attacks on Reduced-Round Deoxys-BC-256

New Related-Tweakey Boomerang and Rectangle Attacks on Deoxys-BC Including BDT Effect

MILP-Aided Related-Tweak/Key Impossible Differential Attack and Its Applications to QARMA, Joltik-BC

Quantum Rectangle Attack and Its Application on Deoxys-BC

Related-Tweak Impossible Differential Cryptanalysis of Reduced-Round TweAES

Improved Meet-in-the-Middle Attacks on Reduced-Round Kiasu-BC and Joltik-BC.

Impossible Differential Attack On Reduced-Round Twine

New Improved Impossible Differential Attack on Reduced-Round AES-128

SAT-based Analysis of Related-key Impossible Distinguishers on Piccolo and (Tweakable) TWINE

Improved Impossible Differential Attacks on Large-Block Rijndael

Improved Single-Key Attacks on 9-Round AES-192/256.

Improved Impossible Differential Cryptanalysis of Large-Block Rijndael

Related-Key Multiple Impossible Differential Cryptanalysis on Full-Round LiCi-2 Designed for IoT

Weak Keys in Reduced AEGIS and Tiaoxin

Improved Impossible Differential Attacks on Reduced-Round MISTY1.

Mind the TWEAKEY Schedule: Cryptanalysis on SKINNYe-64-256.

Improved related-key attack on 7-round AES-128/256

Theoretical Round Modification Fault Analysis on AEGIS-128 with Algebraic Techniques

Explicit Upper Bound Of Impossible Differentials For AES-Like Ciphers: Application To uBlock And Midori