Abstract:This paper studies the Keccak-based authenticated encryption (AE) scheme Ketje Sr against cube-like attacks. Ketje is one of the remaining 16 candidates of third round CAESAR competition, whose primary recommendation is Ketje Sr. Although the cube-like method has been successfully applied to Ketje’s sister ciphers, including Keccak-MAC and Keyak – another Keccak-based AE scheme, similar attacks are missing for Ketje. For Ketje Sr, the state (400-bit) is much smaller than Keccak-MAC and Keyak (1600-bit), thus the 128-bit key and cubes with the same dimension would occupy more lanes in Ketje Sr. Hence, the number of key bits independent of the cube sum is very small, which makes the divide-and-conquer method (it has been applied to 7-round attack on Keccak-MAC by Dinur et al.) can not be translated to Ketje Sr trivially. This property seems to be the barrier for the translation of the previous cube-like attacks to Ketje Sr. In this paper, we evaluate Ketje Sr against the divide-and-conquer method. Firstly, by applying the linear structure technique, we find some 32/64-dimension cubes of Ketje Sr that do not multiply with each other as well as some bits of the key in the first round. In addition, we introduce the new dynamic variable instead of the auxiliary variable (it was used in Dinur et al.’s divide-and-conquer attack to reduce the diffusion of the key) to reduce the diffusion of the key as well as the cube variables. Finally, we successfully launch a 6/7-round1 key recovery attack on Ketje Sr v1 and v2 (v2 is presented for the 3rd round CAESAR competition.). In 7-round attack, the complexity of online phase for Ketje Sr v1 is 2113, while for Ketje Sr v2, it is 297 (the preprocessing complexity is the same). We claim 7-round reduced Ketje Sr v2 is weaker than v1 against our attacks. In addition, some results on other Ketje instances and Ketje Sr with smaller nonce are given. Those are the first results on Ketje and bridge the gaps of cryptanalysis between its sister ciphers – Keyak and the Keccak keyed modes.

Improved Related-Tweakey Rectangle Attacks On Reduced-Round Deoxys-Bc-384 And Deoxys-I-256-128

New Related-Tweakey Boomerang and Rectangle Attacks on Deoxys-BC Including BDT Effect

Related-Tweakey Impossible Differential Attack on Reduced-Round Deoxys-BC-256.

Improved Meet-in-the-Middle Attacks on Reduced-Round Deoxys-BC-256

Quantum Rectangle Attack and Its Application on Deoxys-BC

Improved Meet-in-the-Middle Attacks on Reduced-Round Kiasu-BC and Joltik-BC.

Related-Key Rectangle Cryptanalysis of Rijndael-160 and Rijndael-192

Practical Key-Recovery Attacks on Round-Reduced Ketje Jr, Xoodoo-AE and Xoodyak

Boomerang Connectivity Table: A New Cryptanalysis Tool

Algebraic, Aida/Cube And Side Channel Analysis Of Katan Family Of Block Ciphers

Impossible Differential Attack On Reduced-Round Twine

Improved Related Key Attack on 44-Round SHACAL-2

Optimizing Rectangle and Boomerang Attacks: A Unified and Generic Framework for Key Recovery

Improved related-key boomerang attacks on round-reduced threefish-512

Theoretical Round Modification Fault Analysis on AEGIS-128 with Algebraic Techniques

Enhanced Side-Channel Cube Attacks on PRESENT.

Improved related-key attack on 7-round AES-128/256

Weak Keys in Reduced AEGIS and Tiaoxin

Improved Impossible Differential Attacks on Large-Block Rijndael

Integral Attacks on Pyjamask-96 and Round-Reduced Pyjamask-128

Cube-like Attack on Round-Reduced Initialization of Ketje Sr