Abstract:The conditional cube attack on round-reduced KECCAK keyed modes was proposed by Huang et al. at EUROCRYPT 2017. In their attack, a conditional cube variable was introduced, whose diffusion was significantly reduced by certain key bit conditions. The attack requires a set of cube variables which are not multiplied in the first round while the conditional cube variable is not multiplied with other cube variables (called ordinary cube variables) in the first two rounds. This has an impact on the degree of the output of KECCAK and hence gives a distinguisher. Later, the MILP method was applied to find ordinary cube variables. However, for some KECCAK based versions with few degrees of freedom, one could not find enough ordinary cube variables, which weakens or even invalidates the conditional cube attack.In this paper, a new conditional cube attack on KECCAK is proposed. We remove the limitation that no cube variables multiply with each other in the first round. As a result, some quadratic terms may appear in the first round. We make use of some new bit conditions to prevent the quadratic terms from multiplying with other cube variables in the second round, so that there will be no cubic terms in the first two rounds. Furthermore, we introduce the kernel quadratic term and construct a 6-2-2 pattern to reduce the diffusion of quadratic terms significantly, where the theta operation even in the second round becomes an identity transformation (CP-kernel property) for the kernel quadratic term. Previous conditional cube attacks on KECCAK only explored the CP-kernel property of theta operation in the first round. Therefore, more degrees of freedom are available for ordinary cube variables and fewer bit conditions are used to remove the cubic terms in the second round, which plays a key role in the conditional cube attack on versions with very few degrees of freedom. We also use the MILP method in the search of cube variables and give key-recovery attacks on round-reduced KECCAK keyed modes.As a result, we reduce the time complexity of key-recovery attacks on 7-round KECCAK-MAC-512 and 7-round KETJE SR v2 from 2(111), 2(99) to 2(72), 2(77), respectively. Additionally, we have reduced the time complexity of attacks on 9-round KMAC256 and 7-round KETJE SR v1. Besides, practical attacks on 6-round KETJE SR v1 and v2 are also given in this paper for the first time.

Side Channel Cube Attack Improvement and Application to Cryptographic Algorithm

Enhanced Side-Channel Cube Attacks on PRESENT.

Side-Channel Cube Attacks on EPCBC

Algebraic, Aida/Cube And Side Channel Analysis Of Katan Family Of Block Ciphers

Efficient Hamming weight-based side-channel cube attacks on PRESENT

Fault-cube attack on SIMON family of lightweight block ciphers

Algebraic Side-Channel Attacks on KLEIN

Quantum Attacks on MIBS Block Cipher Based on Bernstein–Vazirani Algorithm

Improved Conditional Cube Attacks on Keccak Keyed Modes with MILP Method

New Conditional Cube Attack On Keccak Keyed Modes

Conditional Cube Attack on Reduced-Round Keccak Sponge Function.

MILP-aided Cube-attack-like Cryptanalysis on Keccak Keyed Modes.

Adaptive Side-Channel Analysis Model and Its Applications to White-Box Block Cipher Implementations.

Snowball: Another View on Side-Channel Key Recovery Tools.

Enhanced Differential Cache Attacks on SM4 with Algebraic Analysis and Error-Tolerance

A closer look at the belief propagation algorithm in side-channel attack on CCA-secure PQC KEM

Side-Channel Information Leakage Analysis And Countermeasures In An Embedded Cpu Microarchitecture

Exploiting the Incomplete Diffusion Feature: A Specialized Analytical Side-Channel Attack Against the Aes and Its Application to Microcontroller Implementations

Evaluating Side-Channel Attack Vulnerabilities in Post-Quantum CRYSTALS-Kyber Hardware Based on Simple Power Analysis

Improved algebraic fault analysis: a case study on piccolo and applications to other lightweight block ciphers