Abstract:In truncated differential cryptanalysis of symmetric primitives, a generalized framework is to search a distinguisher concerning part of output differences, like truncated differential distribution (TDD) on certain bits (e.g. a nibble) first, and then append several rounds before and after it to recover the secret key. The logarithmic likelihood ratio statistic with respect to the TDD is usually used to distinguish guessed key bits. In this paper, we study how to improve the effect of truncated differential cryptanalysis by considering key schedules of the attacked ciphers. It turns out that for a cipher with a simple key schedule, certain guessed subkey bits may reveal information of the master key, which will help build a stronger TDD distinguisher and reduce the key recovery complexity or attack more rounds. As a result, we explore heuristic techniques to search key-recovery-friendly TDDs and construct automatic search models based on MILP. The refined methods are applied to two recent designs of symmetric primitives, WARP and Orthros, together with peculiarities of their structures as well. For WARP, after making two observations on relations between certain differences with key bits, we propose an algorithm that can find TDDs with low complexities and having potentialities to cover more rounds. Consequently, we launch key recovery attacks on 24 to 27 rounds of WARP. When it comes to Orthros, we present a two-step search algorithm to balance the number of guessed key bits and TDDs, obtaining a key recovery attack on a 7-round variant of it in the weak-key setting. Finally, we perform several verification experiments on round-reduced versions of WARP and Orthros, and the experimental results are consistent with the theoretical distributions and the analysis of generalized key recovery attack framework.

Differential-Linear Cryptanalysis of the Lightweight Cryptographic Algorithm KNOT

Algebraic Side-Channel Attacks on KLEIN

Impossible Differential Attack On Reduced-Round Twine

New Differential Cryptanalytic Results for Reduced-Round CAST-128.

Cryptanalysis of Round-Reduced \mathttLED.

New Linear Cryptanalytic Results of Reduced-Round of CAST-128 and CAST-256

Truncated Differential Attacks on Symmetric Primitives with Linear Key Schedule: WARP and Orthros

Practical Key-Recovery Attacks on Round-Reduced Ketje Jr, Xoodoo-AE and Xoodyak

Improved Impossible Differential Attack on Reduced-Round LBlock.

Fiddling the Twiddle Constants - Fault Injection Analysis of the Number Theoretic Transform.

Partial-Collision Attack on the Round-Reduced Compression Function of Skein-256.

Algebraic, Aida/Cube And Side Channel Analysis Of Katan Family Of Block Ciphers

Machine Learning Assisted Differential Distinguishers for Lightweight Ciphers.

Analysis of an Optimal Fault Attack on the LED-64 Lightweight Cryptosystem.

Security Analysis of the Lightweight Cryptosystem TWINE in the Internet of Things.

Differential cryptanalysis of full-round ANU-II ultra-lightweight block cipher

Generalized Related-Key Rectangle Attacks on Block Ciphers with Linear Key Schedule: Applications to SKINNY and GIFT.

Improved Meet-in-the Middle Attacks on Reduced-Round TWINE-128

Differential-Linear Cryptanalysis of GIFT Family and GIFT-based Ciphers

On The Key Schedule Of Lightweight Block Ciphers

Related-Key Multiple Impossible Differential Cryptanalysis on Full-Round LiCi-2 Designed for IoT