Abstract:In order to provide benefits in the areas of fully homomorphic encryption (FHE), multi-party computation (MPC), post-quantum signature schemes, or efficient masked implementations for side-channel resistance, reducing the number of multiplications has become a quite popular trend for the symmetric cryptographic primitive designs. With an aggressive design strategy exploiting the extremely simple and low-degree S-box and low number of rounds, Pyjamask, the fundamental block cipher of the AEAD with the same name, has the smallest number of AND gates per bit among all the existing block ciphers (except Low-MC or Rasta which work on unconventional plaintext/key sizes). Thus, although the AEAD Pyjamask stuck at the second round of the NIST lightweight cryptography standardization process, the block cipher Pyjamask itself still attracts a lot of attention. Not very unexpectedly, the low degree and the low number of rounds are the biggest weakness of Pyjamask. At FSE 2020, Dobraunig et al. successfully mounted an algebraic and higher-order differential attack on full Pyjamask-96, one member of the Pyjamask block cipher family. However, the drawback of this attack is that it has to use the full codebook, which makes the attack less appealing. In this paper, we take integral attacks as our weapon, which are also sensitive to the low degree. Based on a new 11-round integral distinguishes found by state-of-the-art detection techniques, and combined with the relationship between round keys that reduces the involved keys, we give the key recovery attack on the full Pyjamask-96 without the full codebook for the first time. Further, the algebraic and higher-order differential technique does not work for Pyjamask-128, the other member of the Pyjamask block cipher family. To better understand the security margin of Pyjamask-128, we present the first third-party cryptanalysis on Pyjamask-128 up to 11 out of 14 rounds.

Algebraic Attacks Against Grendel: an Arithmetization-Oriented Primitive with the Legendre Symbol

Algebraic-Differential Attacks on a Family of Arithmetization-Oriented Symmetric Ciphers

Solving Degree Bounds For Iterated Polynomial Systems

Theoretical Round Modification Fault Analysis on AEGIS-128 with Algebraic Techniques

New Cryptanalysis of Block Ciphers with Low Algebraic Degree

Algebraic Side-Channel Attacks on KLEIN

Practical Algebraic Cryptanalysis For Dragon-Based Cryptosystems

Algebraic Attacks on Round-Reduced RAIN and Full AIM-III.

An Algebraic Attack on Ciphers with Low-Degree Round Functions: Application to Full MiMC

New Attacks on Randomized ECC Algorithms

Generalized Triangular Dynamical System: An Algebraic System for Constructing Cryptographic Permutations over Finite Fields

Rectangle Attack Against Type-I Generalized Feistel Structures

Constructive Non-Linear Polynomial Cryptanalysis of a Historical Block Cipher

An algebraic attack on stream ciphers with application to nonlinear filter generators and WG-PRNG

Algebraic Attack on Rijndael-192 Based on Grobner Basis

Gröbner Basis Cryptanalysis of Ciminion and Hydra

Invariant Hopping Attacks on Block Ciphers

Integral Attacks on Pyjamask-96 and Round-Reduced Pyjamask-128

Horst Meets Fluid-SPN: Griffin for Zero-Knowledge Applications.

SQUARE Attack on Block Ciphers with Low Algebraic Degree

A New ElGamal-Based Algebraic Homomorphism and Its Application