Abstract:A theoretically reliable key-recovery attack should evaluate not only the non-randomness for the correct key guess but also the randomness for the wrong ones as well. The former has always been the main focus but the absence of the latter can also cause self-contradicted results. In fact, the theoretic discussion of wrong key guesses is overlooked in quite some existing key-recovery attacks, especially the previous cube attack variants based on pure experiments. In this paper, we draw links between the division property and several variants of the cube attack. In addition to the zero-sum property, we further prove that the bias phenomenon, the non-randomness widely utilized in dynamic cube attacks and cube testers, can also be reflected by the division property. Based on such links, we are able to provide several results: Firstly, we give a dynamic cube key-recovery attack on full Grain-128. Compared with Dinur et al.’s original one, this attack is supported by a theoretical analysis of the bias based on a more elaborate assumption. Our attack can recover 3 key bits with a complexity 297.86 and evaluated success probability 99.83%. Thus, the overall complexity for recovering full 128 key bits is 2125. Secondly, now that the bias phenomenon can be efficiently and elaborately evaluated, we further derive new secure bounds for Grain-like primitives (namely Grain-128, Grain-128a, Grain-V1, Plantlet) against both the zero-sum and bias cube testers. Our secure bounds indicate that 256 initialization rounds are not able to guarantee Grain-128 to resist bias-based cube testers. This is an efficient tool for newly designed stream ciphers for determining the number of initialization rounds. Thirdly, we improve Wang et al.’s relaxed term enumeration technique proposed in CRYPTO 2018 and extend their results on Kreyvium and ACORN by 1 and 13 rounds (reaching 892 and 763 rounds) with complexities 2121.19 and 2125.54 respectively. To our knowledge, our results are the current best key-recovery attacks on these two primitives.

Improved key recovery attacks on reduced-round Salsa20

Enhancing the Key Recovery Attack on Round Reduced Salsa

A multi-step key recovery attack on reduced round Salsa and ChaCha

Snowball: Another View on Side-Channel Key Recovery Tools.

Analyzing the Probability of Key Recovery in the Differential Attacks Against ChaCha

Improved Single-Key Attacks on 9-Round AES-192/256.

Moving a Step of ChaCha in Syncopated Rhythm.

Enhanced Side-Channel Cube Attacks on PRESENT.

SALSA VERDE: a machine learning attack on Learning With Errors with sparse small secrets

Links Between Division Property and Other Cube Attack Variants

Improved related-key boomerang attacks on round-reduced threefish-512

An Improved Method for Evaluating Secret Variables and Its Application to WAGE.

Improved Linear Hull Attack On Round-Reduced Simon With Dynamic Key-Guessing Techniques

SALSA PICANTE: a machine learning attack on LWE with binary secrets

Improved deep learning aided key recovery framework: applications to large-state block ciphers

Improved Integral Attacks Without Full Codebook.

New Key Recovery Attack on the MICKEY Family of Stream Ciphers

A Key-Recovery Attack on 855-Round Trivium

Improved related-key attack on 7-round AES-128/256

Correlation Cube Attacks: From Weak-Key Distinguisher to Key Recovery.

Key Guessing Strategies for Linear Key-Schedule Algorithms in Rectangle Attacks