The boomerang attack and the rectangle attack are two attacks that utilize differential cryptanalysis in a larger construction. Both attacks treat the cipher as a cascade of two sub-ciphers, where there exists a good differential for each sub-cipher, but not for the entire cipher. In this paper we combine the boomerang (and the rectangle) attack with related-key differentials.

The new combination is applicable to many ciphers, and we demonstrate its strength by introducing attacks on reduced-round versions of AES and IDEA. The attack on 192-bit key 9-round AES uses 256 different related keys. The 6.5-round attack on IDEA uses four related keys (and has time complexity of 288.1 encryptions). We also apply these techniques to COCONUT98 to obtain a distinguisher that requires only four related-key adaptive chosen plaintexts and ciphertexts. For these ciphers, our results attack larger number of rounds or have smaller complexities then all previously known attacks.

/pdf/related-key-boomerang-and-rectangle-attacks-2oh1u8yxrl.pdf

Related-Key boomerang and rectangle attacks

SAT: Past and Future.- Encodings of Problems in Effectively Propositional Logic.- Efficient Circuit to CNF Conversion.- Mapping CSP into Many-Valued SAT.- Circuit Based Encoding of CNF Formula.- Breaking Symmetries in SAT Matrix Models.- Partial Max-SAT Solvers with Clause Learning.- MiniMaxSat: A New Weighted Max-SAT Solver.- Solving Multi-objective Pseudo-Boolean Problems.- Improved Lower Bounds for Tree-Like Resolution over Linear Inequalities.- Horn Upper Bounds and Renaming.- Matched Formulas and Backdoor Sets.- Short XORs for Model Counting: From Theory to Practice.- Variable Dependency in Local Search: Prevention Is Better Than Cure.- Combining Adaptive Noise and Look-Ahead in Local Search for SAT.- From Idempotent Generalized Boolean Assignments to Multi-bit Search.- Satisfiability with Exponential Families.- Formalizing Dangerous SAT Encodings.- Algorithms for Variable-Weighted 2-SAT and Dual Problems.- On the Boolean Connectivity Problem for Horn Relations.- A First Step Towards a Unified Proof Checker for QBF.- Dynamically Partitioning for Solving QBF.- Backdoor Sets of Quantified Boolean Formulas.- Bounded Universal Expansion for Preprocessing QBF.- Effective Incorporation of Double Look-Ahead Procedures.- Applying Logic Synthesis for Speeding Up SAT.- Towards a Better Understanding of the Functionality of a Conflict-Driven SAT Solver.- A Lightweight Component Caching Scheme for Satisfiability Solvers.- Minimum 2CNF Resolution Refutations in Polynomial Time.- Polynomial Time SAT Decision for Complementation-Invariant Clause-Sets, and Sign-non-Singular Matrices.- Verifying Propositional Unsatisfiability: Pitfalls to Avoid.- A Simple and Flexible Way of Computing Small Unsatisfiable Cores in SAT Modulo Theories.- SAT Solving for Termination Analysis with Polynomial Interpretations.- Fault Localization and Correction with QBF.- Sensor Deployment for Failure Diagnosis in Networked Aerial Robots: A Satisfiability-Based Approach.- Inversion Attacks on Secure Hash Functions Using sat Solvers.

Theory and applications of satisfiability testing - SAT 2007 : 10th International Conference, Lisbon, Portugal, May 28-31, 2007 : proceedings

MD4 is a hash function introduced by Rivest in 1990. It is still used in some contexts, and the most commonly used hash functions (MD5, Sha1, Sha2) are based on the design principles of MD4. MD4 has been extensively studied and very efficient collision attacks are known, but it is still believed to be a one-way function.

In this paper we show a partial pseudo-preimage attack on the compression function of MD4, using some ideas from previous cryptanalysis of MD4. We can choose 64 bits of the output for the cost of 232compression function computations (the remaining bits are randomly chosen by the preimage algorithm).

This gives a preimage attack on the compression function of MD4 with complexity 296, and we extend it to an attack on the full MD4 with complexity 2102. As far as we know this is the first preimage attack on a member of the MD4 family.

MD4 is Not One-Way

IoT is becoming more common and popular due to its wide range of applications in various domains. They collect data from the real environment and transfer it over the networks. There are many challenges while deploying IoT in a real-world, varying from tiny sensors to servers. Security is considered as the number one challenge in IoT deployments, as most of the IoT devices are physically accessible in the real world and many of them are limited in resources (such as energy, memory, processing power and even physical space). In this paper, we are focusing on these resource-constrained IoT devices (such as RFID tags, sensors, smart cards, etc.) as securing them in such circumstances is a challenging task. The communication from such devices can be secured by a mean of lightweight cryptography, a lighter version of cryptography. More than fifty lightweight cryptography (plain encryption) algorithms are available in the market with a focus on a specific application(s), and another 57 algorithms have been submitted by the researchers to the NIST competition recently. To provide a holistic view of the area, in this paper, we have compared the existing algorithms in terms of implementation cost, hardware and software performances and attack resistance properties. Also, we have discussed the demand and a direction for new research in the area of lightweight cryptography to optimize balance amongst cost, performance and security.

/pdf/lightweight-cryptography-algorithms-for-resource-constrained-10420w1mk4.pdf

Lightweight Cryptography Algorithms for Resource-Constrained IoT Devices: A Review, Comparison and Research Opportunities

In recent years, Mixed Integer Linear Programming MILP has been successfully applied in searching for differential characteristics and linear approximations in block ciphers and has produced the significant results for some ciphers such as SIMON a family of lightweight and hardware-optimized block ciphers designed by NSA etc. However, in the literature, the MILP-based automatic search algorithm for differential characteristics and linear approximations is still infeasible for block ciphers such as ARX constructions. In this paper, we propose an MILP-based method for automatic search for differential characteristics and linear approximations in ARX ciphers. By researching the properties of differential characteristic and linear approximation of modular addition in ARX ciphers, we present a method to describe the differential characteristic and linear approximation with linear inequalities under the assumptions of independent inputs to the modular addition and independent rounds. We use this representation as an input to the publicly available MILP optimizer Gurobi to search for differential characteristics and linear approximations for ARX ciphers. As an illustration, we apply our method to Speck, a family of lightweight and software-optimized block ciphers designed by NSA, which results in the improved differential characteristics and linear approximations compared with the existing ones. Moreover, we provide the improved differential attacks on Speck48, Speck64, Speck96 and Speck128, which are the best attacks on them in terms of the number of rounds.

/pdf/milp-based-automatic-search-algorithms-for-differential-and-f4v6h14ukf.pdf

MILP-Based Automatic Search Algorithms for Differential and Linear Trails for Speck

In Eurocrypt’05, Wang et al. presented new techniques to find collisions of Hash function MD4. The techniques are not only efficient to search for collisions, but also applicable to explore the second- preimage of MD4. About the second-preimage attack, they showed that a random message was a weak message with probability 2−122 and it only needed a one-time MD4 computation to find the second-preimage corresponding to the weak message. A weak message means that there exits a more efficient attack than the brute force attack to find its second-preimage. In this paper, we find another new collision differential path which can be used to find the second-preimage for more weak messages. For any random message, it is a weak message with probability 2−56, and it can be converted into a weak message by message modification techniques with about 227 MD4 computations. Furthermore, the original message is close to the resulting message (weak message), i.e, the Hamming weight of the difference for two messages is about 44.

The second-preimage attack on MD4

PRESENT is a lightweight block cipher designed by A. Bogdanov et al. in 2007 for extremely constrained environments such as RFID tags and sensor networks, where the AES is not suitable for. In this paper, the strength of PRESENT against the differential fault attack on the key schedule is explored. Our attack adopts the nibble oriented model of random faults and assumes that the attacker can induce a single nibble fault on the round key. The attack can efficiently recover the secret key with the computational complexity of $2^{29}$, and sixty-four pairs of correct and faulty cipher texts on average.

Differential Fault Analysis on PRESENT Key Schedule

SM3 is a hash function, designed by Xiaoyun Wang et al. and published by the Chinese Commercial Cryptography Administration Office for the use of electronic authentication service system. The design of SM3 builds upon the design of the SHA-2 hash function, but introduces additional strengthening features. In this paper, we present boomerang distinguishers for the SM3 compression function reduced to 32 steps out of 64 steps with complexity 214.4, 33 steps with complexity 232.4, 34 steps with complexity 253.1 and 35 steps with complexity 2117.1. Examples of zero-sum quartets for the 32-step and 33-step SM3 compression function are provided. We also point out a slide-rotational property of SM3-XOR, which exists due to the fact that constants used in the steps are not independent.

/pdf/boomerang-and-slide-rotational-analysis-of-the-sm3-hash-ttidnhvukd.pdf

Boomerang and Slide-Rotational Analysis of the SM3 Hash Function

This paper gives a new generalized key-recovery model of related-key rectangle attacks on block ciphers with linear key schedules. The model is quite optimized and applicable to various block ciphers with linear key schedule. As a proof of work, we apply the new model to two very important block ciphers, i.e. SKINNY and GIFT, which are basic modules of many candidates of the Lightweight Cryptography (LWC) standardization project by NIST. For SKINNY, we reduce the complexity of the best previous 27-round related-tweakey rectangle attack on SKINNY-128-384 from $$2^{331}$$ to $$2^{294}$$. In addition, the first 28-round related-tweakey rectangle attack on SKINNY-128-384 is given, which gains one more round than before. For the candidate LWC SKINNY AEAD M1, we conduct a 24-round related-tweakey rectangle attack with a time complexity of $$2^{123}$$ and a data complexity of $$2^{123}$$ chosen plaintexts. For the case of GIFT-64, we give the first 24-round related-key rectangle attack with a time complexity $$2^{91.58}$$, while the best previous attack on GIFT-64 only reaches 23 rounds at most.

Generalized related-key rectangle attacks on block ciphers with linear key schedule: applications to SKINNY and GIFT

At CRYPTO’16, Beierle et al. presented SKINNY, a family of lightweight tweakable block ciphers intended to compete with the NSA designs SIMON and SPECK. SKINNY can be implemented efficiently in both soft- and hardware and supports block sizes of 64 and 128 bits as well as tweakey sizes of 64, 128, 192 and 128, 256, 384 bits respectively. This paper presents a related-tweakey impossible-differential attack on up to 23 (out of 36) rounds of SKINNY-64/128 for different tweak sizes. All our attacks can be trivially extended to SKINNY-128/128.

Gaoli Wang

Papers

The second-preimage attack on MD4

Differential Fault Analysis on PRESENT Key Schedule

Boomerang and Slide-Rotational Analysis of the SM3 Hash Function

Generalized related-key rectangle attacks on block ciphers with linear key schedule: applications to SKINNY and GIFT

Related-Key Impossible-Differential Attack on Reduced-Round SKINNY