The cube attack is a powerful cryptanalysis technique used against stream ciphers. It enables the retrieval of secret key information by computing the values of superpolys, with unknown secret key bits as variables. A practical key-recovery attack seeks to recover all key bits within a reasonable time complexity. The complexity of such attacks typically involves two main components: (1) the complexity of calculating the superpoly values under the real key, which depends on the size of the mother cube, and (2) the complexity of solving the superpoly system, guess-and-determine techniques are often used to solve the system especially when superpolys are nonlinear. In this paper, we improve the best-known practical key-recovery attack on Trivium by enhancing the techniques used in these two areas. First, we introduce a heuristic method to search for good mother cubes, enabling many balanced superpolys to recover. Second, we propose an efficient MILP-based model to search for a minimal number of guessed variables to solve the balanced superpoly systems, thus reducing the complexity of solving the system. With these advancements, we achieve key-recovery attacks on the 830- and 832-round Trivium within practical time complexity, surpassing the previous best result of 825 rounds. Additionally, we applied our new model to attack ACORN with 128-bit keys, achieving practical key-recovery attacks on the 507- and 611-round versions, compared to the previous highest of 477 rounds.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Cube Attacks Against Trivium, Kreyvium and ACORN with Practical Complexity

  • Yanqi Chen,
  • Ting Li,
  • Yao Sun

摘要

The cube attack is a powerful cryptanalysis technique used against stream ciphers. It enables the retrieval of secret key information by computing the values of superpolys, with unknown secret key bits as variables. A practical key-recovery attack seeks to recover all key bits within a reasonable time complexity. The complexity of such attacks typically involves two main components: (1) the complexity of calculating the superpoly values under the real key, which depends on the size of the mother cube, and (2) the complexity of solving the superpoly system, guess-and-determine techniques are often used to solve the system especially when superpolys are nonlinear. In this paper, we improve the best-known practical key-recovery attack on Trivium by enhancing the techniques used in these two areas. First, we introduce a heuristic method to search for good mother cubes, enabling many balanced superpolys to recover. Second, we propose an efficient MILP-based model to search for a minimal number of guessed variables to solve the balanced superpoly systems, thus reducing the complexity of solving the system. With these advancements, we achieve key-recovery attacks on the 830- and 832-round Trivium within practical time complexity, surpassing the previous best result of 825 rounds. Additionally, we applied our new model to attack ACORN with 128-bit keys, achieving practical key-recovery attacks on the 507- and 611-round versions, compared to the previous highest of 477 rounds.