Differential Distinguishing Attacks on SNOW-V, SNOW-Vi and KCipher-2

In this paper, we evaluate the security against differential attacks for three important stream ciphers: SNOW-V, SNOW-Vi and KCipher-2. SNOW-V and SNOW-Vi are proposed as standard encryption schemes for the 5G mobile communication system, while KCipher-2 is a standard algorithm by ISO/IEC 18033-4 and CRYPTREC. We leverage state-of-the-art SAT-aided search tools. This enables us to evaluate bit-level differential characteristics during the initialization phase. Besides, to enhance search efficiency, we properly choose input differences, and eliminate ineffective differential transitions by carefully analyzing the differential behaviors in the nonlinear transformation. As a result, in the related-IV setting, we demonstrate that distinguishing attacks on 5/5/8 rounds for SNOW-V/SNOW-Vi/KCipher-2, respectively. In the related-key setting, we can extend to 7/8/8 rounds for SNOW-V/SNOW-Vi/KCipher-2, respectively. Our results are best attacks on the initialization phase of these ciphers, and first result in the related-key setting.