Improved cube-attack-like cryptanalysis of reduced-round Ketje-Jr and Keccak-MAC

• Published in: Information processing letters Vol. 171; p. 106124
• Main Authors: Zhao, Zishen, Chen, Shiyao, Wang, Meiqin, Wang, Wei
• Format: Journal Article
• Language: English
• Published: Elsevier B.V 01.10.2021
• Subjects: Cryptography; Cube-attack-like; Keccak-MAC; Ketje; MILP; Cube-attack-like; MILP; Cryptography; Ketje; Keccak-MAC
• ISSN: 0020-0190; 1872-6119
• DOI: 10.1016/j.ipl.2021.106124

•Improved Cube-Attack-Like Cryptanalysis on keyed Keccak constructions.•A new MILP model can avoid the dependency problems existing in previous work.•A more skilled selection of auxiliary variables used on the Keccak permutation. At EUROCRYPT 2015, Dinur et al. proposed cube-attack-like cryptanalysis on reduced-round Keccak. The process of recovering the key is divided into the preprocessing and the online phase. The preprocessing phase is setting a look-up table by computing the cube sum of involved key bits. The online phase is computing the cube sum of auxiliary variables and recording the matching values in the table as candidates. Auxiliary variables help balance the complexity of the two phases by reducing the number of involved key bits. Following this idea, a series of works has been presented, mainly focusing on a better selection of cube variables, auxiliary variables and involved key bits. We provide new methods to select auxiliary variables and involved key bits. The first step is to get a precise algebraic expression of each bit after one round permutation. Then, combined with the corresponding constraints on these variables, we can construct a Mixed-integer Linear Programming (MILP) model. Secondly, unlike the previous idea that auxiliary variables are chosen to satisfy the CP-kernel property just for the consideration of controlling diffusion, we cancel this restriction and adopt a more skilled selection of auxiliary variables. Based on these two steps, we improve the cube-attack-like cryptanalysis in terms of the complexity.