Practical Cube Attack against Nonce-Misused Ascon

• Published in: IACR Transactions on Symmetric Cryptology Vol. 2022; no. 4; pp. 120 - 144
• Main Authors: Baudrin, Jules, Canteaut, Anne, Perrin, Léo
• Format: Journal Article
• Language: English
• Published: Ruhr Universität Bochum 07.12.2022; Ruhr-Universität Bochum
• Subjects: algebraic attack; Ascon; CAESAR; Computer Science; Cryptography and Security; cube attack; lightweight cryptography; nonce-misuse; Cube attack; Ascon; Nonce-misuse; CAESAR; Lightweight cryptography; Algebraic attack
• DOI: 10.46586/tosc.v2022.i4.120-144
• ISSN: 2519-173X

Ascon is a sponge-based Authenticated Encryption with Associated Data that was selected as both one of the winners of the CAESAR competition and one of the finalists of the NIST lightweight cryptography standardization effort. As this competition comes to an end, we analyse the security of this algorithm against cube attacks. We present a practical cube attack against the full 6-round encryption in Ascon in the nonce-misuse setting. We note right away that this attack does not violate the security claims made by the designers of Ascon, due to this setting.Our cryptanalysis is a conditional cube attack that is capable of recovering the full capacity in practical time; but for Ascon-128, its extension to a key recovery or a forgery is still an open question. First, a careful analysis of the maximum-degree terms in the algebraic normal form of the Ascon permutation allows us to derive linear equations in half of the capacity bits given enough cube sums of dimension 32. Then, depending on the results of this first phase, we identify smaller-degree cubes that allow us to recover the remaining half of the capacity. Overall, our cryptanalysis has a complexity of about 240 adaptatively chosen plaintexts, and about 240 calls to the permutation. We have implemented the full attack and our experiments confirm our claims.Our results are built on a theoretical framework which allows us to easily identify monomials whose cube-sums provide linear equations in the capacity bits. The coefficients of these monomials have a more general form than those used in the previous attacks against Ascon, and our method enables us to re-frame previous results in a simpler form. Overall, it enables to gain a deeper understanding of the properties of the permutation, and in particular of its S-box, that make such state-recoveries possible.