Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs

We devise the first closed formula for the number of rounds of a blockcipher with secret components so that these components can be revealed using multiset, algebraic-degree, or division-integral properties, which in this case are equivalent. Using the new result, we attack 7 (out of 9) rounds of Ku...

Full description

Saved in:
Bibliographic Details
Published inIACR Transactions on Symmetric Cryptology pp. 226 - 247
Main Authors Alex Biryukov, Dmitry Khovratovich, Léo Perrin
Format Journal Article
LanguageEnglish
Published Ruhr-Universität Bochum 01.02.2017
Subjects
Algebraic attack
Division property
Generic SPN
Integral
Khazad
Kuznyechik
Multi-set
Online AccessGet full text

Cover

More Information
Summary:We devise the first closed formula for the number of rounds of a blockcipher with secret components so that these components can be revealed using multiset, algebraic-degree, or division-integral properties, which in this case are equivalent. Using the new result, we attack 7 (out of 9) rounds of Kuznyechik, the recent Russian blockcipher standard, thus halving its security margin. With the same technique we attack 6 (out of 8) rounds of Khazad, the legacy 64-bit blockcipher. Finally, we show how to cryptanalyze and find a decomposition of generic SPN construction for which the inner-components are secret. All the attacks are the best to date.
ISSN:2519-173X
DOI:10.13154/tosc.v2016.i2.226-247