Differential cryptanalysis of PRESENT-like cipher 387
cipher in a linear-style. To cipher Maya, their attack can recover the secret S-boxes in versions
up to 16-rounds with 2
38
data complexity and 2
38
time complexity successfully. The correct
S-boxes were usually found in less than one week on a standard PC. In order to be able to
extrapolate the attack complexity for a large number of rounds, they described a theoretical
model. The model suggests that they can break up to 28-round before data complexity reaches
the boundary of 2
64
available plaintexts.
The Borghoff’s slender-set differential attack mainly divides into two parts: data collection
phase and S-box recovery phase. However, the attack presented in [ 10,11] can be improved in
two ways. First, the data collection phase can get more information about the secret S-boxes
with a more efficient method. Second, the attack in [10,11] just only checked whether the
candidate slender-sets are correct or not by using some filtering methods. In other words, in
case of an inconsistency during the checking, their attack will terminate. Actually, in S-box
recovery phase, we can swap the elements in the incorrect sets properly to construct the
correct slender-sets. Furthermore, how can we recover the secret key of the cipher with public
S-boxes with lower data and time complexity? This paper studies an improved slender-set
differential cryptanalysis of PRESENT-like cipher.
Our Results Our contributions are twofold. First, we investigate two different attacks on
PRESENT-like cipher with secret S-boxes and public S-boxes. For PRESENT-like cipher
with secret S-boxes, we introduce two new cryptanalytic techniques, and use them to recover
the secret S-boxes more efficiently. Our first new idea is that we present a new method of
data collection based on the method of optimal distinguisher for collecting information effi-
ciently. This method could make efficient use of all the differential information that comes
from the active S-boxes synthetically, which can reduce data and time complexity. Another
new technique is that we propose a method of constructing the entire valid slender-sets
by pruning search algorithm instead of checking correctness of slender-sets in the S-box
recovery phase. In particular, we implemented a successful attack on the cipher Maya. In
our experiments, the correct S-boxes can be recovered with 2
26
data complexity and 2
22.4
time complexity at a success rate of 100 % based on 200 independent samples. Second, for
PRESENT-like cipher with public S-boxes, we develop a new method to recover the secret
key with lower data and time complexity. Our starting point is to study the differences of
information leakage for correct key and wrong key. A new distinguisher for making a dis-
tinction between the correct key and wrong key is proposed. In particular, we apply our
attack to PRESENT and PRINT
CIPHER
. To the 12-round PRESENT, the experiments show
that we can recover the entire 80-bit secret key with 2
34.9
data and 2
38.9
time complex-
ity. To the 22-round PRINT
CIPHER
, experiments show that we can recover the entire 80-bit
secret key with 2
37.5
data complexity and 2
41.5
time complexity. The experiments suggest
that 18-round PRESENT-80 could be break with approximately 2
59
data complexity and 2
63
time complexity, and at most 27 rounds PRINT
CIPHER
-48 can be broken with 2
48
plaintexts.
Our attack is the best known differential result against PRESENT and PRINT
CIPHER
in prac-
tice. These methods can be used to most cipher where the linear layer is bit-wise permutation.
Related work There are lots of design and analysis on ciphers with secret S-boxes. In 1994,
Gilbert and Chauvaud presented a differential attack on the cipher Khufu which used secret
S-boxes [15]. In 1996, Vaudenay provided cryptanalysis of reduced-round variants of Blow-
fish where the S-boxes were randomly generated from the private key [26]. In 2001, Biryukov
and Shamir studied the security of iterated ciphers where the substitutions and permutations
are all secret and key-dependent [3,4]. In 2009, Borghoff researched on the cipher C2, which
has a secret S-box [9]. In 2011, Szaban and Seredynski proposed a methodology to design
dynamic cellular automata (CA)-based S-boxes [25]. Stoianov presented one approach for
123
Author's personal copy
剩余25页未读，继续阅读
weixin_38736562
- 粉丝: 5
- 资源: 1002
我的内容管理
展开
最新资源
- 解决Eclipse配置与导入Java工程常见问题
- 真空发生器：工作原理与抽吸性能分析
- 爱立信RBS6201开站流程详解
- 电脑开机声音解析：故障诊断指南
- JAVA实现贪吃蛇游戏
- 模糊神经网络实现与自学习能力探索
- PID型模糊神经网络控制器设计与学习算法
- 模糊神经网络在自适应PID控制器中的应用
- C++实现的学生成绩管理系统设计
- 802.1D STP 实现与优化：二层交换机中的生成树协议
- 解决Windows无法完成SD卡格式化的九种方法
- 软件测试方法：Beta与Alpha测试详解
- 软件测试周期详解：从需求分析到维护测试
- CMMI模型详解：软件企业能力提升的关键
- 移动Web开发框架选择：jQueryMobile、jQTouch、SenchaTouch对比
- Java程序设计试题与复习指南
资源上传下载、课程学习等过程中有任何疑问或建议，欢迎提出宝贵意见哦~我们会及时处理！
点击此处反馈
