On selection of samples in algebraic attacks and a new technique to find hidden low degree equations

Abstract

The best way of selecting samples in algebraic attacks against block ciphers is not well explored and understood. We introduce a simple strategy for selecting the plaintexts and demonstrate its strength by breaking reduced-round KATAN32, LBlock and SIMON. For each case, we present a practical attack on reduced-round version which outperforms previous attempts of algebraic cryptanalysis whose complexities were close to exhaustive search. The attack is based on the selection of samples using cube attack and ElimLin which was presented at FSE’12, and a new technique called Universal Proning. In the case of LBlock, we break 10 out of 32 rounds. In KATAN32, we break 78 out of 254 rounds. Unlike previous attempts which break smaller number of rounds, we do not guess any bit of the key and we only use structural properties of the cipher to be able to break a higher number of rounds with much lower complexity. We show that cube attacks owe their success to the same properties and therefore can be used as a heuristic for selecting the samples in an algebraic attack. The performance of ElimLin is further enhanced by the new Universal Proning technique, which allows to discover linear equations that are not found by ElimLin.

Appendix: Additional proofs

Proof of Theorem 13

$$\begin{aligned}&\sum _{\tiny {x}\in C_{m, t}} f({x}, {k}) \\&\quad = \sum _{\tiny {x}\in C_{m, t}} \sum _{\tiny IJ} a_{IJ} \prod _{ \tiny i\in I} x_i \prod _{ \tiny j\in J} {k}_{j}\\&\quad = \sum _{\tiny IJ} a_{IJ} \left( \sum _{\tiny {x}\in C_{m, t}} \prod _{ \tiny i\in I} x_i\right) \prod _{ \tiny j\in J} {k}_{j}\\&\quad = \sum _{\tiny IJ} a_{IJ} \left( \left( \sum _{\tiny {x}\in C_{m, t}} \prod _{ \tiny i\in I \cap I_m } x_i \right) \prod _{ \tiny i\in I \setminus I_m} t_i \right) \prod _{ \tiny j\in J} {k}_{j}\\&\quad \buildrel \star \over {=} \sum _{\tiny IJ} a_{IJ} \left( {1}_{I_m\subseteq I} \prod _{ \tiny i\in I \setminus I_m} t_i \right) \prod _{ \tiny j\in J} {k}_{j}\\&\quad = \sum _{\tiny \begin{array}{c} J, \\ I:I_m \subseteq I \end{array} } a_{IJ} \prod _{ \tiny i\in I} t_i \prod _{ \tiny j\in J} {k}_{j}\\&\quad = \sum _{\tiny J } \left( \sum _{\tiny I:I_m \subseteq I } a_{IJ} \prod _{ \tiny i\in I} t_i \right) \prod _{ \tiny j\in J} {k}_{j}\\&\quad = \sum _{\tiny J } a_J' \prod _{ \tiny j\in J} {k}_{j} \end{aligned}$$

The equality $\star$ is satisfied, since

$$\begin{aligned} \sum _{\tiny {x}\in C_{m, t}} \prod _{ \tiny i\in I \cap I_m } x_i = \left\{ \begin{array}{l l} 0 &{} \quad \text {if }I \not \subseteq I_m \\ 1 &{} \quad \text {if }I \supseteq I_m \end{array} \right. \end{aligned}$$

since $\prod$ appears twice for every $i \in I\setminus I_m$. $\square$