Fixed Points of Special Type and Cryptanalysis of Full GOST

Abstract

GOST, the Russian encryption standard, is a block cipher of 64-bit block and 256-bit key size and consists of 32 rounds. In this work, we show that the probability that the GOST permutations produced through random keys have at least one fixed point and exactly two fixed points of special type are twice and five times more than those of random permutations respectively. We utilize this property of GOST to mount a new reflection attack on full GOST.

The reflection property on GOST was defined and exploited to mount an attack on the full cipher by Kara [7] which was successful only for one out of 2³² keys. This property has been further studied by Courtois [1], Dinur et al. [5] and Isobe [6]. Isobe mounted an attack that works for any key with a time complexity of 2²²⁵ [6]. Isobe’s attack was improved by Dinur et al. reducing the time complexity to 2¹⁹² using the whole codebook [5]. They introduce a new version of the meet-in-the-middle technique which they call ”2-dimensional meet in the middle (2DMITM)” attack. Their attack is based on applying 2DMITM attack on 8-round GOST 2⁶⁴ times. In this work, we mount an attack with time complexity of 2¹²⁹ using 2³² chosen plaintexts instead of the whole codebook utilizing the 2DMITM attack. The main advantages of our attack is that we mount the 2DMITM attack on 8-round GOST only twice. On the other hand, our attack works only for the weak key set of 2¹⁹² keys, which indicates that the security level of full GOST is equivalent to 129 bits for these keys. In addition, we have computed the success rates of Kara attack in [7] and our attack. We have verified our calculations experimentally.

We would like to thank Nicolas Courtois for proposing this title to us.