Cryptanalysis of Draco
Draco is a lightweight stream cipher designed by Hamann et al. in IACR ToSC 2022. It has a Grain-like structure with two state registers of size 95 and 33 bits. In addition, the cipher uses a 128-bit secret key and a 96-bit IV. The first 32 bits of the key and the IV forms a non-volatile internal s...
| Main Author: | |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Ruhr-Universität Bochum
2022-12-01
|
| Series: | IACR Transactions on Symmetric Cryptology |
| Subjects: | |
| Online Access: | https://tosc.iacr.org/index.php/ToSC/article/view/9972 |
| _version_ | 1828118003386941440 |
|---|---|
| author | Subhadeep Banik |
| author_facet | Subhadeep Banik |
| author_sort | Subhadeep Banik |
| collection | DOAJ |
| description |
Draco is a lightweight stream cipher designed by Hamann et al. in IACR ToSC 2022. It has a Grain-like structure with two state registers of size 95 and 33 bits. In addition, the cipher uses a 128-bit secret key and a 96-bit IV. The first 32 bits of the key and the IV forms a non-volatile internal state that does not change during the time that the cipher produces keystream bits.
The authors claim that the cipher is provably secure against Time-Memory-Data (TMD) Tradeoff attacks. However in this paper, we first present two TMD tradeoff attacks against Draco. Both attacks leverage the fact that for certain judiciously chosen IVs the state update function of the cipher depend on only a small fraction of the non-volatile internal state. This makes the state update function in Draco essentially a one way function over a much smaller domain and range. The first attack requires around 2114.2 Draco iterations and requires that the adversary has access to 232 chosen IVs. The second attack is such that the attack parameters can be tuned as per the requirements of the attacker. If the attacker prioritizes that the number of different chosen IVs is limited to 220 say, then the attack can be done in around time proportional to 2126 Draco rounds. However if the total attack complexity is to be optimized, then the attack can be performed in 2107 time using around 240 chosen IVs.
|
| first_indexed | 2024-04-11T13:24:18Z |
| format | Article |
| id | doaj.art-24046886aaaf47efb34a96c859277e02 |
| institution | Directory Open Access Journal |
| issn | 2519-173X |
| language | English |
| last_indexed | 2024-04-11T13:24:18Z |
| publishDate | 2022-12-01 |
| publisher | Ruhr-Universität Bochum |
| record_format | Article |
| series | IACR Transactions on Symmetric Cryptology |
| spelling | doaj.art-24046886aaaf47efb34a96c859277e022022-12-22T04:22:06ZengRuhr-Universität BochumIACR Transactions on Symmetric Cryptology2519-173X2022-12-012022410.46586/tosc.v2022.i4.92-104Cryptanalysis of DracoSubhadeep Banik0Universita della Svizzera Italiana, Lugano, Switzerland Draco is a lightweight stream cipher designed by Hamann et al. in IACR ToSC 2022. It has a Grain-like structure with two state registers of size 95 and 33 bits. In addition, the cipher uses a 128-bit secret key and a 96-bit IV. The first 32 bits of the key and the IV forms a non-volatile internal state that does not change during the time that the cipher produces keystream bits. The authors claim that the cipher is provably secure against Time-Memory-Data (TMD) Tradeoff attacks. However in this paper, we first present two TMD tradeoff attacks against Draco. Both attacks leverage the fact that for certain judiciously chosen IVs the state update function of the cipher depend on only a small fraction of the non-volatile internal state. This makes the state update function in Draco essentially a one way function over a much smaller domain and range. The first attack requires around 2114.2 Draco iterations and requires that the adversary has access to 232 chosen IVs. The second attack is such that the attack parameters can be tuned as per the requirements of the attacker. If the attacker prioritizes that the number of different chosen IVs is limited to 220 say, then the attack can be done in around time proportional to 2126 Draco rounds. However if the total attack complexity is to be optimized, then the attack can be performed in 2107 time using around 240 chosen IVs. https://tosc.iacr.org/index.php/ToSC/article/view/9972DracoGrain FamilyStream Cipher |
| spellingShingle | Subhadeep Banik Cryptanalysis of Draco IACR Transactions on Symmetric Cryptology Draco Grain Family Stream Cipher |
| title | Cryptanalysis of Draco |
| title_full | Cryptanalysis of Draco |
| title_fullStr | Cryptanalysis of Draco |
| title_full_unstemmed | Cryptanalysis of Draco |
| title_short | Cryptanalysis of Draco |
| title_sort | cryptanalysis of draco |
| topic | Draco Grain Family Stream Cipher |
| url | https://tosc.iacr.org/index.php/ToSC/article/view/9972 |
| work_keys_str_mv | AT subhadeepbanik cryptanalysisofdraco |