Conditional Cube Attack on Round-Reduced ASCON
This paper evaluates the secure level of authenticated encryption Ascon against cube-like method. Ascon submitted by Dobraunig et al. is one of 16 survivors of the 3rd round CAESAR competition. The cube-like method is first used by Dinur et al. to analyze Keccak keyed modes. At CT-RSA 2015, Dobrauni...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Ruhr-Universität Bochum
2017-03-01
|
| Series: | IACR Transactions on Symmetric Cryptology |
| Subjects: | |
| Online Access: | https://tosc.iacr.org/index.php/ToSC/article/view/590 |
| _version_ | 1828965682528649216 |
|---|---|
| author | Zheng Li Xiaoyang Dong Xiaoyun Wang |
| author_facet | Zheng Li Xiaoyang Dong Xiaoyun Wang |
| author_sort | Zheng Li |
| collection | DOAJ |
| description | This paper evaluates the secure level of authenticated encryption Ascon against cube-like method. Ascon submitted by Dobraunig et al. is one of 16 survivors of the 3rd round CAESAR competition. The cube-like method is first used by Dinur et al. to analyze Keccak keyed modes. At CT-RSA 2015, Dobraunig et al. applied this method to 5/6-round reduced Ascon, whose structure is similar to Keccak keyed modes. However, for Ascon the non-linear layer is more complex and state is much smaller, which make it hard for the attackers to select enough cube variables that do not multiply with each other after the first round. This seems to be the reason why the best previous key-recovery attack is on 6-round Ascon, while for Keccak keyed modes (Keccak-MAC and Keyak) the attacked round is no less than 7-round. In this paper, we generalize the conditional cube attack proposed by Huang et al., and find new cubes depending on some key bit conditions for 5/6-round reduced Ascon, and translate the previous theoretic 6-round attack with 266 time complexity to a practical one with 240 time complexity. Moreover, we propose the first 7-round key-recovery attack on Ascon. By introducing the cube-like key-subset technique, we divide the full key space into many subsets according to different key conditions. For each key subset, we launch the cube tester to determine if the key falls into it. Finally, we recover the full key space by testing all the key subsets. The total time complexity is about 2103.9. In addition, for a weak-key subset, whose size is 2117, the attack is more efficient and costs only 277 time complexity. Those attacks do not threaten the full round (12 rounds) Ascon. |
| first_indexed | 2024-12-14T11:15:44Z |
| format | Article |
| id | doaj.art-90e9d02ee2e848d385fe914d80af4217 |
| institution | Directory Open Access Journal |
| issn | 2519-173X |
| language | English |
| last_indexed | 2024-12-14T11:15:44Z |
| publishDate | 2017-03-01 |
| publisher | Ruhr-Universität Bochum |
| record_format | Article |
| series | IACR Transactions on Symmetric Cryptology |
| spelling | doaj.art-90e9d02ee2e848d385fe914d80af42172022-12-21T23:04:03ZengRuhr-Universität BochumIACR Transactions on Symmetric Cryptology2519-173X2017-03-0117520210.13154/tosc.v2017.i1.175-202590Conditional Cube Attack on Round-Reduced ASCONZheng Li0Xiaoyang Dong1Xiaoyun Wang2Key Laboratory of Cryptologic Technology and Information Security, Ministry of Education, Shandong UniversityKey Laboratory of Cryptologic Technology and Information Security, Ministry of Education, Shandong UniversityKey Laboratory of Cryptologic Technology and Information Security, Ministry of Education, Shandong University; Institute for Advanced Study, Tsinghua UniversityThis paper evaluates the secure level of authenticated encryption Ascon against cube-like method. Ascon submitted by Dobraunig et al. is one of 16 survivors of the 3rd round CAESAR competition. The cube-like method is first used by Dinur et al. to analyze Keccak keyed modes. At CT-RSA 2015, Dobraunig et al. applied this method to 5/6-round reduced Ascon, whose structure is similar to Keccak keyed modes. However, for Ascon the non-linear layer is more complex and state is much smaller, which make it hard for the attackers to select enough cube variables that do not multiply with each other after the first round. This seems to be the reason why the best previous key-recovery attack is on 6-round Ascon, while for Keccak keyed modes (Keccak-MAC and Keyak) the attacked round is no less than 7-round. In this paper, we generalize the conditional cube attack proposed by Huang et al., and find new cubes depending on some key bit conditions for 5/6-round reduced Ascon, and translate the previous theoretic 6-round attack with 266 time complexity to a practical one with 240 time complexity. Moreover, we propose the first 7-round key-recovery attack on Ascon. By introducing the cube-like key-subset technique, we divide the full key space into many subsets according to different key conditions. For each key subset, we launch the cube tester to determine if the key falls into it. Finally, we recover the full key space by testing all the key subsets. The total time complexity is about 2103.9. In addition, for a weak-key subset, whose size is 2117, the attack is more efficient and costs only 277 time complexity. Those attacks do not threaten the full round (12 rounds) Ascon.https://tosc.iacr.org/index.php/ToSC/article/view/590AsconCAESARCube-likeKey RecoveryAuthenticated Encryption |
| spellingShingle | Zheng Li Xiaoyang Dong Xiaoyun Wang Conditional Cube Attack on Round-Reduced ASCON IACR Transactions on Symmetric Cryptology Ascon CAESAR Cube-like Key Recovery Authenticated Encryption |
| title | Conditional Cube Attack on Round-Reduced ASCON |
| title_full | Conditional Cube Attack on Round-Reduced ASCON |
| title_fullStr | Conditional Cube Attack on Round-Reduced ASCON |
| title_full_unstemmed | Conditional Cube Attack on Round-Reduced ASCON |
| title_short | Conditional Cube Attack on Round-Reduced ASCON |
| title_sort | conditional cube attack on round reduced ascon |
| topic | Ascon CAESAR Cube-like Key Recovery Authenticated Encryption |
| url | https://tosc.iacr.org/index.php/ToSC/article/view/590 |
| work_keys_str_mv | AT zhengli conditionalcubeattackonroundreducedascon AT xiaoyangdong conditionalcubeattackonroundreducedascon AT xiaoyunwang conditionalcubeattackonroundreducedascon |