改进的减轮MIBS-80密码的中间相遇攻击

MIBS密码算法是一个Feistel结构的轻量级分组密码,广泛适用于资源严格受限的环境。该文利用多重集和有效的差分枚举方法,构造了8轮MIBS中间相遇区分器,并在新区分器的基础上,实现了12轮和13轮MIBS-80密码的中间相遇攻击。攻击过程利用差分传递的性质筛选明文对,利用MIBS-80密钥扩展算法中主密钥和轮密钥的关系减少密钥的猜测量,攻击12轮MIBS-80的时间复杂度为253.2,攻击13轮MIBS-80的时间复杂度为262。与已有中间相遇攻击的结果相比,该文对MIBS-80中间相遇攻击的轮数提高了2轮。     

11轮3D密码算法的中间相遇攻击

引入多重集并结合截断差分和S盒的性质,构造出6轮中间相遇区分器,实现11轮3D密码的中间相遇攻击,恢复密钥所需的时间复杂度为2329,并结合时空折中的方法降低了数据复杂度。此外,利用新的区分器有效改进了3D算法10轮中间相遇攻击的时间复杂度,约2201次10轮加密运算。     

对ARIA算法中间相遇攻击的改进

对ARIA算法的结构特征进行了研究,利用“多重集”并结合截断差分的性质,将预计算的参数由30个减少到16个,构造新的4轮中间相遇区分器,有效地改进了ARIA-192算法的7轮中间相遇攻击。新攻击的预计算复杂度为2135.3,时间复杂度约为2123。     

改进的减轮Kiasu-BC算法的中间相遇攻击

Kiasu-BC算法是加密认证竞赛CAESAR第一轮入选方案Kiasu的内置可调分组密码。Kiasu-BC算法是基于AES-128轮函数构造的可调分组密码算法，通过对Kiasu-BC算法的结构特征进行研究，利用调柄自由度以及内部密钥间的制约关系，降低预计算的复杂度。结合差分枚举技术，构造新的5轮中间相遇区分器，改进Kiasu-BC算法的8轮中间相遇攻击。改进后攻击的时间复杂度为2¹¹⁴，存储复杂度为2⁶³，数据复杂度为2¹⁰⁸。     

减轮Simeck算法的积分攻击

该文对轻量级分组密码算法Simeck在积分攻击下的安全性进行了研究。通过向前解密扩展已有的积分区分器,构造了16轮Simeck48和20轮Simeck64算法的高阶积分区分器,并在新区分器的基础上,利用等价子密钥技术和部分和技术,结合中间相遇策略和密钥扩展算法的性质,实现了24轮Simeck48和29轮Simeck64算法的积分攻击。攻击24轮Simeck48的数据复杂度为246,时间复杂度为295,存储复杂度为282.52;攻击29轮Simeck64的数据复杂度为263,时间复杂度为2127.3,存储复杂度为2109.02。与Simeck算法已有积分攻击的结果相比,该文对Simeck48和Simeck64积分攻击的轮数分别提高了3轮和5轮。     

对基于NLFSR分组密码KTANTAN32的相关密钥中间相遇代数攻击

 本文分析了KTANTAN32的代数学弱点.使用相关密钥中间相遇攻击,用代数推导的方法得到了在240轮之后所使用某些密钥的一元线性方程,解这些方程便可迅速逐比特恢复相应密钥.因只须一对相关密钥和2个明密文,即可恢复部分密钥比特,攻击的时间复杂度和空间复杂度都可以忽略不计.分析表明KTANTAN32是一个很弱的算法.同时也说明使用NLFSR和线性密钥编排是KTANTAN32的致命弱点,为抵抗相关密钥中间相遇攻击,设计者应在密钥编排中加入非线性因素.     

对8轮CLEFIA算法的一种现实攻击

CLEFIA算法是SONY公司在2007年的快速软件加密大会上提出的一个分组密码算法.研究了CLEFIA算法的等价结构,并找到了它的一个5轮区分器.基于5轮区分器,利用中间相遇攻击方法对6/7/8轮的CLEFIA算法进行了攻击.攻击复杂度都比较小,其中对于6轮和7轮的攻击在普通PC机上不到1秒钟就可恢复密钥,8轮的攻击...     

CIKS-128分组算法的相关密钥-差分攻击

分析研究了CIKS-128分组密码算法在相关密钥-差分攻击下的安全性.利用DDP结构和非线性函数的差分信息泄漏规律构造了一条高概率相关密钥-差分特征,并给出攻击算法,恢复出了192bit密钥;在此基础上,对剩余64bit密钥进行穷举攻击,恢复出了算法的全部256bit密钥.攻击所需的计算复杂度为2⁷⁷次CIKS-128算法加密,数据复杂度为2⁷⁷个相关密钥-选择明文,存储复杂度为2^25.4字节存储空间.分析结果表明,CIKS-128算法在相关密钥-差分攻击条件下是不安全的.     

42轮SHACAL-2新的相关密钥矩形攻击

利用SHACAL-2密码算法轮变换的特点,构造了一个新型的34轮区分器.基于该区分器和部分密钥分别猜测的技术,针对40轮、42轮简化SHACAL-2分别给出了新的攻击方法.研究结果表明:利用2个相关密钥.对40轮SHACAL-2进行相关密钥矩形攻击其数据复杂度约为2235选择明文数据量,计算复杂度约为243.6次加密;而对42轮SHACAL-2进行相关密钥矩形攻击其数据复杂度约为2235选择明文数据量,计算复杂度约为2472.6次加密.与已有的结果相比较,这些新分析所需的数据复杂度和计算复杂度均有明显的降低.     

FOX算法的中间相遇攻击

研究了FOX分组密码算法在中间相遇攻击下的安全性。首先,分别构造了FOX64和FOX128的3轮中间相遇区分器,实施了6轮中间相遇攻击,得到对6轮FOX64和FOX128较好的攻击结果。其次,将FOX128的中间相遇区分器扩展到4轮,并结合时间存储数据折衷的方法,攻击了7轮FOX128,与已有的攻击结果相比,攻击的时间复杂度和存储复杂度略大,而数据复杂度明显降低。     

Improved impossible differential and biclique cryptanalysis of HIGHT

HIGHT is a lightweight block cipher introduced in CHES 2006 by Hong et al as a block cipher suitable for low‐resource applications. In this paper, we propose improved impossible differential and biclique attacks on HIGHT block cipher both exploiting the permutation‐based property of the cipher's key schedule algorithm as well as its low diffusion. For impossible differential attack, we found a new 17‐round impossible differential characteristic that enables us to propose a new 27‐round impossible differential attack. The total time complexity of the attack is 2^120.4 where an amount of 2^59.3 chosen plaintext‐ciphertext pairs and 2^107.4 memory are required. We also instantiate a new biclique cryptanalysis of HIGHT, which is based on the new idea of splitting each of the forward and backward keys into 2 parts where the computations associated to each one are performed independently. The time complexity and data complexity of this attack are 2^125.7 and 2⁴², respectively. To the best of our knowledge, this is the fastest biclique attack on full‐round HIGHT.     

Hybrid genetic-paired-permutation algorithm for improved VLSI placement

This paper addresses Very large-scale integration (VLSI) placement optimization, which is important because of the rapid development of VLSI design technologies. The goal of this study is to develop a hybrid algorithm for VLSI placement. The proposed algorithm includes a sequential combination of a genetic algorithm and an evolutionary algorithm. It is commonly known that local search algorithms, such as random forest, hill climbing, and variable neighborhoods, can be effectively applied to NP-hard problem-solving. They provide improved solutions, which are obtained after a global search. The scientific novelty of this research is based on the development of systems, principles, and methods for creating a hybrid (combined) placement algorithm. The principal difference in the proposed algorithm is that it obtains a set of alternative solutions in parallel and then selects the best one. Nonstandard genetic operators, based on problem knowledge, are used in the proposed algorithm. An investigational study shows an objective-function improvement of 13%. The time complexity of the hybrid placement algorithm is O(N²).     

Quantum collision search algorithm against New FORK-256

In order to improve the attack efficiency of the New FORK-256 function,an algorithm based on Grover＇s quantum search algorithm and birthday attack is proposed.In this algorithm,finding a collision for arbitrary hash function only needs O（2m/3） expected evaluations,where m is the size of hash space value.It is proved that the algorithm can obviously improve the attack efficiency for only needing O（274.7） expected evaluations,and this is more efficient than any known classical algorithm,and the consumed space of the algorithm equals the evaluation.     

基于FPGA平台的Piccolo功耗分析安全性评估

为了评估Piccolo密码算法的功耗分析安全性,该文提出一种针对Piccolo末轮的攻击模型,基于SASEBO (Side-channel Attack Standard Evaluation BOard)实测功耗数据对该算法进行了相关性功耗分析攻击。针对Piccolo末轮运算中包含白化密钥的特点,将末轮攻击密钥(包括轮密钥RK24L, RK24R, WK2, WK3)分成4段子密钥,逐个完成各个子密钥的攻击,使80位种子密钥的搜索空间从280降低到(2220+2212+216),使种子密钥的恢复成为可能。攻击结果表明,在实测功耗数据情况下,3000条功耗曲线即可恢复80位种子密钥,证实了该攻击模型的有效性和Piccolo硬件面向功耗分析的脆弱性,研究并采取切实有效的防护措施势在必行。     

Is the Data Encryption Standard a group? (Results of cycling experiments on DES)

The Data Encryption Standard (DES) defines an indexed set of permutations acting on the message space ={0,1}⁶⁴. If this set of permutations were closed under functional composition, then the two most popular proposals for strengthening DES through multiple encryption would be equivalent to single encryption. Moreover, DES would be vulnerable to a known-plaintext attack that runs in 2²⁸ steps on the average. It is unknown in the open literature whether or not DES has this weakness.Two statistical tests are presented for determining if an indexed set of permutations acting on a finite message space forms a group under functional composition. The first test is a meet-in-the-middle algorithm which uses O(K) time and space, where K is the size of the key space. The second test, a novel cycling algorithm, uses the same amount of time but only a small constant amount of space. Each test yields a known-plaintext attack against any finite, deterministic cryptosystem that generates a small group.The cycling closure test takes a pseudorandom walk in the message space until a cycle is detected. For each step of the pseudorandom walk, the previous ciphertext is encrypted under a key chosen by a pseudorandom function of the previous ciphertext. Results of the test are asymmetrical: long cycles are overwhelming evidence that the set of permutations is not a group; short cycles are strong evidence that the set of permutations has a structure different from that expected from a set of randomly chosen permutations.Using a combination of software and special-purpose hardware, the cycling closure test was applied to DES. Experiments show, with overwhelming confidence, that DES is not a group. Additional tests confirm that DES is free of certain other gross algebraic weaknesses. But one experiment discovered fixed points of the so-called weak-key transformations, thereby revealing a previously unpublished additional weakness of the weak keys.Support for this research was provided in part by the National Science Foundation under contract number MCS-8006938 and by the International Business Machines Corporation.     

Zodiac算法新的Square攻击

该文重新评估了Zodiac算法抗Square攻击的能力。Zodiac算法存在8轮Square区分器,该文首先根据算法的结构特性,给出了Zodiac的4个等价结构,而后利用等价结构得到了两个新的9轮Square区分器。利用新的区分器,对不同轮数的Zodiac算法实施了Square攻击,对12轮,13轮,14轮,15轮和16轮Zodiac的攻击复杂度分别为237.3,262.9,296.1,2137.1和2189.5次加密运算,选择明文数分别为210.3,211,211.6,212.1和212.6。结果表明:完整16轮192 bit密钥的Zodiac算法是不抗Square攻击的。     

对比特搜索生成器的猜测确定攻击

针对具有低重量反馈多项式的比特搜索生成器(BSG),利用猜测确定攻击的思想提出了一种快速密钥恢复攻击。该算法基于BSG序列的差分构造特点,首先由截获的密钥流恢复出候选差分序列,然后用反馈多项式对候选差分序列进行校验,以此减少需要求解的L维线性方程系统的数量,从而大大减少了算法所需的复杂度。理论分析和仿真结果表明,对于反馈多项式的重量小于10的BSG,该算法明显优于现有的攻击方法。特别地当反馈多项式的重量为3时,该算法能够将最好的攻击结果O(L320.5L)降低到O(L20.5L)。     

Cryptanalysis of mCrypton—A lightweight block cipher for security of RFID tags and sensors

mCrypton is a 64‐bit lightweight block cipher designed for use in low‐cost and resource‐constrained applications such as RFID tags and sensors in wireless sensor networks. In this paper, we investigate the strength of this cipher against related‐key impossible differential cryptanalysis. First, we construct two 6‐round related‐key impossible differentials for mCrypton‐96 and mCrypton‐128. Then, using these distinguishers, we present 9‐round related‐key impossible differential attacks on these two versions. The attack on mCrypton‐96 requires 2^59.9 chosen plaintexts, and has a time complexity of about 2^74.9 encryptions. The data and time complexities for the attack on mCrypton‐128 are 2^59.7 chosen plaintexts and 2^66.7 encryptions, respectively. Copyright © 2011 John Wiley & Sons, Ltd.     

低轮FOX64算法的零相关-积分分析

FOX系列算法是一类基于Lai-Massey模型设计的分组密码算法。该文首先评估低轮FOX64算法抵抗零相关线性分析的能力,给出4轮FOX64算法的零相关线性区分器。然后,利用零相关线性区分器与积分区分器的关系,首次得到4轮FOX64算法的积分区分器。最后,利用积分区分器分析5, 6, 7, 8轮FOX64算法,攻击的时间复杂度分别约为252.7, 2116.7, 2180.7, 2244.7次加密,数据复杂度为250个选择明文。该文首次给出攻击8轮FOX64/256时间复杂度小于穷举攻击的有效攻击。     

对Shannon算法的线性区分攻击

该文基于对Shannon算法非线性反馈移存器反馈函数和非线性滤波函数进行线性逼近,得到了优势为2-28的32个新的区分器,给出了一个对流密码算法Shannon的新的线性区分攻击。该区分攻击大约需要252密钥字就能将Shannon算法的密钥流序列从随机序列中区分出来。