摘要
Cube攻击是由Dinur和Shamir在2009年的欧密会上提出的一种代数攻击方法,它旨在从目标加密算法中提取关于未知变量的线性关系,而难点是在寻找有效的Cube.超轻量级序列密码具有速度快,功耗低,便于硬件实现等优点,市场对超轻量级序列密码的需求很大,使得密码学界对超轻量级序列密码算法的研究更加深入.2015年Armknetcht等人对轻量级序列密码提出了一个新的设计方向,在每轮密钥流比特的生成过程中重复使用初始密钥比特,并基于此想法设计了一个超轻量级序列密码算法Sprout,使得内部状态大小与密钥大小相同,打破了超轻量级序列密码设计的瓶颂.Fruit是2016年由Ghafari等设计的一种超轻量级流密码,其设计目的是在保证内部状态很小的同时能避免时间-存储-数据折衷攻击.本文对减轮的流密码Fruit作Cube攻击,在随机选取Cube方法的基础上提出一些寻找Cube的新想法,并最终对减轮的83轮(最高可到86轮)Fruit算法做Cube攻击求得80个密钥中的17个密钥,比穷尽搜索降低了2^(17)的复杂度.并发现找到的线性多项式只与密钥的后17比特有关,没有发现关于密钥前63比特的线性表示,Fruit算法的轮密钥函数导致的结果,对轮密钥函数的分析有很好的借鉴意义.
The cube attack is an algebraic cryptanalysis method introduced by Dinur and Shamir at EUROCRYPT 2009, it aims to extract linear relations about secret variables from the targeted primitives, and the difficulty is to find a good cube. Ultra-lightweight stream ciphers have the advantages of high speed, low power consumption, easy to implement and so on. The market demand for ultra-lightweight stream ciphers is very large, which makes the ultra-lightweight,stream ciphers to be more attractive. In 2015, Armknetcht et al. proposed a new design direction for lightweight stream ciphers, with repeated use of initial key bits in each round of key stream bit generation. Based on this idea, they proposed a new ultra-lightweight stream cipher named Sprout, with the internal state size and the key size are both 80 bits. An ultra-lightweight stream cipher Fruit was designed by Ghafari et al. in 2016 to reduce the internal state without harming its security against time-memory-data tradeoff attack. This work applies the cube attack to round-reduced Fruit. We consider a few new ideas for obtaining good cubes. The cube attack on round-reduced Fruit(83 rounds, up to 86 rounds) can recover 17 bits of keys out of the 80-bit key, which is 2^(17) times faster than exhaustive key search. The linear polynomial is found to be only related to the last 17 bits of the key, no linear representation is found in the first 63 bits of the key. This result is due to the round key function of the Fruit algorithm,it is a good reference for the analysis of the round key function.
出处
《密码学报》
CSCD
2017年第6期528-536,共9页
Journal of Cryptologic Research
