Cryptanalysis of iterated Even-Mansour schemes with two keys

Itai Dinur; Orr Dunkelman; Nathan Keller; Adi Shamir

doi:10.1007/978-3-662-45611-8_23

Cryptanalysis of iterated Even-Mansour schemes with two keys

Itai Dinur, Orr Dunkelman, Nathan Keller, Adi Shamir

Department of Computer Science

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

Abstract

The iterated Even-Mansour (EM) scheme is a generalization of the original 1-round construction proposed in 1991, and can use one key, two keys, or completely independent keys. In this paper, we methodically analyze the security of all the possible iterated Even-Mansour schemes with two n-bit keys and up to four rounds, and show that none of them provides more than n-bit security. Our attacks are based on a new cryptanalytic technique called multibridge which splits the cipher to different parts in a novel way, such that they can be analyzed independently, exploiting its self-similarity properties. After the analysis of the parts, the key suggestions are efficiently joined using a meet-in-themiddle procedure.

As a demonstration of the multibridge technique, we devise a new attack on 4 steps of the LED-128 block cipher, reducing the time complexity of the best known attack on this scheme from 2⁹⁶ to 2⁶⁴. Furthermore, we show that our technique can be used as a generic key-recovery tool, when combined with some statistical distinguishers (like those recently constructed in reflection cryptanalysis of GOST and PRINCE).

Original language	English
Title of host publication	Advances in Cryptology - ASIACRYPT 2014 - 20th International Conference on the Theory and Application of Cryptology and Information Security, Proceedings, Part I
Editors	Palash Sarkar, Tetsu Iwata
Publisher	Springer Verlag
Pages	439-457
Number of pages	19
ISBN (Electronic)	9783662456101
DOIs	https://doi.org/10.1007/978-3-662-45611-8_23
State	Published - 2014
Event	20th International Conference on the Theory and Application of Cryptology and Information Security, ASIACRYPT 2014 - Kaoshiung, Taiwan, Province of China Duration: 7 Dec 2014 → 11 Dec 2014

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	8873
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	20th International Conference on the Theory and Application of Cryptology and Information Security, ASIACRYPT 2014
Country/Territory	Taiwan, Province of China
City	Kaoshiung
Period	7/12/14 → 11/12/14

Bibliographical note

Publisher Copyright:
© International Association for Cryptologic Research 2014.

Keywords

Cryptanalysis
Iterated even-mansour
LED-128
Meet-in-the-middle attacks
Multibridge attack

ASJC Scopus subject areas

Theoretical Computer Science
General Computer Science

Access to Document

10.1007/978-3-662-45611-8_23

Cite this

Dinur, I., Dunkelman, O., Keller, N., & Shamir, A. (2014). Cryptanalysis of iterated Even-Mansour schemes with two keys. In P. Sarkar, & T. Iwata (Eds.), Advances in Cryptology - ASIACRYPT 2014 - 20th International Conference on the Theory and Application of Cryptology and Information Security, Proceedings, Part I (pp. 439-457). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 8873). Springer Verlag. https://doi.org/10.1007/978-3-662-45611-8_23

Dinur, Itai ; Dunkelman, Orr ; Keller, Nathan et al. / Cryptanalysis of iterated Even-Mansour schemes with two keys. Advances in Cryptology - ASIACRYPT 2014 - 20th International Conference on the Theory and Application of Cryptology and Information Security, Proceedings, Part I. editor / Palash Sarkar ; Tetsu Iwata. Springer Verlag, 2014. pp. 439-457 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{e1ba642cb8b04e3384af46054e5e3556,

title = "Cryptanalysis of iterated Even-Mansour schemes with two keys",

abstract = "The iterated Even-Mansour (EM) scheme is a generalization of the original 1-round construction proposed in 1991, and can use one key, two keys, or completely independent keys. In this paper, we methodically analyze the security of all the possible iterated Even-Mansour schemes with two n-bit keys and up to four rounds, and show that none of them provides more than n-bit security. Our attacks are based on a new cryptanalytic technique called multibridge which splits the cipher to different parts in a novel way, such that they can be analyzed independently, exploiting its self-similarity properties. After the analysis of the parts, the key suggestions are efficiently joined using a meet-in-themiddle procedure.As a demonstration of the multibridge technique, we devise a new attack on 4 steps of the LED-128 block cipher, reducing the time complexity of the best known attack on this scheme from 296 to 264. Furthermore, we show that our technique can be used as a generic key-recovery tool, when combined with some statistical distinguishers (like those recently constructed in reflection cryptanalysis of GOST and PRINCE).",

keywords = "Cryptanalysis, Iterated even-mansour, LED-128, Meet-in-the-middle attacks, Multibridge attack",

author = "Itai Dinur and Orr Dunkelman and Nathan Keller and Adi Shamir",

note = "Publisher Copyright: {\textcopyright} International Association for Cryptologic Research 2014.; 20th International Conference on the Theory and Application of Cryptology and Information Security, ASIACRYPT 2014 ; Conference date: 07-12-2014 Through 11-12-2014",

year = "2014",

doi = "10.1007/978-3-662-45611-8_23",

language = "English",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer Verlag",

pages = "439--457",

editor = "Palash Sarkar and Tetsu Iwata",

booktitle = "Advances in Cryptology - ASIACRYPT 2014 - 20th International Conference on the Theory and Application of Cryptology and Information Security, Proceedings, Part I",

address = "Germany",

}

Dinur, I, Dunkelman, O, Keller, N & Shamir, A 2014, Cryptanalysis of iterated Even-Mansour schemes with two keys. in P Sarkar & T Iwata (eds), Advances in Cryptology - ASIACRYPT 2014 - 20th International Conference on the Theory and Application of Cryptology and Information Security, Proceedings, Part I. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 8873, Springer Verlag, pp. 439-457, 20th International Conference on the Theory and Application of Cryptology and Information Security, ASIACRYPT 2014, Kaoshiung, Taiwan, Province of China, 7/12/14. https://doi.org/10.1007/978-3-662-45611-8_23

Cryptanalysis of iterated Even-Mansour schemes with two keys. / Dinur, Itai; Dunkelman, Orr; Keller, Nathan et al.
Advances in Cryptology - ASIACRYPT 2014 - 20th International Conference on the Theory and Application of Cryptology and Information Security, Proceedings, Part I. ed. / Palash Sarkar; Tetsu Iwata. Springer Verlag, 2014. p. 439-457 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 8873).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Cryptanalysis of iterated Even-Mansour schemes with two keys

AU - Dinur, Itai

AU - Dunkelman, Orr

AU - Keller, Nathan

AU - Shamir, Adi

N1 - Publisher Copyright: © International Association for Cryptologic Research 2014.

PY - 2014

Y1 - 2014

N2 - The iterated Even-Mansour (EM) scheme is a generalization of the original 1-round construction proposed in 1991, and can use one key, two keys, or completely independent keys. In this paper, we methodically analyze the security of all the possible iterated Even-Mansour schemes with two n-bit keys and up to four rounds, and show that none of them provides more than n-bit security. Our attacks are based on a new cryptanalytic technique called multibridge which splits the cipher to different parts in a novel way, such that they can be analyzed independently, exploiting its self-similarity properties. After the analysis of the parts, the key suggestions are efficiently joined using a meet-in-themiddle procedure.As a demonstration of the multibridge technique, we devise a new attack on 4 steps of the LED-128 block cipher, reducing the time complexity of the best known attack on this scheme from 296 to 264. Furthermore, we show that our technique can be used as a generic key-recovery tool, when combined with some statistical distinguishers (like those recently constructed in reflection cryptanalysis of GOST and PRINCE).

AB - The iterated Even-Mansour (EM) scheme is a generalization of the original 1-round construction proposed in 1991, and can use one key, two keys, or completely independent keys. In this paper, we methodically analyze the security of all the possible iterated Even-Mansour schemes with two n-bit keys and up to four rounds, and show that none of them provides more than n-bit security. Our attacks are based on a new cryptanalytic technique called multibridge which splits the cipher to different parts in a novel way, such that they can be analyzed independently, exploiting its self-similarity properties. After the analysis of the parts, the key suggestions are efficiently joined using a meet-in-themiddle procedure.As a demonstration of the multibridge technique, we devise a new attack on 4 steps of the LED-128 block cipher, reducing the time complexity of the best known attack on this scheme from 296 to 264. Furthermore, we show that our technique can be used as a generic key-recovery tool, when combined with some statistical distinguishers (like those recently constructed in reflection cryptanalysis of GOST and PRINCE).

KW - Cryptanalysis

KW - Iterated even-mansour

KW - LED-128

KW - Meet-in-the-middle attacks

KW - Multibridge attack

UR - http://www.scopus.com/inward/record.url?scp=84916625011&partnerID=8YFLogxK

U2 - 10.1007/978-3-662-45611-8_23

DO - 10.1007/978-3-662-45611-8_23

M3 - Conference contribution

AN - SCOPUS:84916625011

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 439

EP - 457

BT - Advances in Cryptology - ASIACRYPT 2014 - 20th International Conference on the Theory and Application of Cryptology and Information Security, Proceedings, Part I

A2 - Sarkar, Palash

A2 - Iwata, Tetsu

PB - Springer Verlag

T2 - 20th International Conference on the Theory and Application of Cryptology and Information Security, ASIACRYPT 2014

Y2 - 7 December 2014 through 11 December 2014

ER -

Dinur I, Dunkelman O, Keller N, Shamir A. Cryptanalysis of iterated Even-Mansour schemes with two keys. In Sarkar P, Iwata T, editors, Advances in Cryptology - ASIACRYPT 2014 - 20th International Conference on the Theory and Application of Cryptology and Information Security, Proceedings, Part I. Springer Verlag. 2014. p. 439-457. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-662-45611-8_23

Cryptanalysis of iterated Even-Mansour schemes with two keys

Abstract

Publication series

Conference

Bibliographical note

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this