分组密码TWIS的三子集中间相遇攻击

doi:10.3969/j.issn.1000-436x.2014.06.023

摘要/Abstract

摘要：

对轻量级分组密码TWIS的安全性做进一步分析，将三子集中间相遇攻击应用于忽略后期白化过程的10轮TWIS。基于TWIS密钥生成策略中存在的缺陷，即其实际密钥长度仅为62 bit且初始密钥混淆速度慢，攻击恢复10轮TWIS全部62 bit密钥的计算复杂度为2⁴⁵，数据复杂度达到最低，仅为一个已知明密文对。分析结果表明TWIS在三子集中间相遇攻击下是不安全的。

关键词: 分组密码, TWIS, 中间相遇攻击, 复杂度

Abstract:

To do further analysis of the security of lightweight block cipher TWIS, 3-subset meet-in-the-middle attack was applied to 10-round TWIS without the final whitening. Based on the weakness in the key schedule of TWIS:its ac-tual key size was only 62-bit and the confusion speed of the initial key was rather slow, the time complexity to recover the whole 62-bit key of 10-round TWIS was 2⁴⁵, and the data complexity was low enough with only one known plain-text-ciphertext pair. The result shows that block cipher TWIS is not secure under 3-subset meet-in-the-middle attack.

Key words: block cipher, TWIS, meet-in-the-middle attack, complexity

郑雅菲,卫宏儒. 分组密码TWIS的三子集中间相遇攻击[J]. 通信学报, 2014, 35(6): 180-184.

Ya-fei ZHENG,Hong-ru WEI. 3-subset meet-in-the-middle attack on block cipher TWIS[J]. Journal on Communications, 2014, 35(6): 180-184.

图/表 4

图1

表1

图2

表2

参考文献 13

[1]	OJHA S K , KUMAR N , JAIN K . TWIS–a lightweight block cipher[A]. Information Systems Security, Berlin: Springer Heidelberg, 2009.280-291.
[2]	SHIRAI T , SHIBUTANI K , AKISHITA T , et al. The 128 bit block cipher CLEFIA[A]. Fast Software Encryption, Berlin: Springer Heidelberg, 2007.181-195.
[3]	SU B Z , WU W L , ZHANG L , et al. Full-round differential attack on TWIS block cipher[A]. Information Security Applications, Berlin: Springer Heidelberg, 2011.234-242.
[4]	KOCAK O , OZTOP N . FCryptanalysis of TWIS block cipher[A]. Re-search in Cryptology, Berlin: Springer Heidelberg, 2012.109-121.
[5]	DIFFIE W , HELLMAN M E . Special feature exhaustive cryptanalysis of the NBS data encryption standard[J]. Computer, 1977,10(6):74-84.
[6]	CHAUM D , EVERTSE J H . Cryptanalysis of DES with a reduced number of rounds[A]. Cryptology-CRYPTO'85 Proceedings, Berlin: Springer Heidelberg, 1986.192-211.
[7]	DEMIRCI H , SELCUK A A . A meet-in-the-middle attack on 8-round AES[A]. Fast Software Encryption, Berlin: Springer Heidelberg, 2008.116-126.
[8]	DEMIRCI H , TASKM ? , COBAN M , et al. Improved meet-in-the-middle attacks on AES[A]. Progress in Cryptology- INDOCRYPT 2009[C]. Berlin: Springer Heidelberg, 2009.114-156.
[9]	DUNKELMAN O , SEKAR G , PRENEEL B . Improved meet-in-the-middle attacks on reduced-round DES[A]. Progress in Cryptology–INDOCRYPT 2007[C]. Berlin: Springer Heidelberg, 2007.86-100.
[10]	INDESTEEGE S , KELLER N , DUNKELMAN O , et al. A practical attack on keeloq[A]. Cryptology-EUROCRYPT 2008[C]. Berlin: Springer Heidelberg, 2008.1-18.
[11]	DE C C , DUNKELMAN O , KNEZEVIC M . KATAN and KTAN-TAN—a family of small and efficient hardware-oriented block ci-phers[A]. Cryptographic Hardware and Embedded Systems-CHES 2009[C]. Berlin: Springer Heidelberg, 2009.272-288.
[12]	BOGDANOV A , RECHBERGER C . A 3-subset meet-in-the-middle attack: cryptanalysis of the lightweight block cipher KTANTAN[A]. Selected Areas in Cryptography[C]. Berlin: Springer Heidelberg, 2011.229-240.
[13]	SEKAR G , SEKAR G , MOUHA N , VELICHKOV V , et al. Meet-in-the-middle attacks on reduced-round XTEA[A]. Topics in Cryptology–CT-RSA 2011[C]. Berlin: Springer Heidelberg, 2011.250-267.

轮数	RK_i?1	RK_i
前期白化	{k₀ ,k₁ ,k₂ ,k₉₉ ,k₁₀₀,…,k₁₂₇}	{k₀ ,k₁,…,k₅,k₁₀₂ ,k₁₀₃,…,k₁₂₇}
i=1	{k₀ ,k₁ ,k₂ ,k₉₉ ,k₁₀₀,…,k₁₂₇}	{k₀ ,k₁,…,k₅,k₁₀₂ ,k₁₀₃,…,k₁₂₇}
i=2	{k₀ ,k₁,…,k₅,k₁₀₂ ,k₁₀₃,…,k₁₂₇}	{k₀ ,k₁,…,k₈ ,k₁₀₅ ,k₁₀₆,…,k₁₂₇}
i=3	{k₀ ,k₁,…,k₈ ,k₁₀₅ ,k₁₀₆,…,k₁₂₇}	{k₀ ,k₁,…,k₁₁ ,k₁₀₈ ,k₁₀₉,…,k₁₂₇}
i=4	{k₀ ,k₁,…,k₁₁ ,k₁₀₈ ,k₁₀₉,…,k₁₂₇}	{k₀ ,k₁,…,k₁₄ ,k₁₁₁ ,k₁₁₂,…,k₁₂₇}
i=5	k₀ ,k₁,…,k₁₄ ,k₁₁₁ ,k₁₁₂,…,k₁₂₇}	{k₀ ,k₁,…,k₁₇ ,k₁₁₄ ,k₁₁₅,…,k₁₂₇}
i=6	{k₀ ,k₁,…,k₁₇ ,k₁₁₄ ,k₁₁₅,…,k₁₂₇}	{k₀ ,k₁,…,k₂₀,k₁₁₇ ,k₁₁₈,…,k₁₂₇}
i=7	{k₀ ,k₁,…,k₂₀,k₁₁₇ ,k₁₁₈,…,k₁₂₇}	{k0 ,k₁,…,k₂₃,k₁₂₀ ,k₁₂₁,…,k₁₂₇}
i=8	{k₀ ,k₁,…,k₂₃,k₁₂₀ ,k₁₂₁,…,k₁₂₇}	{k₀ ,k₁,…,k₂₆,k₁₂₃ ,k₁₂₄,…,k₁₂₇}
i=9	{k₀ ,k₁,…,k₂₆,k₁₂₃ ,k₁₂₄,…,k₁₂₇}	{k₀ ,k₁,…,k₂₉,k₁₂₆ ,k₁₂₇}
i=10	{k₀ ,k₁,…,k₂₉,k₁₂₆ ,k₁₂₇}	{k₁ ,k₂,…,k₃₂}
后期白化	{k₀ ,k₁,…,k₈ ,k₁₀₅ ,k₁₀₆,…,k₁₂₇}	{k₀ ,k₁,…,k₁₁ ,k₁₀₈ ,k₁₀₉,…,k₁₂₇}

算法	轮数	恢复密钥比特	计算复杂度	数据复杂度	攻击方法
本文	10	62	2 ⁴⁵	1	三子集MITM
文献[4]	10	12	2 ²¹	2 ²¹	差分攻击

[1]	张平, 牛凯, 姚圣时, 戴金晟. 面向未来的语义通信：基本原理与实现方法[J]. 通信学报, 2023, 44(5): 1-14.
[2]	杨光, 吴朝阳, 聂敏, 闫晓红, 江帆. 基于CWGAN-SLM的多小波OFDM系统峰均比抑制算法研究[J]. 通信学报, 2023, 44(4): 99-110.
[3]	胡斌, 谈潇, 王森鹏. 基于分治策略的SAT差分自动化搜索算法及其应用[J]. 通信学报, 2023, 44(4): 137-144.
[4]	杜少宇. 积分攻击改进——随机线性区分与密钥恢复攻击[J]. 通信学报, 2023, 44(4): 145-153.
[5]	王晓云, 张小舟, 马良, 王亚娟, 楼梦婷, 姜涛, 金婧, 王启星, 刘光毅. 6G通信感知一体化网络的感知算法研究与优化[J]. 通信学报, 2023, 44(2): 219-230.
[6]	刘正斌, 李永强, 朱朝熹. 分组密码最小活跃S盒个数快速搜索算法[J]. 通信学报, 2023, 44(1): 118-128.
[7]	李曼曼, 陈少真. 改进的减轮Kiasu-BC算法的中间相遇攻击[J]. 通信学报, 2022, 43(7): 41-48.
[8]	蒋梓龙, 金晨辉. Saturnin算法的不可能差分分析[J]. 通信学报, 2022, 43(3): 53-62.
[9]	谢敏,李嘉琪,田峰. FeW的差分故障攻击[J]. 通信学报, 2020, 41(4): 143-149.
[10]	王薇,张明,姚博彬,殷勤业,穆鹏程. 结合子空间旋转技术的非圆信号快速DOA估计[J]. 通信学报, 2020, 41(11): 198-205.
[11]	武小年,李迎新,韦永壮,孙亚平. GRANULE和MANTRA算法的不可能差分区分器分析[J]. 通信学报, 2020, 41(1): 94-101.
[12]	谢顺钦,周锞,陈大海,李湘鲁,钟声,张健. 基于虚拟调制指数集的多指数CPM减相位状态检测[J]. 通信学报, 2019, 40(9): 45-50.
[13]	谢敏,田峰,李嘉琪. TWINE算法的相关密钥不可能飞来去器攻击[J]. 通信学报, 2019, 40(9): 184-192.
[14]	王艳,李顺波,薛改娜. SLCE序列的2-adic复杂度[J]. 通信学报, 2019, 40(8): 151-156.
[15]	沈煜,李玮,谷大武,吴益鑫,曹珊,刘亚,刘志强,周志洪. ARIA密码的积分故障分析[J]. 通信学报, 2019, 40(2): 164-173.