Cryptanalysis of Full SCARF

Antonio Flórez-Gutiérrez; Eran Lambooij; Gaëtan Leurent; Håvard Raddum; Tyge Tiessen; Michiel Verbauwhede

doi:10.1007/978-3-031-91107-1_14

Cryptanalysis of Full SCARF

Antonio Flórez-Gutiérrez
, Eran Lambooij
, Gaëtan Leurent
, Håvard Raddum
, Tyge Tiessen
, Michiel Verbauwhede

NTT Social Informatics Laboratories
Bar-Ilan University
École normale supérieure
Simula Research Laboratory
KU Leuven

Research output: Chapter in Book/Report/Conference proceeding › Article in proceedings › Research › peer-review

4 Downloads (Orbit)

Abstract

SCARF is a tweakable block cipher dedicated to cache address randomization, proposed at the USENIX Security conference. It has a 10-bit block, 48-bit tweak, and 240-bit key. SCARF is aggressively optimized to meet the harsh latency constraints of cache address randomization, and uses a dedicated model for its security claim. The full version of SCARF has 8 rounds, and its designers claim security up to 2⁴⁰ queries and 2⁸⁰computations. In this work we present a distinguisher against 6-round SCARF under the collision model with time and query complexity 2³⁰, and a key-recovery attack against the full 8-round SCARF under the encryption-decryption model with 2³⁹queries and time 2^76.2. As part of the attack, we present a novel method to compute the minimal number of right pairs following a differential characteristic when the input pairs are restricted to a subspace of the domain of the primitive.

Original language	English
Title of host publication	Proceedings of The 44th Annual International Conference on the Theory and Applications of Cryptographic Techniques, EUROCRYPT 2025
Publisher	Springer
Publication date	2025
Pages	397–426
ISBN (Print)	978-3-031-91106-4
ISBN (Electronic)	978-3-031-91107-1
DOIs	https://doi.org/10.1007/978-3-031-91107-1_14
Publication status	Published - 2025
Event	The 44th Annual International Conference on the Theory and Applications of Cryptographic Techniques - Madrid, Spain Duration: 4 May 2025 → 8 May 2025

Conference

Conference	The 44th Annual International Conference on the Theory and Applications of Cryptographic Techniques
Country/Territory	Spain
City	Madrid
Period	04/05/2025 → 08/05/2025

Keywords

SCARF
Tweakable block cipher
Cryptanalysis

Access to Document

10.1007/978-3-031-91107-1_14

FulltextAccepted author manuscript, 781 KB

OpenUrl availability

Check availability in DTU Findit

Cite this

@inproceedings{ce5f84ca6aee4530b990b2c90ec21fcc,

title = "Cryptanalysis of Full SCARF",

abstract = "SCARF is a tweakable block cipher dedicated to cache address randomization, proposed at the USENIX Security conference. It has a 10-bit block, 48-bit tweak, and 240-bit key. SCARF is aggressively optimized to meet the harsh latency constraints of cache address randomization, and uses a dedicated model for its security claim. The full version of SCARF has 8 rounds, and its designers claim security up to 240 queries and 280 computations. In this work we present a distinguisher against 6-round SCARF under the collision model with time and query complexity 230, and a key-recovery attack against the full 8-round SCARF under the encryption-decryption model with 239 queries and time 276.2. As part of the attack, we present a novel method to compute the minimal number of right pairs following a differential characteristic when the input pairs are restricted to a subspace of the domain of the primitive.",

keywords = "SCARF, Tweakable block cipher, Cryptanalysis",

author = "Antonio Fl{\'o}rez-Guti{\'e}rrez and Eran Lambooij and Ga{\"e}tan Leurent and H{\aa}vard Raddum and Tyge Tiessen and Michiel Verbauwhede",

year = "2025",

doi = "10.1007/978-3-031-91107-1\_14",

language = "English",

isbn = "978-3-031-91106-4",

pages = "397–426",

booktitle = "Proceedings of The 44th Annual International Conference on the Theory and Applications of Cryptographic Techniques, EUROCRYPT 2025",

publisher = "Springer",

note = "The 44th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Eurocrypt ; Conference date: 04-05-2025 Through 08-05-2025",

}

Flórez-Gutiérrez, A, Lambooij, E, Leurent, G, Raddum, H, Tiessen, T & Verbauwhede, M 2025, Cryptanalysis of Full SCARF. in Proceedings of The 44th Annual International Conference on the Theory and Applications of Cryptographic Techniques, EUROCRYPT 2025 . Springer, pp. 397–426, The 44th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Madrid, Spain, 04/05/2025. https://doi.org/10.1007/978-3-031-91107-1_14

Cryptanalysis of Full SCARF. / Flórez-Gutiérrez, Antonio; Lambooij, Eran; Leurent, Gaëtan et al.
Proceedings of The 44th Annual International Conference on the Theory and Applications of Cryptographic Techniques, EUROCRYPT 2025 . Springer, 2025. p. 397–426.

Research output: Chapter in Book/Report/Conference proceeding › Article in proceedings › Research › peer-review

TY - GEN

T1 - Cryptanalysis of Full SCARF

AU - Flórez-Gutiérrez, Antonio

AU - Lambooij, Eran

AU - Leurent, Gaëtan

AU - Raddum, Håvard

AU - Tiessen, Tyge

AU - Verbauwhede, Michiel

PY - 2025

Y1 - 2025

N2 - SCARF is a tweakable block cipher dedicated to cache address randomization, proposed at the USENIX Security conference. It has a 10-bit block, 48-bit tweak, and 240-bit key. SCARF is aggressively optimized to meet the harsh latency constraints of cache address randomization, and uses a dedicated model for its security claim. The full version of SCARF has 8 rounds, and its designers claim security up to 240 queries and 280 computations. In this work we present a distinguisher against 6-round SCARF under the collision model with time and query complexity 230, and a key-recovery attack against the full 8-round SCARF under the encryption-decryption model with 239 queries and time 276.2. As part of the attack, we present a novel method to compute the minimal number of right pairs following a differential characteristic when the input pairs are restricted to a subspace of the domain of the primitive.

AB - SCARF is a tweakable block cipher dedicated to cache address randomization, proposed at the USENIX Security conference. It has a 10-bit block, 48-bit tweak, and 240-bit key. SCARF is aggressively optimized to meet the harsh latency constraints of cache address randomization, and uses a dedicated model for its security claim. The full version of SCARF has 8 rounds, and its designers claim security up to 240 queries and 280 computations. In this work we present a distinguisher against 6-round SCARF under the collision model with time and query complexity 230, and a key-recovery attack against the full 8-round SCARF under the encryption-decryption model with 239 queries and time 276.2. As part of the attack, we present a novel method to compute the minimal number of right pairs following a differential characteristic when the input pairs are restricted to a subspace of the domain of the primitive.

KW - SCARF

KW - Tweakable block cipher

KW - Cryptanalysis

U2 - 10.1007/978-3-031-91107-1_14

DO - 10.1007/978-3-031-91107-1_14

M3 - Article in proceedings

SN - 978-3-031-91106-4

SP - 397

EP - 426

BT - Proceedings of The 44th Annual International Conference on the Theory and Applications of Cryptographic Techniques, EUROCRYPT 2025

PB - Springer

T2 - The 44th Annual International Conference on the Theory and Applications of Cryptographic Techniques

Y2 - 4 May 2025 through 8 May 2025

ER -

Cryptanalysis of Full SCARF

Abstract

Conference

Keywords

Access to Document

OpenUrl availability

Fingerprint

Cite this