Cryptanalysis of low-data instances of full LowMCv2

Christian Rechberger, Hadi Soleimany, Tyge Tiessen

Research output: Contribution to journalJournal articleResearchpeer-review

107 Downloads (Pure)


LowMC is a family of block ciphers designed for a low multiplicative complexity. The specification allows a large variety of instantiations, differing in block size, key size, number of S-boxes applied per round and allowed data complexity. The number of rounds deemed secure is determined by evaluating a number of attack vectors and taking the number of rounds still secure against the best of these. In this paper, we demonstrate that the attacks considered by the designers of LowMC in the version 2 of the round-formular were not sufficient to fend off all possible attacks. In the case of instantiations of LowMC with one of the most useful settings, namely with few applied S-boxes per round and only low allowable data complexities, efficient attacks based on difference enumeration techniques can be constructed. We show that it is most effective to consider tuples of differences instead of simple differences, both to increase the range of the distinguishers and to enable key recovery attacks. All applications for LowMC we are aware of, including signature schemes like Picnic and more recent (ring/group) signature schemes have used version 3 of the round-formular for LowMC, which takes our attack already into account.

Original languageEnglish
JournalIACR Transactions on Symmetric Cryptology
Issue number3
Pages (from-to)163-181
Publication statusPublished - 1 Jan 2018


  • Block cipher
  • Cryptanalysis
  • Low data
  • LowMC


Dive into the research topics of 'Cryptanalysis of low-data instances of full LowMCv2'. Together they form a unique fingerprint.

Cite this