Key Recovery Attacks on Recent Authenticated Ciphers

Andrey Bogdanov; Christoph Dobraunig; Maria  Eichlseder; Martin Mehl Lauridsen; Florian Mendel; Martin Schläffer; Elmar Wolfgang Tischhauser

Key Recovery Attacks on Recent Authenticated Ciphers

Andrey Bogdanov, Christoph Dobraunig, Maria Eichlseder, Martin Mehl Lauridsen, Florian Mendel, Martin Schläffer, Elmar Wolfgang Tischhauser

Department of Applied Mathematics and Computer Science

Graz University of Technology

Research output: Chapter in Book/Report/Conference proceeding › Article in proceedings › Research › peer-review

Abstract

In this paper, we cryptanalyze three authenticated ciphers: AVALANCHE, Calico, and RBS. While the former two are contestants in the ongoing international CAESAR competition for authenticated encryption schemes, the latter has recently been proposed for lightweight applications such as RFID systems and wireless networks. All these schemes use well-established and secure components such as the AES, Grain-like NFSRs, ChaCha and SipHash as their building blocks. However, we discover key recovery attacks for all three designs, featuring square-root complexities. Using a key collision technique, we can recover the secret key of AVALANCHE in 2^n/2, where n 2∈ {28; 192; 256} is the key length. This technique also applies to the authentication part of Calico whose 128-bit key can be recovered in 2⁶⁴ time. For RBS, we can recover its full 132-bit key in 2⁶⁵ time with a guess-and-determine attack. All attacks also allow the adversary to mount universal forgeries.

Original language	English
Title of host publication	3rd International Conference on Cryptology and Information Security in Latin America
Number of pages	12
Publisher	Springer
Publication date	2014
Pages	274-287
ISBN (Print)	978-3-319-16294-2
ISBN (Electronic)	978-3-319-16295-9
Publication status	Published - 2014
Event	3rd International Conference on Cryptology and Information Security in Latin America: Latincrypt 2014 - The Costão do Santinho Resort, Florianópolis, Brazil Duration: 17 Sept 2014 → 19 Sept 2014 Conference number: 3

Conference

Conference	3rd International Conference on Cryptology and Information Security in Latin America
Number	3
Location	The Costão do Santinho Resort
Country/Territory	Brazil
City	Florianópolis
Period	17/09/2014 → 19/09/2014

Series	Lecture Notes in Computer Science
Volume	8895
ISSN	0302-9743

Keywords

authenticated encryption
CAESAR
key collision
guess-and-determine
universal forgery
AVALANCHE
Calico
RBS

OpenUrl availability

Full text

Cite this

@inproceedings{f261206d1f16414580347a8d01e4743b,

title = "Key Recovery Attacks on Recent Authenticated Ciphers",

abstract = "In this paper, we cryptanalyze three authenticated ciphers: AVALANCHE, Calico, and RBS. While the former two are contestants in the ongoing international CAESAR competition for authenticated encryption schemes, the latter has recently been proposed for lightweight applications such as RFID systems and wireless networks. All these schemes use well-established and secure components such as the AES, Grain-like NFSRs, ChaCha and SipHash as their building blocks. However, we discover key recovery attacks for all three designs, featuring square-root complexities. Using a key collision technique, we can recover the secret key of AVALANCHE in 2n/2, where n 2∈ {28; 192; 256} is the key length. This technique also applies to the authentication part of Calico whose 128-bit key can be recovered in 264 time. For RBS, we can recover its full 132-bit key in 265 time with a guess-and-determine attack. All attacks also allow the adversary to mount universal forgeries. ",

keywords = "authenticated encryption, CAESAR, key collision, guess-and-determine, universal forgery, AVALANCHE, Calico, RBS",

author = "Andrey Bogdanov and Christoph Dobraunig and Maria Eichlseder and Lauridsen, {Martin Mehl} and Florian Mendel and Martin Schl{\"a}ffer and Tischhauser, {Elmar Wolfgang}",

year = "2014",

language = "English",

isbn = "978-3-319-16294-2",

series = "Lecture Notes in Computer Science",

publisher = "Springer",

pages = "274--287",

booktitle = "3rd International Conference on Cryptology and Information Security in Latin America",

note = "3rd International Conference on Cryptology and Information Security in Latin America : Latincrypt 2014 ; Conference date: 17-09-2014 Through 19-09-2014",

}

Bogdanov, A, Dobraunig, C, Eichlseder, M, Lauridsen, MM, Mendel, F, Schläffer, M & Tischhauser, EW 2014, Key Recovery Attacks on Recent Authenticated Ciphers. in 3rd International Conference on Cryptology and Information Security in Latin America. Springer, Lecture Notes in Computer Science, vol. 8895, pp. 274-287, 3rd International Conference on Cryptology and Information Security in Latin America, Florianópolis, Brazil, 17/09/2014.

Key Recovery Attacks on Recent Authenticated Ciphers. / Bogdanov, Andrey; Dobraunig, Christoph; Eichlseder, Maria et al.
3rd International Conference on Cryptology and Information Security in Latin America. Springer, 2014. p. 274-287 (Lecture Notes in Computer Science, Vol. 8895).

Research output: Chapter in Book/Report/Conference proceeding › Article in proceedings › Research › peer-review

TY - GEN

T1 - Key Recovery Attacks on Recent Authenticated Ciphers

AU - Bogdanov, Andrey

AU - Dobraunig, Christoph

AU - Eichlseder, Maria

AU - Lauridsen, Martin Mehl

AU - Mendel, Florian

AU - Schläffer, Martin

AU - Tischhauser, Elmar Wolfgang

N1 - Conference code: 3

PY - 2014

Y1 - 2014

N2 - In this paper, we cryptanalyze three authenticated ciphers: AVALANCHE, Calico, and RBS. While the former two are contestants in the ongoing international CAESAR competition for authenticated encryption schemes, the latter has recently been proposed for lightweight applications such as RFID systems and wireless networks. All these schemes use well-established and secure components such as the AES, Grain-like NFSRs, ChaCha and SipHash as their building blocks. However, we discover key recovery attacks for all three designs, featuring square-root complexities. Using a key collision technique, we can recover the secret key of AVALANCHE in 2n/2, where n 2∈ {28; 192; 256} is the key length. This technique also applies to the authentication part of Calico whose 128-bit key can be recovered in 264 time. For RBS, we can recover its full 132-bit key in 265 time with a guess-and-determine attack. All attacks also allow the adversary to mount universal forgeries.

AB - In this paper, we cryptanalyze three authenticated ciphers: AVALANCHE, Calico, and RBS. While the former two are contestants in the ongoing international CAESAR competition for authenticated encryption schemes, the latter has recently been proposed for lightweight applications such as RFID systems and wireless networks. All these schemes use well-established and secure components such as the AES, Grain-like NFSRs, ChaCha and SipHash as their building blocks. However, we discover key recovery attacks for all three designs, featuring square-root complexities. Using a key collision technique, we can recover the secret key of AVALANCHE in 2n/2, where n 2∈ {28; 192; 256} is the key length. This technique also applies to the authentication part of Calico whose 128-bit key can be recovered in 264 time. For RBS, we can recover its full 132-bit key in 265 time with a guess-and-determine attack. All attacks also allow the adversary to mount universal forgeries.

KW - authenticated encryption

KW - CAESAR

KW - key collision

KW - guess-and-determine

KW - universal forgery

KW - AVALANCHE

KW - Calico

KW - RBS

M3 - Article in proceedings

SN - 978-3-319-16294-2

T3 - Lecture Notes in Computer Science

SP - 274

EP - 287

BT - 3rd International Conference on Cryptology and Information Security in Latin America

PB - Springer

T2 - 3rd International Conference on Cryptology and Information Security in Latin America

Y2 - 17 September 2014 through 19 September 2014

ER -

Key Recovery Attacks on Recent Authenticated Ciphers

Abstract

Conference

Keywords

OpenUrl availability

Fingerprint

Cite this