论文信息 - Structural Cryptanalysis of SASAS

Structural Cryptanalysis of SASAS

In this paper we consider the security of block ciphers which contain alternate layers of invertible S-boxes and affine mappings (there are many popular cryptosystems which use this structure, including the winner of the AES competition, Rijndael). We show that a five-layer scheme with 128-bit plaintexts and 8-bit S-boxes is surprisingly weak against what we call a multiset attack, even when all the S-boxes and affine mappings are key dependent (and thus completely unknown to the attacker). We tested the multiset attack with an actual implementation, which required just 216 chosen plaintexts and a few seconds on a single PC to find the 217 bits of information in all the unknown elements of the scheme.

Alex Biryukov | Adi Shamir

[1] David A. Wagner,et al. Integral Cryptanalysis , 2002, FSE.

[2] Alex Biryukov,et al. Cryptanalysis of SAFER++ , 2003, CRYPTO.

[3] Vincent Rijmen,et al. The Block Cipher Square , 1997, FSE.

[4] G. G. Stokes. "J." , 1890, The New Yale Book of Quotations.

[5] Alex Biryukov,et al. A Toolbox for Cryptanalysis: Linear and Affine Equivalence Algorithms , 2003, EUROCRYPT.

[6] Ross Anderson,et al. Serpent: A Proposal for the Advanced Encryption Standard , 1998 .

[7] Marine Minier,et al. A Collision Attack on 7 Rounds of Rijndael , 2000, AES Candidate Conference.

[8] Stefan Lucks,et al. Attacking Seven Rounds of Rijndael under 192-bit and 256-bit Keys , 2000, AES Candidate Conference.

[9] David Wagner,et al. Integral Cryptanalysis (Extended abstract) , 2002, FSE 2002.

[10] Louis Goubin,et al. Asymmetric cryptography with S-Boxes , 1997, ICICS.

[11] Eli Biham. Cryptanalysis of Patarin's 2-Round Public Key System with S Boxes (2R) , 2000, EUROCRYPT.

[12] Joos Vandewalle,et al. Linear Cryptanalysis of Reduced-Round Versions of the SAFER Block Cipher Family , 2000, FSE.

[13] Vincent Rijmen,et al. The Design of Rijndael: AES - The Advanced Encryption Standard , 2002 .