Related-Key Cryptanalysis of Midori

Midori64 and Midori128 [2] are lightweight block ciphers, which respectively cipher 64-bit and 128-bit blocks. While several attack models are discussed by the authors of Midori, the authors made no claims concerning the security of Midori against related-key differential attacks. In this attack model, the attacker uses related-key differential characteristics, i.e., tuples \((\delta _P, \delta _K, \delta _C)\) such that a difference (generally computed as a XOR) of \(\delta _P\) in the plaintext coupled with a difference \(\delta _K\) in the key yields a difference \(\delta _C\) after r rounds with a good probability. In this paper, we propose a constraint programming model to automate the search for optimal (in terms of probability) related-key differential characteristics on Midori. Using it, we build related-key distinguishers on the full-round Midori64 and Midori128, and mount key recovery attacks on both versions of the cipher with practical time complexity, respectively \(2^{35.8}\) and \(2^{43.7}\).