Practical key recovery attacks on FlexAEAD

Orr Dunkelman; Maria Eichlseder; Daniel Kales; Nathan Keller; Gaëtan Leurent; Markus Schofnegger

doi:10.1007/s10623-022-01023-5

Practical key recovery attacks on FlexAEAD

Orr Dunkelman, Maria Eichlseder, Daniel Kales, Nathan Keller, Gaëtan Leurent, Markus Schofnegger

Department of Mathematics

Research output: Contribution to journal › Article › peer-review

Abstract

FlexAEAD is a block cipher candidate submitted to the NIST Lightweight Cryptography standardization project, based on repeated application of an Even-Mansour construction. In order to optimize performance, the designers chose a relatively small number of rounds, using properties of the mode and bounds on differential and linear characteristics to substantiate their security claims. Due to a forgery attack with complexity of 2 ⁴⁶, FlexAEAD was not selected to the second round of evaluation in the NIST project. In this paper we present a practical key recovery attack on FlexAEAD, using clusters of differentials for the internal permutation and the interplay between different parts of the mode. Our attack, that was fully verified in practice, allows recovering the secret subkeys of FlexAEAD-64 with time complexity of less than 2 ³¹ encryptions (with experimental success rate of 75%). This is the first practical key recovery attack on a candidate of the NIST standartization project.

Original language	English
Journal	Designs, Codes, and Cryptography
DOIs	https://doi.org/10.1007/s10623-022-01023-5
State	Published - 2022

Bibliographical note

Publisher Copyright:
© 2022, The Author(s), under exclusive licence to Springer Science+Business Media, LLC, part of Springer Nature.

Funding

We thank the designers of FlexAE and FlexAEAD for their comments on a preliminary version of this analysis on the NIST LWC mailing list. Some of the results presented in this paper were obtained during a workshop dedicated to cryptanalysis of the NIST lightweight candidates, held in the framework of the European Research Council project ‘LightCrypt’ (ERC StG no. 757731). The first author was supported by the Israeli Science Foundation through grants No. 880/18 and 3380/19. The fourth author was also supported by the BIU Center for Research in Applied Cryptography and Cyber Security in conjunction with the Israel National Cyber Bureau in the Prime Minister’s Office. We thank the participants of the workshop who contributed to the discussion on FlexAEAD, and in particular Tomer Ashur, Roberto Avanzi, Anne Canteaut, Itai Dinur, Eran Lambooij, Eyal Ronen, and Yu Sasaki, for their valuable suggestions.

Funders	Funder number
Horizon 2020 Framework Programme	757731
Israel Science Foundation	880/18, 3380/19

Keywords

Authenticated encryption
NIST LWC
Practical key recovery
Truncated differential

Access to Document

10.1007/s10623-022-01023-5

Cite this

@article{17ef17a2fff8486c829819e0578ae150,

title = "Practical key recovery attacks on FlexAEAD",

abstract = "FlexAEAD is a block cipher candidate submitted to the NIST Lightweight Cryptography standardization project, based on repeated application of an Even-Mansour construction. In order to optimize performance, the designers chose a relatively small number of rounds, using properties of the mode and bounds on differential and linear characteristics to substantiate their security claims. Due to a forgery attack with complexity of 2 46, FlexAEAD was not selected to the second round of evaluation in the NIST project. In this paper we present a practical key recovery attack on FlexAEAD, using clusters of differentials for the internal permutation and the interplay between different parts of the mode. Our attack, that was fully verified in practice, allows recovering the secret subkeys of FlexAEAD-64 with time complexity of less than 2 31 encryptions (with experimental success rate of 75%). This is the first practical key recovery attack on a candidate of the NIST standartization project.",

keywords = "Authenticated encryption, NIST LWC, Practical key recovery, Truncated differential",

author = "Orr Dunkelman and Maria Eichlseder and Daniel Kales and Nathan Keller and Ga{\"e}tan Leurent and Markus Schofnegger",

note = "Publisher Copyright: {\textcopyright} 2022, The Author(s), under exclusive licence to Springer Science+Business Media, LLC, part of Springer Nature.",

year = "2022",

doi = "10.1007/s10623-022-01023-5",

language = "אנגלית",

journal = "Designs, Codes, and Cryptography",

issn = "0925-1022",

publisher = "Springer Netherlands",

}

TY - JOUR

T1 - Practical key recovery attacks on FlexAEAD

AU - Dunkelman, Orr

AU - Eichlseder, Maria

AU - Kales, Daniel

AU - Keller, Nathan

AU - Leurent, Gaëtan

AU - Schofnegger, Markus

PY - 2022

Y1 - 2022

N2 - FlexAEAD is a block cipher candidate submitted to the NIST Lightweight Cryptography standardization project, based on repeated application of an Even-Mansour construction. In order to optimize performance, the designers chose a relatively small number of rounds, using properties of the mode and bounds on differential and linear characteristics to substantiate their security claims. Due to a forgery attack with complexity of 2 46, FlexAEAD was not selected to the second round of evaluation in the NIST project. In this paper we present a practical key recovery attack on FlexAEAD, using clusters of differentials for the internal permutation and the interplay between different parts of the mode. Our attack, that was fully verified in practice, allows recovering the secret subkeys of FlexAEAD-64 with time complexity of less than 2 31 encryptions (with experimental success rate of 75%). This is the first practical key recovery attack on a candidate of the NIST standartization project.

AB - FlexAEAD is a block cipher candidate submitted to the NIST Lightweight Cryptography standardization project, based on repeated application of an Even-Mansour construction. In order to optimize performance, the designers chose a relatively small number of rounds, using properties of the mode and bounds on differential and linear characteristics to substantiate their security claims. Due to a forgery attack with complexity of 2 46, FlexAEAD was not selected to the second round of evaluation in the NIST project. In this paper we present a practical key recovery attack on FlexAEAD, using clusters of differentials for the internal permutation and the interplay between different parts of the mode. Our attack, that was fully verified in practice, allows recovering the secret subkeys of FlexAEAD-64 with time complexity of less than 2 31 encryptions (with experimental success rate of 75%). This is the first practical key recovery attack on a candidate of the NIST standartization project.

KW - Authenticated encryption

KW - NIST LWC

KW - Practical key recovery

KW - Truncated differential

UR - http://www.scopus.com/inward/record.url?scp=85126149048&partnerID=8YFLogxK

U2 - 10.1007/s10623-022-01023-5

DO - 10.1007/s10623-022-01023-5

M3 - ???researchoutput.researchoutputtypes.contributiontojournal.article???

AN - SCOPUS:85126149048

SN - 0925-1022

JO - Designs, Codes, and Cryptography

JF - Designs, Codes, and Cryptography

ER -

Practical key recovery attacks on FlexAEAD

Abstract

Bibliographical note

Funding

Keywords

Access to Document

Other files and links

Fingerprint

Cite this