Practical-Time Related-Key Attack on GOST with Secret S-Boxes

Orr Dunkelman; Nathan Keller; Ariel Weizmann

doi:10.1007/978-3-031-38548-3_7

Practical-Time Related-Key Attack on GOST with Secret S-Boxes

Orr Dunkelman, Nathan Keller, Ariel Weizmann

Department of Mathematics

University of Haifa

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

1 Scopus citations

Abstract

The block cipher GOST 28147-89 was the Russian Federation encryption standard for over 20 years, and is still one of its two standard block ciphers. GOST is a 32-round Feistel construction, whose security benefits from the fact that the S-boxes used in the design are kept secret. In the last 10 years, several attacks on the full 32-round GOST were presented. However, they all assume that the S-boxes are known. When the S-boxes are secret, all published attacks either target a small number of rounds, or apply for small sets of weak keys. In this paper we present the first practical-time attack on GOST with secret S-boxes. The attack works in the related-key model and is faster than all previous attacks in this model which assume that the S-boxes are known. The complexity of the attack is less than 2²⁷ encryptions. It was fully verified, and runs in a few seconds on a PC. The attack is based on a novel type of related-key differentials of GOST, inspired by local collisions. Our new technique may be applicable to certain GOST-based hash functions as well. To demonstrate this, we show how to find a collision on a Davies-Meyer construction based on GOST with an arbitrary initial value, in less than 2¹⁰ hash function evaluations.

Original language	English
Title of host publication	Advances in Cryptology – CRYPTO 2023 - 43rd Annual International Cryptology Conference, CRYPTO 2023, Proceedings
Editors	Helena Handschuh, Anna Lysyanskaya
Publisher	Springer Science and Business Media Deutschland GmbH
Pages	177-208
Number of pages	32
ISBN (Print)	9783031385476
DOIs	https://doi.org/10.1007/978-3-031-38548-3_7
State	Published - 2023
Event	Advances in Cryptology – CRYPTO 2023 - 43rd Annual International Cryptology Conference, CRYPTO 2023, Proceedings - Santa Barbara, United States Duration: 20 Aug 2023 → 24 Aug 2023

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	14083 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	Advances in Cryptology – CRYPTO 2023 - 43rd Annual International Cryptology Conference, CRYPTO 2023, Proceedings
Country/Territory	United States
City	Santa Barbara
Period	20/08/23 → 24/08/23

Bibliographical note

Publisher Copyright:
© 2023, International Association for Cryptologic Research.

Funding

O. Dunkelman—Supported in part by the Center for Cyber, Law, and Policy in conjunction with the Israel National Cyber Bureau in the Prime Minister’s Office and by the Israeli Science Foundation through grants No. 880/18 and 3380/19. N. Keller and A. Weizmann—Supported by the European Research Council under the ERC starting grant agreement n. 757731 (LightCrypt) and by the BIU Center for Research in Applied Cryptography and Cyber Security in conjunction with the Israel National Cyber Bureau in the Prime Minister’s Office. A. Weizmann—Supported by the President Scholarship for Ph.D. students at the Bar-Ilan University.

Funders	Funder number
European Commission	757731
Bar-Ilan University
Israel Science Foundation	880/18, 3380/19

Keywords

GOST
Local collision
Related-key differential cryptanalysis

Access to Document

10.1007/978-3-031-38548-3_7

Cite this

Dunkelman, O., Keller, N., & Weizmann, A. (2023). Practical-Time Related-Key Attack on GOST with Secret S-Boxes. In H. Handschuh, & A. Lysyanskaya (Eds.), Advances in Cryptology – CRYPTO 2023 - 43rd Annual International Cryptology Conference, CRYPTO 2023, Proceedings (pp. 177-208). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 14083 LNCS). Springer Science and Business Media Deutschland GmbH. https://doi.org/10.1007/978-3-031-38548-3_7

Dunkelman, Orr ; Keller, Nathan ; Weizmann, Ariel. / Practical-Time Related-Key Attack on GOST with Secret S-Boxes. Advances in Cryptology – CRYPTO 2023 - 43rd Annual International Cryptology Conference, CRYPTO 2023, Proceedings. editor / Helena Handschuh ; Anna Lysyanskaya. Springer Science and Business Media Deutschland GmbH, 2023. pp. 177-208 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{739bb94c00af43bcafc469c47f2d5ade,

title = "Practical-Time Related-Key Attack on GOST with Secret S-Boxes",

abstract = "The block cipher GOST 28147-89 was the Russian Federation encryption standard for over 20 years, and is still one of its two standard block ciphers. GOST is a 32-round Feistel construction, whose security benefits from the fact that the S-boxes used in the design are kept secret. In the last 10 years, several attacks on the full 32-round GOST were presented. However, they all assume that the S-boxes are known. When the S-boxes are secret, all published attacks either target a small number of rounds, or apply for small sets of weak keys. In this paper we present the first practical-time attack on GOST with secret S-boxes. The attack works in the related-key model and is faster than all previous attacks in this model which assume that the S-boxes are known. The complexity of the attack is less than 227 encryptions. It was fully verified, and runs in a few seconds on a PC. The attack is based on a novel type of related-key differentials of GOST, inspired by local collisions. Our new technique may be applicable to certain GOST-based hash functions as well. To demonstrate this, we show how to find a collision on a Davies-Meyer construction based on GOST with an arbitrary initial value, in less than 210 hash function evaluations.",

keywords = "GOST, Local collision, Related-key differential cryptanalysis",

author = "Orr Dunkelman and Nathan Keller and Ariel Weizmann",

note = "Publisher Copyright: {\textcopyright} 2023, International Association for Cryptologic Research.; Advances in Cryptology – CRYPTO 2023 - 43rd Annual International Cryptology Conference, CRYPTO 2023, Proceedings ; Conference date: 20-08-2023 Through 24-08-2023",

year = "2023",

doi = "10.1007/978-3-031-38548-3_7",

language = "אנגלית",

isbn = "9783031385476",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer Science and Business Media Deutschland GmbH",

pages = "177--208",

editor = "Helena Handschuh and Anna Lysyanskaya",

booktitle = "Advances in Cryptology – CRYPTO 2023 - 43rd Annual International Cryptology Conference, CRYPTO 2023, Proceedings",

address = "גרמניה",

}

Dunkelman, O, Keller, N & Weizmann, A 2023, Practical-Time Related-Key Attack on GOST with Secret S-Boxes. in H Handschuh & A Lysyanskaya (eds), Advances in Cryptology – CRYPTO 2023 - 43rd Annual International Cryptology Conference, CRYPTO 2023, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 14083 LNCS, Springer Science and Business Media Deutschland GmbH, pp. 177-208, Advances in Cryptology – CRYPTO 2023 - 43rd Annual International Cryptology Conference, CRYPTO 2023, Proceedings, Santa Barbara, United States, 20/08/23. https://doi.org/10.1007/978-3-031-38548-3_7

Practical-Time Related-Key Attack on GOST with Secret S-Boxes. / Dunkelman, Orr; Keller, Nathan; Weizmann, Ariel.
Advances in Cryptology – CRYPTO 2023 - 43rd Annual International Cryptology Conference, CRYPTO 2023, Proceedings. ed. / Helena Handschuh; Anna Lysyanskaya. Springer Science and Business Media Deutschland GmbH, 2023. p. 177-208 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 14083 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Practical-Time Related-Key Attack on GOST with Secret S-Boxes

AU - Dunkelman, Orr

AU - Keller, Nathan

AU - Weizmann, Ariel

PY - 2023

Y1 - 2023

N2 - The block cipher GOST 28147-89 was the Russian Federation encryption standard for over 20 years, and is still one of its two standard block ciphers. GOST is a 32-round Feistel construction, whose security benefits from the fact that the S-boxes used in the design are kept secret. In the last 10 years, several attacks on the full 32-round GOST were presented. However, they all assume that the S-boxes are known. When the S-boxes are secret, all published attacks either target a small number of rounds, or apply for small sets of weak keys. In this paper we present the first practical-time attack on GOST with secret S-boxes. The attack works in the related-key model and is faster than all previous attacks in this model which assume that the S-boxes are known. The complexity of the attack is less than 227 encryptions. It was fully verified, and runs in a few seconds on a PC. The attack is based on a novel type of related-key differentials of GOST, inspired by local collisions. Our new technique may be applicable to certain GOST-based hash functions as well. To demonstrate this, we show how to find a collision on a Davies-Meyer construction based on GOST with an arbitrary initial value, in less than 210 hash function evaluations.

AB - The block cipher GOST 28147-89 was the Russian Federation encryption standard for over 20 years, and is still one of its two standard block ciphers. GOST is a 32-round Feistel construction, whose security benefits from the fact that the S-boxes used in the design are kept secret. In the last 10 years, several attacks on the full 32-round GOST were presented. However, they all assume that the S-boxes are known. When the S-boxes are secret, all published attacks either target a small number of rounds, or apply for small sets of weak keys. In this paper we present the first practical-time attack on GOST with secret S-boxes. The attack works in the related-key model and is faster than all previous attacks in this model which assume that the S-boxes are known. The complexity of the attack is less than 227 encryptions. It was fully verified, and runs in a few seconds on a PC. The attack is based on a novel type of related-key differentials of GOST, inspired by local collisions. Our new technique may be applicable to certain GOST-based hash functions as well. To demonstrate this, we show how to find a collision on a Davies-Meyer construction based on GOST with an arbitrary initial value, in less than 210 hash function evaluations.

KW - GOST

KW - Local collision

KW - Related-key differential cryptanalysis

UR - http://www.scopus.com/inward/record.url?scp=85173016384&partnerID=8YFLogxK

U2 - 10.1007/978-3-031-38548-3_7

DO - 10.1007/978-3-031-38548-3_7

M3 - ???researchoutput.researchoutputtypes.contributiontobookanthology.conference???

AN - SCOPUS:85173016384

SN - 9783031385476

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 177

EP - 208

BT - Advances in Cryptology – CRYPTO 2023 - 43rd Annual International Cryptology Conference, CRYPTO 2023, Proceedings

A2 - Handschuh, Helena

A2 - Lysyanskaya, Anna

PB - Springer Science and Business Media Deutschland GmbH

T2 - Advances in Cryptology – CRYPTO 2023 - 43rd Annual International Cryptology Conference, CRYPTO 2023, Proceedings

Y2 - 20 August 2023 through 24 August 2023

ER -

Dunkelman O, Keller N, Weizmann A. Practical-Time Related-Key Attack on GOST with Secret S-Boxes. In Handschuh H, Lysyanskaya A, editors, Advances in Cryptology – CRYPTO 2023 - 43rd Annual International Cryptology Conference, CRYPTO 2023, Proceedings. Springer Science and Business Media Deutschland GmbH. 2023. p. 177-208. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-031-38548-3_7