Format-Preserving Encryption (FPE) schemes accept plaintexts from any finite set of values (such as social security numbers or birth dates) and produce ciphertexts that belong to the same set. They are extremely useful in practice since they make it possible to encrypt existing databases or communication packets without changing their format. Due to industry demand, NIST had standardized in 2016 two such encryption schemes called FF1 and FF3. They immediately attracted considerable cryptanalytic attention with decreasing attack complexities. The best currently known attack on the Feistel construction FF3 has data and memory complexity of O(N11 / 6) and time complexity of O(N17 / 6), where the input belongs to a domain of size N× N. In this paper, we present and experimentally verify three improved attacks on FF3. Our best attack achieves the tradeoff curve D= M= O~ (N2-t), T= O~ (N2+t) for all t≤ 0.5. In particular, we can reduce the data and memory complexities to the more practical O~ (N1.5), and at the same time, reduce the time complexity to O~ (N2.5). We also identify another attack vector against FPE schemes, the related-domain attack. We show how one can mount powerful attacks when the adversary is given access to the encryption under the same key in different domains, and show how to apply it to efficiently distinguish FF3 and FF3-1 instances.
|Title of host publication||Advances in Cryptology – EUROCRYPT 2021 - 40th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Proceedings|
|Editors||Anne Canteaut, François-Xavier Standaert|
|Publisher||Springer Science and Business Media Deutschland GmbH|
|Number of pages||28|
|State||Published - 2021|
|Event||40th Annual International Conference on the Theory and Applications of Cryptographic Techniques, EUROCRYPT 2021 - Zagreb, Croatia|
Duration: 17 Oct 2021 → 21 Oct 2021
|Name||Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)|
|Conference||40th Annual International Conference on the Theory and Applications of Cryptographic Techniques, EUROCRYPT 2021|
|Period||17/10/21 → 21/10/21|
Bibliographical noteFunding Information:
We also identify another attack vector against FPE schemes, the related-domain attack. We show how one can mount powerful attacks O. Amon—is supported in part by Len Blavatnik and the Blavatnik Family foundation and by the Blavatnik ICRC. O. Dunkelman—was supported in part by the Center for Cyber, Law, and Policy in conjunction with the Israel National Cyber Bureau in the Prime Minister’s Office and by the Israeli Science Foundation through grants No. 880/18 and 3380/19. N. Keller—was supported by the European Research Council under the ERC starting grant agreement n. 757731 (LightCrypt) and by the BIU Center for Research in Applied Cryptography and Cyber Security in conjunction with the Israel National Cyber Bureau in the Prime Minister’s Office. E. Ronen—is a member of CPIIS.
© 2021, International Association for Cryptologic Research.