State-Recovery Attacks on Modified Ketje Jr

IACR Transactions on Symmetric Cryptology

Thomas Fuhr¹  María Naya-Plasencia²  Yann Rotella² 

[1] ANSSI Crypto Lab 51, boulevard de La Tour-Maubourg 75700 Paris 07 SP;Inria Paris;

关键词: Ketje;    Authenticated Encryption;    cryptanalysis;    divide-and-conquer;    nonlinear sieving;   

DOI  :  10.13154/tosc.v2018.i1.29-56

来源: DOAJ

【 摘 要 】

In this article we study the security of the authenticated encryption algorithm Ketje against divide-and-conquer attacks. Ketje is a third-round candidate in the ongoing CAESAR competition, which shares most of its design principles with the SHA-3 hash function. Several versions of Ketje have been submitted, with different sizes for its internal state. We describe several state-recovery attacks on the smaller variant, called Ketje Jr. We show that if one increases the amount of keystream output after each round from 16 bits to 40 bits, Ketje Jr becomes vulnerable to divide-and-conquer attacks with time complexities 271.5 for the original version and 282.3 for the current tweaked version, both with a key of 96 bits. We also propose a similar attack when considering rates of 32 bits for the non-tweaked version. Our findings do not threaten the security of Ketje, but should be taken as a warning against potential future modifications that would aim at increasing the performance of the algorithm.

【 授权许可】

Unknown