高级检索

    基于代数结构视角对轻量分组密码WARP的积分分析

    Integral Cryptanalysis on Lightweight Block Cipher WARP Based on the Algebraic Structure Perspective

    • 摘要: 在融合了物联网、5G网络等新一代信息技术的工业互联网中,底层终端设备产生海量数据. 数据安全传输的需求使得针对资源受限环境所设计的轻量级密码得到广泛应用. 对新提出的轻量级密码进行安全性评估对于保障工业互联网的安全运行至关重要. 发现了某种特定结构加密算法基于多变量多项式的积分性质,利用该性质得到了更长积分区分器,改进了基于代数结构的分析方法. 提出了基于代数结构构造SPN(substitution permutation network)和Feistel-SP结构分组密码积分区分器的框架,并将其应用于SAC 2020会议上提出的轻量分组密码WARP的分析上,构造了2个复杂度为2116的22轮积分区分器,比设计者给出的区分器多了2轮,并且复杂度更低. 利用该积分区分器,实现26轮密钥恢复攻击,比设计者给出的密钥恢复攻击增加了5轮,这是目前在单密钥情境下对WARP最好的攻击结果. 此外,还对18轮积分区分器进行了实验验证,运算复杂度为232.

       

      Abstract: In the industrial Internet that incorporates the Internet of things and 5G network technologies, end devices generate enormous amounts of data. The secure transmission of the data requires lightweight ciphers dedicated to such resource-constrained environments. Furthermore, the security evaluation of newly proposed lightweight ciphers is crucial to secure the industrial Internet. An improved integral property for ciphers with a particular structure is proposed by using the multivariate polynomial technique in this study. By using the proposed integral property, longer integral distinguishers are constructed, which improve the integral analysis from the algebraic structure perspective. A framework for constructing integral distinguishers of SPN and Feistel-SP block ciphers from the algebraic structure perspective is given. It is applied to the integral analysis of the lightweight block cipher WARP proposed by Banik et al. in SAC 2020. As a result, two 22-round integral distinguishers with data complexity 2116 are constructed, which are two rounds longer than the distinguishers given by the designers, with less complexity. Based on the 22-round distinguishers, a 26-round key-recovery attack is proposed, which is five rounds more than the one given by the designers. To the best of our knowledge, this is thus far the best known key-recovery attack on WARP in the single-key scenario. In addition, experimental verification of an 18-round integral distinguisher is carried out with the data complexity 232.

       

    /

    返回文章
    返回