Collision Attacks on AES-192/256, Crypton-192/256, mCrypton-96/128, and Anubis

Abstract

At AES’00, a collision attack on 7-round reduced AES was proposed. In this paper, we apply this idea to seven SPN block ciphers, AES-192/256, Crypton-192/256, mCrypton-96/128, and Anubis. Applying our attacks on AES-192/256, we improve the attack result based on meet-in-the-middle attack (AES-192) and the attack result proposed in AES’00 (AES-256), respectively. Our attack result on Anubis is superior to known cryptanalytic result on it. In the cases of Crypton-192/256 and mCrypton-96/128, our attacks are applicable to 8-round reduced versions. The attack results on mCrypton-96/128 are more practical than known cryptanalytic results on them.

1. Introduction

Recently, meet-in-the-middle attack has received attention. The attack procedure of meet-in-the-middle attack can be summarized as follows. Let ℳ be the message space and 𝒦 the key space. Suppose that 𝐺_𝐾 and 𝐻_𝐾∶ℳ×𝒦→ℳ are two block ciphers and let 𝐹_𝐾=𝐻_𝐾∘𝐺_𝐾. In this attack, an attacker tries to deduce 𝐾 from a given plaintext/ciphertext pair 𝑐=𝐹_𝐾(𝑝) by trying to solve 𝐺_𝐾(𝑝)=𝐻_𝐾⁻¹(𝑐). In some cases, the equation is not tested for all the bits of the intermediate encryption value, but rather for only some of them. So far, many meet-in-the-middle attack results on block cipher have been proposed [1, 2]. On the other hand, Gilbert and Minier proposed a collision attack on 7-round of AES in [3]. This attack is a type of meet-in-the middle attack and exploits a 4-round distinguisher. In general, block cipher is completely deterministic, that is, if it is run again with the exact same input values, identical output values will be produced. Similarly, the different input values result in the different output values. However, it is possible that the different input values result in the output values of which the specific parts are the same. We call this case a collision.

In this paper, we apply the main idea of [3] to seven SPN block ciphers, such as AES-192/256 [4], Crypton [5], mCrypton-96/128 [6], and Anubis [7]. Table 1 shows our attack results on them. Rijndael was announced as the Advanced Encryption Standard (AES) in 2001. After DES, it is one of the most widely used and analyzed ciphers in the world. AES is a 128-bit block cipher and accepts key sizes of 128,192, and 256 bits. These versions of AES are called AES-128/192/256 and the number of rounds for these versions is 10,12, and 14, respectively. Our attacks on AES-192/256 require a computational complexity of 2^69.2 encryptions with 2³² chosen plaintexts and 2⁷⁴ memory bytes, respectively. Though our attacks on them are not applicable to the full AES-192/256, these are superior to the attack results of [1] (AES-192) and [3] (AES-256), respectively.

Table 1 

Our attack results on AES-192/256, Crypton-192/256, mCrypton-96/128, and Anubis.

Crypton is a 128-bit block cipher submitted as a candidate for the AES proposal of NIST. This algorithm has a 12-round SPN structure with 128/192/256-bit secret keys. According to the length of the secret keys, we call them Crypton-128/192/256, respectively. Our attack is applicable to 8-round reduced Crypton-192/256. To our knowledge, truncated differential cryptanalysis on 8-round reduced Crypton-192/256 has the best results on them, so far [8]. The attacks on an 8-round reduced Crypton-192/256 need the computational complexity of 2^161.6 encryptions with 2⁹⁶ chosen plaintexts and 2¹³⁸ memory bytes, respectively. Compared to the attack results of [8], our attacks decrease the data complexity but increase the computational complexity.

A 64-bit block cipher mCrypton was designed as a reduced version of Crypton for a ubiquitous environment. It provides low-resource hardware implementation, which is suitable for low-end devices such as RFID tags and wireless sensor network. Several security aspects related to RFID tags and wireless sensor network have already been studied. mCrypton has 12 rounds and supports the 64/96/128-bit secret keys. Our attack is applicable to mCrypton-96/128. We require the computational complexity of 2^81.6 encryptions with 2⁴⁸ chosen plaintexts and 2⁶⁵ memory bytes. However, this is not the best result on them, since related-key impossible differential cryptanalysis on 9-round reduced mCrypton-96/128 was proposed in [9]. However, considering the attack assumption of a related-key attack, our attacks are more practical than it.

Anubis is a block cipher submitted to the NESSIE project and operates on data blocks of 128 bits, accepting keys of length 32𝑁 bits (𝑁=4,…,10). It is a Rijndael variant that uses involutions for the various operations. Our attack is applicable to Anubis where the length of the secret key is longer than 192 bits. We need the computational complexity of 2^161.6 encryptions with 2⁹⁶ chosen plaintexts and 2¹³⁸ memory bytes. This result is superior to known cryptanalytic results on this algorithm.

The rest of this paper is organized as follows. In Section 2, we propose collision attacks on AES-192/256. Collision attacks on Crypton-192/256 and mCrypton-96/128 are introduced in Section 3. In Section 4, we present a collision attack on Anubis. In each section, we start with a brief description of the block cipher concerned. Finally, we give our conclusion in Section 5.

2. Collision Attacks on 7-Round Reduced AES-192/256

First, we briefly present AES-192/256. And then we introduce collision attacks on AES-192/256. Note that the attack procedure on AES-192 is the same as that on AES-256. Thus, for the simplicity of notations, we just call them AES-192/256 AES.

2.1. AES-192/256

AES-192/256 are 128-bit block ciphers with 192/256-bit secret keys. According to the length of the secret key, the number of rounds is 12 and 14, respectively. Each internal state is treated as a byte matrix of size 4×4, where each byte represents a value in GF(2⁸) (see Figure 1).

Figure 1 

Internal state of AES-192/256 and Anubis.

In round 𝑟, input/output values and round key are denoted by 𝐼^𝑟,𝑂^𝑟, and RK^𝑟, respectively (𝑟=1,…,12 (AES-192) or 14 (AES-256)). A whitening key is denoted by RK⁰. The round function of AES-192/256 applies the following four operations to the state matrix:(i)SubBytes (SB): applying the same 8×8 invertible S-box 16 times in parallel on each byte of the state;(ii)ShiftRows (SR): cyclic shift of each row (the 𝑖th row is shifted by 𝑖 bytes to the left); (iii)MixColumns (MC): multiplication of each column by a constant 4×4 matrix over GF(2⁸);(iv)AddRoundKey (ARK): XORing the state with a 128-bit round key.

The SB, SR, MC, and ARK transformations are applied to each round except that MC is omitted in the last round. Besides, before the first round, an extra ARK is applied, which we call a whitening key step. For the more detailed descriptions of AES-192/256, we refer to [4]. We omit the key schedules of them, as they do not affect our attacks.

2.2. Finding a 4-Round Distinguisher of AES

In our attack on AES, we use a 4-round distinguisher of round 2~5. We consider an input value 𝐼² of round 2 in AES which is constructed as follows: (i) (𝐼²₀₀,𝐼²₁₀,𝐼²₂₀,𝐼²₃₀): four 8-bit variables; (ii) 𝐼²_𝑖𝑗: a fixed 8-bit constant (0≤𝑖≤3,1≤𝑗≤3).

By using 𝐼², we can construct the following equations on 𝐼³(𝑖=0,…,3). Here, 𝑎_𝑖𝑗 means the entry of the coefficient matrix of MC (𝑗=0,…,3): 𝐼³_𝑖0=𝑎_𝑖0∘SB𝐼²₀₀⊕𝑎_𝑖1∘SB𝐼²₁₁⊕𝑎_𝑖2∘SB𝐼²₂₂⊕𝑎_𝑖3∘SB𝐼²₃₃⊕RK²_𝑖0,𝐼³_𝑖1=𝑎_𝑖0∘SB𝐼²₀₁⊕𝑎_𝑖1∘SB𝐼²₁₂⊕𝑎_𝑖2∘SB𝐼²₂₃⊕𝑎_𝑖3∘SB𝐼²₃₀⊕RK²_𝑖1,𝐼³_𝑖2=𝑎_𝑖0∘SB𝐼²₀₂⊕𝑎_𝑖1∘SB𝐼²₁₃⊕𝑎_𝑖2∘SB𝐼²₂₀⊕𝑎_𝑖3∘SB𝐼²₃₁⊕RK²_𝑖2,𝐼³_𝑖3=𝑎_𝑖0∘SB𝐼²₀₃⊕𝑎_𝑖1∘SB𝐼²₁₀⊕𝑎_𝑖2∘SB𝐼²₂₁⊕𝑎_𝑖3∘SB𝐼²₃₂⊕RK²_𝑖3. (1)

Note that each 𝐼³_𝑖0, 𝐼³_𝑖1, 𝐼³_𝑖2, and 𝐼³_𝑖3 depends on only one 8-bit variable and one 8-bit round key: (𝐼²₀₀,RK²_𝑖0),(𝐼²₃₀,RK²_𝑖1),(𝐼²₂₀,RK²_𝑖2), and (𝐼²₁₀,RK²_𝑖3).

Applying the above procedure repeatedly, as shown in (2), we can obtain an equation on an input value 𝐼⁵₀₀ of round 5 by using 𝐼². Here, bold characters indicate (𝐼²₁₀,𝐼²₂₀,𝐼²₃₀)𝐼⁵₀₀=𝑎₀₀∘SB𝑎₀₀∘SB𝑎₀₀∘SB𝐼²₀₀⊕𝑎₀₁∘SB𝐼²₁₁⊕𝑎₀₂∘SB𝐼²₂₂⊕𝑎₀₃∘SB𝐼²₃₃⊕RK²₀₀⊕𝑎₀₁∘SB𝑎₁₀∘SB𝐼²₀₁⊕𝑎₁₁∘SB𝐼²₁₂⊕𝑎₁₂∘SB𝐼²₂₃⊕𝑎₁₃∘SB𝐈^𝟐_𝟑𝟎⊕RK²₁₁⊕𝑎₀₂∘SB𝑎₂₀∘SB𝐼²₀₂⊕𝑎₂₁∘SB𝐼²₁₃⊕𝑎₂₂∘SB𝐈^𝟐_𝟐𝟎⊕𝑎₂₃∘SB𝐼²₃₁⊕RK²₂₂⊕𝑎₀₃∘SB𝑎₃₀∘SB𝐼²₀₃⊕𝑎₃₁∘SB𝐈^𝟐_𝟏𝟎⊕𝑎₃₂∘SB𝐼²₂₁⊕𝑎₃₃∘SB𝐼²₃₂⊕RK²₃₃⊕RK³₀₀⊕𝑎₀₁∘SB𝑎₁₀∘SB𝑎₀₀∘SB𝐼²₀₁⊕𝑎₀₁∘SB𝐼²₀₂⊕𝑎_𝑖2∘SB𝐼²₂₃⊕𝑎₀₃∘SB𝐈^𝟐_𝟑𝟎⊕RK²₀₁⊕𝑎₁₁∘SB𝑎₁₀∘SB𝐼²₀₂⊕𝑎₁₁∘SB𝐼²₁₃⊕𝑎₁₂∘SB𝐈^𝟐_𝟐𝟎⊕𝑎₁₃∘SB𝐼²₃₁⊕RK²₁₂⊕𝑎₁₂∘SB𝑎₂₀∘SB𝐼²₀₃⊕𝑎₂₁∘SB𝐈^𝟐_𝟏𝟎⊕𝑎₂₂∘SB𝐼²₂₁⊕𝑎₂₃∘SB𝐼²₃₂⊕RK²₂₃⊕𝑎₁₃∘SB𝑎₃₀∘SB𝐼²₀₀⊕𝑎₃₁∘SB𝐼²₁₁⊕𝑎₃₂∘SB𝐼²₂₂⊕𝑎₃₃∘SB𝐼²₃₃⊕RK²₃₀⊕RK³₁₁⊕𝑎₀₂∘SB𝑎₂₀∘SB𝑎₀₀∘SB𝐼²₀₂⊕𝑎₀₁∘SB𝐼²₁₃⊕𝑎₀₂∘SB𝐈^𝟐_𝟐𝟎⊕𝑎₀₃∘SB𝐼²₃₁⊕RK²₀₂⊕𝑎₂₁∘SB𝑎₁₀∘SB𝐼²₀₃⊕𝑎₁₁∘SB𝐈^𝟐_𝟏𝟎⊕𝑎₁₂∘SB𝐼²₂₁⊕𝑎₁₃∘SB𝐼²₃₂⊕RK²₁₃⊕𝑎₂₂∘SB𝑎₂₀∘SB𝐼²₀₀⊕𝑎₂₁∘SB𝐼²₁₁⊕𝑎₂₂∘SB𝐼²₂₂⊕𝑎₂₃∘SB𝐼²₃₃⊕RK²₂₀⊕𝑎₂₃∘SB𝑎₃₀∘SB𝐼²₀₁⊕𝑎₃₁∘SB𝐼²₁₂⊕𝑎₃₂∘SB𝐼²₂₃⊕𝑎₃₃∘SB𝐈^𝟐_𝟑𝟎⊕RK²₃₁⊕RK³₂₂⊕𝑎₀₃∘SB𝑎₃₀∘SB𝑎₀₀∘SB𝐼²₀₃⊕𝑎₀₁∘SB𝐈^𝟐_𝟏𝟎⊕𝑎₀₂∘SB𝐼²₂₁⊕𝑎₀₃∘SB𝐼²₃₂⊕RK²₀₃⊕𝑎₃₁∘SB𝑎₁₀∘SB𝐼²₀₀⊕𝑎₁₁∘SB𝐼²₁₁⊕𝑎₁₂∘SB𝐼²₂₂⊕𝑎₁₃∘SB𝐼²₃₃⊕RK²₁₀⊕𝑎₃₂∘SB𝑎₂₀∘SB𝐼²₀₁⊕𝑎₂₁∘SB𝐼²₁₂⊕𝑎₂₂∘SB𝐼²₂₃⊕𝑎₂₃∘SB𝐈^𝟐_𝟑𝟎⊕RK²₂₁⊕𝑎₃₃∘SB𝑎₃₀∘SB𝐼²₀₂⊕𝑎₃₁∘SB𝐼²₁₃⊕𝑎₃₂∘SB𝐈^𝟐_𝟐𝟎⊕𝑎₃₃∘SB𝐼²₃₁⊕RK²₃₂⊕RK³₃₃⊕RK⁴₀₀. (2)

Note that this equation consists of five parts as follows: 𝐼⁵₀₀=𝑎₀₀∘SB[⋅]⊕𝑎₀₁∘SB[⋅]⊕𝑎₀₂[⋅]⊕𝑎∘SB₀₃∘SB[⋅]⊕RK⁴₀₀. (3) If we find different (𝐼^2′₁₀,𝐼^2′₂₀,𝐼^2′₃₀) and (𝐼^2′′₁₀,𝐼^2′′₂₀,𝐼^2′′₃₀) which satisfy that each subpart including (𝐼²₁₀,𝐼²₂₀,𝐼²₃₀), that is, (2,3,4)th rows of the first part, (1,2,3)th rows of the second part, (1,2,4)th rows of the third part, and (1,3,4)th rows of the fourth part in (2), has the same value for a given 𝐼²₀₀, then 𝐼^5′₀₀ is equal to 𝐼^5′′₀₀. That is, for all 𝐼²₀₀∈{0,…,255}, these (𝐼^2′₁₀,𝐼^2′₂₀,𝐼^2′₃₀) and (𝐼^2′′₁₀,𝐼^2′′₂₀,𝐼^2′′₃₀) result in the same 32-bit value of four subparts (the length of the value in each subpart is 8 bits). By the birthday paradox, we can obtain different (𝐼^2′₁₀,𝐼^2′₂₀,𝐼^2′₃₀) and (𝐼^2′′₁₀,𝐼^2′′₂₀,𝐼^2′′₃₀) from 2¹⁶(𝐼²₁₀,𝐼²₂₀,𝐼²₃₀) with the probability of 0.5.

We can express 𝐼⁵ by using 𝑂⁵ as follows. Here, 𝑓⁻¹ means the inverse of a function 𝑓𝑂⁵=ARK_RK⁵∘MC∘SR∘SB𝐼⁵=MC∘SR∘ARK_SR⁻¹_∘MC⁻¹_[RK⁵_]∘SB𝐼⁵⟹SB𝐼⁵=ARK_SR⁻¹_∘MC⁻¹_[RK⁵_]∘SR⁻¹∘MC⁻¹𝑂⁵. (4) If we obtain different (𝐼^2′₁₀,𝐼^2′₂₀,𝐼^2′₃₀) and (𝐼^2′′₁₀,𝐼^2′′₂₀,𝐼^2′′₃₀) satisfying 𝐼^5′₀₀=𝐼^5′′₀₀, then SB[𝐼^5′₀₀] is also equal to SB[𝐼^5′′₀₀]. Thus, from the above equation, we can construct the following equation. Here, 𝑏_𝑖𝑗 means the entry of the coefficient matrix of MC⁻¹SB𝐼^5′₀₀=𝑏₀₀∘𝑂^5′₀₀⊕𝑏₀₁∘𝑂^5′₁₀⊕𝑏₀₂∘𝑂^5′₂₀⊕𝑏₀₃∘𝑂^5′₃₀=𝑏₀₀∘𝑂^5′′₀₀⊕𝑏₀₁∘𝑂^5′′₁₀⊕𝑏₀₂∘𝑂^5′′₂₀⊕𝑏₀₃∘𝑂^5′′₃₀=SB𝐼^5′′₀₀. (5) For all 𝐼²₀₀∈{0,…,255}, we can check that 𝐼^5′₀₀ is equal to 𝐼^5′′₀₀ by using (5). That is, with the probability of 0.5, we can find different (𝐼^2′₁₀,𝐼^2′₂₀,𝐼^2′₃₀) and (𝐼^2′′₁₀,𝐼^2′′₂₀,𝐼^2′′₃₀) satisfying (5) for all 𝐼²₀₀ (among 2¹⁶ candidates).

On the other hand, our attack on AES recovers a 192-bit round key and the probability that (5) holds for one 𝐼²₀₀ is 2⁻⁸. So, if we use only 25𝐼²₀₀, the probability that (5) holds is (2⁻⁸)²⁵=2⁻²⁰⁰. Since 2⁻²⁰⁰⋅2¹⁹²≪1, we consider only 25𝐼²₀₀.

2.3. Collision Attack on a 7-Round Reduced AES

Now, we show how to exploit a 4-round distinguisher constructed in the previous subsection in order to attack a 7-round reduced AES.

Similarly to the previous subsection, 𝑂⁵ can be expressed by using 𝑂⁷ as follows: 𝑂⁷=ARK_RK⁷∘SR∘SB∘ARK_RK⁶∘MC∘SR∘SB𝑂⁵=SR∘ARK_SR⁻¹_[RK⁷_]∘SB∘MC∘SR∘ARK_SR⁻¹_∘MC⁻¹_[RK⁶_]∘SB𝑂⁵⟹𝑂⁵=SB⁻¹∘ARK_SR⁻¹_∘MC⁻¹_[RK⁶_]∘SR⁻¹∘MC⁻¹∘SB⁻¹∘ARK_SR⁻¹_[RK⁷_]∘SR⁻¹𝑂⁷. (6) For the simplicity of notations, SR⁻¹∘MC⁻¹[RK⁶] and SR⁻¹[RK⁷] in (6) are denoted by RK^6∗ and RK^7∗, respectively.

Our attack procedure on AES is as follows (see Figure 2). (1)Construct 2³² plaintexts 𝑃^𝑖, where all byte values except (𝑃^𝑖₀₀,𝑃^𝑖₁₁,𝑃^𝑖₂₂,𝑃^𝑖₃₃) are fixed constants, and obtain the corresponding ciphertexts 𝐶^𝑖 (𝑖=0,…,2³²−1). Sort 𝐶^𝑖's according to a 32-bit value 𝑃^𝑖₀₀‖𝑃^𝑖₁₁‖𝑃^𝑖₂₂‖𝑃^𝑖₃₃. (2)For each 𝑗(=0,…,3), guess 40-bit round keys (RK^6∗_𝑗0, RK^7∗_{0((4−𝑗)mod4)}, RK^7∗_{1((4−𝑗)mod4)}, RK^7∗_{2((4−𝑗)mod4)}, RK^7∗_{3((4−𝑗)mod4)}) and compute the corresponding 𝑂⁵_𝑗0 from the guessed round keys and 𝐶^𝑖 by using (6) (e.g., guess (RK^6∗₀₀,RK^7∗₀₀,RK^7∗₁₀,RK^7∗₂₀,RK^7∗₃₀) to compute 𝑂⁵₀₀). Sort 𝑂⁵_𝑗0 according to the guessed round keys, 𝑖 and 𝑗, and keep them in a table. (3)Select 2¹⁶ sets 𝑆^𝑘 including 25 output values 𝑋 of MC in round 1(𝑘=0,…,2¹⁶−1). Note that 𝑋_𝑚𝑛 are fixed constants in all 𝑆^𝑘(0≤𝑚≤3,1≤𝑛≤3). In each 𝑆^𝑘, 25𝑋₀₀ have different values but all 𝑆^𝑘 contain the same 𝑋₀₀. In the case of (𝑋₁₀,𝑋₂₀,𝑋₃₀), they are different in each 𝑆^𝑘 but the same in all 𝑆^𝑘. (4)Guess 32-bit round keys (RK⁰₀₀,RK⁰₁₁,RK⁰₂₂,RK⁰₃₃) and construct 2¹⁶ sets 𝑄^𝑘 including the corresponding (𝑃^′₀₀,𝑃^′₁₁,𝑃^′₂₂,𝑃^′₃₃) from each 𝑋 in 𝑆^𝑘, and do the following:(i)choose different two sets 𝑄^𝑘1 and 𝑄^𝑘2. By using the table constructed in Step 2, check that 25 pairs from 𝑄^𝑘1 and 𝑄^𝑘2 satisfy (5);(ii)if all 25 pairs satisfy (5), then output the corresponding 192-bit guessed round keys as the right round keys of AES.

Figure 2 

The attack procedure on AES-192/256.

The data complexity of this attack is 2³² chosen plaintexts and the memory complexity is 2⁷⁴(≈4⋅2³²⋅2⁴⁰) memory bytes. The computational complexity depends on Step 2 heavily. Thus, it is about 2^69.2(≈2³²⋅2⁴⁰⋅1/7⋅1/4⋅4) encryptions. Though this attack is not applicable to the full AES-192/256, this result is superior to the attack results of [1] (AES-192) and [3] (AES-256), respectively.

3. Collision Attacks on 8-Round Reduced Crypton-192/256 and mCrypton-96/128

In this section, we present collision attacks on 8-round reduced Crypton-192/256 and mCrypton-96/128. Our attacks on 8-round reduced mCrypton-96/128 are similar to them on 8-round reduced Crypton-192/256. Thus, we mainly introduce the attacks on 8-round reduced Crypton-192/256. Furthermore, similarly to the attacks on AES-192/256, the attack procedure on Crypton-192 (mCrypton-96) is the same as that on Crypton-256 (mCrypton-128). Thus, for the simplicity of notations, we just call them Crypton-192/256 (mCrypton-96/128) and Crypton (mCrypton). First, we briefly present Crypton and mCrypton.

3.1. Crypton and mCrypton

As shown in Figure 3(a), a 128-bit block cipher Crypton has a 12-round SPN structure with 128/192/2 56-bit secret keys and processes blocks of 128 bits in the form of 4 × 4 byte array (see Figure 4). Note that indices used in the internal state of Crypton are different from that of AES.

(a)

(b)

Figure 3 

(a) Crypton and (b) mCrypton.

Figure 4 

Internal state of Crypton and mCrypton.

Similarly to AES-192/256, in round 𝑟, we denote input/output values and round key 𝐼^𝑟,𝑂^𝑟, and RK^𝑟, respectively (𝑟=1,…,12). The round function 𝜌 of Crypton consists of the following four operations: (i)𝛾: applying four 4×4 S-boxes (𝑆₀,𝑆₁,𝑆₂,𝑆₃) 4 times in parallel on each byte of the state. Note that two versions (𝛾_𝑜,𝛾_𝑒) of 𝛾 are used according to rounds. In detail, 𝛾_𝑜 is for odd rounds and 𝛾_𝑒 is for even rounds;(ii)𝜋: mixing each byte column of 4 × 4 array by using four masking bytes (𝑚₀,𝑚₁,𝑚₂,𝑚₃). Similarly to 𝛾, two versions (𝜋_𝑜,𝜋_𝑒) of 𝜋 are applied according to rounds (𝜋_𝑜 is for odd rounds and 𝜋_𝑒 is for even rounds);(iii)𝜏: moving the byte at the (𝑖,𝑗)th position to the (𝑗,𝑖)th position;(iv)𝜎: XORing the state with an 128-bit round key.

The round function 𝜌 consists of applying in sequence four operations, the S-box transformation 𝛾, the bit permutation 𝜋, the byte transposition 𝜏, and the key addition 𝜎, to the 4×4 byte array. More specifically, the odd round function 𝜌_𝑜RK and the even round function 𝜌_𝑒RK are defined (for a round key RK) as follows:(i)𝜌_𝑜RK=𝜎_RK∘𝜏∘𝜋_𝑜∘𝛾_𝑜 for odd rounds;(ii)𝜌_𝑒RK=𝜎_RK∘𝜏∘𝜋_𝑒∘𝛾_𝑒for even rounds.

For the more detailed descriptions of Crypton, we refer to [5]. Similarly to our attacks on AES-192/256, our attacks on Crypton do not also consider the key schedule of this algorithm. Thus, we omit its key schedules.

mCrypton is a 64-bit lightweight block cipher designed for use in low-cost and resource-constrained applications such as RFID tags and sensors in wireless sensor networks. As shown in Figure 3(b), it has a 12-round SPN structure and supports the 64/96/128-bit secret keys. The overall structure of mCrypton is similar to Crypton except that mCrypton is based on nibble-oriented operations (note that Crypton is based on byte-oriented operations).

3.2. Collision Attacks on an 8-Round Reduced Crypton

First, we explain the way to find a distinguisher of Crypton. By using a similar method in the attack on AES-192/256, we can also construct a 4-round distinguisher of Crypton. Furthermore, because of the weak diffusion property of Crypton, we can extend this distinguisher to a 5-round distinguisher of it. In detail, our attacks on an 8-round reduced Crypton consider a 5-round distinguisher of round 2~6.

Recall that, in the attack on AES-192/256, an equation on 𝑂⁵₀₀ can be constructed by using 𝐼². We apply this method to Crypton. As a result, we obtain an equation on 𝐼⁶₃₀ by using 𝐼². Similarly to AES-192/256, this equation consists of five parts as follows. Here, 𝑚_𝑖 means a masking byte used in 𝜋 and “∧” is a bitwise AND operation 𝐼⁶₃₀=𝑆₀[⋅]∧𝑚₃⊕𝑆₁[⋅]∧𝑚₀⊕𝑆₂[⋅]∧𝑚₁⊕𝑆₃[⋅]∧𝑚₂⊕RK⁵₃₀. (7)

On the other hand, 𝐼⁶ can be written by using 𝑂⁶ as follows: 𝑂⁶=𝜎_RK⁶∘𝜏∘𝜋_𝑒∘𝛾_𝑒𝐼⁶=𝜏∘𝜋_𝑒∘𝜎_{𝜋𝑒−1∘𝜏−1(RK}⁶₎∘𝛾_𝑒𝐼⁶⟹𝛾_𝑒𝐼⁶=𝜎_{𝜋𝑒−1∘𝜏−1(RK}⁶₎∘𝜋_𝑒⁻¹∘𝜏⁻¹𝑂⁶. (8)

Thus, we use the following equation as a checking equation (note that, in the case of the attack on AES-192/256, a checking equation is (5)) 𝛾_𝑒𝐼^6′₃₀=𝑂^6′₀₃∧𝑚₀⊕𝑂^6′₁₃∧𝑚₃⊕𝑂^6′₂₃∧𝑚₂⊕𝑂^6′₃₃∧𝑚₁=𝑂^6′′₀₃∧𝑚₀⊕𝑂^6′′₁₃∧𝑚₃⊕𝑂^6′′₂₃∧𝑚₂⊕𝑂^6′′₃₃∧𝑚₁=𝛾_𝑒𝐼^6′′₃₀. (9)

The overall attack procedure is similar to the case of AES. Figure 5 presents our attack procedure on an 8-round reduced Crypton. The method to compute 𝑂⁶ from 𝑂⁸ is shown in 𝑂⁸=𝜏∘𝜋_𝑒∘𝜏∘𝜎_RK⁸∘𝜏∘𝜋_𝑒∘𝛾_𝑒∘𝜎_RK⁷∘𝜏∘𝜋_𝑜∘𝛾_𝑜𝑂⁶=𝜏∘𝜋_𝑒∘𝜏∘𝜏∘𝜋_𝑒∘𝜎_{𝜋𝑒−1∘𝜏−1[RK}⁸_]∘𝛾_𝑒∘𝜏∘𝜋_𝑜∘𝜎_{𝜋𝑜−1∘𝜏−1[RK}⁷_]∘𝛾_𝑜𝑂⁶=𝜏∘𝜎_{𝜋𝑒−1∘𝜏−1[RK}⁸_]∘𝛾_𝑒∘𝜏∘𝜋_𝑜∘𝜎_{𝜋𝑜−1∘𝜏−1[RK}⁷_]∘𝛾_𝑜𝑂⁶=𝜎_{𝜏∘𝜋𝑒−1∘𝜏−1[RK}⁸_]∘𝜏∘𝛾_𝑒∘𝜏∘𝜋_𝑜∘𝜎_{𝜋𝑜−1∘𝜏−1[RK}⁷_]∘𝛾_𝑜𝑂⁶=𝜎_{𝜏∘𝜋𝑒−1∘𝜏−1[RK}⁸_]∘𝛾_𝑒∘𝜋_𝑜∘𝜎_{𝜋𝑜−1∘𝜏−1[RK}⁷_]∘𝛾_𝑜𝑂⁶.⟹𝑂⁶=𝛾_𝑜⁻¹∘𝜎_{𝜋𝑜−1∘𝜏−1[RK}⁷_]∘𝜋_𝑜⁻¹∘𝛾_𝑒⁻¹∘𝜎_{𝜏∘𝜋𝑒−1∘𝜏−1[RK}⁸_]𝑂⁸. (10)

Figure 5 

The attack procedure on Crypton-192/256 and mCrypton-96/128.

The complexities of this attack are as follows:(i) the data complexity: 2⁹⁶ chosen plaintexts; (ii) the memory complexity: 2¹³³ memory bytes; (iii) the computational complexity: 2^161.6 encryptions.

So far, the best attack result was the truncated differential cryptanalysis on 8-round reduced Crypton-192/256 proposed in [8]. This attack requires the computational complexity of 2^126.2 encryptions with 2¹²⁶ chosen plaintexts, respectively. Compared to these results, our attack decreases the data complexity but increases the computational complexity.

3.3. Collision Attacks on an 8-Round Reduced mCrypton

As shown in Figure 5, the attack procedure on mCrypton is the same as that on Crypton except that it is based on nibble-oriented operations (recall that Crypton is based on byte-oriented operations). In detail, our attack on mCrypton uses (9) as a checking equation and 𝑂⁶ is computed from 𝑂⁸ by using (10).

Since the size of internal state of mCrypton is half of that in Crypton, the complexities of the attack on mCrypton are half of them on Crypton. The complexities of the attack on mCrypton are as follows:(i) the data complexity: 2⁴⁸ chosen plaintexts; (ii) the memory complexity: 2^81.6 memory bytes; (iii) the computational complexity: 2⁶⁵ encryptions.

In [9], related-key impossible differential cryptanalysis on 9-round reduced mCrypton-96/128 was proposed. The attack on a 9-round reduced mCrypton-96 needs the computational complexity of 2^74.9 encryptions with 2^59.9 chosen plaintexts. In the case of a 9-round reduced mCrypton-128, we need the computational complexity of 2^66.7 encryptions with 2^59.7 chosen plaintexts. To our knowledge, these are the best results on mCrypton-96/128. However, considering the attack assumption of a related-key attack, our attacks are more practical than it.

4. Collision Attack on an 8-Round Reduced Anubis

First, we present Anubis, and then a collision attack on an 8-round reduced Anubis is introduced.

4.1. Anubis

As shown in Figure 6, Anubis is a 128-bit block cipher with variable-length keys from 128 bits to 320 bits in steps of 32 bits. The number of rounds depends on the length of the secret key: at least 12 (for the 128-bit secret key), plus one extra round for each additional 32 bits. For example, when the length of the secret key is 192(=128+2⋅32) bits, the number of rounds is 14(=12+2).

Figure 6 

Anubis.

Anubis processes blocks of 128 bits in the form of 4×4 byte array and uses the same indices as AES (see Figure 1). Similarly to block ciphers concerned in the previous sections, in round 𝑟, we denote input/output values and round key 𝐼^𝑟, 𝑂^𝑟, and RK^𝑟, respectively.

The round function of Anubis consists of sixteen 8×8 S-box parallel lookups, a linear transformation (matrix transposition followed by multiplication by a constant MDS diffusion matrix), and the round key addition. These transformations are defined as follows:(i)𝛾: applying the same 8×8 S-box 16 times in parallel on each byte of the state;(ii)𝜏: moving the byte at the (𝑖,𝑗)th position to the (𝑗,𝑖)th position;(iii)𝜃: multiplication of each column by a constant 4×4 matrix over GF(2⁸); (iv)𝜎: XORing the state with a 128-bit round key.

For the more detailed descriptions of Anubis, we refer to [7]. Similarly to the previous sections, we omit their key schedules, as they do not affect our attacks.

4.2. Collision Attacks on an 8-Round Reduced Anubis

Our attack on an 8-round reduced Anubis is similar to the attacks on AES-192/256, Crypton-192/256, and mCrypton-96/128. In collision attack on an 8-round reduced Anubis, we use a 5-round distinguisher of round 2~6. By using a similar method of the attack introduced in the previous sections, we can obtain the following equation on 𝐼⁶₀₀ by using 𝐼²: 𝐼⁶₀₀=(𝑆[⋅])⊕(𝑆[⋅])⊕(𝑆[⋅])⊕(𝑆[⋅])∘01∘02∘04∘06⊕RK⁵₀₀. (11)

On the other hand, 𝐼⁶ can be written by using 𝑂⁶ as follows: 𝑂⁶=𝜎_RK⁶∘𝜃∘𝜏∘𝛾𝐼⁶=𝜃∘𝜏∘𝜎_{𝜏−1∘𝜃}⁻¹_[RK6]∘𝛾𝐼⁶⟹𝛾𝐼⁶=𝜎_{𝜏−1∘𝜃}⁻¹_[RK6]∘𝜏⁻¹∘𝜃⁻¹𝑂⁶. (12) Thus, we use the following equation as a checking equation 𝛾𝐼^6′₀₀=𝑂^6′₀₀∘01⊕𝑂^6′₁₀∘02⊕𝑂^6′₂₀∘04⊕𝑂^6′₃₀=𝑂∘06_6′′00∘01⊕𝑂^6′′₁₀∘02⊕𝑂^6′′₂₀∘04⊕𝑂^6′′₃₀∘06=𝛾_𝑒𝐼^6′′₀₀. (13)

The attack procedure on an 8-round reduced Anubis is similar to that on block ciphers proposed in the previous sections. Figure 7 presents our attack procedure on an 8-round reduced Anubis. In our attack, the method to compute 𝑂⁶ from 𝑂⁸ is 𝑂⁸=𝜎_RK⁸∘𝜏∘𝛾∘𝜎_RK⁷∘𝜃∘𝜏∘𝛾𝑂⁶=𝜏∘𝜎_𝜏−1[RK⁸_]∘𝛾∘𝜎_RK⁷∘𝜃∘𝜏∘𝛾𝑂⁶=𝜏∘𝜎_𝜏−1[RK⁸_]∘𝜃∘𝜏∘𝜎_{𝜏−1∘𝜃}⁻¹_[RK7]∘𝛾𝑂⁶⟹𝑂⁶=𝛾⁻¹∘𝜎_{𝜏−1∘𝜃}⁻¹_[RK7]∘𝜏⁻¹∘𝜃⁻¹∘𝜎_𝜏−1[RK⁸_]∘𝜏⁻¹𝑂⁸. (14) The complexities of this attack is as follows:(i) the data complexity: 2⁹⁶ chosen plaintexts; (ii) the memory complexity: 2¹³³ memory bytes; (iii) the computational complexity: 2^161.6 encryptions.

Figure 7 

The attack procedure on Anubis.

So far, the best attack results on Anubis are a collision attack and a square attack on a 7-round reduced version [11]. A collision attack on a 7-round reduced Anubis requires the computational complexity of 2¹⁴⁰ encryptions with 2³² chosen plaintexts. In the case of a square attack on this algorithm, we need the computational complexity of 2¹²⁰ encryptions with 2¹²⁸~2¹¹⁹ chosen plaintexts. Thus, our attack result is superior to these cryptanalytic results.

5. Conclusion

In this paper, we have introduced collision attacks on seven SPN block ciphers, 7-round reduced AES-192/256, 8-round reduced Crypton-192/256, 8-round reduced mCrypton-96/128, and an 8-round reduced Anubis. Our attacks are based on the idea of [3].

Our attacks on 7-round reduced AES-192/256 improve the attack results based on a type of meet-in-the-middle attack. Considering that the best attack results on Crypton-192/256 are those on 8-round reduced versions, our attacks on these algorithms are meaningful. Our attacks on 8-round reduced mCrypton-96/128 are not best results on mCrypton-96/128. However, considering that known best attack results on them are based on a related-key attack, our attacks are more practical than them. In the case of Anubis, our attack result is superior to known cryptanalytic result on this algorithm.

Conflict of Interests

The authors declare that there is no conflict of interests regarding the publication of this paper.

Acknowledgments

This research was supported by the Ministry of Science, ICT & Future Planning (MSIP), Korea, under the Convergence Information Technology Research Center (C-ITRC) Support Program (NIPA-2013-H0301-13-3007), supervised by the National IT Industry Promotion Agency (NIPA).