Improving Division Property Based Cube Attacks by Removing Invalid Monomials

Abstract

Division property based cube attack was proposed by Todo et al. at CRYPTO 2017, which can exploit larger cube indices than traditional cube attacks. At CRYPTO 2018, Wang et al. introduced degree evaluation and flag technique to reduce the complexity of recovering the superpoly. Although division property based cube attacks that introducing these methods are powerful to analyze many stream ciphers, how to further reduce the complexity of determining possible monomials of the superpoly is still a problem. In this paper, we introduce some techniques to speedup the recovery of the superpoly.

• 1. When evaluating all possible monomials, we provide the filter technique to reduce the complexity of evaluating monomials by division trails. Non-cube public variables involved in superpoly also can be obtained by the filter technique. While evaluating monomials, the effect of non-cube public variables on all monomials can be considered directly.

• 2. In order to remove most invalid monomials, we modify the parameters of flag technique in the initialization phase. Most invalid division trails can be identified and fewer remaining monomials need to be determined by constructing a linear system.

To verify our scheme, we apply the method to the initialization of the Grain128a. In the recovery of the superpoly of 106-round Grain128a, the number of possible monomials needs to be determined is reduced to $5.56\%$ of Wang et al.’s superpoly evaluations. The complexity of analysing 184-round Grain128a is smaller than $57\%$ of the current best complexity. In the recovery attack of 185 or higher rounds Grain128a, cube indices set that includes all non-constant public variables can be achieved according to the results of the filter technique.