Some Results on Related Key-IV Pairs of Espresso

Abstract

In this paper, we analyze the Espresso cipher from a related key chosen IV perspective. More precisely, we explain how one can obtain Key-IV pairs such that Espresso’s keystreams either have certain identical bits or are shifted versions of each other. For the first case, we show how to obtain such pairs after $2^{32}$ iterations, while for the second case, we present an algorithm that produces such pairs in $2^{28}$ iterations. Moreover, we show that by making a minor change in the padding used during the initialization phase, it can lead to a more secure version of the cipher. Specifically, changing the padding increases the complexity of our second attack from $2^{28}$ to $2^{34}$. Finally, we show how related IVs can accelerate brute force attacks, resulting in a faster key recovery. Although our work does not have any immediate implications for breaking the Espresso cipher, these observations are relevant in the related-key chosen IV scenario.

A Examples

1.1 A.1 Propagation of a Single Bit Differential

Table 9. Propagation of a Single Bit Differential

Based on Algorithm 1, in Table 9 we present some examples. More precisely, two initial states $X_{0}$ and $X_{0, \varDelta }$ which differ only in the position presented in Table 9, Column 1, produce identical output bits in the positions found in Table 9, Column 3, among the initial 160 key stream bits obtained during the PRGA.

1.2 A.2 Multiple Key-IV Trials with a Fixed Differential

In Table 10 we provide an examples for Algorithm 2.

Table 10. Key-IV pairs which differ only in the $239^{th}$ position

1.3 A.3 Key-IV Pairs that Produce Shifted Keystreams

In Table 11 we present a set of examples for Algorithms 4 to 7.

Table 11. Key-IV pairs that produce shifted keystreams