Grover on Chosen IV Related Key Attack Against GRAIN-128a

Abstract

In this paper, we present a chosen IV related key attack on Grain-128a, that exploits Grover’s algorithm as a tool. Earlier a classical version of such a chosen IV related key attack was considered by Banik et al. in ACISP 2013. They showed that using around $\gamma \cdot 2^{32}$ related keys (where $\gamma$ is an experimentally determined constant and is estimated as $2^8$), and $\gamma \cdot 2^{64}$ chosen IVs one can mount the attack in the classical domain. This is because for each related key on an average $2^{32}$ chosen IVs need to be examined. Thus, the query complexity becomes $O(2^{32}\cdot 2^{32})$, i.e., $O(2^{64})$. Contrary to this, thanks to the quantum paradigm, we use the superposition of all these $2^{64}$ queries at a time and feed them to the oracle. As a result, we could manage to decrease the complexity of the related key search to the order of $2^{16}$, consequently reducing the number of required IVs to $2^{32}$ through the exploitation of the Grover search algorithm. Simulation of the attack against a reduced version of Grain-128a like cipher in the IBMQ simulator has also been presented as proof of the concept. Resource estimation for hardware implementation of the attack is presented and analyzed under NIST MAXDEPTH limit.