Improved Rebound Attacks on AESQ: Core Permutation of CAESAR Candidate PAEQ

Abstract

In this paper, we present improved rebound attacks against AESQ permutation that is an underlying permutation of PAEQ authenticated encryption scheme currently discussed in the second round of the CAESAR competition. AESQ is an AES-based permutation. Designers claim that no attack should be found with complexity up to $2^{256}$ and they have shown a rebound attack against 12 (out of 20) rounds with $2^{256}$ computational cost and $2^{256}$ memory. In this paper, we present the first third-party cryptanalysis on AESQ. First, we reduce the complexity of the 12-round attack to $2^{128}$ computational cost and negligible memory. We then extend the number of rounds and present a 16-round attack with $2^{192}$ computational cost and $2^{128}$ memory. Moreover, we discuss time-memory tradeoffs and multiple limited birthday distinguishers. In particular, the time-memory tradeoff is useful for the 12-round attack, which allows us to balance the time and memory complexities to $2^{102.4}$.