Gain: Practical Key-Recovery Attacks on Round-Reduced PAEQ

Abstract

This work presents practical key-recovery attacks on round-reduced variants of CAESAR Round 2 candidate PAEQ by analyzing it in the light of guess-and-determine analysis. The attack developed here targets the mode of operation along with diffusion inside the AES based internal permutation AESQ. The first attack uses a guess-and-invert technique leading to a meet-in-the-middle attack that is able to recover the key for 6 out of the 20 rounds of paeq-64/80/128 with reduced key entropy of 1, 2¹⁶ and 2³², respectively. The second analysis extends the attack to 7 rounds using a invert-and-guess strategy which results in reduced key space of 2²⁴, 2³², and 2⁴⁰ for the same PAEQ variants. Then, an 8-round attack (without the last shuffle operation) is mounted using a guess-invert-guess strategy which works on any of the three variants with a complexity of 2⁴⁸. Moreover, unlike the CICO attack mounted by the designers which works with only AESQ, our 8-round attack additionally takes into account the mode of operation of PAEQ. Finally, combining guess-and-determine with internal differential cryptanalytic strategies a full 8-round attack is devised which recovers the key for paeq-64/80/128 with time complexities of 2³⁴, 2⁶⁶, and 2⁹⁸, respectively.