Skip to main content
SpringerLink
Log in

Cryptanalysis of the AEAD and hash algorithm DryGASCON

  • Published:
Cryptography and Communications Aims and scope Submit manuscript

Abstract

The DryGASCON scheme was one of authenticated encryption (AE) algorithms submitted to the ongoing NIST Lightweight Cryptography Standardization Process. Such a competition aims to standardize lightweight cryptographic algorithms and determine lightweight AE schemes that are suitable for use in constrained environments suitable for several emerging areas in which highly-constrained devices are interconnected. This article deals with DryGASCON and aims to evaluate its security. The reasons for this choice are twofold. The first reason is related to its unique design. The second one is that no forgery cryptanalysis has been performed on it in the literature to the best of our knowledge. Specifically, this paper presents practical forgery attacks on DryGASCON by exploiting internal collisions of the underlying permutation. During our cryptanalysis, we investigate collisions and discuss how to find them. Next, we mounted forgery attacks on DryGASCON128 with an optimal probability 2− 13 for a class of weak keys and with certainty (optimal probability 1) for pairs of related keys. We show that the number of elements from the weak-key class depends on the size of the secret keys. In addition, we also find forgeries of DryGASCON256 in the related-key scenario. Forgery attacks succeeded without the reuse of nonce. Our results threaten the authenticity and robustness of DryGASCON. However, thanks to our analysis, we shed light on the causes of its weaknesses, and we manage to draw constructive conclusions and recommendations for future AE designs schemes, notably similar to DryGASCON.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2
Fig. 3
Fig. 4
Fig. 5

Similar content being viewed by others

Data Availability

The codes used to support this study are deposited in the GitHub (https://github.com/CatherineLiang/Cryptanalysis-of-DryGASCON).

References

  1. Bertoni, G., Daemen, J., Peeters, M., Assche, G.V.: Workshop Records of DIAC. Permutation-based encryption, authentication and authenticated encryption (2012)

  2. Bellare, M., Namprempre, C.: Authenticated encryption: relations among notions and analysis of the generic composition paradigm. In: Okamoto, T. (ed.) ASIACRYPT. LNCS. https://doi.org/10.1007/3-540-44448-341, vol. 1976, pp 531–545. Springer (2000)

  3. Bellare, M., Rogaway, P.: Encode-then-encipher encryption: how to exploit nonces or redundancy in plaintexts for efficient cryptography. In: Okamoto, T. (ed.) ASIACRYPT. LNCS. https://doi.org/10.1007/3-540-44448-3_24, vol. 1976, pp 317–330. Springer (2000)

  4. Bhattacharyya, R., Roy, A.: Secure message authentication against related-key attack. In: Moriai, S. (ed.) FSE. LNCS. https://doi.org/10.1007/978-3-662-43933-3_16, vol. 8424, pp 305–324. Springer (2013)

  5. Biham, E., Shamir, A.: Differential cryptanalysis of DES-like cryptosystems. J. Cryptol. 4(1), 3–72 (1991). https://doi.org/10.1007/BF00630563

    Article  MathSciNet  Google Scholar 

  6. Dobraunig, C., Eichlseder, M., Mendel, F., Schläffer, M.: Ascon-Submission to the CAESAR competition. http://ascon.iaik.tugraz.at (2014)

  7. Ganesh, V., Hansen, T., Soos, M., Liew, D., Govostes, R.: STP constraint solver. https://github.com/stp/stp (2007)

  8. Handschuh, H., Preneel, B.: Key-recovery attacks on universal hash function based mac algorithms. In: Wagner, D. (ed.) CRYPTO. LNCS. https://doi.org/10.1007/978-3-540-85174-5_9, vol. 5157, pp 144–161. Springer (2008)

  9. Katz, J., Yung, M.: Unforgeable encryption and chosen ciphertext secure modes of operation. In: Goos, G., Hartmanis, J., van Leeuwen, J., Schneier, B. (eds.) FSE. LNCS. https://doi.org/10.1007/3-540-44706-7_20, vol. 1978, pp 284–299. Springer (2000)

  10. Liang, H., Wang, M.: Cryptanalysis of the lightweight block cipher BORON Secur. Commun. Netw. https://doi.org/10.1155/2019/7862738 (2019)

  11. N.I.S.T. lightweight cryptography. https://csrc.nist.gov/projects/lightweight-cryptography

  12. Rogaway, P.: Authenticated-encryption with associated-data. In: Atluri, V. (ed.) ACM CCS, pp 98–107. ACM (2002)

  13. Rogaway, P.: Nonce-based symmetric encryption. In: Roy, B., Meier, W. (eds.) FSE. LNCS. https://doi.org/10.1007/978-3-540-25937-4_22, vol. 3017, pp 348–358. Springer (2004)

  14. Riou, S.: DryGASCON. Submission to NIST LWC (Round 2). https://csrc.nist.gov/CSRC/media/Projects/lightweight-cryptography/documents/round-2/spec-doc-rnd2/drygascon-spec-round2.pdf

  15. Riou, S.: DryGASCON algorithm update. NIST lightweight cryptography round 2. https://csrc.nist.gov/CSRC/media/Projects/lightweight-cryptography/documents/round-2/status-update-sep2020/DryGASCON_20200917-status-update.pdf (2019)

  16. Tezcan, C.: Analysis of Ascon, DryGASCON, and Shamash Permutations. https://eprint.iacr.org/2020/1458.pdf

  17. Tezcan, C.: Analysis of Ascon, DryGASCON, and Shamash Permutations. In: International Journal of Information Security Science. https://www.ijiss.org/ijiss/index.php/ijiss/article/view/762, vol. 9.3, pp 172–187 (2020)

Download references

Acknowledgements

The authors sincerely thank Associate Professor Wu Hongjun (from Nanyang Technological University) and Wei Wang (from Shandong University) for their interesting and appreciated discussions. We thank anonymous reviewers’ work for polishing this paper. This paper was supported by the National Natural Science Foundation of China (Grant No. 62002201, Grant No. 62032014), the National Key Research and Development Program of China (Grant No. 2018YFA0704702, 2018YFA0704704), the Major Scientific and Technological Innovation Project of Shandong Province, China (Grant No. 2019JZZY010133), the Major Basic Research Project of Natural Science Foundation of Shandong Province, China (Grant No. ZR202010220025).

Author information

Authors and Affiliations

  1. School of Cyber Science and Technology, Shandong University, 266237, Qingdao, China

    Huicong Liang & Meiqin Wang

  2. Key Laboratory of Cryptologic Technology and Information Security, Ministry of Education, Shandong University, 266237, Qingdao, China

    Huicong Liang & Meiqin Wang

  3. Department of Mathematics, University of Paris VIII, F-93526, Saint-Denis, France

    Sihem Mesnager

  4. University Sorbonne Paris Cité, LAGA, UMR 7539, CNRS, 93430, Villetaneuse, France

    Sihem Mesnager

  5. Telecom Paris, Polytechnic Institute of Paris, 91120, Palaiseau, France

    Sihem Mesnager

Authors
  1. Huicong Liang
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Sihem Mesnager
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Meiqin Wang
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Meiqin Wang.

Additional information

Publisher’s note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

This work has received funding from the National Natural Science Foundation of China (Grant No. 62002201, Grant No. 62032014), the National Key Research and Development Program of China (Grant No. 2018YFA0704702, 2018YFA0704704), the Major Scientific and Technological Innovation Project of Shandong Province, China (Grant No. 2019JZZY010133), the Major Basic Research Project of Natural Science Foundation of Shandong Province, China (Grant No. ZR202010220025).

Appendices

Appendix A: Key Setup permutation

Fig. 6
figure 6

Key Setup permutations for DryGASCON128

Full size image
Fig. 7
figure 7

Key Setup permutations for DryGASCON256

Full size image

Appendix B: MixSX32 permutation from DryGASCON256

Fig. 8
figure 8

MixSX32 permutation for DryGASCON256

Full size image
Fig. 9
figure 9

Differential characteristic with probability 2− 6 for Property 3

Full size image

MixSX32 permutation for 576-bit c, 128-bit x and 18-bit i could be written as \(c \leftarrow \textit {MixSX32}(i, c, x ),\) where

$$ \begin{array}{@{}rcl@{}} i &=& i_{17}\|i_{16}\|i_{15}\|i_{14}\|i_{13}\|i_{12}\|i_{11}\|i_{10}\|i_{9}\|i_{8}\|i_{7}\|i_{6}\|i_{5}\|i_{4}\|i_{3}\|i_{2}\|i_{1}\|i_{0},\\ c& =& c_{17}\|c_{16}\|c_{15}\|c_{14}\|c_{13}\|c_{12}\|c_{11}\|c_{10}\|c_{9}\|c_{8}\|c_{7}\|c_{6}\|c_{5}\|c_{4}\|c_{3}\|c_{2}\|c_{1}\|c_{0},\\ x &=& x_{3}\|x_{2}\|x_{1}\|x_{0}. \end{array} $$

For example, let i be equal to 011000110001101100, and the output of MixSX32 permutation is

$$ \begin{array}{@{}rcl@{}} && c \leftarrow \\ &&c_{17}\|(c_{16}\oplus x_{i[17:16]})\|c_{15}\|(c_{14}\oplus x_{i[15:14]})\|c_{13}\|(c_{12}\oplus x_{i[13:12]})\|c_{11}\|(c_{10}\oplus x_{i[11:10]})\|c_{9}\| \\ && (c_{8}\oplus x_{i[9:8]})\|c_{7}\|(c_{6}\oplus x_{i[7:6]})\|c_{5}\|(c_{4}\oplus x_{i[5:4]})\|c_{3}\|(c_{2}\oplus x_{i[3:2]})\|c_{1}\|(c_{0}\oplus x_{i[1:0]})\\ && \leftarrow c_{17}\|(c_{16}\oplus x_{1})\|c_{15}\|(c_{14}\oplus x_{2})\|c_{13}\|(c_{12}\oplus x_{0})\|c_{11}\|(c_{10}\oplus x_{3})\|c_{9}\| \\ && (c_{8}\oplus x_{0})\|c_{7}\|(c_{6}\oplus x_{1})\|c_{5}\|(c_{4}\oplus x_{2})\|c_{3}\|(c_{2}\oplus x_{3})\|c_{1}\|(c_{0}\oplus x_{0}). \end{array} $$

Appendix C: Differential characteristics

Table 2 Differential Characteristic with Probability 2− 6 for Property 3
Full size table
Fig. 10
figure 10

Differential Characteristic with Probability 2− 13 for Property 5

Full size image
Table 3 Differential Characteristic with Probability 2− 13 for Property 5
Full size table
Fig. 11
figure 11

Differential Characteristic with Probability 2− 10 for Property 6

Full size image
Table 4 Differential Characteristic with Probability 2− 10 for Property 6
Full size table

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Liang, H., Mesnager, S. & Wang, M. Cryptanalysis of the AEAD and hash algorithm DryGASCON. Cryptogr. Commun. 14, 597–625 (2022). https://doi.org/10.1007/s12095-021-00542-7

Download citation

  • Received:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s12095-021-00542-7

Keywords

Mathematics Subject Classification (2010)

Search

Navigation