We study quantum superposition attacks against permutation‐based pseudorandom cryptographic schemes. We first extend Kuwakado and Morii’s attack against the Even–Mansour cipher and exhibit key recovery attacks against a large class of pseudorandom schemes based on a single call to an n ‐bit permutation, with polynomial O ( n ) (or O ( n 2 ), if the concrete cost of Hadamard transform is also taken in) quantum steps. We then consider schemes, namely, two permutation‐based pseudorandom cryptographic schemes. Using the improved Grover‐meet‐Simon method, we show that the keys of a wide class of schemes can be recovered with O ( n ) superposition queries (the complexity of the original is O ( n 2 n /2 )) and O ( n 2 n /2 ) quantum steps. We also exhibit subclasses of “degenerated” schemes that lack certain internal operations and exhibit more efficient key recovery attacks using either the Simon’s algorithm or collision searching algorithm. Further, using the all‐subkeys‐recovery idea of Isobe and Shibutani, our results give rise to key recovery attacks against several recently proposed permutation‐based PRFs, as well as the two‐round Even–Mansour ciphers with generic key schedule functions and their tweakable variants. From a constructive perspective, our results establish new quantum Q2 security upper bounds for two permutation‐based pseudorandom schemes as well as sound design choices.

At CRYPTO 2017 and IEEE Transactions on Computers in 2018, Todo et al. proposed the division property based cube attack method making it possible to launch cube attacks with cubes of dimensions far beyond practical reach. However, assumptions are made to validate their attacks. In this paper, we further formulate the algebraic properties of the superpoly in one framework to facilitate cube attacks in more successful applications: we propose the “flag” technique to enhance the precision of MILP models, which enable us to identify proper non-cube IV assignments; a degree evaluation algorithm is presented to upper bound the degree of the superpoly s.t. the superpoly can be recovered without constructing its whole truth table and overall complexity of the attack can be largely reduced; we provide a divide-and-conquer strategy to Trivium-like stream ciphers namely Trivium, Kreyvium, TriviA-SC1/2 so that the large scale MILP models can be split into several small solvable ones enabling us to analyze Trivium-like primitives with more than 1000 initialization rounds; finally, we provide a term enumeration algorithm for finding the monomials of the superpoly, so that the complexity of many attacks can be further reduced. We apply our techniques to attack the initialization of several ciphers namely 839-round Trivium, 891-round Kreyvium, 1009-round TriviA-SC1, 1004-round TriviA-SC2, 184-round Grain-128a and 750-round Acorn respectively.

Camellia is one of the widely used block ciphers, which has been included in the NESSIE block cipher portfolio and selected as a standard by ISO/IEC. In this study, the authors observe that there exist some interesting properties of the FL / FL −1 functions in Camellia. With this observation they derive some weak keys for the cipher, based on which they present the first known 8‐round zero‐correlation linear distinguisher of Camellia with FL / FL −1 layers. This result shows that the FL / FL −1 layers inserted in Camellia cannot resist zero‐correlation linear cryptanalysis effectively for some weak keys since the currently best zero‐correlation linear distinguisher for Camellia without FL / FL −1 layers also covers eight rounds. Moreover, by using the novel distinguisher, they launch key recovery attacks on 13‐round Camellia‐192 and 14‐round Camellia‐256. To their knowledge, these results are the best for Camellia‐192 and Camellia‐256 with FL / FL −1 and whitening layers.

As an ISO/IEC international standard, Camellia has been used in various cryptographic applications. In this study, the authors present the best currently known attacks on Camellia‐192/256 with key‐dependent layers FL / FL −1 (without the whitening layers) by taking advantage of the intrinsic weakness of keyed functions, the redundancy of key schedule and the early abort technique. Specifically, the authors mount the first impossible differential attack on 13‐round Camellia‐192 with 2 124.79 chosen plaintexts, 2 186.09 13‐round encryptions and 2 129.79 bytes, while the analysis for the biggest number of rounds in previous results on Camellia‐192 worked on 12 rounds. Furthermore, the authors successfully attack on 14‐round Camellia‐256 with 2 122.14 chosen plaintexts, 2 228.33 14‐round encryptions and 2 134.14 bytes. Compared with the previously best known attack on 14‐round Camellia‐256, the time and memory complexities are reduced by 2 9.87 times and 2 46.06 times, and the data complexity is comparable.

In this study, the authors present the first related‐key rectangle cryptanalysis of Rijndael‐160/160 and Rijndael‐192/192. The author's attack on Rijndael‐160/160 covers eight rounds. The attack complexities are 2 126.5 chosen plaintexts, 2 129.28 8‐round Rijndael‐160/160 encryptions and 2 132.82 bytes. Their attack on Rijndael‐192/192 covers ten rounds. It requires 2 179 chosen plaintexts, 2 181.09 10‐round Rijndael‐192/192 encryptions and 2 185.59 bytes memory. These are the currently best cryptanalytic results on Rijndael‐160/160 and Rijndael‐192/192 in terms of the number of attacked rounds. Furthermore, their results show that the slow diffusion in the key schedule of Rijndael makes it a target for this type of analysis.

© 2014 John Wiley & Sons, Ltd. Meet-in-the-Middle (MitM) fault analysis is a kind of powerful cryptanalytic approach suitable for various block ciphers. When applying the method to analyze the security of block ciphers, it is very crucial to find effective MitM characteristics based on some fault models. In this paper, we investigate the security of word-oriented substitution-permutation network (SPN) block ciphers by means of MitM fault analysis and observe that if the diffusion layers of the ciphers have some special properties, it is easy to derive effective MitM characteristics under the condition of single-word fault model, which can lead to efficient fault attacks on the ciphers. In order to demonstrate the effectiveness of our observation, we apply it to ARIA and AES and obtain some effective MitM characteristics, respectively; then, we present efficient MitM fault attacks on the ciphers in terms of these characteristics. It is expected that our work could be helpful in evaluating the security of word-oriented SPN block ciphers against fault attack. We also hope that this work could be beneficial to the design strategy of diffusion layers of block ciphers.