Mobile wireless sensor networks (MWSNs) have blended into a new application scenario to create revolutionary intelligent cities and handle numerous challenges of security, adaptability, and robustness as wireless technology has advanced. Exploiting lightweight cryptosystems is considered one of the main approaches for MWSNs to achieve confidentiality, integrity, and authentication to prevent malicious cyberattacks and resource abuses. The Saturnin lightweight cryptosystem, presented at ToSC in 2020, can be applied to protect MWSNs. No literature suggests Saturnin can defend against a ciphertext-only attack, where the attackers are the most susceptible. This study proposes the novel statistical differential fault analysis (SDFA) in this attack scenario with double distinguishers of square Chi-maximum likelihood estimate and Dice-Hamming weight. Following the experiments, it recovered the 256-bit secret key using 656 faults in the fourth-to-last round of Saturnin. Compared to the classic statistical fault analysis (SFA), the novel SDFA can expand fault injections to the deeper round and decrease the faults by half with a reliability of at least 99%. It gives an essential reference for figuring out how secure lightweight cryptosystems in MWSNs are.

With the development of wireless technology, the ubiquitous sensor networks have a profound effect on the way human interacts with computers, devices and environment. In order to reduce the potentially serious risks in the interaction, applying lightweight ciphers is effective to balance security, efficiency and convenience. Simeck is such a lightweight cipher that provides data confidentiality, authentication and integrity. It is significant to explore whether Simeck remains robust security. Up to now, the attacking assumptions of the previous security analysis of Simeck focus on the known-plaintext attack and the chosen-plaintext attack. There is no literature about Simeck against the ciphertext-only attack, which represents the weakest attacking capability of the attackers. On the assumption of the ciphertext-only attack, this paper proposes the security analysis of Simeck against the statistical fault analysis with a series of novel distinguishers of KDE, MME and MME-GF. The experimental results show that the proposed distinguishers can recover the secret key of Simeck in both decreasing faults and increasing reliability and accuracy. Thus, Simeck cannot resist against the statistical fault analysis with the proposed distinguishers. Furthermore, the good performance of these novel distinguishers can be applied on the PRESENT lightweight cipher. It offers the valuable reference for the design and analysis of the lightweight ciphers in the ubiquitous sensor networks.

Abstract In ASIACRYPT 2014, Jean et al. proposed the authentication encryption scheme Deoxys, which is one of the third-round candidates in CAESAR competition. Its internal block cipher is called Deoxys-BC that adopts the tweakey frame. Deoxys-BC has two versions of the tweakey size that are 256 bits and 384 bits, denoted by Deoxys-BC-256 and Deoxys-BC-384, respectively. In this paper, we revaluate the security of Deoxys-BC-256 against the meet-in-the-middle attack to obtain some new results. First, we append one round at the top and two rounds at the bottom of a 6-round distinguisher to form a 9-round truncated differential path with the probability of $2^{-144}$. Based on it, the adversary can attack 9-round Deoxys-BC-256 with $2^{108}$ chosen plaintext-tweaks, $2^{113.6}$ encryptions and $2^{102}$ blocks. Second, we construct a new 6.5-round distinguisher to form 10-round attacking path with the probability of $2^{-152}$. On the basis of it, the adversary could attack 10-round Deoxys-BC-256 with $2^{115}$ chosen plaintext-tweaks, $2^{171}$ encryptions and $2^{152}$ blocks. These two attacks improve the previous cryptanalytic results on reduced-round Deoxys-BC-256 against the meet-in-the-middle attack.

Abstract Kiasu-BC and Joltik-BC are internal tweakable block ciphers of authenticated encryption algorithms Kiasu and Joltik submitted to the CAESAR competition. Kiasu-BC is a 128-bit block cipher, of which tweak and key sizes are 64 and 128 bits, respectively. Joltik-BC-128 is a 64-bit lightweight block cipher supporting 128 bits tweakey. Its designers recommended the key and tweak sizes are both 64 bits. In this paper, we propose improved meet-in-the-middle attacks on 8-round Kiasu-BC, 9-round and 10-round Joltik-BC-128 by exploiting properties of their structures and using precomputation tables and the differential enumeration. For Kiasu-BC, we build a 5-round distinguisher to attack 8-round Kiasu-BC with $2^{109}$ plaintext–tweaks, $2^{112.8}$ encrytions and $2^{92.91}$ blocks. Compared with previously best known cryptanalytic results on 8-round Kiasu-BC under chosen plaintext attacks, the data and time complexities are reduced by $2^{7}$ and $2^{3.2}$ times, respectively. For the recommended version of Joltik-BC-128, we construct a 6-round distinguisher to attack 9-round Joltik-BC-128 with $2^{53}$ plaintext–tweaks, $2^{56.6}$ encryptions and $2^{52.91}$ blocks, respectively. Compared with previously best known results, the data and time complexities are reduced by $2^7$ and $2^{5.1}$ times, respectively. In addition, we present a 6.5-round distinguisher to attack 10-round Joltik-BC-128 with $2^{53}$ plaintext–tweaks, $2^{101.4}$ encryptions and $2^{76.91}$ blocks.

With the enlargement of wireless technology, Internet of Things (IoT) is emerging as a promising approach to realize smart cities and address lots of serious problems such as safety, convenience and efficiency. In order to avoid any possible rancorous attacks, employing lightweight cryptosystems is most effective to implement encryption/decryption, message authentication and digital signature for security of the IoT. LED is such a lightweight cipher with two flexible keysize variants in the IoT. Since its designing, a multitude of fault analysis techniques in chosen plaintext attacks focus on provoking faults on LED to derive the 64-bit and 128-bit secret keys. It is vital to investigate whether injecting faults allows breaking LED while the attackers have the weakest ciphertext-only attacking ability. This study presents ciphertext-only fault analysis with six different distinguishers on LED. The simulating experiments show that our analysis can recover its 64-bit and 128-bit secret keys with over 99 percent probability using the SEI, GF, GF-SEI, ML, HW and MAP distinguishers. The attack can not only improve the attacking efficiency, but also decrease the number of faults. The fault locations can be injected into the deeper round. It provides vital reference for security analysis of other lightweight ciphers in the IoT.

TWINE is a lightweight block cipher, which was proposed by NEC corporation in 2012. It is both a good example of common trade-offs in lightweight cryptography and one of the only instances of a GFN with improved diffusion layer. Therefore, its security has attracted amount of attention in recent years. In this paper, we present a meet-in-the-middle attack on 26-round TWINE-128 by exploiting the slow diffusion of key schedule. Specifically, we first construct a new 11-round distinguisher of TWINE. Based on it, we mount a meet-in-the-middle attack on 26-round TWINE-128. The data, time and memory complexities are 260 chosen plaintexts, 2126.18 26-round encryptions and 2109 64-bit blocks, respectively. Our results are better than all previous ones on TWINE-128 in the single-key scenario if not considering biclique cryptanalysis of TWINE-128.

SIMON is a new family of lightweight block ciphers proposed by the National Security Agency (NSA) in 2013. Since its publication, it has attracted much research interest and a number of analysis results have been presented. As a popular kind of implementation attack method, the fault attack also works when it is applied to SIMON. In this paper, we propose an effective fault attack on SIMON under the random byte fault model. Compared with the previous attack results, our attack can successfully recover the whole master key with injecting the faults into only one intermediate round for six instances of SIMON. In our attack, we fully utilize a class of differential propagation properties of SIMON to determine the fault injection position as long as the full diffusion of the fault has not been obtained. On the basis of it, we can recover the last round key with the differential analysis technique. The differential propagation properties make it possible to inject the faults into the earlier intermediate round at the beginning than that of the previous attacks. Meanwhile, the same faulty ciphertext set can also help to recover other round keys. So we do not have to inject the faults into any other intermediate rounds to reveal the whole master key. Moreover, in this paper we also give a detailed mathematical analysis on the average number of the fault injections under the random byte fault model. The data complexity analysis shows that less fault injections are required in our attack compared with other work under the same attack model. Finally, we also verify the effectiveness and correctness of our attack with experiments.

As an ISO/IEC international standard, Camellia has been used in various cryptographic applications. In this study, the authors present the best currently known attacks on Camellia‐192/256 with key‐dependent layers FL / FL −1 (without the whitening layers) by taking advantage of the intrinsic weakness of keyed functions, the redundancy of key schedule and the early abort technique. Specifically, the authors mount the first impossible differential attack on 13‐round Camellia‐192 with 2 124.79 chosen plaintexts, 2 186.09 13‐round encryptions and 2 129.79 bytes, while the analysis for the biggest number of rounds in previous results on Camellia‐192 worked on 12 rounds. Furthermore, the authors successfully attack on 14‐round Camellia‐256 with 2 122.14 chosen plaintexts, 2 228.33 14‐round encryptions and 2 134.14 bytes. Compared with the previously best known attack on 14‐round Camellia‐256, the time and memory complexities are reduced by 2 9.87 times and 2 46.06 times, and the data complexity is comparable.

With the advancement and deployment of leading-edge telecommunication technologies for sensing and collecting traffic related information, the vehicular ad-hoc networks (VANETs) have emerged as a new application scenario that is envisioned to revolutionize the human driving experiences and traffic flow control systems. To avoid any possible malicious attack and resource abuse, employing lightweight cryptosystems is widely recognized as one of the most effective approaches for the VANETs to achieve confidentiality, integrity and authentication. As a typical substitution-permutation network lightweight cryptosystem, LED supports 64-bit and 128-bit secret keys, which are flexible to provide security for the RFID and other highly-constrained devices in the VANETs. Since its introduction, some research of fault analysis has been devoted to attacking the last three rounds of LED. It is an open problem to know whether provoking faults at a former round of LED allows recovering the secret key. In this paper, we give an answer to this problem by showing a novel impossible differential fault analysis on one round earlier of all LED keysize variants. Mathematical analysis and simulating experiments show that the attack could recover the 64-bit and 128-bit secret keys of LED by introducing 48 faults and 96 faults in average, respectively. The result in this study describes that LED is vulnerable to a half byte impossible differential fault analysis. It will be beneficial to the analysis of the same type of other iterated lightweight cryptosystems in the VANETs.

© 2014 John Wiley & Sons, Ltd. Meet-in-the-Middle (MitM) fault analysis is a kind of powerful cryptanalytic approach suitable for various block ciphers. When applying the method to analyze the security of block ciphers, it is very crucial to find effective MitM characteristics based on some fault models. In this paper, we investigate the security of word-oriented substitution-permutation network (SPN) block ciphers by means of MitM fault analysis and observe that if the diffusion layers of the ciphers have some special properties, it is easy to derive effective MitM characteristics under the condition of single-word fault model, which can lead to efficient fault attacks on the ciphers. In order to demonstrate the effectiveness of our observation, we apply it to ARIA and AES and obtain some effective MitM characteristics, respectively; then, we present efficient MitM fault attacks on the ciphers in terms of these characteristics. It is expected that our work could be helpful in evaluating the security of word-oriented SPN block ciphers against fault attack. We also hope that this work could be beneficial to the design strategy of diffusion layers of block ciphers.

In CHES 2006, M. Amir et al. introduced a generalized method of differential fault attack (DFA) against AES-128. Their fault models cover all locations before the 9th round in AES-128. However, their method cannot be applied to AES with other key sizes, such as AES-192 and AES-256. On the differential analysis, we propose a new method to extend DFA on AES with all key sizes. Our results in this study will also be beneficial to the analysis of the same type of other iterated block ciphers.