improved linear analysis on block cipher multi2

ISCAS OpenIR

	improved linear analysis on block cipher multi2
	Lu Yi; Ding Liping; Wang Yongji
	2012
会议名称	11th International Conference on Cryptology and Network Security, CANS 2012
会议录名称	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
页码	72-85
会议日期	December 12, 2012 - December 14, 2012
会议地点	Darmstadt, Germany
收录类别	EI
ISSN	0302-9743
ISBN	9783642354038
部门归属	(1) National Engineering Research Center of Fundamental Software Institute of Software Chinese Academy of Sciences Beijing China
摘要	Developed by Hitachi, MULTI2 is a block cipher used mainly to secure the multimedia content. It was registered in ISO/IEC 9979 and was patented in US and Japan. MULTI2 uses the Feistel structure and operates on the 64-bit blocks. The encryption key has 256 bits. This paper studies the linear analysis on MULTI2. We give a detailed bias analysis on MULTI2 round functions. For the first time formal proofs on their bias properties are given. This allows to find a new 4-round bias 2^-2. Previously, the best 4-round bias 2^-5.7 was proposed. Using our results on the MULTI2 round functions, we propose the linear attacks on r-round MUTLI2 to recover the encryption key. Our linear attack can recover the 256-bit encryption key in time 2⁴⁶, 2 ^60.4, 2^83.8, 2^91.7, 2^123.4, 2 ^123.2 of r-round encryptions for r = 8, 12, 16, 20, 24, 28 respectively. Further, we can recover the 32-bit sub-key in last round much faster than the whole encryption key recovery, i.e., in time 2³⁷ for r = 8, 12, 16, 20, 24. Note that previously, the best linear key-recovery attack was a 20-round attack with time 2^93.4 (of 20-round encryptions) and data 2^39.2. As ISO register recommends to use at least 32 rounds, our attacks remain to be theoretical and do not threaten security for the practical use currently. © Springer-Verlag 2012.; Developed by Hitachi, MULTI2 is a block cipher used mainly to secure the multimedia content. It was registered in ISO/IEC 9979 and was patented in US and Japan. MULTI2 uses the Feistel structure and operates on the 64-bit blocks. The encryption key has 256 bits. This paper studies the linear analysis on MULTI2. We give a detailed bias analysis on MULTI2 round functions. For the first time formal proofs on their bias properties are given. This allows to find a new 4-round bias 2^-2. Previously, the best 4-round bias 2^-5.7 was proposed. Using our results on the MULTI2 round functions, we propose the linear attacks on r-round MUTLI2 to recover the encryption key. Our linear attack can recover the 256-bit encryption key in time 2⁴⁶, 2 ^60.4, 2^83.8, 2^91.7, 2^123.4, 2 ^123.2 of r-round encryptions for r = 8, 12, 16, 20, 24, 28 respectively. Further, we can recover the 32-bit sub-key in last round much faster than the whole encryption key recovery, i.e., in time 2³⁷ for r = 8, 12, 16, 20, 24. Note that previously, the best linear key-recovery attack was a 20-round attack with time 2^93.4 (of 20-round encryptions) and data 2^39.2. As ISO register recommends to use at least 32 rounds, our attacks remain to be theoretical and do not threaten security for the practical use currently. © Springer-Verlag 2012.
关键词	Network Security Recovery
语种	英语
内容类型	会议论文
URI标识	http://ir.iscas.ac.cn/handle/311060/15821
专题	中国科学院软件研究所
推荐引用方式 GB/T 7714	Lu Yi,Ding Liping,Wang Yongji. improved linear analysis on block cipher multi2[C],2012:72-85.