Improved Distinguishing Attacks on HC-256
نویسندگان
چکیده
The software-efficient stream cipher HC-256 was proposed by Wu at FSE 2004. Due to its impressive performance, the cipher was also a well-received entrant to the ECRYPT eSTREAM competition. The closely related stream cipher HC-128, also designed by Wu, went on to find a place in the final portfolio of the eSTREAM contest. The cipher HC-256 is word-oriented, with 32 bits in each word, and uses a 256-bit key and a 256-bit IV. Since HC-256 was published in 2004, barring a cache-timing analysis of unprotected implementations, there has not been any attack on the cipher. This paper makes two contributions. First, we build a class of distinguishers on HC-256, each of which requires testing the validity of about 2 linear equations involving binary keystream variables. Thereby, our attacks improve the data complexity of the hitherto best-known distinguisher (presented by the designer along with the specifications of the cipher) by a factor of about 12. We also present another observation that, we believe, can be further exploited to build more efficient distinguishing attacks on the cipher. It is hoped that the results of this paper would also find use in future security evaluations of the closely-related ciphers HC-128 and HC-256’.
منابع مشابه
Cache Timing Analysis of HC-256
In this paper, we describe an abstract model of cache timing attacks that can be used for designing ciphers. We then analyse HC-256 under this model, demonstrating a cache timing attack under certain strong assumptions. From the observations made in our analysis, we derive a number of design principles for hardening ciphers against cache timing attacks.
متن کاملA Cache Timing Analysis of HC-256
In this paper, we describe a cache-timing attack against the stream cipher HC-256, which is the strong version of eStream winner HC128. The attack is based on an abstract model of cache timing attacks that can also be used for designing stream ciphers. From the observations made in our analysis, we derive a number of design principles for hardening ciphers against cache timing attacks.
متن کاملImproved distinguishers for HC-128
HC-128 is an eSTREAM final portfolio stream cipher. Several authors have investigated its security and, in particular, distinguishing attacks have been considered. Still, no one has been able to provide a distinguisher stronger than the one presented by Wu in the original HC128 paper. In this paper we first argue that the keystream requirement in Wu’s original attack is underestimated by a fact...
متن کاملDistinguishing Attacks on T-Functions
Klimov and Shamir proposed a new class of simple cryptographic primitives named T-functions. For two concrete proposals based on the squaring operation, a single word T-function and a previously unbroken multi-word T-function with a 256-bit state, we describe an efficient distinguishing attack having a 2 data complexity. Furthermore, Hong et al. recently proposed two fully specified stream ciph...
متن کاملCryptanalysis and Design of Stream Ciphers
This thesis presents some novel results on the cryptanalysis and design of stream ciphers. The first part of the thesis introduces various stream ciphers design and cryptanalysis techniques. The second part of the thesis gives the cryptanalysis of seven stream ciphers. The properties of addition are exploited in the cryptanalysis of two stream ciphers: the differential-linear cryptanalysis agai...
متن کامل