标题：Conditional Cube Attack on Reduced-Round Keccak Sponge Function
作者：Huang, Senyang; Wang, Xiaoyun; Xu, Guangwu; Wang, Meiqin; Zhao, Jingyuan
作者机构：[Huang, Senyang; Wang, Xiaoyun] Tsinghua Univ, Inst Adv Study, Beijing 100084, Peoples R China.; [Wang, Xiaoyun; Wang, Meiqin] Shandong Univ, Minist 更多
会议名称：36th Annual International Conference on the Theory and Applications of Cryptographic Techniques (EUROCRYPT)
会议日期：APR 30-MAY 04, 2017
来源：ADVANCES IN CRYPTOLOGY - EUROCRYPT 2017, PT II
关键词：Keccak-MAC; Keyak; Cube tester; Conditional cube variable; Ordinary cube; variable
摘要：The security analysis of Keccak, the winner of SHA-3, has attracted considerable interest. Recently, some attention has been paid to the analysis of keyed modes of Keccak sponge function. As a notable example, the most efficient key recovery attacks on Keccak-MAC and Keyak were reported at EUROCRYPT'15 where cube attacks and cube-attack-like cryptanalysis have been applied. In this paper, we develop a new type of cube distinguisher, the conditional cube tester, for Keccak sponge function. By imposing some bit conditions for certain cube variables, we are able to construct cube testers with smaller dimensions. Our conditional cube testers are used to analyse Keccak in keyed modes. For reduced-round Keccak-MAC and Keyak, our attacks greatly improve the best known attacks in key recovery in terms of the number of rounds or the complexity. Moreover, our new model can also be applied to keyless setting to distinguish Keccak sponge function from random permutation. We provide a searching algorithm to produce the most efficient conditional cube tester by modeling it as an MILP (mixed integer linear programming) problem. As a result, we improve the previous distinguishing attacks on Keccak sponge function significantly. Most of our attacks have been implemented and verified by desktop computers. Finally we remark that our attacks on the reduced-round Keccak will not threat the security margin of Keccak sponge function.