TY - GEN
T1 - Weak keys of the full MISTY1 block cipher for related-key differential cryptanalysis
AU - Lu, Jiqiang
AU - Yap, Wun She
AU - Wei, Yongzhuang
PY - 2013
Y1 - 2013
N2 - The MISTY1 block cipher has a 64-bit block length, a 128-bit user key and a recommended number of 8 rounds. It is a Japanese CRYPTREC-recommended e-government cipher, a European NESSIE selected cipher, and an ISO international standard. Despite of considerable cryptanalytic efforts during the past fifteen years, there has been no published cryptanalytic attack on the full MISTY1 cipher algorithm. In this paper, we present a related-key differential attack on the full MISTY1 under certain weak key assumptions: We describe 2 103.57 weak keys and a related-key differential attack on the full MISTY1 with a data complexity of 261 chosen ciphertexts and a time complexity of 290.93 encryptions. For the first time, our result exhibits a cryptographic weakness in the full MISTY1 cipher (when used with the recommended 8 rounds), and shows that the MISTY1 cipher is distinguishable from an ideal cipher and thus cannot be regarded to be an ideal cipher.
AB - The MISTY1 block cipher has a 64-bit block length, a 128-bit user key and a recommended number of 8 rounds. It is a Japanese CRYPTREC-recommended e-government cipher, a European NESSIE selected cipher, and an ISO international standard. Despite of considerable cryptanalytic efforts during the past fifteen years, there has been no published cryptanalytic attack on the full MISTY1 cipher algorithm. In this paper, we present a related-key differential attack on the full MISTY1 under certain weak key assumptions: We describe 2 103.57 weak keys and a related-key differential attack on the full MISTY1 with a data complexity of 261 chosen ciphertexts and a time complexity of 290.93 encryptions. For the first time, our result exhibits a cryptographic weakness in the full MISTY1 cipher (when used with the recommended 8 rounds), and shows that the MISTY1 cipher is distinguishable from an ideal cipher and thus cannot be regarded to be an ideal cipher.
KW - Block cipher
KW - Differential cryptanalysis
KW - MISTY1
KW - Related-key cryptanalysis
KW - Weak key
UR - https://www.scopus.com/pages/publications/84874307068
U2 - 10.1007/978-3-642-36095-4_25
DO - 10.1007/978-3-642-36095-4_25
M3 - 会议稿件
AN - SCOPUS:84874307068
SN - 9783642360947
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 389
EP - 404
BT - Topics in Cryptology, CT-RSA 2013 - The Cryptographers' Track at the RSA Conference 2013, Proceedings
T2 - Cryptographers' Track at the RSA Conference 2013, CT-RSA 2013
Y2 - 25 February 2013 through 1 March 2013
ER -