Gain: Practical Key-Recovery Attacks on Round-reduced PAEQ

This work presents practical key-recovery attacks on round-reduced variants of CAESAR Round 2 candidate PAEQ by analyzing it in the light of guess-and-determine analysis. The attack developed here targets the mode of operation along with diffusion inside the AES based internal permutation AESQ. The first attack uses a guess-and-invert technique leading to a meet-in-the-middle attack that is able to recover the key for 6 out of the 20 rounds of paeq-64/80/128 with reduced key entropy of \(1,2^{16}\) and \(2^{32}\) respectively. The second analysis extends the attack to 7 rounds using a invert-and-guess strategy which results in reduced key-space of \(2^{24},2^{32}\) and \(2^{40}\) for the same PAEQ variants. Finally, an 8-round attack is mounted using a guess-invert-guess strategy which works on any of the three variants with a complexity of \(2^{48}\). Moreover, unlike the CICO attack mounted by the designers which works with only AESQ, our 8-round attack additionally takes into account the mode of operation of PAEQ.

1. 1.

   It is understood that here 2|n.

2. 2.

   The unknown byte of the input column.

3. 3.

   Except the last branch when the last message block is incomplete. This is because for last incomplete block output is further truncated resulting in loss of information available to the attacker.

Authors and Affiliations

1. Crypto Research Lab, Department of Computer Science and Engineering, IIT Kharagpur, Kharagpur, India

   Dhiman Saha, Sourya Kakarla, Srinath Mandava & Dipanwita Roy Chowdhury

Corresponding author

Correspondence to Dhiman Saha .

Editors and Affiliations

1. Universities of Paris 8 and Paris 13, LAGA, Paris, France

   Claude Carlet

2. University of Waterloo, Waterloo, Ontario, Canada

   M. Anwar Hasan

3. CRRao AIMSCS, Hyderabad, India

   Vishal Saraswat

Reprints and permissions

© 2016 Springer International Publishing AG

Policies and ethics