基于概率线性等式的立方攻击
Utilizing Probabilistic Linear Equations in Cube Attacks
-
摘要: 立方攻击由Dinur和Shamir在2009年欧密会上提出,它已经被证明是一种有效的攻击流密码的手段。在经典立方攻击中,攻击者利用线性方程组进行密钥恢复攻击。然而,我们发现此前文献中公开的许多线性等式实际上是非线性的,因而不符合经典立方攻击的理论框架。而且,经典立方攻击难以运用到线性等式较少的情形。因此,充分利用那些能被线性等式有效逼近的等式具有重要意义。在本文中,我们提出了一种测试并利用这些概率线性等式的方法,从而将立方攻击进行扩展。具体地,我们用标准的参数估计方法以及序贯概率比测试进行离线阶段的线性测试,用极大似然译码方法进行在线阶段的概率线性方程组求解。作为示例,我们提出了一个针对672轮Trivium的新的立方攻击,且需要穷搜的密钥比特减少了7个。Abstract: Cube attacks, proposed by Dinur and Shamir at EUROCRYPT 2009, have shown huge power against stream ciphers. In the original cube attacks, a linear system of secret key bits is exploited for key recovery attacks. However, we find a number of equations claimed linear in previous literature actually nonlinear and not fit into the theoretical framework of cube attacks. Moreover, cube attacks are hard to apply if linear equations are rare. Therefore, it is of significance to make use of probabilistic linear equations, namely nonlinear superpolys that can be approximated by linear expressions effectively. In this paper, we suggest a way to test out and utilize these probabilistic linear equations, thus extending cube attacks to a wider scope. Concretely, we employ the standard parameter estimation approach and the sequential probability ratio test (SPRT) for linearity test in the preprocessing phase, and use maximum likelihood decoding (MLD) for solving the probabilistic linear equations in the online phase. As an application, we exhibit our new attack against 672 rounds of Trivium and reduce the number of key bits to search by 7.