变形ARIA密码算法的新攻击  

New Attacks on a Variant ARIA Cipher

作　　者：韦永壮[1,2] 苏崇茂[1] 马春波[1] 

机构地区：[1]桂林电子科技大学广西信息科学实验中心,广西桂林541004 [2]中国科学院软件研究所,北京100190

出　　处：《应用科学学报》2013年第6期650-654,共5页Journal of Applied Sciences

基　　金：国家自然科学基金(No.61100185);广西自然科学基金(No.2011GXNSFB018071);广西无线宽带通信与信号处理重点实验室(桂林电子科技大学)主任基金(No.11101);保密通信重点实验室基金(No.9140C110404110C1106);中国博士后科学基金(No.2011M500419)资助

摘　　要：ARIA密码是韩国官方公布的分组密码标准算法,其分组长度为128比特,支持128比特、192比特、256比特3种密钥长度.该文检验变形ARIA,即采用相同S盒的ARIA算法抵抗中间相遇攻击的能力.利用ARIA算法结构,分别构造4、5、6轮变形ARIA的相遇区分器,并由此给出7轮ARIA-192、8轮ARIA-192、9轮ARIA-256的新攻击.结果表明,如果ARIA密码算法采用相同的S盒,那么其安全性将明显降低.该文还进一步说明:如果分组密码算法的非线性层与线性层组合不当,在采用时空折中方法时往往可打破数据复杂度和预处理时间复杂度等量交换的瓶颈,进而提高攻击效率.ARIA cipher is a standard block cipher published by South Korean. Its block size is 128 bits and supports three key lengths： 128 bits, 192 bits, and 256 bits. In this paper, the security of a variant ARIA cipher using the same S boxes against the meet-in-the-middle attack is examined. Based on the structure of the cipher, we design 4-round, 5-round, and 6-round distinguishers, respectively. Moreover, some new attacks on 7-round ARIA-192, 8-round ARIA-192, and 9-round ARIA-256 are proposed. It is shown that the security of ARIA will be reduced significantly if the cipher only uses a nonlinear S box. Furthermore, if the linear and nonlinear layers are not properly combined, one can break the equivalent tradeoff between the dada complexity and the preprocess time complexity under a dada-time-memory tradeoff attack. In this case, a more effective attack may be obtained.

关 键 词：分组密码 ARIA算法 中间相遇攻击 时间复杂度 

分 类 号：TN918.1[电子电信—通信与信息系统]