对轻量级分组密码MIBS和I-PRESENT的非对称Biclique攻击  

Asymmetric Biclique cryptanalysis of lightweight block ciphers MIBS and I-PRESENT

作　　者：崔杰[1] 左海风 仲红[1] 

机构地区：[1]安徽大学计算机科学与技术学院,合肥230039

出　　处：《中国科学：信息科学》2017年第10期1395-1410,共16页Scientia Sinica(Informationis)

基　　金：国家自然科学基金(批准号:61502008;61572001);安徽省自然科学基金(批准号:1508085QF132)资助项目

摘　　要：安全评估在确定密码的安全边界方面一直扮演着关键的角色,其中Biclique分析就是一种寻找安全边界的方法.本文结合非对称Biclique结构和early abort技术提出了一种新的Biclique攻击技术,运用该技术对MIBS-80和I-PRESENT-128进行攻击,并且给出其安全边界.复杂度分析表明,攻击MIBS-80所需要的计算复杂度和数据复杂度分别为2^(78.62)和2^(64),攻击I-PRESENT-128所需的计算复杂度和数据复杂度分别为2^(127.07)和2^(64),与已有攻击方案对比表明,本文两种方案的计算复杂度均是最优的.由于攻击方案的总复杂度主要取决于计算复杂度,因此本方案具有一定的优势.此外,本文也是首次运用非对称Biclique方案对全轮I-PRESENT-128进行攻击.The security evaluation of lightweight block ciphers plays a critical role in determining the security margins for these ciphers. One method for finding the security margin of a block cipher is Biclique cryptanalysis. In this paper,we present a new schematic for a Biclique attack,which combines asymmetric Biclique and early-abort techniques. We then apply the proposed schematic to MIBS-80 and I-PRESENT-128 to evaluate their security margins. The cryptanalysis for MIBS-80 has a computational complexity of 278.62 and a data complexity of 264.The cryptanalysis for I-PRESENT-128 has a computational complexity of 2127.07 and a data complexity of 264.Compared to existing schemes,the computational complexity of the two schemes presented here is significantly reduced. Because the total complexity of cryptanalysis depends on the computational complexity,the proposed scheme provides significant advantages. Additionally,this study is the first to use an asymmetric Biclique to attack a full-round I-PRESENT-128.

关 键 词：轻量级分组密码 Biclique攻击 MIBS I-PRESENT 部分匹配 

分 类 号：TN918.4[电子电信—通信与信息系统]