基于Nonce重用的ACORN v3状态恢复攻击  

State recovery attack on ACORN v3 in nonce-reuse setting

作　　者：张国双 陈晓 林东岱[1,2] 刘凤梅 ZHANG Guoshuang;CHEN Xiao;LIN Dongdai;LIU Fengmei(Institute of Information Engineering,Chinese Academy of Sciences,Beijing 100093,China;School of Cyber Security,University of Chinese Academy of Sciences,Beijing 100049,China;Science and Technology on Information Assurance Laboratory,Beijing 100072,China)

机构地区：[1]中国科学院信息工程研究所,北京100093 [2]中国科学院大学网络空间安全学院,北京100049 [3]信息保障技术重点实验室,北京100072

出　　处：《通信学报》2020年第8期11-21,共11页Journal on Communications

基　　金：国家自然科学基金资助项目(No.61872040);“十三五”国家密码发展基金资助项目(No.MMJJ20170201);北京市自然科学基金资助项目(No.4202070)。

摘　　要：基于差分代数方法,利用猜测确定技术给出了Nonce重用两次情况下ACORN v3的状态恢复攻击,攻击所需的计算复杂度为2122.5c,数据复杂度和存储复杂度可忽略不计,其中c是求解线性方程组的复杂度。针对Nonce多次重用时的情形进行了分析,发现ACORN v3较复杂的滤波函数,使由密钥流直接提取关于内部状态线性方程的方法变得不可行,从而有效规避了通过增加Nonce重用次数来显著降低攻击复杂度的安全风险。Based on differential-algebraic method and guess-and-determine technique,the state recovery attack of ACORN v3 was presented when one pair of key and Nonce was used to encrypt two messages.The time complexity of the attack was 2122.5c,where c was the time complexity of solving linear equations.The data complexity and the storage complexity were negligible.Furthermore,according to the analysis on the sense of multiple nonce reuse,it is found that relatively complicated filter function of ACORN v3 makes it infeasible to extract the linear equations about the internal state directly from key streams.Thus,the risk of significantly reducing the attack complexity by increasing the times of nonce reuse can be effectively avoided.

关 键 词：认证加密 密码分析 ACORN 状态恢复攻击 

分 类 号：TN918.1[电子电信—通信与信息系统]