约减轮数分组密码LEA的差分分析  

Differential Analysis of Reduced Rounds Block Cipher LEA

作　　者：李艳俊 李寅霜[2] 刘健 王克 LI Yanjun;LI Yinshuang;LIU Jian;WANG Ke(Information Industry Information Security Evaluation Center,The 15th Research Institute of China Electronics Technology Group Corporation,Beijing 100083,China;Beijing Institute of Electronic Science and technology,Beijing 100070,China)

机构地区：[1]中国电子科技集团公司第十五研究所信息产业信息安全测评中心,北京100083 [2]北京电子科技学院,北京100070

出　　处：《电子与信息学报》2023年第10期3737-3744,共8页Journal of Electronics & Information Technology

基　　金：北京高校“高精尖”学科建设项目(20210101Z0401)。

摘　　要：LEA算法是面向软件的轻量级加密算法,在2019年成为ISO/IEC国际标准轻量级加密算法,具有快速加密、占用运算资源少等优点。该文基于多条输入输出差分相同的路径计算了差分概率,首次对LEA-128进行了13轮和14轮的密钥恢复攻击;采用提前抛弃技术,分别在12轮和13轮差分特征后面添加了1轮,恢复了96 bit密钥;其中13轮的密钥恢复攻击数据复杂度为2^(98)个明文,时间复杂度为2^(86.7)次13轮LEA-128解密;14轮的密钥恢复攻击数据复杂度为2118个明文,时间复杂度为2^(110.6)次14轮LEA-128解密。The LEA algorithm is a software-oriented lightweight encryption algorithm,which became the ISO/IEC international standard lightweight encryption algorithm in 2019.It has the advantages of fast encryption and less computing resources.The differential probability is calculated based on multiple paths with the same input-output difference,13 and 14 rounds of key recovery attacks of LEA-128 are given for the first time.Using the early abort technology,one round is added after the 12-round and 13-round differential characteristic,and a total of 96 bit keys are recovered.The 13-round key recovery attack has a data complexity of 2^(98) plaintext and a time complexity of 286.7 times of 13 rounds of LEA-128 decryption;the 14-round key recovery attack has a data complexity of 2^(118) plaintext and a time complexity of 2^(110.6) times of 14 rounds of LEA-128 decryption.

关 键 词：轻量级分组密码 ARX 差分分析 密钥恢复攻击 

分 类 号：TN918.1[电子电信—通信与信息系统] TP309.2[电子电信—信息与通信工程]