International Association for Cryptologic Research

International Association
for Cryptologic Research


Paper: Cryptanalysis of Low-Data Instances of Full LowMCv2

Christian Rechberger , Graz University of Technology
Hadi Soleimany , Cyberspace Research Institute, Shahid Beheshti University
Tyge Tiessen , DTU Compute, Technical University of Denmark
DOI: 10.13154/tosc.v2018.i3.163-181
Search ePrint
Search Google
Presentation: Slides
Abstract: LowMC is a family of block ciphers designed for a low multiplicative complexity. The specification allows a large variety of instantiations, differing in block size, key size, number of S-boxes applied per round and allowed data complexity. The number of rounds deemed secure is determined by evaluating a number of attack vectors and taking the number of rounds still secure against the best of these. In this paper, we demonstrate that the attacks considered by the designers of LowMC in the version 2 of the round-formular were not sufficient to fend off all possible attacks. In the case of instantiations of LowMC with one of the most useful settings, namely with few applied S-boxes per round and only low allowable data complexities, efficient attacks based on difference enumeration techniques can be constructed. We show that it is most effective to consider tuples of differences instead of simple differences, both to increase the range of the distinguishers and to enable key recovery attacks. All applications for LowMC we are aware of, including signature schemes like Picnic and more recent (ring/group) signature schemes have used version 3 of the roundformular for LowMC, which takes our attack already into account.
Video from TOSC 2018
  title={Cryptanalysis of Low-Data Instances of Full LowMCv2},
  journal={IACR Transactions on Symmetric Cryptology},
  publisher={Ruhr-Universit├Ąt Bochum},
  volume={2018, Issue 3},
  author={Christian Rechberger and Hadi Soleimany and Tyge Tiessen},