变形ARIA密码算法的新攻击

New Attacks on a Variant ARIA Cipher

ARIA密码是韩国官方公布的分组密码标准算法,其分组长度为128比特,支持128比特、192比特、256比特3种密钥长度.该文检验变形ARIA,即采用相同S盒的ARIA算法抵抗中间相遇攻击的能力.利用ARIA算法结构,分别构造4、5、6轮变形ARIA的相遇区分器,并由此给出7轮ARIA-192、8轮ARIA-192、9轮ARIA-256的新攻击.结果表明,如果ARIA密码算法采用相同的S盒,那么其安全性将明显降低.该文还进一步说明:如果分组密码算法的非线性层与线性层组合不当,在采用时空折中方法时往往可打破数据复杂度和预处理时间复杂度等量交换的瓶颈,进而提高攻击效率.

ARIA cipher is a standard block cipher published by South Korean. Its block size is 128 bits and supports three key lengths： 128 bits, 192 bits, and 256 bits. In this paper, the security of a variant ARIA cipher using the same S boxes against the meet-in-the-middle attack is examined. Based on the structure of the cipher, we design 4-round, 5-round, and 6-round distinguishers, respectively. Moreover, some new attacks on 7-round ARIA-192, 8-round ARIA-192, and 9-round ARIA-256 are proposed. It is shown that the security of ARIA will be reduced significantly if the cipher only uses a nonlinear S box. Furthermore, if the linear and nonlinear layers are not properly combined, one can break the equivalent tradeoff between the dada complexity and the preprocess time complexity under a dada-time-memory tradeoff attack. In this case, a more effective attack may be obtained.