分组密码SHACAL2的Biclique攻击

Biclique Cryptanalysis of Block Cipher SHACAL2

分组密码算法SHACAL2是由Handschuh等人于2002年基于标准散列函数SHA2设计的,具有较高的安全性.利用SHACAL2算法密钥生成策略与扩散层的特点,构造了SHACAL2的首18轮32维Biclique.基于构造的Biclique对完整64轮SHACAL2算法应用Biclique攻击.分析结果表明,Biclique攻击恢复64轮SHACAL2密钥的数据复杂度不超过2224已知明文,时间复杂度约为2511.18次全轮加密.与已知分析结果相比,Biclique攻击所需的数据复杂度明显降低,且计算复杂度优于穷举攻击.对全轮的SHACAL2算法,Biclique攻击是一种相对有效的攻击方法.这是首次对SHACAL2算法的单密钥全轮攻击.

SHACAL2 is a block cipher designed by Handschuh H. et al based on the standard Hash function SHA2 in 2002. It one of the European standard block ciphers, and has relatively high security because of its long block length and key length, which are 256b and 512b respectively. There have been a few security analysis results about SHACAL2, such as impossible differential cryptanalysis and related-key rectangle attack on reduced rounds of SHACAL2. Taking advantage of the characteristics of the key schedule and the permutation layer of block cipher SHACAL2, 18-round 32-dimensional Biclique of the first eight rounds of SHACAL2 is constructed. Based on the Biclique constructed, Biclique attack is applied to the whole 64-round SHACAL2. And the results show that, using Biclique attack to recover the whole 512b key information of 64-round SHACAL2, the data complexity is no more than 2224 chosen plaintexts, and the time complexity is 2511＇18 64-round encryptions. Compared with the known analysis results, the data complexity of Biclique attack decreased obviously, and the time complexity is better than exhaustive search. For whole round SHACAL2,Biclique attack is a relatively effective method. This is the first single-key attack for whole round SHACAL2.