Improved Meet-in-the-Middle Attacks on Reduced-Round Deoxys-BC-256. (22nd June 2020) - Liu, Ya; Shi, Bing; Gu, Dawu; Zhao, Fengyu; Li, Wei; Liu, Zhiqiang
Abstract: In ASIACRYPT 2014, Jean et al. proposed the authentication encryption scheme Deoxys, which is one of the third-round candidates in CAESAR competition. Its internal block cipher is called Deoxys-BC that adopts the tweakey frame. Deoxys-BC has two versions of the tweakey size that are 256 bits and 384 bits, denoted by Deoxys-BC-256 and Deoxys-BC-384, respectively. In this paper, we revaluate the security of Deoxys-BC-256 against the meet-in-the-middle attack to obtain some new results. First, we append one round at the top and two rounds at the bottom of a 6-round distinguisher to form a 9-round truncated differential path with the probability of 2^-144 . Based on it, the adversary can attack 9-round Deoxys-BC-256 with 2^108 chosen plaintext-tweaks, 2^113.6 encryptions and 2^102 blocks. Second, we construct a new 6.5-round distinguisher to form 10-round attacking path with the probability of 2^-152 . On the basis of it, the adversary could attack 10-round Deoxys-BC-256 with 2^115 chosen plaintext-tweaks, 2^171 encryptions and 2^152 blocks. These two attacks improve the previous cryptanalytic results on reduced-round Deoxys-BC-256 against the meet-in-the-middle attack.