Observations on the Security of COMET. (22nd May 2021) - Xu, Zheng; Li, Yongqiang; Wang, Mingsheng
Abstract: This paper investigates the security of counter mode encryption with authentication tag (COMET), one of the 32 second-round candidates in National Institute of Standards and Technology's lightweight cryptography standardization process, against differential cryptanalysis. CHAM-64/128 is a block cipher chosen as one of the underlying block ciphers in COMET for hardware-oriented applications, and a differential characteristic with a high probability for CHAM-64/128 is useful for forgery attacks on COMET. However, we find that the optimal 39 -round differential characteristic for CHAM-64/128 proposed by Roh et al., which is the longest differential characteristic of CHAM-64/128, is invalid. Then, we propose a new method of distinguishing an m -bit block cipher from an m -bit random permutation using a differential characteristic with a probability not higher than 2^-m . Using our method, we use two 39 -round differential characteristics with a probability of 2^-64 for CHAM-64/128 to distinguish 39 -round-reduced CHAM-64/128 from a 64 -bit random permutation, respectively. Furthermore, we refine the probabilities of two differentials with the same input and output differential masks as the two 39 -round differential characteristics, respectively. Finally, we present the first forgery attacks on COMET with the two differentials without using weak keys. Our forgery attacks follow the nonce-misuse scenario. It should be noticed that this attack does not invalidate the security claims of the designers.