Search

The DECT standard cipher (DSC) is a 64-bit stream cipher, which was used in the digital enhanced cordless telecommunications (DECT) standard to protect the privacy of users. The Coisel–Sanchez (CS) attack proposed by Coisel and Sanchez in CHES 2015 is the most effective cryptanalysis against the DSC cipher up to now. Based on the CS attack, we present an improved attack in which an information collection method with unknown memory is used to improve the utilization of information and the message classification technique is adopted to reduce the computation time of evaluation indexes. Meanwhile, we present an improved pre-sieving technique to avoid the computation of evaluation indexes of a large number of incorrect candidates. Our known plaintext attack requires only 2 min of communication compared to 3 min for the CS attack. By analyzing 213 keystreams, our approach is able to increase the success probability of retrieving secret key from 55–89%. As far as we know, the attack we present in this paper is the most effective one among the existing attacks to the DSC cipher.

Due to the strong security and high performance of the AES block cipher, many hash functions take AES-like structures as building blocks. To evaluate the security of these AES-like structures against differential cryptanalysis, giving the lower bounds on the number of active S-boxes in a differential trail, is an important perspective. However, the original ‘wide-trail strategy’ for AES becomes less effective to get tight bounds for these AES-like structures, because of the different state dimensions (M×M2, instead of M×M) and different round functions from AES. In this paper, we focus on a kind of AES-like structure with state dimensions M×M2, diffusion-optimal permutations and MixColumns transformations using MDS matrices. Inspired by the ‘wide-trail strategy’, we propose a theoretical method to count active S-boxes, by which we prove that there are at least rBd(Bd−1) active S-boxes in any 2r(r≥3) rounds of such an AES-like structure, where Bd is the differential branch number of the MixColumns transformation and equals to M+1. What’s more, this lower bound can be achieved by some diffusion layers. As examples, we apply our method to the LANE hash function and 3D block cipher, optimal lower bounds are both got.