INDOCRYPT 2010: Progress in Cryptology - INDOCRYPT 2010 pp 176-196

# Algebraic, AIDA/Cube and Side Channel Analysis of KATAN Family of Block Ciphers

• Gregory V. Bard
• Nicolas T. Courtois
• Jorge NakaharaJr
• Bingsheng Zhang
Conference paper

DOI: 10.1007/978-3-642-17401-8_14

Part of the Lecture Notes in Computer Science book series (LNCS, volume 6498)
Cite this paper as:
Bard G.V., Courtois N.T., Nakahara J., Sepehrdad P., Zhang B. (2010) Algebraic, AIDA/Cube and Side Channel Analysis of KATAN Family of Block Ciphers. In: Gong G., Gupta K.C. (eds) Progress in Cryptology - INDOCRYPT 2010. INDOCRYPT 2010. Lecture Notes in Computer Science, vol 6498. Springer, Berlin, Heidelberg

## Abstract

This paper presents the first results on AIDA/cube, algebraic and side-channel attacks on variable number of rounds of all members of the KATAN family of block ciphers. Our cube attacks reach 60, 40 and 30 rounds of KATAN32, KATAN48 and KATAN64, respectively. In our algebraic attacks, we use SAT solvers as a tool to solve the quadratic equations representation of all KATAN ciphers. We introduced a novel pre-processing stage on the equations system before feeding it to the SAT solver. This way, we could break 79, 64 and 60 rounds of KATAN32, KATAN48, KATAN64, respectively. We show how to perform side channel attacks on the full 254-round KATAN32 with one-bit information leakage from the internal state by cube attacks. Finally, we show how to reduce the attack complexity by combining the cube attack with the algebraic attack to recover the full 80-bit key. Further contributions include new phenomena observed in cube, algebraic and side-channel attacks on the KATAN ciphers. For the cube attacks, we observed that the same maxterms suggested more than one cube equation, thus reducing the overall data and time complexities. For the algebraic attacks, a novel pre-processing step led to a speed up of the SAT solver program. For the side-channel attacks, 29 linearly independent cube equations were recovered after 40-round KATAN32. Finally, the combined algebraic and cube attack, a leakage of key bits after 71 rounds led to a speed up of the algebraic attack.

### Keywords

algebraic cube side-channel attacks cryptanalysis lightweight block ciphers for RFID tags

## Authors and Affiliations

• Gregory V. Bard
• 1
• Nicolas T. Courtois
• 2
• Jorge NakaharaJr
• 3