Cryptanalysis of MORUS

Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 11273)


MORUS is a high-performance authenticated encryption algorithm submitted to the CAESAR competition, and recently selected as a finalist. There are three versions of MORUS: MORUS-640 with a 128-bit key, and MORUS-1280 with 128-bit or 256-bit keys. For all versions the security claim for confidentiality matches the key size. In this paper, we analyze the components of this algorithm (initialization, state update and tag generation), and report several results.

As our main result, we present a linear correlation in the keystream of full MORUS, which can be used to distinguish its output from random and to recover some plaintext bits in the broadcast setting. For MORUS-1280, the correlation is \(2^{-76}\), which can be exploited after around \(2^{152}\) encryptions, less than what would be expected for a 256-bit secure cipher. For MORUS-640, the same attack results in a correlation of \(2^{-73}\), which does not violate the security claims of the cipher.

To identify this correlation, we make use of rotational invariants in MORUS using linear masks that are invariant by word-rotations of the state. This motivates us to introduce single-word versions of MORUS called MiniMORUS, which simplifies the analysis. The attack has been implemented and verified on MiniMORUS, where it yields a correlation of \(2^{-16}\).

We also study reduced versions of the initialization and finalization of MORUS, aiming to evaluate the security margin of these components. We show a forgery attack when finalization is reduced from 10 steps to 3, and a key-recovery attack in the nonce-misuse setting when initialization is reduced from 16 steps to 10. These additional results do not threaten the full MORUS, but studying all aspects of the design is useful to understand its strengths and weaknesses.


MORUS CAESAR Authenticated encryption Nonce respecting Linear cryptanalysis Confidentiality 



The results presented here were originally found during the Flexible Symmetric Cryptography workshop held at the Lorentz Center in Leiden, Netherlands. The authors would like to thank Meltem Sonmez Turan, who participated in the initial discussion. The second author was supported by the European Union’s H2020 grant 644052 (HECTOR). The fourth and sixth authors are partially supported by the French Agence Nationale de la Recherche through the BRUTUS project under Contract ANR-14-CE28-0015. The fifth author was supported by EPSRC Grant EP/M013472/1.

Supplementary material


  1. 1.
    AlFardan, N.J., Bernstein, D.J., Paterson, K.G., Poettering, B., Schuldt, J.C.N.: On the security of RC4 in TLS. In: USENIX Security Symposium 2013, pp. 305–320. USENIX Association (2013)Google Scholar
  2. 2.
    Ashur, T., et al.: Cryptanalysis of MORUS. Cryptology ePrint Archive, Report 2018/464 (2018).
  3. 3.
    Ashur, T., Rijmen, V.: On linear hulls and trails. In: Dunkelman, O., Sanadhya, S.K. (eds.) INDOCRYPT 2016. LNCS, vol. 10095, pp. 269–286. Springer, Cham (2016). Scholar
  4. 4.
    CAESAR Committee: CAESAR: Competition for authenticated encryption: security, applicability, and robustness. Call for submissions (2013).
  5. 5.
    Duong, T., Rizzo, J.: Here come the \(\oplus \) ninjas. Ekoparty (2011)Google Scholar
  6. 6.
    Dwivedi, A.D., Klouček, M., Morawiecki, P., Nikolić, I., Pieprzyk, J., Wójtowicz, S.: SAT-based cryptanalysis of authenticated ciphers from the CAESAR competition. Cryptology ePrint Archive, Report 2016/1053 (2016).
  7. 7.
    Dwivedi, A.D., Morawiecki, P., Wójtowicz, S.: Differential and rotational cryptanalysis of round-reduced MORUS. In: Samarati, P., Obaidat, M.S., Cabello, E. (eds.) E-Business and Telecommunications - ICETE/SECRYPT 2017, pp. 275–284. SciTePress (2017)Google Scholar
  8. 8.
    Dworkin, M.J.: NIST SP 800–38D: Recommendation for block cipher modes of operation: Galois/Counter Mode (GCM) and GMAC. National Institute of Standards and Technology (NIST) Special Publication (SP) (2007).
  9. 9.
    Kales, D., Eichlseder, M., Mendel, F.: Note on the robustness of CAESAR candidates. IACR Cryptology ePrint Archive, Report 2017/1137 (2017).
  10. 10.
    Mantin, I., Shamir, A.: A practical attack on broadcast RC4. In: Matsui, M. (ed.) FSE 2001. LNCS, vol. 2355, pp. 152–164. Springer, Heidelberg (2002). Scholar
  11. 11.
    Matsui, M.: Linear cryptanalysis method for DES cipher. In: Helleseth, T. (ed.) EUROCRYPT 1993. LNCS, vol. 765, pp. 386–397. Springer, Heidelberg (1994). Scholar
  12. 12.
    Matsui, M., Yamagishi, A.: A new method for known plaintext attack of FEAL cipher. In: Rueppel, R.A. (ed.) EUROCRYPT 1992. LNCS, vol. 658, pp. 81–91. Springer, Heidelberg (1993). Scholar
  13. 13.
    McGrew, D.A., Viega, J.: The security and performance of the Galois/Counter Mode (GCM) of operation. In: Canteaut, A., Viswanathan, K. (eds.) INDOCRYPT 2004. LNCS, vol. 3348, pp. 343–355. Springer, Heidelberg (2004). Scholar
  14. 14.
    Mileva, A., Dimitrova, V., Velichkov, V.: Analysis of the authenticated cipher MORUS (v1). In: Pasalic, E., Knudsen, L.R. (eds.) BalkanCryptSec 2015. LNCS, vol. 9540, pp. 45–59. Springer, Cham (2016). Scholar
  15. 15.
    Minaud, B.: Linear biases in AEGIS keystream. In: Joux, A., Youssef, A. (eds.) SAC 2014. LNCS, vol. 8781, pp. 290–305. Springer, Cham (2014). Scholar
  16. 16.
    Salam, M.I., Simpson, L., Bartlett, H., Dawson, E., Pieprzyk, J., Wong, K.K.: Investigating cube attacks on the authenticated encryption stream cipher MORUS. In: IEEE Trustcom/BigDataSE/ICESS 2017, pp. 961–966. IEEE (2017)Google Scholar
  17. 17.
    Shi, T., Guan, J., Li, J., Zhang, P.: Improved collision cryptanalysis of authenticated cipher MORUS. In: Artificial Intelligence and Industrial Engineering - AIIE 2016. Advances in Intelligent Systems Research, vol. 133, pp. 429–432. Atlantis Press (2016)Google Scholar
  18. 18.
    Vaudenay, S., Vizár, D.: Under pressure: security of CAESAR candidates beyond their guarantees. Cryptology ePrint Archive, Report 2017/1147 (2017).
  19. 19.
    Wu, H., Huang, T.: The authenticated cipher MORUS (v2). Submission to CAESAR: competition for authenticated encryption. Security, applicability, and robustness (Round 3 and Finalist), September 2016.
  20. 20.
    Wu, H., Preneel, B.: AEGIS: a fast authenticated encryption algorithm. In: Lange, T., Lauter, K., Lisoněk, P. (eds.) SAC 2013. LNCS, vol. 8282, pp. 185–201. Springer, Heidelberg (2014). Scholar
  21. 21.
    Wu, H., Preneel, B.: AEGIS: A fast authenticated encryption algorithm (v1.1). Submission to CAESAR: Competition for Authenticated Encryption. Security, Applicability, and Robustness (Round 3 and Finalist), September 2016.

Copyright information

© International Association for Cryptologic Research 2018

Authors and Affiliations

  1. 1.imec-COSICKU LeuvenLeuvenBelgium
  2. 2.Graz University of TechnologyGrazAustria
  3. 3.InriaParisFrance
  4. 4.Royal Holloway University of LondonEghamUK
  5. 5.NTTTokyoJapan
  6. 6.Radboud UniversityNijmegenNetherlands
  7. 7.CopenhagenDenmark

Personalised recommendations