Cryptanalysis of CTC2
CTC is a toy cipher designed in order to assess the strength of algebraic attacks. While the structure of CTC is deliberately weak with respect to algebraic attacks, it was claimed by the designers that CTC is secure with respect to statistical attacks, such as differential and linear cryptanalysis. After a linear attack on CTC was presented, the cipher’s linear transformation was tweaked to offer more diffusion, and specifically to prevent the existence of 1-bit to 1-bit approximations (and differentials) through the linear transformation. The new cipher was named CTC2, and was analyzed by the designers using algebraic techniques.
In this paper we analyze the security of CTC2 with respect to differential and differential-linear attacks. The data complexities of our best attacks on 6-round, 7-round, and 8-round variants of CTC2 are 64, 215, and 237 chosen plaintexts, respectively, and the time complexities are dominated by the time required to encrypt the data.
Our findings show that the diffusion of CTC2 is relatively low, and hence variants of the cipher with a small number of rounds are relatively weak, which may explain (to some extent) the success of the algebraic attacks on these variants.
KeywordsTime Complexity Linear Approximation Linear Transformation Block Cipher Stream Cipher
Unable to display preview. Download preview PDF.
- 8.Nicolas, T.: Courtois, How Fast can be Algebraic Attacks on Block Ciphers?, IACR ePrint report 2006/168 (2006)Google Scholar
- 9.Courtois, N.T.: Algebraic Attacks On Block Ciphers. In: Dagstuhl seminar on Symmetric Cryptography (January 2007)Google Scholar
- 10.Courtois, N.T.: CTC2 and Fast Algebraic Attacks on Block Ciphers Revisited, IACR ePrint report 2007/152 (2007)Google Scholar
- 14.Dunkelman, O., Keller, N.: Linear Cryptanalysis of CTC, IACR ePrint report 2006/250 (2006)Google Scholar
- 16.Faugére, J.-C., Perret, L.: Algebraic Cryptanalysis of Curry and Flurry using Correlated Messages, IACR ePrint report 2008/402 (2008)Google Scholar
- 17.Langford, S.K.: Differential-Linear Cryptanalysis and Threshold Signatures, Ph.D. thesis (1995)Google Scholar