Random Permutation Statistics and an Improved Slide-Determine Attack on KeeLoq

Abstract

KeeLoq is a lightweight block cipher which is extensively used in the automotive industry [7,8,14,15]. Its periodic structure, and overall simplicity makes it vulnerable to many different attacks. Only certain attacks are considered as really “practical” attacks on KeeLoq: the brute force, and several other attacks which require up to 2¹⁶ known plaintexts and are then much faster than brute force, developed by Courtois et al., [10] and (faster attack) by Dunkelman et al. [1].

On the other hand, due to the unusually small block size, there are yet many other attacks on KeeLoq, which require the knowledge of as much as about 2³² known plaintexts but are much faster still. There are many scenarios in which such attacks are of practical interest, for example if a master key can be recovered, see Section 2 in [11] for a detailed discussion. The fastest of these attacks is an attack by Courtois, Bard and Wagner from [10] that has a very low complexity of about 2²⁸ KeeLoq encryptions on average. In this paper we will propose an improved and refined attack which is faster both on average and in the best case.

We also present an exact mathematical analysis of probabilities that arise in these attacks using the methods of modern analytic combinatorics.