Cryptology ePrint Archive: Report 2015/160

Differential-Linear Cryptanalysis of ICEPOLE

Tao Huang; Ivan Tjuawinata; Hongjun Wu

Abstract: ICEPOLE is a CAESAR candidate with the intermediate level of robustness under nonce misuse circumstances in the original document. In particular, it was claimed that key recovery attack against ICEPOLE is impossible in the case of nonce misuse. ICEPOLE is strong against the differential cryptanalysis and linear cryptanalysis. In this paper, we developed the differential-linear attacks against ICEPOLE when nonce is misused. Our attacks show that the state of ICEPOLE-128 and ICEPOLE-128a can be recovered with data complexity $2^{46}$ and time complexity $2^{46}$; the state of ICEPOLE-256a can be recovered with data complexity $2^{60}$ and time complexity $2^{60}$. For ICEPOLE-128a and ICEPOLE-256a, the secret key is recovered once the state is recovered. We experimentally verified the attacks against ICEPOLE-128 and ICEPOLE-128a.

Category / Keywords: ICEPOLE, Authenticated cipher, CAESAR, Differential-linear cryptanalysis

Original Publication (in the same form): IACR-FSE-2015

Date: received 25 Feb 2015

Contact author: huangtao at ntu edu sg

Available format(s): PDF | BibTeX Citation

Version: 20150227:221448 (All versions of this report)

Short URL: ia.cr/2015/160

Discussion forum: Show discussion | Start new discussion