Cryptology ePrint Archive: Report 2016/532

Cryptanalysis of GOST2

Tomer Ashur and Achiya Bar-On and Orr Dunkelman

Abstract: GOST 28147 is a 256-bit key 64-bit block cipher developed by the USSR, later adopted by the Russian government as a national standard. In 2010, GOST was suggested to be included in ISO-18033, but was rejected due to weaknesses found in its key schedule.

In 2015, a new version of GOST was suggested with the purpose of mitigating such attacks. In this paper, we show that similar weaknesses exist in the new version as well. More specifically, we present a fixed-point attack on the full cipher with time complexity of $2^{237}$ encryptions. We also present reflection which improves on exhaustive search by a factor of $2e$ attack with time complexity of $2^{192}$ for a key that is chosen from a class of $2^{224}$ weak keys. Finally, we discuss an impossible reflection attack and several possible related-key attacks.

Category / Keywords: secret-key cryptography / Block ciphers, cryptanalysis, GOST, GOST2, reflection attack, fixed-point attack, related-key attack, impossible reflection attack

Original Publication (in the same form): IACR-FSE-2017

Date: received 30 May 2016, last revised 23 Feb 2017

Contact author: tashur at esat kuleuven be

Available format(s): PDF | BibTeX Citation

Version: 20170223:170204 (All versions of this report)

Short URL:

Discussion forum: Show discussion | Start new discussion

[ Cryptology ePrint archive ]