Paper 2020/1177

Differential Attacks on CRAFT Exploiting the Involutory S-boxes and Tweak Additions

Hao Guo, Siwei Sun, Danping Shi, Ling Sun, Yao Sun, Lei Hu, and Meiqin Wang


CRAFT is a lightweight tweakable block cipher proposed at FSE 2019, which allows countermeasures against Differential Fault Attacks to be integrated into the cipher at the algorithmic level with ease. CRAFT employs a lightweight and involutory S-box and linear layer, such that the encryption function can be turned into decryption at a low cost. Besides, the tweakey schedule algorithm of CRAFT is extremely simple, where four 64-bit round tweakeys are generated and repeatedly used. Due to a combination of these features which makes CRAFT exceedingly lightweight, we find that some input difference at a particular position can be preserved through any number of rounds if the input pair follows certain truncated differential trails. Interestingly, in contrast to traditional differential analysis, the validity of this invariant property is affected by the positions where the constant additions take place. We use this property to construct ``weak-tweakey'' truncated differential distinguishes of CRAFT in the single-key model. Subsequently, we show how the tweak additions allow us to convert these weak-tweakey distinguishers into ordinary secret-key distinguishers based on which key-recovery attacks can be performed. Moreover, we show how to construct MILP models to search for truncated differential distinguishers exploiting this invariant property. As a result, we find a 15-round truncated differential distinguisher of CRAFT and extend it to a 19-round key-recovery attack with $2^{60.99}$ data, $2^{68}$ memory, $2^{94.59}$ time complexity, and success probability 80.66%. Also, we find a 14-round distinguisher with probability $2^{-43}$ (experimentally verified), a 16-round distinguisher with probability $2^{-55}$, and a 20-round weak-key distinguisher ($2^{118}$ weak keys) with probability $2^{-63}$. Experiments on round-reduced versions of the distinguishers show that the experimental probabilities are sometimes higher than predicted. Finally, we note that our result is far from threatening the security of the full CRAFT.

Available format(s)
Secret-key cryptography
Publication info
A minor revision of an IACR publication in FSE 2021
Lightweight cryptographyTweakable block cipherInvolutoryFault detectionDifferential attackMILP
Contact author(s)
guohao @ iie ac cn
siweisun isaac @ gmail com
shidanping @ iie ac cn
lingsun @ sdu edu cn
sunyao @ iie ac cn
mqwang @ sdu edu cn
hulei @ iie ac cn
2020-09-30: received
Short URL
Creative Commons Attribution


      author = {Hao Guo and Siwei Sun and Danping Shi and Ling Sun and Yao Sun and Lei Hu and Meiqin Wang},
      title = {Differential Attacks on CRAFT Exploiting the Involutory S-boxes and Tweak Additions},
      howpublished = {Cryptology ePrint Archive, Paper 2020/1177},
      year = {2020},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.