Paper 2021/544

Improved guess-and-determine and distinguishing attacks on SNOW-V

Jing Yang and Thomas Johansson and Alexander Maximov

Abstract

In this paper, we investigate the security of SNOW-V, demonstrating two guess-and-determine (GnD) attacks against the full version with complexities $2^{384}$ and $2^{378}$, respectively, and one distinguishing attack against a reduced variant with complexity $2^{303}$. Our GnD attacks use enumeration with recursion to explore valid guessing paths, and try to truncate as many invalid guessing paths as possible at early stages of the recursion by carefully designing the order of guessing. In our first GnD attack, we guess three 128-bit state variables, determine the remaining four using four consecutive keystream words, and finally verify the correct guess according to the next three consecutive keystream words. The second GnD attack is similar but exploits one more keystream word as side information helping to truncate more guessing paths. Our distinguishing attack targets a reduced variant where 32-bit adders are replaced with exclusive-OR. The main advantage of our distinguishing attack is that the contribution from the linear part can be cancelled locally, while classical distinguishing attacks require to combine keystream words very far away to achieve so. Thus the samples in our distinguishing attack can be collected from short keystream sequences under different (Key, IV) pairs. These attacks do not threaten SNOW-V, but provide more in-depth details for understanding its security and give new ideas for cryptanalysis of other ciphers.