Orr Dunkelman

From ESC2013
Jump to: navigation, search

Title: New Directions in Dividing: Le Fabuleux Destin d'MISTY1 (The Case of MISTY1)

Abstract: MISTY1 is a block cipher designed by Matsui in 1997. It is widely deployed in Japan where it is an e-government standard, and is recognized internationally as a NESSIE-recommended cipher as well as an ISO standard and an RFC. Moreover, MISTY1 was selected to be the blueprint on top of which KASUMI, the GSM/3G block cipher, was based. Since its introduction, and especially in recent years, MISTY1 was subjected to extensive cryptanalytic efforts, which resulted in numerous attacks on its reduced variants. Most of these attacks aimed at maximizing the number of attacked rounds, and as a result, their complexities are highly impractical.

In this work we pursue another direction, by focusing on attacks with a practical time complexity. The best previously-known attacks with practical complexity against MISTY1 could break either 4 rounds (out of 8), or 5 rounds in a modified variant in which some of the $FL$ functions are removed. We present an attack on 5-round MISTY1 with all the $FL$ functions present whose time complexity is $2^{38}$ encryptions. When the $FL$ functions are removed, we present a devastating related-key attack on the full 8-round variant, requiring only $2^{18}$ data and time.

While our attacks clearly do not compromise the security of the full MISTY1, they expose several weaknesses in MISTY1's components, and improve our understanding of its security. Moreover, future designs which rely on MISTY1 as their base, should take these issues into close consideration.

Joint talk with Nathan Keller.

slides