Welcome to the resource topic for 2023/1212
Title:
CLRW1$^{3} is not Secure Beyond the Birthday Bound: Breaking TNT with {O(2^{n/2})}$ queries
Authors: Mustafa Khairallah
Abstract:In this paper, we present a new distinguisher for the Tweak-aNd-Tweak (TNT) tweakable block cipher with O(2^{n/2}) complexity. The distinguisher is an adaptive chosen ciphertext distinguisher, unlike previous attacks that are only non-adaptive chosen plaintext attacks. However, the attack contradicts the security claims made by the designers. Given TNT can be seen as the three-round CLRW1 tweakable block cipher, our attack matches its more conservative bound. We provide the distinguisher description, a probabilistic analysis of its behaviour, experimental verification and an analysis of why the proof fails to capture the security of TNT. In summary, the distinguisher is based on collision counting and exploits non-uniformity in the statistical behaviour of random permutations. It reduces the goal of finding the collision to solving a difference equation defined over a random permutation. Due to this relation, the number of collisions observed by the distinguisher is twice as expected from an ideal tweakable block cipher.
ePrint: https://eprint.iacr.org/2023/1212
See all topics related to this paper.
Feel free to post resources that are related to this paper below.
Example resources include: implementations, explanation materials, talks, slides, links to previous discussions on other websites.
For more information, see the rules for Resource Topics .