International Association for Cryptologic Research

International Association
for Cryptologic Research


Paper: State-Recovery Attacks on Modified Ketje Jr

Thomas Fuhr , ANSSI Crypto Lab 51, boulevard de La Tour-Maubourg 75700 Paris 07 SP
María Naya-Plasencia , Inria Paris
Yann Rotella , Inria Paris
DOI: 10.13154/tosc.v2018.i1.29-56
Search ePrint
Search Google
Abstract: In this article we study the security of the authenticated encryption algorithm Ketje against divide-and-conquer attacks. Ketje is a third-round candidate in the ongoing CAESAR competition, which shares most of its design principles with the SHA-3 hash function. Several versions of Ketje have been submitted, with different sizes for its internal state. We describe several state-recovery attacks on the smaller variant, called Ketje Jr. We show that if one increases the amount of keystream output after each round from 16 bits to 40 bits, Ketje Jr becomes vulnerable to divide-and-conquer attacks with time complexities 271.5 for the original version and 282.3 for the current tweaked version, both with a key of 96 bits. We also propose a similar attack when considering rates of 32 bits for the non-tweaked version. Our findings do not threaten the security of Ketje, but should be taken as a warning against potential future modifications that would aim at increasing the performance of the algorithm.
  title={State-Recovery Attacks on Modified Ketje Jr},
  journal={IACR Trans. Symmetric Cryptol.},
  publisher={Ruhr-Universität Bochum},
  volume={2018, Issue 1},
  author={Thomas Fuhr and María Naya-Plasencia and Yann Rotella},