International Association for Cryptologic Research

International Association
for Cryptologic Research


Paper: Cube-Based Cryptanalysis of Subterranean-SAE

Fukang Liu , Shanghai Key Laboratory of Trustworthy Computing, East China Normal University, Shanghai, China; University of Hyogo, Hyogo, Japan
Takanori Isobe , National Institute of Information and Communications Technology, Tokyo, Japan; University of Hyogo, Hyogo, Japan
Willi Meier , University of Applied Sciences and Arts Northwestern Switzerland (FHNW), Windisch, Switzerland
DOI: 10.13154/tosc.v2019.i4.192-222
Search ePrint
Search Google
Abstract: Subterranean 2.0 designed by Daemen, Massolino and Rotella is a Round 2 candidate of the NIST Lightweight Cryptography Standardization process. In the official document of Subterranean 2.0, the designers have analyzed the state collisions in unkeyed absorbing by reducing the number of rounds to absorb the message from 2 to 1. However, little cryptanalysis of the authenticated encryption scheme Subterranean-SAE is made. For Subterranean-SAE, the designers introduce 8 blank rounds to separate the controllable input and output, and expect that 8 blank rounds can achieve a sufficient diffusion. Therefore, it is meaningful to investigate the security by reducing the number of blank rounds. Moreover, the designers make no security claim but expect a non-trivial effort to achieve full-state recovery in a nonce-misuse scenario. In this paper, we present the first practical full-state recovery attack in a nonce-misuse scenario with data complexity of 213 32-bit blocks. In addition, in a nonce-respecting scenario and if the number of blank rounds is reduced to 4, we can mount a key-recovery attack with 2122 calls to the internal permutation of Subterranean-SAE and 269.5 32-bit blocks. A distinguishing attack with 233 calls to the internal permutation of Subterranean-SAE and 233 32-bit blocks is achieved as well. Our cryptanalysis does not threaten the security claim for Subterranean-SAE and we hope it can enhance the understanding of Subterranean-SAE.
Video from TOSC 2020
  title={Cube-Based Cryptanalysis of Subterranean-SAE},
  journal={IACR Transactions on Symmetric Cryptology},
  publisher={Ruhr-Universit├Ąt Bochum},
  volume={2019, Issue 4},
  author={Fukang Liu and Takanori Isobe and Willi Meier},