Practical Key-Recovery Attack on MANTIS5

Abstract

MANTIS is a lightweight tweakable block cipher published at CRYPTO 2016. In addition to the full 14-round version, MANTIS₇, the designers also propose an aggressive 10-round version, MANTIS₅. The security claim for MANTIS₅ is resistance against “practical attacks”, defined as related-tweak attacks with data complexity 2^d less than 2³⁰ chosen plaintexts (or 2⁴⁰ known plaintexts), and computational complexity at most 2^126−d. We present a key-recovery attack against MANTIS₅ with 2²⁸ chosen plaintexts and a computational complexity of about 2³⁸ block cipher calls, which violates this claim. Our attack is based on a family of differential characteristics and exploits several properties of the lightweight round function and tweakey schedule. To verify the validity of the attack, we also provide a practical implementation which recovers the full key in about 1 core hour using 2³⁰ chosen plaintexts.