State-Recovery Attacks on Modified Ketje Jr

  • Thomas Fuhr ANSSI Crypto Lab 51, boulevard de La Tour-Maubourg 75700 Paris 07 SP
  • María Naya-Plasencia Inria Paris
  • Yann Rotella Inria Paris
Keywords: Ketje, Authenticated Encryption, cryptanalysis, divide-and-conquer, nonlinear sieving


In this article we study the security of the authenticated encryption algorithm Ketje against divide-and-conquer attacks. Ketje is a third-round candidate in the ongoing CAESAR competition, which shares most of its design principles with the SHA-3 hash function. Several versions of Ketje have been submitted, with different sizes for its internal state. We describe several state-recovery attacks on the smaller variant, called Ketje Jr. We show that if one increases the amount of keystream output after each round from 16 bits to 40 bits, Ketje Jr becomes vulnerable to divide-and-conquer attacks with time complexities 271.5 for the original version and 282.3 for the current tweaked version, both with a key of 96 bits. We also propose a similar attack when considering rates of 32 bits for the non-tweaked version. Our findings do not threaten the security of Ketje, but should be taken as a warning against potential future modifications that would aim at increasing the performance of the algorithm.
How to Cite
Fuhr, T., Naya-Plasencia, M., & Rotella, Y. (2018). State-Recovery Attacks on Modified Ketje Jr. IACR Transactions on Symmetric Cryptology, 2018(1), 29-56.