Clustering Related-Tweak Characteristics: Application to MANTIS-6

Abstract

The TWEAKEY/STK construction is an increasingly popular approach for designing tweakable block ciphers that notably uses a linear tweakey schedule. Several recent attacks have analyzed the implications of this approach for differential cryptanalysis and other attacks that can take advantage of related tweakeys. We generalize the clustering approach of a recent differential attack on the tweakable block cipher MANTIS₅ and describe a tool for efficiently finding and evaluating such clusters. More specifically, we consider the set of all differential characteristics compatible with a given truncated characteristic, tweak difference, and optional constraints for the differential. We refer to this set as a semi-truncated characteristic and estimate its probability by analyzing the distribution of compatible differences at each step. We apply this approach to find a semi-truncated differential characteristic for MANTIS₆ with probability about 2^−67.73 and derive a key-recovery attack with a complexity of about 2^55.09 chosen-plaintext queries and 2^55.52 computations. The data-time product is 2^110.61 << 2¹²⁶.