TY - JOUR AU - Zhao, Boxin AU - Dong, Xiaoyang AU - Jia, Keting PY - 2019/09/20 Y2 - 2024/03/28 TI - New Related-Tweakey Boomerang and Rectangle Attacks on Deoxys-BC Including BDT Effect JF - IACR Transactions on Symmetric Cryptology JA - ToSC VL - 2019 IS - 3 SE - Articles DO - 10.13154/tosc.v2019.i3.121-151 UR - https://tosc.iacr.org/index.php/ToSC/article/view/8360 SP - 121-151 AB - <p>In the CAESAR competition, Deoxys-I and Deoxys-II are two important authenticated encryption schemes submitted by Jean <em>et al. </em>Recently, Deoxys-II together with Ascon, ACORN, AEGIS-128, OCB and COLM have been selected as the final CAESAR portfolio. Notably, Deoxys-II is also the primary choice for the use case “Defense in depth”. However, Deoxys-I remains to be one of the third-round candidates of the CAESAR competition. Both Deoxys-I and Deoxys-II adopt Deoxys-BC-256 and Deoxys-BC-384 as their internal tweakable block ciphers.<br>In this paper, we investigate the security of round-reduced Deoxys-BC-256/-384 and Deoxys-I against the related-tweakey boomerang and rectangle attacks with some new boomerang distinguishers. For Deoxys-BC-256, we present 10-round related-tweakey boomerang and rectangle attacks for the popular setting (|<em>tweak</em>|<em>, </em>|<em>key</em>|) = (128<em>, </em>128), which reach one more round than the previous attacks in this setting. Moreover, an 11-round related-tweakey rectangle attack on Deoxys-BC-256 is given for the first time. We also put forward a 13-round related-tweakey boomerang attack in the popular setting (|<em>tweak</em>|<em>, </em>|<em>key</em>|) = (128<em>, </em>256) for Deoxys-BC-384, while the previous attacks in this setting only work for 12 rounds at most. In addition, the first 14-round relatedtweakey rectangle attack on Deoxys-BC-384 is given when (|<em>tweak</em>| <em>&lt; </em>98<em>, </em>|<em>key</em>| <em>&gt; </em>286), that attacks one more round than before. Besides, we give the first 10-round rectangle attack on the authenticated encryption mode Deoxys-I-128-128 with one more round than before, and we also reduce the complexity of the related-tweakey rectangle attack on 12-round Deoxys-I-256-128 by a factor of 2<sup>28</sup>. Our attacks can not be applied to (round-reduced) Deoxys-II.</p> ER -