Cryptanalysis of AEGIS‐128

Chinese Journal of ElectronicsVolume 31, Issue 2 p. 285-292 Information Security and CryptologyOpen Access Cryptanalysis of AEGIS-128 Tairong SHI, Corresponding Author Tairong SHI [email protected] PLA SSF Information and Engineering University, Zhengzhou, 450001 China Institute of Software, Chinese Academy of Sciences, Beijing, 100190 ChinaSearch for more papers by this authorBin HU, Corresponding Author Bin HU [email protected] PLA SSF Information and Engineering University, Zhengzhou, 450001 ChinaSearch for more papers by this authorJie GUAN, Corresponding Author Jie GUAN [email protected] PLA SSF Information and Engineering University, Zhengzhou, 450001 ChinaSearch for more papers by this authorSenpeng WANG, Corresponding Author Senpeng WANG [email protected] PLA SSF Information and Engineering University, Zhengzhou, 450001 ChinaSearch for more papers by this author Tairong SHI, Corresponding Author Tairong SHI [email protected] PLA SSF Information and Engineering University, Zhengzhou, 450001 China Institute of Software, Chinese Academy of Sciences, Beijing, 100190 ChinaSearch for more papers by this authorBin HU, Corresponding Author Bin HU [email protected] PLA SSF Information and Engineering University, Zhengzhou, 450001 ChinaSearch for more papers by this authorJie GUAN, Corresponding Author Jie GUAN [email protected] PLA SSF Information and Engineering University, Zhengzhou, 450001 ChinaSearch for more papers by this authorSenpeng WANG, Corresponding Author Senpeng WANG [email protected] PLA SSF Information and Engineering University, Zhengzhou, 450001 ChinaSearch for more papers by this author First published: 01 March 2022 https://doi.org/10.1049/cje.2020.00.231 This work was supported by the National Natural Science Foundation of China (61672509, 61602514, 61802437, 61902428, 62102448, 62072445). AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract AEGIS, an authenticated encryption (AE) algorithm designed by H. J. Wu and B. Preneel, is one of the six winners of the Competition for Authenticated Encryption: Security, Applicability, and Robustness, which was launched by the National Institute of Standards and Technology. In this paper, we comprehensively investigate the existence of collision in the initialization of AEGIS-128 and evaluate the number of advanced encryption standard (AES) round functions involved in initialization, which reflects the resistance to differential attack. As a result, we find that there are 40 AES round functions, which is less than 50 ones claimed in the design document. We also prove that AEGIS-128 is strong enough to resist adversary who has access to partial state. In particular, we present a collision-based distinguisher and exploit it to recover the key of 4-step and 5-step (out of the full 10) AEGIS-128. The time and memory complexities are about 2 29.7 and 2 26 respectively. Specifically, we quantize the attack of 4-step AEGIS-128, in which we solve the technical issue of dealing with the function that does not fulfill Simon's promise. It is noted that the nonce is not reused in our work. Although we present some results of AEGIS-128 that exceed the existed analysis, the security margin of AEGIS-128 remains large. I. Introduction The authenticated encryption (AE) scheme[1], simultaneously providing confidentiality and authenticity, is widely used in communication systems. The CAESAR competition (the Competition for Authenticated Encryption: Security, Applicability, and Robustness)[2], launched by the National Institute of Standards and Technology (NIST), was announced in 2013. The competition tasked with developing secure, efficient and reliable AE algorithms that offer advantages over AES-GCM[3]. In March 2018, the seven finalists from the third round were announced. The finalists are ACORN, Ascon, AEGIS, Deoxys, COLM superseded AES-COPA and ElmD, and OCB. These finalists have drawn extensive attention from the global cryptography research community[4-7] and needed further analysis. In particular, MORUS was left out of the six winners for the attacks proposed in Ref.[8]. In this work, our target is one of the six winners – AEGIS[9], which provides three main variants: AEGIS-128, AEGIS-256 and AEGIS-128L. In fact, AEGIS was first introduced at SAC 2013[10], it already inspired other encryption designs, including PAES[11] and Tiaoxin[12]. AEGIS is constructed from AES encryption round function. Parallel AES round functions make it suitable for fast software implementation using AES-NI and hardware implementation. The computational cost of AEGIS is about half than that of AES. 1. Related work According to the analysis provided by the designers, AEGIS with a large state and update function including 5 AES-round functions would ensure the security of the key. Furthermore, it is extremely difficult to apply statistical attack, differential attack and collision attack. Indeed, AEGIS provides a large security margin against several types of attacks in nonce-respecting setting. It can be reflected by the published results of AEGIS. In Ref.[13], Minaud constructed linear biases of 2 − 77 and 2 − 89 in the keystream of AEGIS-128 and AEGIS-256, while those would require 2 140 and 2 188 data separately. Dey et al.[14] proposed differential fault analysis of AEGIS family in a nonce-reuse setting. They showed that the internal states of AEGIS-128, AEGIS-256 and AEGIS-128L can be recovered with 384, 512 and 512 single-bit faults respectively. An AEGIS scheme that could be used to moderate DoS attacks in web applications was proposed by Mary and Begum[15]. Shi et al.[16] provided two new types of weak states in AEGIS-256 and AEGIS-128L with probability 2 − 384 and 2 − 512 separately. Eichlseder et al.[17] proposed improved keystream approximations and derived upper bounds below 2 − 128 for the squared correlation contribution of any single suitable linear characteristic for the AEGIS family. 2. Our contributions Our analysis focuses on the initialization of AEGIS-128, and AEGIS refers to AEGIS-128 in the rest of this paper. Our contributions are shown as follows: 1) We devote to searching the collision and discussing the resistance against differential attack in terms of the number of AES round functions. By exploring the details of internal state in each step of AEGIS, we find that the second block of 4-step AEGIS exists a collision with probability 1. The collision is independent with AES function and the value of key. Hence, we can construct a collision-based distinguisher. Furthermore, we discuss the number of AES round functions involved in internal state and keystream and obtain results different from that of design document. These results reveal that the growth rate of the number of AES round function involved in IV is not as fast as expected. 2) We reconsider the security margin in the worst case that the collision position can be detected. For 4-step AEGIS, we recover the s by checking whether the output difference is zero on the second block state or not. In classical setting, the collision s can be directly recovered byte by byte. In quantum setting, we recover the collision by Simon's algorithm, in which we solve the technique issue that the collision form is far from the promise of Simon's algorithm. Based on the collision distinguisher, we realize the key recovery attack on 4-step AEGIS. For 5-step AEGIS, we further propose a new distinguisher by eliminating the partial output difference and checking the remained output difference. The right collision s leads to a specific output difference function and the s can be determined. Based on it, we launch the key recovery of 5-step AEGIS in classical setting. Both attacks on 4-step and 5-step AEGIS reduce to recovering key from the collision s where s = K ⊕ R ( K ⊕ c 1 ) ( R is the AES function without key addition and c 1 is a constant). We denote the process by Recover( K), and solve it by the technique of guess-and-determine. Moreover the complexities of our attacks mainly depend on Recover( K), where the time complexity is 2 58 and the memory complexity is 2 28 56-bit blocks required to store the candidates in the guess process. The success rate is 1 in all attacks. 3. Organizations of the paper The rest of this paper is organized as follows. The specification of AEGIS is given in Section II. Section III describes the collision in 4-step AEGIS and discusses the number of AES round functions involved in internal state. Section IV is devoted to the key recovery attacks of 4-step and 5-step AEGIS. We conclude the paper in Section V. II. Description of AEGIS In AEGIS, the internal state is 640-bit wide, the key is 128-bit wide, and the plaintext is divided in blocks of 128 bits. The internal state of AEGIS consists of five 128-bit substates, and the substates of step i are denoted by S 0 i , S 1 i , S 2 i , S 3 i , S 4 i . The state update function updates the 640-bit internal state with an 128-bit message block m i , S i + 1 = StateUpdate ( S i , m i ) It is given as follows: S 0 i + 1 = S 0 i ⊕ R ( S 4 i ) ⊕ m i S 1 i + 1 = S 1 i ⊕ R ( S 0 i ) S 2 i + 1 = S 2 i ⊕ R ( S 1 i ) S 3 i + 1 = S 3 i ⊕ R ( S 2 i ) S 4 i + 1 = S 4 i ⊕ R ( S 3 i ) where R denotes a single round of AES function without key addition. The state update function is described in Fig.1. Fig. 1Open in figure viewerPowerPoint The state update function of AEGIS The AEGIS initialization receives K and I V as inputs, and the initial state is loading as follows: S 0 0 = K ⊕ IV S 1 0 = c 1 S 2 0 = c 0 S 3 0 = K ⊕ c 0 S 4 0 = K ⊕ c 1 where c 0 , c 1 are two fixed constants. After loading the initial state, AEGIS runs the state update function for 10 steps with the K and I V being used as message for i = 0 to 9 , S i + 1 = StateUpdate ( S i , m i ) where for i = 0 to 4 , m 2 i = K , m 2 i + 1 = K ⊕ I V . At each step of the encryption, an 128-bit plaintext block P i is used to update the internal state and the ciphertext is output as C i = S 1 i ⊕ S 4 i ⊕ ( S 2 i & S 3 i ) ⊕ P i S i + 1 = StateUpdate ( S i , P i ) III. Collision Analysis of AEGIS We present the particular internal state in the first 4 steps of AEGIS, and show how the key-dependent collision occurs. 1. State description of the first 4 steps The main idea of the analysis is to find the definite relationship between IV and the internal state by differential analysis. We regard IV as the input x, and a differential is given by an input difference Δ x and a state difference Δ S . Before giving the specific expressions, we present some notations for readability. The polynomials R ( K ⊕ x ) ⊕ R ( x ⊕ R ( K ⊕ c 1 ) ) and R ( c 1 ⊕ R ( K ⊕ x ) ) often appear in the internal state. For simplicity, we define u x = R ( K ⊕ x ) ⊕ R ( x ⊕ R ( K ⊕ c 1 ) ) (1) v x = R ( c 1 ⊕ R ( K ⊕ x ) ) (2) In addition, we denote the values without information of x as I i ( i = 1 , 2 , 3 , … , 9 ) , as shown in Table 1. Table 1. Corresponding values of I i ( 0 ≤ i ≤ 9 ) I i ( 0 ≤ i ≤ 9 ) Values I 0 c 0 ⊕ R ( c 1 ) I 1 K ⊕ c 0 ⊕ R ( c 0 ) I 2 K ⊕ c 1 ⊕ R ( K ⊕ c 0 ) I 3 I 1 ⊕ R ( I 0 ) I 4 I 2 ⊕ R ( I 1 ) I 5 K ⊕ R ( K ⊕ c 1 ) ⊕ R ( I 2 ) I 6 I 5 ⊕ K ⊕ R ( I 4 ) I 7 I 4 ⊕ R ( I 3 ) I 8 I 6 ⊕ K ⊕ R ( I 7 ) I 9 c 1 ⊕ R ( I 5 ) ⊕ R ( I 6 ) Therefore, we can summarize all polynomials involved x in three forms: x, u x and v x . According to the update function, we can derive the expressions of all substates, as shown in Table 2, which are clearer than the original. Table 2. Expressions of each substate in the initialization of AEGIS i-step m i S 0 i S 1 i S 2 i S 3 i S 4 i 0 K K ⊕ x c 1 c 0 K ⊕ c 0 K ⊕ c 1 1 K ⊕ x x ⊕ R ( K ⊕ c 1 ) c 1 ⊕ R ( K ⊕ x ) I 0 I 1 I 2 2 K I 5 c 1 ⊕ u x I 0 ⊕ v x I 3 I 4 3 K ⊕ x I 6 u x ⊕ c 1 ⊕ R ( I 5 ) v x ⊕ R ( c 1 ⊕ u x ) ⊕ I 0 I 3 ⊕ R ( I 0 ⊕ v x ) I 7 4 K x ⊕ I 8 u x ⊕ I 9 I 0 ⊕ v x ⊕ R ( c 1 ⊕ u x ) ⊕ R ( c 1 ⊕ R ( I 5 ) ⊕ u x ) I 3 ⊕ R ( I 0 ⊕ v x ) ⊕ R ( I 0 ⊕ v x ⊕ R ( c 1 ⊕ u x ) ) I 7 ⊕ R ( I 3 ⊕ R ( I 0 ⊕ v x ) ) Let us consider the Table 2 with the number of AES round functions that I V and K involved. We sum up the feature by "the growth rate of AES round function." • The third row shows the state after running 1 steps. Three substates i.e. S 0 1 , S 1 1 and S 4 1 include the AES function, in which the key K involved; while only one substate S 1 1 includes the AES function involved IV. • The fourth row shows the state after running 2 steps. Four substates i.e. S 0 2 , S 1 2 , S 2 2 and S 4 2 include the AES function involved the key K; while two substates S 1 2 and S 2 2 include the AES function involved IV. Similarly, we analyze the rest and deduce the result that the growth rate of K is faster than that of IV. To prevent the difference in the internal state from eliminating in the middle of initialization, AEGIS injects the IV repeatedly in the message as K ⊕ I V into the state for 5 times. Indeed, a differential attack against the initialization would be more difficult than exhaustive key search. However the elimination happened exactly for the IV loading repeatedly. 2. State collision in 4-step (2 and 3-step respectively) AEGIS We surprisingly find that u x is periodic, leading to a collision in the subsequent steps. We number the 16 bytes of each 128-bit word by usual ordering: 1 5 9 13 2 6 10 14 3 7 11 15 4 8 12 16 Theorem 1 For 4-step (2 and 3-step respectively) AEGIS, if the input difference on initialization vector is Δ I V = K ⊕ R ( K ⊕ c 1 ) , then the output difference on the internal state will be Δ S 1 4 = 0 ( Δ S 1 2 = 0 , Δ S 1 3 = 0 respectively) with probability 1. Proof From Eq.(1), we know u x = u ( x ) = R ( K ⊕ x ) ⊕ R ( x ⊕ R ( K ⊕ c 1 ) ) . Let s = K ⊕ R ( K ⊕ c 1 ) , then we have: u ( x ⊕ s ) = R ( K ⊕ x ⊕ s ) ⊕ R ( x ⊕ s ⊕ R ( K ⊕ c 1 ) ) = R ( K ⊕ x ⊕ K ⊕ R ( K ⊕ c 1 ) ) ⊕ R ( x ⊕ K ⊕ R ( K ⊕ c 1 ) ⊕ R ( K ⊕ c 1 ) ) = R ( x ⊕ R ( K ⊕ c 1 ) ) ⊕ R ( K ⊕ x ) = u ( x ) This implies that u x is periodic with s = K ⊕ R ( K ⊕ c 1 ) . Since S 1 4 = u x ⊕ I 9 , S 1 2 = c 1 ⊕ u x and S 1 3 = u x ⊕ c 1 ⊕ R ( I 5 ) , the output difference must be 0 with probability 1 when the input difference Δ x = K ⊕ R ( K ⊕ c 1 ) . As described above, we are interested in the relationship between the output difference and the key. Now we know that for an unknown K and s = K ⊕ R ( K ⊕ c 1 ) , the following characteristic is satisfied for Δ x → p Δ u x : s → p = 1 0 To filter s from other input differences that Δ x ≠ s , we should consider the number of solutions that the corresponding output difference Δ u x = 0 . In fact, u x can be viewed as the sum of two AES round functions. Fig.2 illustrates the differential when the input difference is introduced in the first byte x [ 1 ] . Fig. 2Open in figure viewerPowerPoint Differential of u x when Δ x = ( Δ x [ 1 ] , 0 , … , 0 ) Let S ( · ) be the AES S-Box operation. The output difference Δ S 1 4 = 0 so that the following equation involved the variable Δ x [ 1 ] is established: S ( x [ 1 ] ⊕ K [ 1 ] ) ⊕ S ( x [ 1 ] ⊕ K [ 1 ] ⊕ Δ x [ 1 ] ) ⊕ S ( x [ 1 ] ⊕ R ( K ⊕ c 1 ) [ 1 ] ) ⊕ S ( x [ 1 ] ⊕ R ( K ⊕ c 1 ) [ 1 ] ⊕ Δ x [ 1 ] ) = 0 where R ( K ⊕ c 1 ) [ 1 ] represents the first byte of R ( K ⊕ c 1 ) . According to the differential property of AES S-box[18], it has one solution in average for fixed x and K and we know Δ x [ 1 ] = s [ 1 ] satisfying it. In this way, we obtain a collision distinguisher. 3. The number of AES round functions in the initialization of AEGIS Along the way, we summary the following Table 3 about the number of AES round functions that involved in internal state in the longer versions AEGIS. Table 3. The max number of AES round functions in different step of AEGIS i-step S 0 i S 1 i S 2 i S 3 i S 4 i Total number This paper Ref.[8] 6 5 6 2 3 4 20 − 7 5 6 7 3 4 25 − 8 5 6 7 8 4 30 − 9 5 6 7 8 9 35 − 10 10 6 7 8 9 40 50 For the full version AEGIS (10 steps), if there is a difference in IV, the difference would pass through 10 AES round functions at most, and there are 10 + 6 + 7 + 8 + 9 = 40 AES round functions in the full 640-bit state and 6 + 7 + 8 + 9 = 30 AES round functions involved in the first 128-bit keystream. Those results are inconsistent with the following statement in the design document: "In AEGIS-128, there are 50 AES round functions (10 steps) in the initialization. If there is a difference in IV, the difference would pass through more than 10 AES round functions." We think this kind of contradiction is caused by loading the I V and K repeatedly, which does not live up to the expectation. IV. Key Recovery Attack on Collision Detection-Based Step-Reduced AEGIS We evaluate the security of AEGIS with a strong assumption that the adversary can detect partial state during application. In particular, we mount key recovery attacks on 4-step AEGIS in classical and quantum settings respectively. 1. Key recovery attack in classical setting In classical setting, we have the access to one 128-bit block state S 1 4 . We take the recovery process of s [ 1 , 2 , 3 , 4 ] , for example: Step 1 Guess possible value of 32-bit s [ 1 , 2 , 3 , 4 ] ; Step 2 Choose pairs of I V , IV * satisfying Δ I V [ 1 , 2 , 3 , 4 ] = s [ 1 , 2 , 3 , 4 ] and the rest fixed; Step 3 Run the AEGIS for 4 steps and get the output difference Δ S 1 4 = S 1 4 * ⊕ S 1 4 ; Step 4 If the output difference Δ S 1 4 = 0 , the guess of s [ 1 , 2 , 3 , 4 ] is probable correct and terminates; otherwise the guess is invalid, go back to Step 1. After one execution of the above process, which takes 2 32 AEGIS calls at most, the value of 32-bit s [ 1 , 2 , 3 , 4 ] would yield the equations involved K 1 = K [ 1 , 2 , 3 , 4 , 6 , 11 , 16 ] as Eq.(3). K [ 1 ] ⊕ { 02 } · S K [ 1 ] ⊕ c 1 [ 1 ] ⊕ { 03 } · S K [ 6 ] ⊕ c 1 [ 6 ] ⊕ S K [ 11 ] ⊕ c 1 [ 11 ] ⊕ S K [ 16 ] ⊕ c 1 [ 16 ] = s [ 1 ] K [ 2 ] ⊕ S K [ 1 ] ⊕ c 1 [ 1 ] ⊕ { 02 } · S K [ 6 ] ⊕ c 1 [ 6 ] ⊕ { 03 } · S K [ 11 ] ⊕ c 1 [ 11 ] ⊕ S K [ 16 ] ⊕ c 1 [ 16 ] = s [ 2 ] K [ 3 ] ⊕ S K [ 1 ] ⊕ c 1 [ 1 ] ⊕ S K [ 6 ] ⊕ c 1 [ 6 ] ⊕ { 02 } · S K [ 11 ] ⊕ c 1 [ 11 ] ⊕ { 03 } · S K [ 16 ] ⊕ c 1 [ 16 ] = s [ 3 ] K [ 4 ] ⊕ { 03 } · S K [ 1 ] ⊕ c 1 [ 1 ] ⊕ S K [ 6 ] ⊕ c 1 [ 6 ] ⊕ S K [ 11 ] ⊕ c 1 [ 11 ] ⊕ { 02 } · S K [ 16 ] ⊕ c 1 [ 16 ] = s [ 4 ] (3) To obtain all 128 key bits, we just shift the position of possible difference to Δ I V [ 5 , 6 , 7 , 8 ] , Δ I V [ 9 , 10 , 11 , 12 ] and Δ I V [ 13 , 14 , 15 , 16 ] . Then the other three sets of equations about K 2 = K [ 5 , 6 , 7 , 8 , 10 , 15 , 4 ] , K 3 = K [ 9 , 10 , 11 , 12 , 14 , 3 , 8 ] and K 4 = K [ 13 , 14 , 15 , 16 , 2 , 7 , 12 ] were determined by Eqs.4-6. However, it is still difficult to obtain the key because there are 7 bytes unknown variables involved in each 4 sets of equations. We denote this phase by Recover( K), and solve it by guess-and-determine. Then it can be summarized as below: K [ 5 ] ⊕ { 02 } · S K [ 5 ] ⊕ c 1 [ 5 ] ⊕ { 03 } · S K [ 10 ] ⊕ c 1 [ 10 ] ⊕ S K [ 15 ] ⊕ c 1 [ 15 ] ⊕ S K [ 4 ] ⊕ c 1 [ 4 ] = s [ 5 ] K [ 6 ] ⊕ S K [ 5 ] ⊕ c 1 [ 5 ] ⊕ { 02 } · S K [ 10 ] ⊕ c 1 [ 10 ] ⊕ { 03 } · S K [ 15 ] ⊕ c 1 [ 15 ] ⊕ S K [ 4 ] ⊕ c 1 [ 4 ] = s [ 6 ] K [ 7 ] ⊕ S K [ 5 ] ⊕ c 1 [ 5 ] ⊕ S K [ 10 ] ⊕ c 1 [ 10 ] ⊕ { 02 } · S K [ 15 ] ⊕ c 1 [ 15 ] ⊕ { 03 } · S K [ 4 ] ⊕ c 1 [ 4 ] = s [ 7 ] K [ 8 ] ⊕ { 03 } · S K [ 5 ] ⊕ c 1 [ 5 ] ⊕ S K [ 10 ] ⊕ c 1 [ 10 ] ⊕ S K [ 15 ] ⊕ c 1 [ 15 ] ⊕ { 02 } · S K [ 4 ] ⊕ c 1 [ 4 ] = s [ 8 ] (4) K [ 9 ] ⊕ { 02 } · S K [ 9 ] ⊕ c 1 [ 9 ] ⊕ { 03 } · S K [ 14 ] ⊕ c 1 [ 14 ] ⊕ S K [ 3 ] ⊕ c 1 [ 3 ] ⊕ S K [ 8 ] ⊕ c 1 [ 8 ] = s [ 9 ] K [ 10 ] ⊕ S K [ 9 ] ⊕ c 1 [ 9 ] ⊕ { 02 } · S K [ 14 ] ⊕ c 1 [ 14 ] ⊕ { 03 } · S K [ 3 ] ⊕ c 1 [ 3 ] ⊕ S K [ 8 ] ⊕ c 1 [ 8 ] = s [ 10 ] K [ 11 ] ⊕ S K [ 9 ] ⊕ c 1 [ 9 ] ⊕ S K [ 14 ] ⊕ c 1 [ 14 ] ⊕ { 02 } · S K [ 3 ] ⊕ c 1 [ 3 ] ⊕ { 03 } · S K [ 8 ] ⊕ c 1 [ 8 ] = s [ 11 ] K [ 12 ] ⊕ { 03 } · S K [ 9 ] ⊕ c 1 [ 9 ] ⊕ S K [ 14 ] ⊕ c 1 [ 14 ] ⊕ S K [ 3 ] ⊕ c 1 [ 3 ] ⊕ { 02 } · S K [ 8 ] ⊕ c 1 [ 8 ] = s [ 12 ] (5) K [ 13 ] ⊕ { 02 } · S K [ 13 ] ⊕ c 1 [ 13 ] ⊕ { 03 } · S K [ 2 ] ⊕ c 1 [ 2 ] ⊕ S K [ 7 ] ⊕ c 1 [ 7 ] ⊕ S K [ 12 ] ⊕ c 1 [ 12 ] = s [ 13 ] K [ 14 ] ⊕ S K [ 13 ] ⊕ c 1 [ 13 ] ⊕ { 02 } · S K [ 2 ] ⊕ c 1 [ 2 ] ⊕ { 03 } · S K [ 7 ] ⊕ c 1 [ 7 ] ⊕ S K [ 12 ] ⊕ c 1 [ 12 ] = s [ 14 ] K [ 15 ] ⊕ S K [ 13 ] ⊕ c 1 [ 13 ] ⊕ S K [ 2 ] ⊕ c 1 [ 2 ] ⊕ { 02 } · S K [ 7 ] ⊕ c 1 [ 7 ] ⊕ { 03 } · S K [ 12 ] ⊕ c 1 [ 12 ] = s [ 15 ] K [ 16 ] ⊕ { 03 } · S K [ 13 ] ⊕ c 1 [ 13 ] ⊕ S K [ 2 ] ⊕ c 1 [ 2 ] ⊕ S K [ 7 ] ⊕ c 1 [ 7 ] ⊕ { 02 } · S K [ 12 ] ⊕ c 1 [ 12 ] = s [ 16 ] (6) Complexity analysis. To recover s, we performs 4 × 2 32 = 2 34 queries to 4-step AEGIS. Through Recover( K), the right K can be determined with probability 1 and the time complexity is about 4 × 2 32 = 2 34 S-Box applications, which is comparable to 2 34 / 20 = 2 29.7 queries to 4-step AEGIS. The data complexity is 2 34 . The memory complexity is 4 × 2 24 = 2 26 56-bit blocks required to store the candidates. 2. Key recovery in quantum setting In this setting, we would recover the s by running quantum Simon's algorithm, in which the attacker is allowed to make queries to the initialization in quantum superposition. Simon's algorithm[19] was first used to break the security of the 3-round Feistel construction[20] and then to proved that the Even-Mansour construction[21] is insecure. At Crypto 2016, Kaplan et al.[22] broke several symmetric ciphers by using Simon's quantum algorithm. At Asiacrypt 2017, Leander and May[23] combined Simon's and Grover's[24] algorithms to broke the FX-based block ciphers. Simon's algorithm[19] solves the following problem: Problem 1 (Simon's problem): Given a Boolean function f : { 0 , 1 } n → { 0 , 1 } n and the promise that there exists a unique n-bit period s ≠ 0 such that f ( x ) = f ( x ⊕ s ) , find s. The optimal classical time to solve the problem is O ( 2 n / 2 ) , whereas Simon's algorithm[19] succeeds using only O ( n ) quantum queries to f as following: Step 1 Perform the Hadamard transformation over { 0 , 1 } n on the left register: | 0 n 〉 | 0 n 〉 → 1 2 n ∑ x ∈ { 0 , 1 } n | x , 0 n 〉 Step 2 A query to the function f maps this to the state: 1 2 n ∑ x ∈ { 0 , 1 } n | x , 0 n 〉 → 1 2 n ∑ x ∈ { 0 , 1 } n | x , f ( x ) 〉 Step 3 Perform the Hadamard transformation over { 0 , 1 } n on the left register again: 1 2 n ∑ x ∈ { 0 , 1 } n | x , f ( x ) 〉 → 1 2 n ∑ x ∈ { 0 , 1 } n [ ∑ v ∈ { 0 , 1 } n ( − 1 ) v · x | v 〉 ] | f ( x ) 〉 = def A Step 4 Measure the two register, and the left register is collapsed to v. Since A = 1 2 n ∑ x ∈ { 0 , 1 } n [ ∑ v ∈ { 0 , 1 } n ( − 1 ) u · x | v 〉 ] | f ( x ) 〉 = 1 2 n ∑ v ∈ { 0 , 1 } n ∑ x ∈ { 0 , 1 } n ( − 1 ) u · x | v 〉 | f ( x ) 〉 = 1 2 n ∑ v ∈ { 0 , 1 } n ∑ f ( z ) ∈ { 0 , 1 } n [ ∑ x ∈ { 0 , 1 } n and f ( x ) = f ( z ) ( − 1 ) v · x ] | v , f ( z ) 〉 Hence, for any ( v , f ( z ) ) ∈ { 0 , 1 } n × { 0 , 1 } n , the probability of obtaining ( v , f ( z ) ) is given by p [ v , f ( z ) ] = 1 4 n [ ∑ x ∈ { 0 , 1 } n and f ( x ) = f ( z ) ( − 1 ) v · x ] 2 By the promise of Simon problem, we have { x ∈ { 0 , 1 } n and f ( x ) = f ( z ) } = { z , z ⊕ s } then p [ v , f ( z ) ] = 1 4 n [ ( − 1 ) v · z + ( − 1 ) v · ( z ⊕ s ) ] 2 = 1 4 n [ 1 + ( − 1 ) v · s ] 2 Therefore, measuring the state yields v such that v · s = 0 . Here we can construct the function for 4-step AEGIS as follows: f : { 0 , 1 } 128 → { 0 , 1 } 128 x ↦ u ( x ) ⊕ I 9 Unfortunately, the promise of Simon's algorithm is that there is only one non-zero s, while our objective function f holds f ( x ⊕ t ) = f ( x ) for many different t in Eq.(7): t = t [ 1 ] t [ 5 ] t [ 9 ] t [ 13 ] t [ 2 ] t [ 6 ] t [ 10 ] t [ 14 ] t [ 3 ] t [ 7 ] t [ 11 ] t [ 15 ] t [ 4 ] t [ 8 ] t [ 12 ] t [ 16 ] , t [ i ] ∈ ( 0 , s [ i ] ) ( 1 ≤ i ≤ 16 ) (7) There would be a total of 2 16 different t satisfying f ( x ⊕ t ) = f ( x ) and t = s iff t [ i ] = s [ i ] ( 1 ≤ i ≤ 16 ). It is far from the Simon's promise, so we reconsider the validity and efficiency of Simon's algorithm, and solve this issue by block matrix method as Theorem 2. Theorem 2 For f : { 0 , 1 } 128 → { 0 , 1 } 128 such that f ( x ⊕ t ) = f ( x ) for any input x, where t is of form Eq.(7), we can recover s by solving the following equations involved cn vectors v 1 , … , v cn , which are obtained by cn calls of Simon's algorithm. v 1 [ 1 ] · s [ 1 ] = 0 ⋮ v cn [ 1 ] · s [ 1 ] = 0 v 1 [ 2 ] · s [ 2 ] = 0 ⋮ v cn [ 2 ] · s [ 2 ] = 0 ⋯ v 1 [ 16 ] · s [ 16 ] = 0 ⋮ v cn [ 16 ] · s [ 16 ] = 0 Proof For any ( v , f ( z ) ) ∈ { 0 , 1 } n × { 0 , 1 } n , the probability of obtaining ( v , f ( z ) ) is given by p [ v , f ( z ) ] = 1 4 n [ ∑ x ∈ { 0 , 1 } n and f ( x ) = f ( z ) ( − 1 ) v · x ] 2 = 1 4 n [ ∑ t satisfies ( 4 ) ( − 1 ) v · ( z ⊕ t ) ] 2 = 1 4 n [ ( − 1 ) v · z · ∑ t satisfies ( 4 ) ( − 1 ) v · t ] 2 = 1 4 n [ ∏ t [ i ] = s [ i ] , 1 ≤ i ≤ 16 ( 1 + ( − 1 ) v [ i ] · t [ i ] ) ] 2 = 1 4 n [ ∏ 1 ≤ i ≤ 16 ( 1 + ( − 1 ) v [ i ] · s [ i ] ) ] 2 Hence, measuring the state yields a random vector v that v [ i ] · s [ i ] = 0 ( 1 ≤ i ≤ 16 ) and we would solve the equations byte by byte. Therefore, Simon's algorithm will return s = K ⊕ R ( K ⊕ c 1 ) . The rest of the work reduces to recovering K through Algorithm 1. Complexity analysis. The success rate and time complexity of recovering s are similar to general application of Simon's algorithm, in which O ( n ) calls are needed. The time complexity is about 2 29.7 and 2 26 56-bit of memory are required in Recover( K) according to Algorithm 1. 3. Key recovery attack on 5-step AEGIS Continue with previous work, we obtain the internal state after 5 steps AEGIS by S 1 5 = u x ⊕ R ( x ⊕ I 8 ) ⊕ I 9 . When the input difference Δ x = s , the output difference becomes Δ S 1 5 = R ( x ⊕ I 8 ) ⊕ R ( x ⊕ s ⊕ I 8 ) since Δ u x = 0 , then we have the following lemma: Lemma 1 Let f : { 0 , 1 } 128 → { 0 , 1 } 128 be the output difference function of S 1 5 and when the input differen