Re: [Cfrg] [Ext] Re: Analysis of ipcrypt?

["Scott Fluhrer (sfluhrer)" <[e-mail]>]

I just looked at ipcrypt.

Obviously, a simple MITM attack would recover the key with 2^64 work (and a handful of known plaintexts/ciphertexts).

In addition, I believe I found a linear characteristic through the permutation; the bias is about 0.5 - 0.016.  This linear characteristic should (haven't verified) lead to something that recovers an outer round key (or, at least, places it within a 100 or so of potential values) with your 2^24 known plaintexts/ciphertexts and about 2^54 work (where 'work' is the equivalent of evaluating the cipher once).

I'm currently searching for more linear characteristics; that would drasticly improve this result.  However, even with what I have, this doesn't look good for this cipher.

> -----Original Message-----
> From: Cfrg [mailto:[e-mail]] On Behalf Of Paul Hoffman
> Sent: Thursday, February 22, 2018 7:19 PM
> To: Greg Rose <[e-mail]>
> Cc: [e-mail]
> Subject: Re: [Cfrg] [Ext] Re: Analysis of ipcrypt?
> 
> On Feb 22, 2018, at 4:14 PM, Greg Rose <[e-mail]> wrote:
> > Anyone who wants to do 32-bit encryption with a key longer than 80 bits
> already needs to have their threat model reviewed ;-).
> 
> OK, so please review what I said at the top of the thread:
> 
> For a project I'm on, ipcrypt is attractive if an attacker cannot derive the 128-
> bit random key without a lot (maybe 2^80ish) effort. For cases in common
> use, assume that the attacker has 2^24 known plaintext/ciphertext pairs
> under a single 128-bit random key. For additional ciphertexts, how much
> effort must the attacker expend to get the key in order to decrypt additional
> unknown ciphertexts?
> 
> The threat model then is that an attacker with 2^24 known
> plaintext/ciphertext pairs wants to determine the 128-bit random key that
> was used so that the attacker can de-anonymize addresses that are not in
> their current set.
> 
> Why is that threat model worth a smiley?
> 
> --Paul Hoffman