Key committing attack on Tiaoxin-346 algorithm

Abstract Key committing security is a crucial metric of authentication encryption schemes, complementing the fundamental principles of confidentiality and integrity. It ensures that an adversary cannot decrypt a given ciphertext to different sets of key, nonce, and associated data. In this study, we explore a key committing attack on the authenticated encryption stream cipher Tiaoxin-346 from the perspective of internal state collisions. We establish a more rigorous constraint within the FROB framework by identifying a different settings of $$\left( k_{2}, Nonce, AD^{*}\right)$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mfenced> <mml:msub> <mml:mi>k</mml:mi> <mml:mn>2</mml:mn> </mml:msub> <mml:mo>,</mml:mo> <mml:mi>N</mml:mi> <mml:mi>o</mml:mi> <mml:mi>n</mml:mi> <mml:mi>c</mml:mi> <mml:mi>e</mml:mi> <mml:mo>,</mml:mo> <mml:mi>A</mml:mi> <mml:mmultiscripts> <mml:mi>D</mml:mi> <mml:mrow/> <mml:mrow> <mml:mrow/> <mml:mo>∗</mml:mo> </mml:mrow> </mml:mmultiscripts> </mml:mfenced> </mml:math> for any specified $$\left( k_{1}, Nonce, AD_{1}\right)$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mfenced> <mml:msub> <mml:mi>k</mml:mi> <mml:mn>1</mml:mn> </mml:msub> <mml:mo>,</mml:mo> <mml:mi>N</mml:mi> <mml:mi>o</mml:mi> <mml:mi>n</mml:mi> <mml:mi>c</mml:mi> <mml:mi>e</mml:mi> <mml:mo>,</mml:mo> <mml:mi>A</mml:mi> <mml:msub> <mml:mi>D</mml:mi> <mml:mn>1</mml:mn> </mml:msub> </mml:mfenced> </mml:math> . Specifically, we demonstrate that for the Tiaoxin-346 algorithm, it is possible to find another settings of key $$k_{2}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msub> <mml:mi>k</mml:mi> <mml:mn>2</mml:mn> </mml:msub> </mml:math> and associated data $$AD^{*}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>A</mml:mi> <mml:mmultiscripts> <mml:mi>D</mml:mi> <mml:mrow/> <mml:mrow> <mml:mrow/> <mml:mo>∗</mml:mo> </mml:mrow> </mml:mmultiscripts> </mml:mrow> </mml:math> with a computational complexity of O (1), given any key $$k_{1}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msub> <mml:mi>k</mml:mi> <mml:mn>1</mml:mn> </mml:msub> </mml:math> and $$AD_{1}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>A</mml:mi> <mml:msub> <mml:mi>D</mml:mi> <mml:mn>1</mml:mn> </mml:msub> </mml:mrow> </mml:math> . We provide a detailed explanation of the rationale and a step-by-step methodology for constructing an internal state collision at the seventh round of the update process, aimed at recovering the appropriate $$AD^{*}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>A</mml:mi> <mml:mmultiscripts> <mml:mi>D</mml:mi> <mml:mrow/> <mml:mrow> <mml:mrow/> <mml:mo>∗</mml:mo> </mml:mrow> </mml:mmultiscripts> </mml:mrow> </mml:math> . Notably, the computational complexity of our attack is O (1), significantly lower than the generic attack complexity of $$O\left( 2^{64}\right)$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>O</mml:mi> <mml:mfenced> <mml:msup> <mml:mn>2</mml:mn> <mml:mn>64</mml:mn> </mml:msup> </mml:mfenced> </mml:mrow> </mml:math> , which effectively violates the key commitment security of Tiaoxin-346. The results of this study contribute to refining the security of authenticated encryption algorithms and offer valuable insights for the design of round update functions in AES-based schemes.