Weak Tweak-Key Analysis of Blink via Superbox

This work presents the first third-party cryptanalysis of Blink, a recent tweakable block cipher built on the Three-Hash Framework with a long-key design. Leveraging the idea of Superbox, we develop a lightweight theoretical model capturing the value correlations, weak-key conditions, fixed-key probabilities and the local clustering behaviors inside a Blink Superbox when the value spaces are affine. This model is intended as a concrete, easy-to-follow specialization of existing generic frameworks adapted to the structure of Blink. We then build a simple pattern-based automatic tool to search for weak tweak-key differentials. The main results are as follows: For Blink-64 with 448-bit key size, we obtain a 10-round distinguisher with probability 2−50.42 for up to 2442 weak keys (equivalently 2−6 of the full key space); For Blink-128 with 1024-bit key size, we obtain a 10-round distinguisher with probability 2−68.83 for up to 21010 weak keys (equivalently 2−14 of the full key space), which can be extended to a 12-round multiple differential distinguisher with probability 2−96.83. Based on the weak tweak-key distinguisher, we further mount a 13-round key recovery attack on Blink-64, recovering the full 448-bit master key with time complexity 2114.02 and 256 chosen plaintexts. All these distinguishers and key recovery attacks work within the data and time bounds claimed by the designers. And our analysis remains consistent with the security of the full-round design of Blink, while offering additional insight into the edge-case behaviors arising from the tweak-key interaction in Blink, and could be potentially informative for future refinements of tweakable block cipher constructions.