Differential Cryptanalysis of ARADI

ARADI is a low-latency block cipher for memory encryption, proposed by researchers at the National Security Agency of the United States. We study its differential cryptanalysis using quasidifferential trails. Due to a large number of high-correlation quasidifferential trails per characteristic, we find a substantial difference between fixed-key probabilities and key-averaged probabilities. To efficiently compute the fixed-key probabilities, we propose a new method to estimate these probabilities that remains efficient even when the number of quasidifferential trails is too large for exhaustive enumeration. Moreover, we show how to correctly combine the fixed-key probabilities of differential characteristics to estimate the fixed-key probabilities of differentials. We further show that the number of key bits that must be guessed was underestimated in prior key-recovery attacks, and provide a method using quasidifferential trails over the key-recovery rounds to determine the correct number of bits. Finally, we propose two new high-probability differentials tailored for key recovery, and use them to mount key-recovery attacks on 12- and 14-round ARADI.