Boomerang Attack Article Index for
Boomerang 		Website Links For
Boomerang 		 

Information About

Boomerang Attack
  CATEGORIES ABOUT BOOMERANG ATTACK
   
cryptographic attacks
   
APPAREL
BABY
BEAUTY
BOOKS
CAR TOYS
CELL PHONES
DVD'S
ELECTRONICS
GOURMET FOOD
GROCERIES
HEALTH & PERSONAL
HOME & GARDEN
JEWELRY
MUSIC
MUSIC INSTRUMENTS
OFFICE PRODUCTS
SOFTWARE
SPORTING GOODS
TOOLS & HARDWARE
TOYS
VIDEO GAMES
SHOPPING HOME
MORE SHOPPING...



In Cryptography , the boomerang attack is a method for the Cryptanalysis of Block Cipher s based on Differential Cryptanalysis . The attack was published in 1999 by David Wagner , who used it to break the COCONUT98 cipher.

The boomerang attack has allowed new avenues of attack for many ciphers previously deemed safe from differential cryptanalysis.

Refinements on the boomerang attack have been published: the amplified boomerang attack, then the '''rectangle attack'''.


THE ATTACK

The boomerang attack is based on Differential Cryptanalysis . In differential cryptanalysis, an attacker exploits how differences in the input to a cipher (the plaintext) can affect the resultant difference at the output (the ciphertext). A high-probability "differential" (that is, an input difference that will produce a likely output difference) is needed that covers all, or nearly all, of the cipher. The boomerang attack allows differentials to be used which cover only part of the cipher.

The attack attempts to generate a so-called "quartet" structure at a point halfway through the cipher. For this purpose, say that the encryption action, ''E'', of the cipher can be split into two consecutive stages, ''E''0 and ''E''1, so that ''E(M)'' = ''E''1(''E''0(M)), where ''M'' is some plaintext message. Suppose we have two differentials for the two stages; say,

  • for ''E''0, and

:
abla o
  • for ''E''1-1 (the decryption action of ''E''1).


The basic attack proceeds as follows:
  • Choose a random plaintext P and calculate P' = P \oplus \Delta.

  • Request the encryptions of P and P' to obtain C = E(P) and C' = E(P')

  • Calculate D = C \oplus

    • abla and D' = C' \oplus

abla
  • Request the decryptions of D and D' to obtain Q = E^{-1}(D) and Q' = E^{-1}(D')

  • Compare Q and Q'; when the differentials hold, Q \oplus Q' = \Delta.



APPLICATION TO SPECIFIC CIPHERS

The best attack on KASUMI , a block cipher used in 3GPP , is a related-key rectangle attack which breaks the full eight rounds of the cipher faster than exhaustive search (Biham et al., 2005). The attack requires 254.6 chosen plaintexts, each of which has been encrypted under one of four related keys, and has a time complexity equivalent to 276.1 KASUMI encryptions.


REFERENCES