Multidimensional meet-in-the-middle attacks on reduced-round TWINE-128

Abstract

TWINE is a lightweight block cipher designed for multiple platforms and was proposed at Selected Areas in Cryptography, 2012. The number of rounds of TWINE is 36 and the most powerful attack given by the designers is the impossible differential attack against 24 rounds of TWINE-128 whose time complexity is 2115.10 encryptions and data complexity is 252.21 blocks. The best attack known so far is the biclique attack on the full round cipher with a time complexity of 2126.82 and data complexity of 2 60. However the time complexity of biclique attack is near exhaustive search and data needed for the attack is near the whole codebook. In this paper we propose some meet-in-the-middle type attacks on reduced round TWINE-128. We show that meet-in-the-middle type attacks can be applied on more rounds than the best attack done by the designers while they claim that the first 5 rounds contain all the key bits for TWINE-128. Our attacks are due to the slow diffusion of both the cipher and the key schedule algorithm. One of our attacks just use 212 chosen plaintext-ciphertext pair with time complexity of 2124 to break 21 rounds of the algorithm. Also we propose another attack on 25 rounds of the cipher by using 248 chosen plaintext-ciphertext pairs with the time complexity of 2122 and memory complexity of 2125 while the best attack proposed by the designers is for 24 rounds. © 2013 Springer-Verlag.