Impossible differential properties of reduced round Streebog

Abstract

In this paper, we investigate the impossible differential properties of the underlying block cipher and compression function of the new cryptographic hashing standard of the Russian federation Streebog. Our differential trail is constructed in such a way that allows us to recover the key of the underlying block cipher by observing input and output pairs of the compression function which utilizes the block cipher in Miyaguchi-Preneel mode. We discuss the implication of this attack when utilizing Streebog to construct a MAC using the secret-IV construction. Moreover, we present two versions of the attack with different time-data trade-offs.