<abstract xmlns="http://www.w3.org/1999/xhtml"><p>T-310 is an important Cold War cipher. The cipher is extremely complex and it outputs extremely few bits from the internal state. A recent paper [C<sc>ourtois</sc>, N. T.: <italic>Decryption oracle slide attacks on T-310</italic>, Cryptologia, <bold>42</bold> (2018), no. 3, 191–204] shows an example of a highly anomalous key such that T-310 can be broken by a slide attack with a decryption oracle. In this paper, we show that the same attacks are ALSO possible for regular keys which satisfy all the official KT1 requirements. Two other recent papers [C<sc>ourtois</sc>, N. T.—G<sc>eorgiou</sc>, M.—S<sc>carlata</sc>, M.: <italic>Slide attacks and LC-weak keys in T-310</italic>, Cryptologia <bold>43</bold> (2019), no. 3, 175–189]; [C<sc>ourtois</sc>, N. T.—O<sc>prisanu</sc>, M. B.—S<sc>chmeh</sc>, K.: <italic>Linear cryptanalysis and block cipher design in East Germany in the 1970s</italic>, Cryptologia (published online), December 5, 2018] show that some of the KT1 keys are very weak w.r.t. Linear Cryptanalysis. In this paper, we show that a vast number of such weak keys exist and study the exact pre-conditions which make them weak. In addition we introduce a new third class of weak keys for RKDC (Related-Key Differential Cryptanalysis). We show that the original designers in the 1970s have ensured that these RKDC properties cannot happen for 4 rounds. We have discovered that these properties can happen for as few as 5 rounds for some keys, and for 10 to 16 rounds they become hard to avoid. The main reason why we study weak keys is to show that none of these properties occur by accident, rather that they are governed by precise pre-conditions which guarantee their existence, and countless other keys with the same properties exist. Eventually, this is how interesting attacks can be found.</p></abstract>

T-310 is an important Cold War cipher. The cipher is extremely complex and it outputs extremely few bits from the internal state. A recent paper [Courtois, N. T.: Decryption oracle slide attacks on T-310, Cryptologia, 42 (2018), no. 3, 191–204] shows an example of a highly anomalous key such that T-310 can be broken by a slide attack with a decryption oracle. In this paper, we show that the same attacks are ALSO possible for regular keys which satisfy all the official KT1 requirements. Two other recent papers [Courtois, N. T.—Georgiou, M.—Scarlata, M.: Slide attacks and LC-weak keys in T-310, Cryptologia 43 (2019), no. 3, 175–189]; [Courtois, N. T.—Oprisanu, M. B.—Schmeh, K.: Linear cryptanalysis and block cipher design in East Germany in the 1970s, Cryptologia (published online), December 5, 2018] show that some of the KT1 keys are very weak w.r.t. Linear Cryptanalysis. In this paper, we show that a vast number of such weak keys exist and study the exact pre-conditions which make them weak. In addition we introduce a new third class of weak keys for RKDC (Related-Key Differential Cryptanalysis). We show that the original designers in the 1970s have ensured that these RKDC properties cannot happen for 4 rounds. We have discovered that these properties can happen for as few as 5 rounds for some keys, and for 10 to 16 rounds they become hard to avoid. The main reason why we study weak keys is to show that none of these properties occur by accident, rather that they are governed by precise pre-conditions which guarantee their existence, and countless other keys with the same properties exist. Eventually, this is how interesting attacks can be found.

How Many Weak-Keys Exist in T-310 ?

ETH Zurich, Department of Computer Science

Tatra Mountains Mathematical Publications

This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 3.0 License.

{"article-title":"How Many Weak-Keys Exist in T-310 ?"}

T-310 is an important Cold War cipher. The cipher is extremely complex and it outputs extremely few bits from the internal state. A recent paper [Courtois, N....

How Many Weak-Keys Exist in T-310 ?

Published Online: Aug 15, 2019

Page range: 61 - 82

Received: Oct 10, 2018

DOI: https://doi.org/10.2478/tmmp-2019-0006

Keywords
Cold War, block ciphers, T-310, Block ciphers, unbalanced Feistel ciphers, linear cryptanalysis, generalised linear cryptanalysis, differential cryptanalysis, collision resistance, weak key attacks, related-key attacks

© 2019 Nicolas T. Courtois et al., published by Sciendo

This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 3.0 License.

How Many Weak-Keys Exist in T-310 ?

Published Online: Aug 15, 2019

Page range: 61 - 82

Received: Oct 10, 2018

DOI: https://doi.org/10.2478/tmmp-2019-0006

KeywordsCold War, block ciphers, T-310, Block ciphers, unbalanced Feistel ciphers, linear cryptanalysis, generalised linear cryptanalysis, differential cryptanalysis, collision resistance, weak key attacks, related-key attacks

© 2019 Nicolas T. Courtois et al., published by Sciendo

This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 3.0 License.

Keywords
Cold War, block ciphers, T-310, Block ciphers, unbalanced Feistel ciphers, linear cryptanalysis, generalised linear cryptanalysis, differential cryptanalysis, collision resistance, weak key attacks, related-key attacks