Eran Lambooij
Inria, Paris, France

Patrick Neumann
Inria, Paris, France

Keywords: CRAFT, known-plaintext attack, meet-in-the-middle attack, minimal data complexity, tweakable block cipher

Abstract

We present the first known-plaintext attack on up to 25 rounds of the tweakable block cipher CRAFT. These attacks require only two known plaintext-ciphertext pairs to recover the full key and work independently of the used tweaks. Given the 64-bit state size and 128-bit key size, this is the minimal data complexity possible for a full key-recovery attack. The basis of the attack is the observation that CRAFT can be decomposed into two loosely dependent functions: the state can be split in half so that each round mixes only 4 bits of each half into the other. Since the key schedule also does not mix these parts, one can guess those 4 bits per round and mount a meet-in-the-middle attack on up to 25 rounds. While the best previous attacks on CRAFT cover up to 26 rounds, they are in the chosen-ciphertext setting and require up to the full code book. We show that those attacks implicitly use a similar decomposition, and therefore our results represent the opposite end of a time-data tradeoff for the same attack family.