1
$\begingroup$

There is a cipher called PRINCE proposed in ASIACRYPT two years ago.

See the paper: “PRINCE – A Low-latency Block Cipher for Pervasive Computing Applications”

The cipher divides the 128-bit key into 64-bit k0 and k1. If I remove the key whitening at the beginning and end. Then the cipher is stripped down to PRINCEcore which only uses 64-bit k1. Is brute forcing the PRINCEcore practical?

Some clarifications:

  • I dont worry about side channel attacks or fault attacks.
  • I have seen several attacks on PRINCE (and also PRINCEcore), but they are not significantly better than brute force.
Improve this question
$\endgroup$
6
  • $\begingroup$ Once you're over the initial development cost of custom hardware, this isn't very expensive. I think it's about as much work as mining a single bitcoin block at the current difficult. Or differently said, it would take the current bitcoin mining network only a few minutes. Should be 10k USD or something of that magnitude. $\endgroup$
    – CodesInChaos
    Commented May 2, 2014 at 14:06
  • $\begingroup$ Removed key-whitening… in that case, let me ask: “What research have you done?” $\endgroup$
    – e-sushi
    Commented May 2, 2014 at 14:09
  • $\begingroup$ @e-sushi, I am sorry. Could you elaborate a little bit? I am not trying to make a trivial case. I am just curious if that is still secure. $\endgroup$
    – drdot
    Commented May 2, 2014 at 14:17
  • 1
    $\begingroup$ @CodesInChaos, Thank you for the comments. Is there any related references that I can take a look? $\endgroup$
    – drdot
    Commented May 2, 2014 at 14:19
  • 1
    $\begingroup$ @e-sushi, thank you for the comment. Now I am getting familiar with the terminology here ;). Yes, I came across those references and there is one more here. I have not seen any attacks on PRINCEcore that is significantly faster than brute force. What is the effort required to do a brute force attack on PRINCEcore? I have seen people using rainbow tables to break DES(56-bit key) pretty fast. $\endgroup$
    – drdot
    Commented May 2, 2014 at 18:47

1 Answer 1

Reset to default
2
$\begingroup$

PRINCEcore is a 64-bit block cipher with a 64-bit key $k_1$. PRINCE is a 64-bit block cipher with a 128-bit key $k_0||k_1$ built from PRINCEcore as $$\operatorname{PRINCE}((k_0||k_1),x)=\operatorname{PRINCEcore}(k_1,(x\oplus k_0))\oplus P(k_0)$$ where $P(k_0)$ is given as $(k_0\ggg1)\oplus(k_0\gg63)$ which I read as: rotate the 64-bit $k_0$ right by one bit, then replace the rightmost bit by its XOR with the second leftmost one; making $P$ a mapping.

That extension from PRINCEcore to PRINCE is reminescent of the extension from DES to DESX, analyzed by Joe Kilian and Phillip Rogaway in How to protect DES against exhaustive key search (an analysis of DESX). At least, that construction greatly improves the resistance to exhaustive key search, and I do not see that PRINCE could be practically brute-forced with work commensurate to brute-force of PRINCEcore (that is, near $2^{63}$ encryptions).

Note: The best motivation I can find for $P$ is that the rotation it contains avoids a cancellation of $k_0$ in some common operating modes, like OFB, CBC, CFB.. However, by rotating the output of PRINCE, we can cancel that rotation. And the single-bit XOR in $P$ does not seem to add much security.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.