8
$\begingroup$

A key schedule that generates round keys by XORing a round constant with the key is linear and can be vulnerable to related key attacks, but let's ignore that for now. Constants are necessary to avoid the slide attack. How complex do these constants need to be and how much must they differ?

For example, would a trivial key schedule composed of $r_i = k \oplus c_i$ to generate the $i^\text{th}$ round key $r_i$ using round constant $c_i$ and secret key $k$ be weak to any form of cryptanalysis if $c_i = i$?

Improve this question
$\endgroup$
1
  • $\begingroup$ Probably unrelated. In Feistel, you need to have pairwise different round keys to stop slide attack. $\endgroup$
    – hola
    Commented May 31, 2021 at 13:40

1 Answer 1

Reset to default
4
$\begingroup$

It depends on the actual block cipher and is quite an open problem. For example, SCREAM, iSCREAM and Midori64 use such key schedule (i.e., its absense) with sparse round constants. They were broken with a practical attack on quite large weak key space [1]. Though, the linear layer has some special property.

I would add that its not the slide attack that matters, but symmetries/invariants and these things are not yet well understood.

[1] https://eprint.iacr.org/2016/732

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.