Boomerang attack

The boomerang attack is based on differential cryptanalysis. In differential cryptanalysis, an attacker exploits how differences in the input to a cipher (the plaintext) can affect the resultant difference at the output (the ciphertext). A high-probability "differential" (that is, an input difference that will produce a likely output difference) is needed that covers all, or nearly all, of the cipher. The boomerang attack allows differentials to be used which cover only part of the cipher.

The attack attempts to generate a so-called "quartet" structure at a point halfway through the cipher. For this purpose, say that the encryption action, E, of the cipher can be split into two consecutive stages, E₀ and E₁, so that E(M) = E₁(E₀(M)), where M is some plaintext message. Suppose we have two differentials for the two stages; say,

${\displaystyle \Delta \to \Delta ^{*}}$

for E₀, and

${\displaystyle \nabla \to \nabla ^{*}}$ for E₁⁻¹ (the decryption action of E₁).

The basic attack proceeds as follows:

• Choose a random plaintext ${\displaystyle P}$ and calculate ${\displaystyle P'=P\oplus \Delta }$.
• Request the encryptions of ${\displaystyle P}$ and ${\displaystyle P'}$ to obtain ${\displaystyle C=E(P)}$ and ${\displaystyle C'=E(P')}$
• Calculate ${\displaystyle D=C\oplus \nabla }$ and ${\displaystyle D'=C'\oplus \nabla }$
• Request the decryptions of ${\displaystyle D}$ and ${\displaystyle D'}$ to obtain ${\displaystyle Q=E^{-1}(D)}$ and ${\displaystyle Q'=E^{-1}(D')}$
• Compare ${\displaystyle Q}$ and ${\displaystyle Q'}$; when the differentials hold, ${\displaystyle Q\oplus Q'=\Delta }$.

One attack on KASUMI, a block cipher used in 3GPP, is a related-key rectangle attack which breaks the full eight rounds of the cipher faster than exhaustive search (Biham et al., 2005). The attack requires 2^54.6 chosen plaintexts, each of which has been encrypted under one of four related keys, and has a time complexity equivalent to 2^76.1 KASUMI encryptions.

• Boomerang attack — explained by John Savard