Related-Key Cryptanalysis on the Full PRINTcipher Suitable for IC-Printing

PRINTcipher-48/96 are 48/96-bit block ciphers proposed in CHES 2010 which support the 80/160-bit secret keys, respectively. In this paper, we propose related-key cryptanalysis of PRINTcipher. To recover the 80-bit secret key of PRINTcipher-48, our attack requires 247 related-key chosen plaintexts with a computational complexity of . In the case of PRINTcipher-96, we require 295 related-key chosen plaintexts with a computational complexity of 2107. These results are the first known related-key cryptanalytic results on them. 1. Introduction Recently, the security of constrained hardware environments such as RFID tags and sensor nodes is major topic in cryptography [1, 2]. The research on lightweight block ciphers suitable for the efficient implementation in constrained hardware environments such as RFID tags and sensor nodes has been studied. As a result, PRESENT [3], LED [4], HIGHT [5], PRINTcipher [6], and Piccolo [7] were proposed. PRINTcipher is a -bit block cipher proposed in CHES 2010 thst supports the -bit secret keys. According to the block size, they are denoted by PRINTcipher-48 and PRINTcipher-96, respectively. The attractive properties of PRINTcipher are that all rounds use the same round key and differ only by a round counter and that the linear layer is partially key-dependent. Because of these properties, most known cryptanalytic results on PRINTcipher are based on weak keys (see Table 1). The best attack results on PRINTcipher are invariance subspace attacks on the full PRINTcipher-48/96 [8]. In detail, the attack on the full PRINTcipher-48 is applicable to weak keys and requires chosen plaintexts with a negligible computational complexity. In the case of the full PRINTcipher-96, it is applicable to weak keys and requires chosen plaintexts with a negligible computational complexity. Table 1: Summary of cryptanalytic results on PRINTcipher. In this paper, we find weakness of PRINTcipher-48/96 on related-key attacks. To construct related-key differential characteristics, we focus on related keys that have different values in the part related to a key-dependent permutation. Thus, we can construct -round related-key differential characteristics with a probability of . By using these characteristics, we can recover the secret keys of PRINTcipher-48/96. Our results are summarized in Table 1. In detail, to recover the -bit secret key of PRINTcipher-48, our attack requires related keys, related-key chosen plaintexts, and a computational complexity of . In the case of PRINTcipher-96, we require related keys, related-key chosen plaintexts, and a