## Cryptanalysis of LOKI 91 (1993)

Venue: | Advances in Cryptology, AusCrypt 92, LNCS 718 |

Citations: | 34 - 8 self |

### BibTeX

@INPROCEEDINGS{Knudsen93cryptanalysisof,

author = {Lars Ramkilde Knudsen and Comp Science Dept and Dk- Arhus C},

title = {Cryptanalysis of LOKI 91},

booktitle = {Advances in Cryptology, AusCrypt 92, LNCS 718},

year = {1993},

pages = {196--208},

publisher = {Springer-Verlag}

}

### Years of Citing Articles

### OpenURL

### Abstract

. In this paper we examine the redesign of LOKI, LOKI 91 proposed in [5]. First it is shown that there is no characteristic with a probability high enough to do a successful differential attack on LOKI 91. Secondly we show that the size of the image of the F-function in LOKI 91 is 8 13 \Theta 2 32 . Finally we introduce a chosen plaintext attack that reduces an exhaustive key search on LOKI 91 by almost a factor 4 using 2 33 + 2 chosen plaintexts. 1 Introduction In 1990 Brown et al [4] proposed a new encryption primitive, called LOKI, later renamed LOKI 89, as an alternative to the Data Encryption Standard (DES), with which it is interface compatible. Cryptanalysis showed weaknesses in LOKI 89 [2, 5, 8] and a redesign, LOKI 91 was proposed in [5]. The ciphers from the LOKI family are DES-like iterated block ciphers based on iterating a function, called the F-function, sixteen times. The block and key size is 64 bits. Each iteration is called a round. The input to each round is d...

### Citations

529 | Differential cryptanalysis of DES-like cryptosystems
- Biham, Shamir
- 1991
(Show Context)
Citation Context ... cryptanalysis of LOKI 91 and show that there is no characteristic with a probability high enough to do a successful differential attack. Differential cryptanalysis was introduced by Biham and Shamir =-=[1]-=-. The underlying theory was later described by Lai and Massey [6]. For the remainder of this paper we expect the reader to be familiar with the basic concepts of differential cryptanalysis. Please con... |

91 | Differential Cryptanalysis of the Full 16-Round DES
- Biham, Shamir
- 1992
(Show Context)
Citation Context ... theory was later described by Lai and Massey [6]. For the remainder of this paper we expect the reader to be familiar with the basic concepts of differential cryptanalysis. Please consult the papers =-=[1, 3, 6]-=- for further details. In section 3 we examine the size of the image of the F-function, the round function in LOKI 91. Because the key is added to the input text before the expansion in the F-function,... |

60 |
LOKI { a cryptographic primitive for authentication and secrecy applications
- Brown, Pieprzyk, et al.
- 1990
(Show Context)
Citation Context ...\Theta 2 32 . Finally we introduce a chosen plaintext attack that reduces an exhaustive key search on LOKI 91 by almost a factor 4 using 2 33 + 2 chosen plaintexts. 1 Introduction In 1990 Brown et al =-=[4]-=- proposed a new encryption primitive, called LOKI, later renamed LOKI 89, as an alternative to the Data Encryption Standard (DES), with which it is interface compatible. Cryptanalysis showed weaknesse... |

45 |
Provable security against a differential cryptanalysis
- Nyberg, Knudsen
- 1993
(Show Context)
Citation Context ...However it is not possible to construct a 13-round characteristic based solely on the best combination. 2 The above does not prove that LOKI 91 is resistant against differential attacks. As stated in =-=[7]-=- to prove this resistance for a DES-like cipher we need to find the best possible differentials. However this seems to be extremely difficult for LOKI 91 and we have done no work in that direction. 3 ... |

41 | Improving Resistance to Differential Cryptanalysis and the Redesign of LOKI
- Brown, Kwan, et al.
- 1993
(Show Context)
Citation Context ...lysis of LOKI 91 Lars Ramkilde Knudsen Aarhus Universitet Comp. Science Dept. DK-8000sArhus C. e-mail:ramlodi@daimi.aau.dk Abstract. In this paper we examine the redesign of LOKI, LOKI 91 proposed in =-=[5]-=-. First it is shown that there is no characteristic with a probability high enough to do a successful differential attack on LOKI 91. Secondly we show that the size of the image of the F-function in L... |

28 |
Differential Cryptanalysis of Snefru
- Biham, Shamir
- 1992
(Show Context)
Citation Context ...R be any 32 bits. From Theorem 3 we have a key K such that K and K have 14 round keys in common and we have furthermore K (15) = Rol 100 (KL ) = KL = K(1) and K (16) = Rol 113 (KL ) = Rol 13 (KL ) = K=-=(2)-=-, i.e. K and K have 16 round keys in common. 2 Theorem 3 can be used in a chosen plaintext attack to reduce an exhaustive key search by almost a factor 2. It is well known that the complementation pro... |

1 |
Iterative Characteristics of DES and s -DES. To appear in the proceedings from CRYPTO'92. This article was processed using the L a T E X macro package with LLNCS style
- Knudsen
(Show Context)
Citation Context ...orm OE ! 0 x . The best probability of such a round for LOKI 91 is 122 2 20 ' 2 \Gamma13 [5]. A pair of rounds of type B must have the following forms, round no. (i): OE ! / round no. (i + 1): / ! OE =-=[9]-=- Lemma 1 The highest probability for a pair of rounds of type B is ( 16 2 12 ) 2 = 2 \Gamma16 . Proof: Consider the case where OE and / differ in the input to only one S-box each, Si and Sj respective... |