Block ciphers sensitive to Groebner Basis Attacks.
Johannes A Buchmann, Andrei Pychkine, Ralf-Philipp Weinmann · IACR Cryptology ePrint Archive · 2005
We construct and analyze Feistel and SPN ciphers that have a sound design strategy against linear and differential attacks but for which the encryption process can be described by very simple polynomial equations. For a block and key size of 128 bits, we present ciphers for which practical Grobner basis attacks can recover the full cipher key requiring only a minimal number of plaintext/ciphertext pairs. We show how Grobner bases for a subset of these ciphers can be constructed with neglegible computational effort. This reduces the key–recovery problem to a Grobner basis conversion problem. By bounding the running time of a Grobner basis conversion algorithm, FGLM, we demonstrate the existence of block ciphers resistant against differential and linear cryptanalysis but vulnerable against Grobner basis attacks.