再探相关立方攻击：改进的立方搜索与超多项式恢复技术
Correlation Cube Attack Revisited: Improved Cube Search and Superpoly Recovery Techniques
AI总结：
本文通过利用超多项式低次因子改进相关立方攻击，提出变量替换和向量数值映射等技术以高效恢复超多项式并搜索优质立方索引集，成功将 Trivium 流密码的实用密钥恢复攻击推进至 830 轮。
摘要：
在本文中，我们通过利用超多项式关于某些“特殊”立方索引集（ISoC）的低次因子来改进立方攻击。这可以视为 Eurocrypt 2018 上提出的相关立方攻击的一个特例，但在我们的框架下，密钥恢复阶段可以获得关于密钥变量更有益的方程。要实施我们的攻击，面临两个具有挑战性的问题：有效恢复超多项式的代数正规型并提取其低次因子；以及高效搜索大量优质的 ISoC。我们引入新技术来解决这两个问题。首先，我们针对密码算法的中间轮提出变量替换技术，在该技术中，内部状态代数表达式中关于密钥变量的多项式被新变量替换。这将改善超多项式恢复的计算复杂度，并有望得到更紧凑的超多项式，使其能够更容易地关于新变量进行分解。其次，我们提出向量数值映射技术，该技术在超多项式次数评估中寻求数值映射技术的效率与单项式预测技术的准确性之间的折中。结合该技术，给出了一种快速剪枝方法，并用 MILP 建模以筛选代数次数满足某个固定阈值的优质 ISoC。借助自动化 MILP 求解器，在整个搜索空间中全面搜索优质立方变得切实可行。为了展示我们技术的威力，我们将所有这些技术应用于 Trivium 流密码。此前最好的实用密钥恢复攻击是针对 820 轮 Trivium，复杂度为 $2^{53.17}$。我们提出了 820 轮、825 轮和 830 轮的实用密钥恢复攻击，其中分别有 2^{80}\ imes 87.8%、2^{80}\ imes 83% 和 2^{80}\ imes 65.7% 的密钥可以被实际恢复。
英文摘要：
In this paper, we improve the cube attack by exploiting low-degree factors of the superpoly w.r.t. certain "special" index set of cube (ISoC). This can be viewed as a special case of the correlation cube attack proposed at Eurocrypt 2018, but under our framework more beneficial equations on the key variables can be obtained in the key-recovery phase. To mount our attack, one has two challenging problems: effectively recover algebraic normal form of the superpoly and extract out its low-degree factors; and efficiently search a large quantity of good ISoCs. We bring in new techniques to solve both of them. First, we propose the variable substitution technique for middle rounds of a cipher, in which polynomials on the key variables in the algebraic expressions of internal states are substituted by new variables. This will improve computational complexity of the superpoly recovery and promise more compact superpolys that can be easily decomposed with respect to the new variables. Second, we propose the vector numeric mapping technique, which seeks out a tradeoff between efficiency of the numeric mapping technique and accuracy of the monomial prediction technique in degree evaluation of superpolys. Combining with this technique, a fast pruning method is given and modeled by MILP to filter good ISoCs of which the algebraic degree satisfies some fixed threshold. Thanks to automated MILP solvers, it becomes practical to comprehensively search for good cubes across the entire search space. To illustrate the power of our techniques, we apply all of them to Trivium stream cipher. The previous best practical key recovery attack was on 820-round Trivium with complexity $2^{53.17}$. We put forward 820-, 825- and 830-round practical key-recovery attacks, in which there are 2^{80}\times 87.8%, 2^{80}\times 83% and 2^{80}\times 65.7% keys that could be practically recovered, respectively.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
