A novel distinguishing attack on Rocca

Abstract

The security of an encryption algorithm often hinges on the indistinguishability between ciphertext and random numbers. In block ciphers, pseudorandomness and super-pseudorandomness are commonly used to depict the indistinguishability between ciphertext and random numbers. Whereas, stream cipher algorithms can be viewed as functions of variables such as the key K, initialization vector IV, and plaintext M. For an ideal stream cipher algorithm, the ciphertext sequences for any two different plaintexts should exhibit good independence across various K-IV pairs. Consequently, the probability of the two ciphertext sequences being equal or having sufficiently long matching segments should be negligible. This study examines a new type of attack that stems from key commitment attacks. By exploiting the independence between the ciphertext sequences, a novel distinguishing attack against the stream cipher is constructed and applied to the encryption of Rocca. Focusing on the authenticated encryption algorithm Rocca, a guess-and-determine method is employed to demonstrate that for any plaintext and two different sets of $\left(key,Nonce,AD\right)$, another plaintext can be found with a time complexity $O\left(2^{160}\right)$, resulting in identical ciphertext sequences except for the initial $4\times 256$ bits. Furthermore, it is proved that under chosen plaintext conditions, the time complexity of this distinguishing attack is $O\left(2^{96}\right)$. These findings imply that Rocca does not offer 256-bit security against such distinguishing attacks, providing valuable insights into the design of round update functions for stream ciphers like Rocca.