New Related-Tweakey Boomerang Attacks and Distinguishers on Deoxys-BC

Deoxys-BC is the primitive tweakable block cipher of the Deoxys family of authenticated encryption schemes. Based on existing related-tweakey boomerang distinguishers, this paper improves the boomerang attacks on 11-round Deoxys-BC-256 and 13-round Deoxys-BC-384 by the optimized key guessing and the precomputation technique. It transfers a part of subtweakey guess in the key-recovery phase to the precomputation resulting in a significant reduction of the overall time complexity. For 11-round Deoxys-BC-256, we give a related-tweakey boomerang attack with time/data/memory complexities of <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2218.6/2125.7/2125.7</tex> , and give another attack with the less time complexity of <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2215.8</tex> and memory complexity of <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2¹²⁰</tex> when the adversary has access to the full codebook. For 13-round Deoxys-BC-384, we give a related-tweakey boomerang attack with time/data/memory complexities of <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2ᵏ⁻⁹⁶+2157.5/2120.4/2¹¹³</tex> . For the key size <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$k=256$</tex> , it reduces the time complexity by a factor of <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2³¹</tex> compared with the previous 13-round boomerang attack. In addition, we present two new related-tweakey boomerang distinguishers on 11-round Deoxys-BC-384 with the same probability as the best previous distinguisher.