A nonlinear invariant attack on T-310 with the original Boolean function

Abstract

There are numerous results on nonlinear invariant attacks on T-310. In all such attacks found so far, both the Boolean functions and the cipher wiring were contrived and chosen by the attacker. In this article, we show how to construct an invariant attack with the original Boolean function that was used to encrypt government communications in the 1980s.

Keywords:

• algebraic cryptanalysis
• annihilators
• Boolean functions
• Feistel ciphers
• generalized linear cryptanalysis
• k-normality
• polynomial invariants
• T-310

About the author

Nicolas T. Courtois is a Senior Lecturer at University College London, where he teaches about applied cryptography and cryptanalysis. His research focuses on the security analysis of cryptographic systems with particular focus on realistic attack scenarios and systems used by millions of users every day. His Google Scholar profile lists more than 150 papers with 9,000 citations in cryptography. His H-index is 38. A university team lead by Nicolas Courtois was given the UK University Cipher Champion in March 2013. He is a founding member of the group Code-Breakers at LinkedIn and a member of the editorial board of Cryptologia. Previously, he was a crypto research engineer at Gemalto, the world's largest manufacturer of smart cards and secure hardware. He has filed more than ten patents on practical applications of cryptography. He is an expert on security engineering, electronic payment, and crypto currency. His blog is blog.bettercrypto.com.

Notes

1 This requires some complex technical conditions on the cipher wiring (Courtois and Oprisanu 2018)

2 This wiring is also called LZS or Langzeitschlüssel which means a long-term key.

3 Some earlier documents about these questions, about cipher designs called ALPHA, SKS and OPERATION cited in (Arbeitsgebiet 1976) are not available to us, cf. also (Courtois, Drobick, and Schmeh 2018).

4 For example we connect $2·3$ inputs of $D,C,B$ to the 6 inputs of W.

5 For example if one input A is b the other must be c.

6 For example we connect $2·3$ inputs of $H,G,F$ to the 6 inputs of Y.