关键词: CAESAR竞赛, AEGIS算法, 弱状态, 伪造攻击

Abstract: AEGIS, an authenticated stream cipher, is one of fifteen third-round candidates of CAESAR competition (Competition for Authenticated Encryption: Security, Applicability, and Robustness). Three AEGIS versions: AEGIS-128、AEGIS-256 and AEGIS-128L are recommended in different internal state and key sizes. This paper proposes two types of weak state for AEGIS-256 and AEGIS-128L respectively. The probabilities of these types of weak state are greater than the existing results. And based on those analyses, a forgery attack on AEGIS-256 is introduced. Indeed, we present internal states with the corresponding plaintexts, in which the tags are 0. As for AEGIS-128L, we attain the information leakage of encryption. Finally, we give brief analysis of what is responsible for weak states. To the best of our knowledge, except for design document, there is no cryptanalysis on weak state of AEGIS proposed until now. Therefore, our work is significant for CAESAR competition.

Key words: CAESAR, AEGIS, weak states, forgery attack