Improved Analysis of Zorro-Like Ciphers

Abstract. Zorro is a 128-bit lightweight block cipher supporting 128-bit keys, presented at CHES 2013 by Gérard et al. One of the main design goals of the cipher was to allow efficient masking, which is a common way to protect against side-channel attacks. This led to a very uncon-ventional design, which resembles AES, but uses only partial non-linear layers. Despite the security claims of the designers, the cipher was re-cently broken by differential and linear attacks due to Wang et al., re-covering its 128-bit key with complexity of about 2108. These attacks are based on high-probability iterative characteristics that are made possible due to a special property of the linear layer of Zorro, which is shown to be devastating in combination with its partial non-linear layer. In this paper, we analyze the security of Zorro-like ciphers with partial non-linear layers by devising differential and linear characteristic search algorithms and key recovery algorithms. These algorithms exploit in a generic way the small number of Sboxes in a Zorro-like round, and ar