A Cryptanalysis of PRINTcipher: The Invariant Subspace Attack

At CHES 2010, the new block cipher PRINTCIPHER was presented as a light-weight encryption solution for printable circuits [15]. The best attack to date is a differential attack [1] that breaks less than half of the rounds. In this paper, we will present a new attack called invariant subspace attack that breaks the full cipher for a significant fraction of its keys. This attack can be seen as a weak-key variant of a statistical saturation attack. For such weak keys, a chosen plaintext distinguishing attack can be mounted in unit time. In addition to breaking PRINTCIPHER, the new attack also gives us new insights into other, more well-established attacks. We derive a truncated differential characteristic with a roundindependent but highly key-dependent probability. In addition, we also show that for weak keys, strongly biased linear approximations exists for any number of rounds. In this sense, PRINTCIPHER behaves very differently to what is usually – often implicitly – assumed.