Cube attacks are an important type of key recovery attacks against nonlinear feedback shift register (NFSR)-based cryptosystems. The key step in cube attacks closely related to key recovery is recovering superpolies. However, in the previous cube attacks including original, division property based and correlation cube attacks, the algebraic normal form of superpolies could hardly be shown to be exact due to an unavoidable failure probability or a requirement of large time complexity. In this study, the authors propose an algebraic method aiming at recovering the exact algebraic normal forms of superpolies practically. The proposed method is developed based on the degree of evaluation method proposed by Liu in Crypto 2017. As an illustration, the authors apply the proposed method to Trivium. As a result, they recover the algebraic normal forms of some superpolies for the 818-, 835-, 837- and 838-round Trivium. Based on these superpolies, the authors could mount key-recovery attacks on 818-, 835-, 837- and 838-round Trivium with the worst complexity slightly lower than a brute-force attack. Besides, for the cube proposed by Liu in Crypto 2017 as a zero-sum distinguisher for the 838-round Trivium, it is proved that its superpoly is not zero-constant. Hopefully, the proposed method would provide some new insights on cube attacks against NFSR-based ciphers.

中文翻译：

---

多维数据集攻击中恢复超级策略的代数方法

多维数据集攻击是针对基于非线性反馈移位寄存器（NFSR）的密码系统的密钥恢复攻击的一种重要类型。与密钥恢复密切相关的多维数据集攻击的关键步骤是恢复超级策略。但是，在先前的包括原始攻击，基于分割属性的攻击和相关立方攻击的多维数据集攻击中，由于不可避免的失败概率或需要大量的时间复杂性，几乎无法证明超级策略的代数范式是精确的。在这项研究中，作者提出了一种代数方法，目的是实际恢复超政策的精确代数正态形式。该方法是基于Liu在Crypto 2017中提出的评估方法的程度而开发的。为说明起见，作者将该方法应用于Trivium。结果是，他们恢复了818、835、837和838轮Trivium的某些超级曲面的代数正态形式。基于这些超级策略，​​作者可以在818、835、837和838轮Trivium上进行密钥恢复攻击，其最差的复杂性比暴力攻击要低一些。此外，对于Liu在Crypto 2017中提出的用于838轮Trivium的零和区分符的多维数据集，事实证明其多维垄断不是零常数。希望该方法能够对基于NFSR的密码的立方攻击提供一些新的见解。对于Liu在Crypto 2017中提出的多维数据集，作为838轮Trivium的零和区分符，事实证明其超级垄断不是零常数。希望该方法能够对基于NFSR的密码的立方攻击提供一些新的见解。对于Liu在Crypto 2017中提出的多维数据集，作为838轮Trivium的零和区分符，事实证明其超级垄断不是零常数。希望该方法能够对基于NFSR的密码的立方攻击提供一些新的见解。