This paper investigates the security of counter mode encryption with authentication tag (COMET), one of the 32 second-round candidates in National Institute of Standards and Technology’s lightweight cryptography standardization process, against differential cryptanalysis. CHAM-64/128 is a block cipher chosen as one of the underlying block ciphers in COMET for hardware-oriented applications, and a differential characteristic with a high probability for CHAM-64/128 is useful for forgery attacks on COMET. However, we find that the optimal $\mathbf{39}$-round differential characteristic for CHAM-64/128 proposed by Roh et al., which is the longest differential characteristic of CHAM-64/128, is invalid. Then, we propose a new method of distinguishing an $\mathbf{m}$-bit block cipher from an $\mathbf{m}$-bit random permutation using a differential characteristic with a probability not higher than $\mathbf{2^{-m}}$. Using our method, we use two $\mathbf{39}$-round differential characteristics with a probability of $\mathbf{2^{-64}}$ for CHAM-64/128 to distinguish $\mathbf{39}$-round-reduced CHAM-64/128 from a $\mathbf{64}$-bit random permutation, respectively. Furthermore, we refine the probabilities of two differentials with the same input and output differential masks as the two $\mathbf{39}$-round differential characteristics, respectively. Finally, we present the first forgery attacks on COMET with the two differentials without using weak keys. Our forgery attacks follow the nonce-misuse scenario. It should be noticed that this attack does not invalidate the security claims of the designers.

中文翻译：

---

对 COMET 安全性的观察

本文研究了带有认证标签的计数器模式加密（COMET）的安全性，它是美国国家标准与技术研究院轻量级密码标准化过程中的 32 个第二轮候选者之一，以对抗差分密码分析。CHAM-64/128 是一种分组密码，被选为 COMET 中面向硬件的应用程序的底层分组密码之一，CHAM-64/128 具有高概率的差分特征可用于对 COMET 的伪造攻击。然而，我们发现 Roh 等人提出的 CHAM-64/128 的最优 $\mathbf{39}$-round 微分特性是 CHAM-64/128 的最长微分特性，是无效的。然后，我们提出了一种新方法，使用概率不高于 $\mathbf{2^{- m}}$。使用我们的方法，我们使用 CHAM-64/128 的概率为 $\mathbf{2^{-64}}$ 的两个 $\mathbf{39}$-round 差分特征来区分 $\mathbf{39}$-分别从 $\mathbf{64}$-bit 随机排列减少 CHAM-64/128。此外，我们分别用两个 $\mathbf{39}$-round 差分特征来细化具有相同输入和输出差分掩码的两个差分的概率。最后，我们在不使用弱密钥的情况下展示了对 COMET 的第一次伪造攻击。我们的伪造攻击遵循随机数滥用场景。