AEGIS is one of the authenticated encryption with associated data designs selected for the final portfolio of the CAESAR competition. It combines the AES round function and simple Boolean operations to update its large state and extract a keystream to achieve an excellent software performance. The AEGIS family consists of AEGIS-128, AEGIS-256 and AEGIS-128L, which use 5, 6 and 8 parallel AES round functions to process 128, 128 and 256 bits message block per step with slightly different output functions separately. Surprisingly, very few cryptanalytic results on AEGIS have been published so far. This paper presents the first guess-and-determine attacks on AEGIS family. Firstly, we propose a new observation on the structure of AEGIS that the relations of fixed variables remain in the outputs at consecutive steps under some conditions on the AND operations, and the vectorial bitwise AND operation is biased, which is able to derive the additional variables added directly. Secondly, we add several techniques, such as divide and conquer on byte-based columns, reduction by meet in the middle and simplification through constraints on variables, for each AEGIS member. Finally, we conduct guess-and-determine attacks on AEGIS-128, AEGIS-256 and AEGIS-128L and result in a complexity of $2^{309}$, $2^{437}$ and $2^{384}$ to $2^{416}$, respectively. Although neither attack threatens the practical security of AEGIS, it has great significance to evaluate the resistance of such structure compared with their large internal state exploited of 640, 768 and 1024 bits. It is also the first internal state recovery attack on AEGIS without nonce reusing, while only distinguishing attacks on AEGIS exist up to now.

中文翻译：

---

对 AEGIS 的猜测和确定攻击

AEGIS 是为 CAESAR 竞赛的最终组合选择的具有相关数据设计的经过身份验证的加密之一。它结合了 AES 轮函数和简单的布尔运算来更新其大状态并提取密钥流以实现出色的软件性能。AEGIS 系列由 AEGIS-128、AEGIS-256 和 AEGIS-128L 组成，它们使用 5、6 和 8 个并行 AES 轮函数来处理每一步的 128、128 和 256 位消息块，输出函数分别略有不同。令人惊讶的是，到目前为止，很少有关于 AEGIS 的密码分析结果发表。本文介绍了对 AEGIS 系列的第一次猜测和确定攻击。第一，我们对 AEGIS 的结构提出了一个新的观察，即在 AND 操作的某些条件下，固定变量的关系在连续步骤的输出中保持不变，并且向量位与操作是有偏差的，它能够推导出直接添加的附加变量. 其次，我们为每个 AEGIS 成员添加了几种技术，例如基于字节的列的分而治之、通过中间相遇减少和通过变量约束来简化。最后，我们对 AEGIS-128、AEGIS-256 和 AEGIS-128L 进行猜测和确定攻击，得到 $2^{309}$、$2^{437}$ 和 $2^{384}$ 到 $2 的复杂度^{416}$，分别。尽管这两种攻击都不会威胁到 AEGIS 的实际安全性，与利用640、768和1024位的大内部状态相比，评估这种结构的电阻具有重要意义。这也是第一次对 AEGIS 进行内部状态恢复攻击而无需 nonce 重用，而目前仅存在对 AEGIS 的区分攻击。