New Attacks on LowMC Instances with a Single Plaintext/Ciphertext Pair

Cryptanalysis of the LowMC block cipher when attacker has access to a single known plaintext/ciphertext pair is mathematically challenging problem. This because unable employ most standard techniques in symmetric cryptography like linear and differential cryptanalysis. scenario particularly relevant while arguing security PICNIC digital signature scheme which generated by serves as public (verification) key corresponding encryption also secret (signing) scheme. In paper Banik et al. (IACR ToSC 2020:4), authors used linearization technique S-box mount attacks on some instances cipher. this paper, we first make more precise complexity analysis attack. Then, show how perform 2-stage MITM attack LowMC. The stage reduces candidates fraction bits master key. second between reduced candidate set remaining successfully recovers We that combined computational both these stages significantly lower than those reported