Cryptanalysis of ARMADILLO 2 ∗ Mohamed

ARMADILLO2 is the recommended variant of a multi-purpose cryptographic primitive dedicated to hardware which has been proposed by Badel et al. in [1]. In this paper we propose a meet-in-the-middle technique that allows us to invert the ARMADILLO2 function. Using this technique we are able to perform a key recovery attack on ARMADILLO2 in FIL-MAC application mode. A variant of this attack can also be applied when ARMADILLO2 is used as a stream cipher in the PRNG application mode. Finally we propose a (second) preimage attack on its hashing application mode. We have validated our attacks by implementing cryptanalysis on scaled variants that match the theoretical predicted complexities. All the cryptanalysis presented in this paper can be applied for any arbitrary bitwise permutations σ0 and σ1 used in the internal permutation.