Slide Attack — breaking a cipher's key schedule, not its rounds

A known-plaintext attack that exploits self-similarity in the key schedule — not the round function's cryptographic strength — so it works regardless of how many rounds the cipher has.

The signal that betrays it

Look at the key schedule, not the S-boxes. The tell is self-similarity independent of round count:

- Every round uses the *same* subkey (weak or absent key schedule), or the schedule cycles through a short, repeating sequence of subkeys. - The round function F is simple/small enough that, given one input-output pair, you could plausibly solve F(x) = y for the key directly. - The challenge emphasizes an unusually large round count, or hints that "more rounds should make it harder" — that framing is itself a signal, because for a slide attack round count is irrelevant. Adding rounds to a cipher with a periodic schedule does not help the defender at all; it only adds rounds that are equally slidable. - Adjacent finding: if you're checking for Weak Key Classes — when a cipher's own key schedule betrays it and discover the key schedule produces identical or palindromic subkeys (e.g. equal key halves), that key collapses the cipher into exactly the self-similar shape a slide attack needs — test the involution property E_k(E_k(P)) = P as a cheap first probe before setting up the full slide.

How to exploit it

The core idea: if every round applies the same function F under the same (or a cyclically-repeating) subkey, the whole cipher is just F iterated r times. A slid pair is two plaintexts (P, P*) such that F(P) = P* — i.e., encrypting P for exactly one round lands you on P*. Because every round is identical, this relation is preserved one round later on the corresponding ciphertexts: F(C) = C*. That gives you two independent equations sharing the same unknown key, which is normally enough to solve for it directly (recover the round key, or invert F in closed form).

Operational steps:

1. Collect many known plaintext/ciphertext pairs (P, C). 2. Search the pair set for a slid pair: some P, P* with P* = F_k(P), and check whether the corresponding ciphertexts satisfy C* = F_k(C) for the *same* key. In practice this is a matching/filtering search over the pair set rather than brute-forcing the key space directly. 3. Once a slid pair is found, solve the two F-relations simultaneously for k — this step is only tractable because F (one round) is a simple function, unlike the full cipher.

``python # F is one round; a slid pair (P, Pstar) and its images (C, Cstar) # satisfy Pstar = round(P, k) and Cstar = round(C, k) for the same k. def find_slid(pairs): # pairs: dict P -> C; look for P, P2 whose relation is consistent # across both the plaintext side and the ciphertext side. for (P, C) in pairs.items(): for (P2, C2) in pairs.items(): if candidate_slide(P, P2) and candidate_slide(C, C2): yield (P, P2, C, C2) ``

Data requirement

finding one slid pair by generic birthday search costs on the order of 2^{n/2} known plaintexts for an n-bit block. This is the number to check against the challenge's data budget before committing to the attack — if you're only handed a handful of plaintext/ciphertext pairs, plain sliding is not going to reach a slid pair and you need a smaller-block or structurally special case. For Feistel ciphers with a cyclic key schedule specifically, the requirement drops to roughly 2^{n/4} pairs — worth checking the cipher's structure before assuming the full 2^{n/2} bound applies.

If subkeys repeat but aren't *exactly* identical (e.g. a short cyclic sequence, or subkeys related by a known offset), combine the slide with a Related-Key Attack — exploiting encryptions under keys with a known relationship: instead of one F iterated identically, you're looking at a small number of related F_ki, and the two techniques' equations combine to pin down the key. This is the practical case more often than a pure single-subkey cipher.

Related building block: recognizing the split-and-XOR shape in the first place is Feistel Structure — the split-and-XOR shape that tells you which attack family applies; the slide attack is one of the routes a Feistel-shaped cipher can fall to once you've identified it.

What does NOT work

- Trying to slide a cipher whose round function changes materially between rounds, even under the same key. Self-similarity is about the round *function* repeating, not just the key. If each round applies a genuinely different transformation (different round constants baked into the function itself, not just XORed in), there is no slid pair to find no matter how much data you collect. - Assuming more data always finds a slid pair. The 2^{n/2} (or 2^{n/4} for cyclic-schedule Feistel) bound is a real floor, not a rule of thumb you can shortcut with cleverness — if the challenge's block size makes that bound infeasible to reach with the plaintexts on offer, the slide attack is the wrong tool even though the schedule looks weak in principle. - **Expecting round-count increases in the *target* cipher to change your odds. This cuts both ways: it means you shouldn't be discouraged by a huge round count (irrelevant to a slide attack), but it also means that if the designer fixed the actual vulnerability — an aperiodic, non-cyclic key schedule (this is precisely why modern schedules mix in round-dependent constants rather than repeating) — no amount of extra data recovers a slid pair, because none exists structurally. - Skipping straight to slide search without checking Weak Key Classes — when a cipher's own key schedule betrays it first.** A cheap involution/fixed-point check on the schedule often confirms or rules out the self-similar structure in far less effort than running the full slid-pair search cold.

Related

Related-Key Attack — exploiting encryptions under keys with a known relationship Weak Key Classes — when a cipher's own key schedule betrays it Feistel Structure — the split-and-XOR shape that tells you which attack family applies