Nonce-reuse Attack on Authenticated Cipher ACORN

Abstract

ACORN is a lightweight authenticated cipher designed for CAESAR competition. This cipher is insecure if nonce is reused or the decrypted plaintext is given as output when verification fails. We use the algebraic characteristics of the output function and the feedback function to recover the state of ACORN on the condition of nonce reuse. Our attack results show that the computational complexity can fall below 2128 for 2 chosen plaintexts with a common nonce that are better than the front attacks.