International Association for Cryptologic Research
The authors present attacks on full hummingbird-2 which are able to recover the 128-bit secret keys of two black box cipher instances that have a certain type of low-weight XOR difference in their keys. They call these highly correlated keys as they produce the same ciphertext with a significant probability. The complexity of their main chosen-IV key-recovery attack is 264. The first 64 bits of the key can be independently recovered with only 236 effort. This is the first sub-exhaustive attack on the full cipher under two related keys.