Meet-in-the-middle attacks on reduced-round GOST

The block cipher GOST (GOST 28147-89) is a Russian standard for encryption and message authentication that is included in OpenSSL 1.0.0. In this paper, we present meet-in-the-middle attacks on several block ciphers, each consisting of 22 or fewer rounds of GOST. Our $22$-round attack on rounds 10–31 requires only 5 known plaintexts and a computational effort equivalent to testing about $2^{223}$ keys for a success probability of $1-2^{-65}$. This attack is the best (going by the number of rounds) low data complexity key-recovery attack on GOST.