Analysis of Multiple Checkpoints in Non-perfect and Perfect Rainbow Tradeoff Revisited ⋆ Wenhao Wang 1, 2 , Dongdai Lin 1 1 State Key Laboratory Of Information Security, Institute of Information Engineering, CAS, Beijing, China. 2 University of Chinese Academy of Sciences, Beijing, China. {wangwenhao, ddlin}@iie.ac.cn Abstract. Time memory tradeoff (TMTO) attack has proven to be an effective cryptanalysis method against block ciphers and stream ciphers. Since it was first proposed in 1980s, many new ideas have come out to re- duce the false alarms during the online phase, among which rainbow table introduced by Oechslin and perfect table introduced by Borst et al. are notable landmarks. Avoine et al. introduced the checkpoints technique to detect false alarms using little additional memory without regener- ating the pre-computed chain. In this paper, we revisit the analysis of multiple checkpoints in rainbow tradeoff. For non-perfect table we give a new sight to the computation of the expected decreasing number of chain regenerations at the k-th iteration. This helps to better understand the real nature of false alarms and leads us to the same results as the work of Jung Woo Kim et al. at Indocrypt 2012. For perfect rainbow tradeoff we give the first way to find optimal positions of multiple checkpoints. The results are better than previous work of Avoine et al., which only applies when the perfect table has the maximum number of chains. All the results are verified through meticulous experiments. Keywords. time memory tradeoff, rainbow tradeoff, multiple check- points 1 Introduction Inverting one-way functions is one of the fundamental problems in cryptography. Much of cryptanalysis of block ciphers and stream ciphers can be expressed as the process of computation of pre-images or inversion of one-way functions. A cryptanalytic time-memory tradeoff (TMTO) is a technique to quickly invert generic one-way functions with the help of pre-computation. After it was first introduced by Hellman to perform an attack over DES [7] TMTO has been applied to many cryptosystems, for example against the GSM algorithm A5/1 ⋆ Supported by the National 973 Program of China under Grant 2011CB302400, the National Natural Science Foundation of China under Grants 10971246, 60970152, and 61173134, and the Strategic Priority Research Program of the Chinese Academy of Sciences under grant XDA06010701.