Analyse de primitives sym´ etriques Pierre Karpman a l’Inria Saclay & Rennes, l’´ Th` ese pr´ epar´ ee ` Ecole polytechnique, et la Nanyang Technological University Sous la direction de Daniel Augot, Pierre-Alain Fouque et Thomas Peyrin Palaiseau 2016–11–18 2016–11–18 Analyse de primitives sym´ etriques 1/53 Pierre Karpman
Introduction New linear mappings for block ciphers Practical freestart collisions for the full SHA-1 Conclusion 2016–11–18 Analyse de primitives sym´ etriques 2/53 Pierre Karpman
Motivating cryptography 2016–11–18 Analyse de primitives sym´ etriques 3/53 Pierre Karpman
Motivating cryptography 2016–11–18 Analyse de primitives sym´ etriques 3/53 Pierre Karpman
Motivating cryptography 2016–11–18 Analyse de primitives sym´ etriques 3/53 Pierre Karpman
Motivating cryptography 2016–11–18 Analyse de primitives sym´ etriques 3/53 Pierre Karpman
Motivating cryptography 2016–11–18 Analyse de primitives sym´ etriques 3/53 Pierre Karpman
A hierarchy of cryptographic components A protocol (e.g. TLS) uses among others ▸ A key exchange algorithm (e.g. Diffie-Hellman) — “public-key” cryptography ▸ instantiated with a secure group (e.g. ANSSI FRP256V1) ▸ An authenticated-encryption mode of operation (e.g. GCM) — “symmetric-key” cryptography ▸ instantiated with a secure block cipher (e.g. the AES) ▸ A digital signature algorithm (e.g. ECDSA) — “public-key” + “symmetric-key” cryptography ▸ instantiated with a secure group and a secure hash function (e.g. SHA-3) 2016–11–18 Analyse de primitives sym´ etriques 4/53 Pierre Karpman
Primitive-centered crypto in a nutshell ▸ Design new primitives ▸ Fast, lightweight, quantum-resistant (isogeny-based, etc.), ... ▸ Analyse new proposals ▸ Analyse standards ▸ AES, SHA- { 1,2,3 } , ... 2016–11–18 Analyse de primitives sym´ etriques 5/53 Pierre Karpman
Focus of this thesis We studied various aspects of ▸ design ▸ analysis ▸ implementation of block ciphers and hash functions 2016–11–18 Analyse de primitives sym´ etriques 6/53 Pierre Karpman
List of publications Efficient and Provable White-Box Primitives with Pierre-Alain Fouque, Paul Kirchner and Brice Minaud ASIACRYPT 2016 Freestart collision for full SHA-1 with Thomas Peyrin and Marc Stevens EUROCRYPT 2016 Key-Recovery Attacks on ASASA with Patrick Derbez, Pierre-Alain Fouque and Brice Minaud ASIACRYPT 2015 From Distinguishers to Key Recovery: Improved Related-Key Attacks on Even-Mansour ISC 2015 Practical Free-Start Collision Attacks on 76-step SHA-1 with Thomas Peyrin and Marc Stevens CRYPTO 2015 Higher-Order Differential Meet-in-The-Middle Preimage Attacks on SHA-1 and BLAKE with Thomas Espitau and Pierre-Alain Fouque CRYPTO 2015 Diffusion Matrices from Algebraic-Geometry Codes with Efficient SIMD Implementation with Daniel Augot and Pierre-Alain Fouque SAC 2014 2016–11–18 Analyse de primitives sym´ etriques 7/53 Pierre Karpman
List of publications Efficient and Provable White-Box Primitives with Pierre-Alain Fouque, Paul Kirchner and Brice Minaud ASIACRYPT 2016 Freestart collision for full SHA-1 with Thomas Peyrin and Marc Stevens EUROCRYPT 2016 Key-Recovery Attacks on ASASA with Patrick Derbez, Pierre-Alain Fouque and Brice Minaud ASIACRYPT 2015 From Distinguishers to Key Recovery: Improved Related-Key Attacks on Even-Mansour ISC 2015 Practical Free-Start Collision Attacks on 76-step SHA-1 with Thomas Peyrin and Marc Stevens CRYPTO 2015 Higher-Order Differential Meet-in-The-Middle Preimage Attacks on SHA-1 and BLAKE with Thomas Espitau and Pierre-Alain Fouque CRYPTO 2015 Diffusion Matrices from Algebraic-Geometry Codes with Efficient SIMD Implementation with Daniel Augot and Pierre-Alain Fouque SAC 2014 2016–11–18 Analyse de primitives sym´ etriques 7/53 Pierre Karpman
Introduction New linear mappings for block ciphers Practical freestart collisions for the full SHA-1 Conclusion 2016–11–18 Analyse de primitives sym´ etriques 8/53 Pierre Karpman
Block ciphers Block cipher A block cipher is a mapping E ∶ K × M → C s.t. for all k ∈ K , E( k , ⋅ ) is invertible and E( k , ⋅ ) , E − 1 ( k , ⋅ ) are efficiently computable. In most cases: ▸ M = C = { 0 , 1 } n , n ∈ { 64 , 128 } ▸ K = { 0 , 1 } κ , κ ∈ { 64 , 80 , 128 , 256 } 2016–11–18 Analyse de primitives sym´ etriques 9/53 Pierre Karpman
Security of block ciphers Ideal block cipher Key-recovery security Differential cryptanalysis (Biham and Shamir, 1990) Exploit statistical properties of x ↦ E( k , x ) ⊕ E( k , x ⊕ ∆ ) 2016–11–18 Analyse de primitives sym´ etriques 10/53 Pierre Karpman
Substitution-Permutation-Network block ciphers SPN round function: R = A ○ S ▸ S is the parallel application of s b -bit S-boxes ▸ A is an affine transformation over F n 2 , n = s × b 2016–11–18 Analyse de primitives sym´ etriques 11/53 Pierre Karpman
An SPN round function in a picture x / n = 7 × b / b / b / b / b / b / b / b S S S S S S S / b / b / b / b / b / b / b / n A y 2016–11–18 Analyse de primitives sym´ etriques 12/53 Pierre Karpman
The wide-trail strategy (Daemen, 1995) ▸ Use structure in A and S to lower-bound the number of active S-boxes in a differential characteristic or linear approximation ▸ Introduce a notion of diffusion for a round function ▸ Canonical example: the AES (Daemen & Rijmen, 2002) 2016–11–18 Analyse de primitives sym´ etriques 13/53 Pierre Karpman
New linear mappings for block ciphers Diffusion Matrices from Algebraic-Geometry Codes with Efficient SIMD Implementation , with Daniel Augot and Pierre-Alain Fouque, SAC 2014 2016–11–18 Analyse de primitives sym´ etriques 14/53 Pierre Karpman
The objective ▸ Find A over F s 2 b with very good diffusion , with b small (i.e. 4) A diffusion measure: the branch number (Daemen 1995) Let M ∈ M s ( F 2 b ) , x ∈ F s 2 b and wt ( x ) be the number of non-zero coordinates of x . The differential branch number of M is x ≠ 0 ( wt ( x ) + wt ( M x )) min The linear branch number of M is x ≠ 0 ( wt ( x ) + wt ( M t x )) min 2016–11–18 Analyse de primitives sym´ etriques 15/53 Pierre Karpman
Branch number & minimal distance ▸ M ∈ M s ( F 2 b ) has differential branch number d ⇔ [ I s M ] generates a [ 2 s , s , d ] F 2 b code ▸ Singleton bound: d is at most s + 1; equality ⇒ MDS code, MDS matrix ▸ MDS conjecture: there is no [ 2 s , s , s + 1 ] F 2 b MDS code with 2 s > 2 b 2016–11–18 Analyse de primitives sym´ etriques 16/53 Pierre Karpman
The idea ▸ Take for A a single M with high branch number (SHARK structure, Rijmen et al., 1996) ▸ For b = 4, s ≥ 16 (block size ≥ 64), M cannot be MDS ▸ ⇒ Use Algebraic geometry codes : trade length for minimal distance (Goppa, 1981), (Tsfasman,Vl˘ adut , ,Zink, 1982) 2016–11–18 Analyse de primitives sym´ etriques 17/53 Pierre Karpman
AG codes AG codes as evaluation codes: ▸ Say we want an [ n , k ] F q code 1 Let X be a smooth plane curve of genus g with # X ( F q ) > n 2 Inject F k q to L ( rP ) of dim. k with P ∈ X ( F q ) 3 C ( m ) is the evaluation of m on n distinct points of X /{ P } 4 For well-chosen n and k , r = k − 1 + g (Riemann, Roch) ⇒ wt ( C ( m ≠ 0 )) ≥ n − ( k − 1 + g ) ▸ ⇒ the min. distance is g less than MDS, but X can be chosen s.t. # X ( F q ) > q + 1 2016–11–18 Analyse de primitives sym´ etriques 18/53 Pierre Karpman
A concrete AG code ▸ Let X be of equation x 5 = y 2 z 3 + yz 4 in P 2 ( F 2 4 ) ▸ It is a maximal curve of genus 2 and has 33 points ▸ ⇒ We can define a [ 32 , 16 , 15 ] F 24 code C ▸ This gives many (up to 32!) M ∈ M 16 ( F 2 4 ) of diff. branch number 15 ▸ The dual also has min. distance 15 ⇒ M has lin. branch number 15 2016–11–18 Analyse de primitives sym´ etriques 19/53 Pierre Karpman
Implementation matters For M to be used as A in a block cipher, we need: ▸ Efficient implementations of multiplication by M ... ▸ ... That are “constant-time”, to protect against side-channel attacks Thus we: ▸ Defined good vectorized algorithms for × M using pshufb ▸ Optimized the structure of M for faster multiplication A cost function for × M : # pshufb ▸ Combinatorial in nature ▸ Low cost can be obtained if M is generated by a single row 2016–11–18 Analyse de primitives sym´ etriques 20/53 Pierre Karpman
Tuning M for fast implementations ▸ Idea: use the automorphisms of C to find a circulant M ▸ Result: no luck, but still got M generated by 8 rows (cost 52) ▸ Second idea: randomly sample many generating matrices ( ≈ 2 38 ) ▸ Result: found many matrices of cost 43 2016–11–18 Analyse de primitives sym´ etriques 21/53 Pierre Karpman
Recommend
More recommend
