Automatic Search for Linear Trails of the SPECK Family Yuan Yao 1 , - PowerPoint PPT Presentation

Introduction Linear Cryptanalysis Against SPECK An Implementation of Wallén’s Algorithm Summary Automatic Search for Linear Trails of the SPECK Family Yuan Yao 1 , 2 Bin Zhang 2 Wenling Wu 2 1 TCA Laboratory, Institute of Software, Chinese Academy of Sciences 2 University of Chinese Academy of Sciences Information Security Conference, 2015 Yuan Yao, Bin Zhang, Wenling Wu Automatic Search for Linear Trails of the SPECK Family

Introduction Linear Cryptanalysis Against SPECK An Implementation of Wallén’s Algorithm Summary Outline Introduction 1 Background Our Contribution Linear Cryptanalysis Against SPECK 2 Search Linear Trails Linear Distinguishers Key Recovery Attacks An Implementation of Wallén’s Algorithm 3 Summary 4 Yuan Yao, Bin Zhang, Wenling Wu Automatic Search for Linear Trails of the SPECK Family

Introduction Linear Cryptanalysis Against SPECK Background An Implementation of Wallén’s Algorithm Our Contribution Summary SPECK By NSA in 2013. Lightweight. Feistel-like. ARX. For software applications. Yuan Yao, Bin Zhang, Wenling Wu Automatic Search for Linear Trails of the SPECK Family

Introduction Linear Cryptanalysis Against SPECK Background An Implementation of Wallén’s Algorithm Our Contribution Summary Previous Work Differential Analysis by Alex Biryukov et. al. at CT-RSA 2014. Differential Analysis by Farzaneh Abed et. al. at FSE 2014. Differential Analysis by Alex Biryukov et. al. at FSE 2014. Differential Analysis by Itai Dinur at SAC 2014. Differential Fault Analysis by Harshal Tupsamudre et. al. at FDTC 2014. Yuan Yao, Bin Zhang, Wenling Wu Automatic Search for Linear Trails of the SPECK Family

Introduction Linear Cryptanalysis Against SPECK Background An Implementation of Wallén’s Algorithm Our Contribution Summary Previous Work Differential Analysis by Alex Biryukov et. al. at CT-RSA 2014. Differential Analysis by Farzaneh Abed et. al. at FSE 2014. Differential Analysis by Alex Biryukov et. al. at FSE 2014. Differential Analysis by Itai Dinur at SAC 2014. Differential Fault Analysis by Harshal Tupsamudre et. al. at FDTC 2014. Linear Cryptanalysis??? Yuan Yao, Bin Zhang, Wenling Wu Automatic Search for Linear Trails of the SPECK Family

Introduction Linear Cryptanalysis Against SPECK Background An Implementation of Wallén’s Algorithm Our Contribution Summary Our Contribution Linear cryptanalysis of SPECK. An implementation of Wallén’s algorithm. Yuan Yao, Bin Zhang, Wenling Wu Automatic Search for Linear Trails of the SPECK Family

Introduction Search Linear Trails Linear Cryptanalysis Against SPECK Linear Distinguishers An Implementation of Wallén’s Algorithm Key Recovery Attacks Summary Basics Definition (Correlation) c X � 2Pr ( X = 0 ) − 1. Yuan Yao, Bin Zhang, Wenling Wu Automatic Search for Linear Trails of the SPECK Family

Introduction Search Linear Trails Linear Cryptanalysis Against SPECK Linear Distinguishers An Implementation of Wallén’s Algorithm Key Recovery Attacks Summary Basics Definition (Correlation) c X � 2Pr ( X = 0 ) − 1. H 0 : c X = 0 ← → H 1 : c X � = 0 Yuan Yao, Bin Zhang, Wenling Wu Automatic Search for Linear Trails of the SPECK Family

Introduction Search Linear Trails Linear Cryptanalysis Against SPECK Linear Distinguishers An Implementation of Wallén’s Algorithm Key Recovery Attacks Summary Basics Definition (Correlation) c X � 2Pr ( X = 0 ) − 1. H 0 : c X = 0 ← → H 1 : c X � = 0 Lemma (Piling-up Lemma) c X ⊕ Y = c X c Y . Yuan Yao, Bin Zhang, Wenling Wu Automatic Search for Linear Trails of the SPECK Family

Introduction Search Linear Trails Linear Cryptanalysis Against SPECK Linear Distinguishers An Implementation of Wallén’s Algorithm Key Recovery Attacks Summary Basics Definitions (Inner Product) X · Y = � n − 1 i = 0 X i & Y i ∈ F 2 . Yuan Yao, Bin Zhang, Wenling Wu Automatic Search for Linear Trails of the SPECK Family

Introduction Search Linear Trails Linear Cryptanalysis Against SPECK Linear Distinguishers An Implementation of Wallén’s Algorithm Key Recovery Attacks Summary Linear Approximation � S [ 0 ] r rounds encryption � S [ r ] Yuan Yao, Bin Zhang, Wenling Wu Automatic Search for Linear Trails of the SPECK Family

Introduction Search Linear Trails Linear Cryptanalysis Against SPECK Linear Distinguishers An Implementation of Wallén’s Algorithm Key Recovery Attacks Summary Linear Approximation S [ 0 ] · � � Γ[ 0 ] r rounds encryption � S [ r ] · � Γ[ r ] � S [ 0 ] · � Γ[ 0 ] ⊕ � S [ r ] · � Γ[ r ] ∈ F 2 Yuan Yao, Bin Zhang, Wenling Wu Automatic Search for Linear Trails of the SPECK Family

Introduction Search Linear Trails Linear Cryptanalysis Against SPECK Linear Distinguishers An Implementation of Wallén’s Algorithm Key Recovery Attacks Summary Linear Trail � S [ 0 ] · � Γ[ 0 ] � S [ 1 ] · � Γ[ 1 ] � S [ 0 ] · � Γ[ 0 ] ⊕ � S [ r ] · � Γ[ r ] � S [ 2 ] · � Γ[ 2 ] � . r − 1 . � � . S [ i ] · � � Γ[ i ] ⊕ � S [ i + 1 ] · � � Γ[ i + 1 ] S [ r − 1 ] · � � i = 0 Γ[ r − 1 ] � S [ r ] · � Γ[ r ] Yuan Yao, Bin Zhang, Wenling Wu Automatic Search for Linear Trails of the SPECK Family

Introduction Search Linear Trails Linear Cryptanalysis Against SPECK Linear Distinguishers An Implementation of Wallén’s Algorithm Key Recovery Attacks Summary Linear Trail � S [ 0 ] · � Γ[ 0 ] � S [ 1 ] · � Γ[ 1 ] � S [ 0 ] · � Γ[ 0 ] ⊕ � S [ r ] · � Γ[ r ] � S [ 2 ] · � Γ[ 2 ] � . r − 1 . � � . S [ i ] · � � Γ[ i ] ⊕ � S [ i + 1 ] · � � Γ[ i + 1 ] S [ r − 1 ] · � � i = 0 Γ[ r − 1 ] � S [ r ] · � Γ[ r ] Yuan Yao, Bin Zhang, Wenling Wu Automatic Search for Linear Trails of the SPECK Family

Introduction Search Linear Trails Linear Cryptanalysis Against SPECK Linear Distinguishers An Implementation of Wallén’s Algorithm Key Recovery Attacks Summary Matsui Search Proposed at EUROCRYPT 1994. Branch-and-bound: | B [ r − s ] ∏ s i = 1 c [ i ] | ≤ | B [ r ] | ∏ s i = 1 | c [ i ] | = s rounds ≤ | B [ r ] | | B [ r − s ] | ≥ r − s rounds Yuan Yao, Bin Zhang, Wenling Wu Automatic Search for Linear Trails of the SPECK Family

Introduction Search Linear Trails Linear Cryptanalysis Against SPECK Linear Distinguishers An Implementation of Wallén’s Algorithm Key Recovery Attacks Summary Matsui Search Algorithm 1: function Search( B , T = {} ) r ← Sizeof( B ) − 1 , s ← Sizeof( T ) 2: if s = r then 3: ˆ B [ r ] ← ∏ r i = 1 c [ i ] 4: else 5: for T ′ in Extend( T ) do 6: if | B [ r − ( s + 1 )] ∏ s + 1 i = 1 c ′ [ i ] | > | ˆ B [ r ] | then 7: Search( B , T ′ ) 8: else 9: return 10: end if 11: end for 12: end if 13: 14: end function Yuan Yao, Bin Zhang, Wenling Wu Automatic Search for Linear Trails of the SPECK Family

Introduction Search Linear Trails Linear Cryptanalysis Against SPECK Linear Distinguishers An Implementation of Wallén’s Algorithm Key Recovery Attacks Summary Round Function of SPECK � � S [ i ] L S [ i ] R ≫ ς ⊞ ⊕ � ≪ τ k [ i ] ⊕ � � S [ i + 1 ] L S [ i + 1 ] R Yuan Yao, Bin Zhang, Wenling Wu Automatic Search for Linear Trails of the SPECK Family

Introduction Search Linear Trails Linear Cryptanalysis Against SPECK Linear Distinguishers An Implementation of Wallén’s Algorithm Key Recovery Attacks Summary Approximations of Primitives � � � Γ 1 Γ 1 Γ 1 � � Γ 3 Γ 3 ⊕ ≪ t � � � Γ 2 Γ 2 Γ 2 � Γ 1 ⊕ � Γ 2 ⊕ � Γ 3 = � � Γ 2 = � � Γ 1 = � Γ 2 = � Γ 1 ≪ t 0 Γ 3 Yuan Yao, Bin Zhang, Wenling Wu Automatic Search for Linear Trails of the SPECK Family

Introduction Search Linear Trails Linear Cryptanalysis Against SPECK Linear Distinguishers An Implementation of Wallén’s Algorithm Key Recovery Attacks Summary Approximations of Primitives � � � Γ 1 Γ 1 Γ 1 � � Γ 3 Γ 3 ⊕ ≪ t � � � Γ 2 Γ 2 Γ 2 � Γ 1 ⊕ � Γ 2 ⊕ � � Γ 2 = � � Γ 1 = � Γ 2 = � Γ 3 = � Γ 1 ≪ t 0 Γ 3 Modulo Addition??? Yuan Yao, Bin Zhang, Wenling Wu Automatic Search for Linear Trails of the SPECK Family

Introduction Search Linear Trails Linear Cryptanalysis Against SPECK Linear Distinguishers An Implementation of Wallén’s Algorithm Key Recovery Attacks Summary Approximations of Modulo Addition Definition w ) � c � c ( � u ,� v ,� Z 2 . u · ( � Z 1 ⊞ � v · � w · � Z 2 ) ⊕ � Z 1 ⊕ � � v � w ⊞ � u Yuan Yao, Bin Zhang, Wenling Wu Automatic Search for Linear Trails of the SPECK Family

Introduction Search Linear Trails Linear Cryptanalysis Against SPECK Linear Distinguishers An Implementation of Wallén’s Algorithm Key Recovery Attacks Summary Linear Approximation Table Enumerate � u ,� v ,� w , calculate c ( � u ,� v ,� w ) , and sort. 2 3 n � 2 3 n � � � Time: O , Memory: O . Yuan Yao, Bin Zhang, Wenling Wu Automatic Search for Linear Trails of the SPECK Family