Basic Idea Guess And Determine Determine partial internal state by - PowerPoint PPT Presentation

Gain : Practical Key-Recovery Attacks on Round-Reduced PAEQ Dhiman Saha Sourya Kakarla Srinath Mandava Dipanwita Roy Chowdhury Crypto Research Lab, Department of Computer Science and Engineering, IIT Kharagpur, India { dhimans,skakarla,smandava,drc } @cse.iitkgp.ernet.in SPACE 2016 Hyderabad, India

Basic Idea Guess And Determine Determine partial internal state by guessing Use this to reduce state space of some other part ◮ Exploits limited diffusion ◮ Build upon guessing strategy to mount key-recovery or forgery ◮ Our motivation: Use this strategy on Authenticated Encryption Schemes ◮ Demonstrated by Boura et al. in FSE 2016 on π − cipher We look at CAESAR submission PAEQ

Authenticated Encryption Confidentiality + Authenticity Two at the cost of One!

Preliminaries Authenticated Encryption ◮ Conventionally, ◮ Encryption scheme → confidentiality ◮ Message Authentication Code (MAC) → authentication and message integrity Authenticated Cipher Tries to merge both these primitives preferably at the cost of one. ◮ Many attempts to build AE schemes ◮ Serious attacks on OpenSSL and TLS exploiting AE!!! ◮ Lack of proper understanding of the problem ◮ Inspired CAESAR competition

Preliminaries CAESAR CAESAR Competition for Authenticated Encryption: Security, Applicability, and Robustness ◮ A multi-year competition announced in 2014 ◮ Select final portfolio of AE schemes ◮ Possible standardization ◮ Benchmark: AES-GCM ◮ 57 accepted submissions ◮ Round 2 → 30 Candidates ◮ Round 3 → 15 Candidates (On-going) PAEQ was a Round 2 candidate at the time of this work

PAEQ Bio PAEQ ↔ Parallelizable Authenticated Encryption based on Quadrupled AES ◮ Introduced by Biryukov and Khovratovich in ISC 2014 ◮ Along with a new generic mode of operation PPAE ◮ Parallelizable Permutation-based Authenticated Encryption ◮ And an AES based permutation AESQ ◮ Security level up to 128 bits & higher, equal to the key length ◮ Third-party Cryptanalysis ◮ Fault Attack - Saha and Roy Chowdhury (CHES 2016) ◮ Rebound attack - Bagheri et al. (ACISP 2016)

Different PAEQ variants PAEQ | Key | | Nonce | | Tag | Security Extra Features 64 64 64 64-bit paeq-64 Primary paeq-80 80 80 80 80-bit sets paeq-128 128 96 128 128-bit Quick 64 64 512 64-bit paeq-64-t Tag Update Nonce-misuse + 64 128 512 64-bit paeq-64-tnm Tag Update Quick Secondary paeq-128-t 128 128 512 128-bit Tag Update sets Nonce-misuse + 128 256 512 128-bit paeq-128-tnm Tag Update 192 128 128 128-bit paeq-192 160 128 160 160-bit paeq-160 256 128 128 128-bit paeq-256

PAEQ Focus of Current Attack PAEQ | Key | | Nonce | | Tag | Security Extra Features 64 64 64 64-bit paeq-64 Primary 80 80 80 80-bit paeq-80 sets PAEQ 128 96 128 128-bit paeq-128 Quick 64 64 512 64-bit paeq-64-t Tag Update paeq-64 Nonce-misuse + 64 128 512 64-bit paeq-64-tnm Tag Update paeq-80 Quick Secondary 128 128 512 128-bit paeq-128-t Tag Update paeq-128 sets Nonce-misuse + 128 256 512 128-bit paeq-128-tnm Tag Update 192 128 128 128-bit paeq-192 paeq-64-t 160 128 160 160-bit paeq-160 256 128 128 128-bit paeq-256

AESQ The Internal Permutation ◮ Internal state size of 512 bits ◮ Comprises of 4 sub-states of 128 bits each ◮ Sub-states correspond to AES state matrix

Inside AESQ SB SRMC SB SRMC SB SRMC SB SRMC ◮ Composition of 20 round 1 2 3 4 functions SB SRMC SB SRMC SB SRMC SB SRMC 5 6 7 8 ◮ Shuffle operation after every 2 rounds ◮ Basically a Column permutation SB SRMC SB SRMC SB SRMC SB SRMC 9 10 11 12 SB SRMC SB SRMC SB SRMC SB SRMC 13 14 15 16 ◮ Round function almost similar to AES ◮ SubBytes ◮ ShiftRows ◮ MixColumns ◮ AddRoundConstants 4 Rounds of AESQ Fig. Source: PAEQ submission document

PAEQ Encryption

PAEQ Authentication

PAEQ Handling Associated Data

PAEQ Final Tag Generation

PAEQ Focus of This Work

PAEQ Encryption ( i th Branch) Input/Output of f ◮ Look at input of permutation ◮ 3 out of 4 inputs known ◮ Also P i ⊕ C i gives partial output of f Note: We have to deal with partially specified states Our Intuition Can we guess part of f output to recover the internal state?

Handling Partial States Byte-Entropy Notion of Byte-Entropy ( E ) The number of unknown bytes in the state/sub-state ◮ Byte-Entropy ◮ Unchanged under SubBytes ( β ), ShiftRows ( ρ ), AddRoundConstants ( α ) ◮ Might increase under Mixcolumns ( µ )

Some Observations on PAEQ

Observation 1 Look at first two rounds of AESQ

Observation 1 Limited Key Diffusion ◮ Recall: Round function works on individual substates ◮ Propagate permutation inputs forward for 2 Rounds ◮ Key diffusion limited to fourth substate

Observation 2 How far can we go forward from the input?

Propagate forward input of i th branch Observation 2

Observation 2 Apply Shuffle

Observation 2 Apply SubBytes, ShiftRows

Observation 2 Three-Fourth Rule Three-Fourth Rule Three-fourth of every column known before Mix-Columns of Round 3

Observation 3 How far can one invert if one of the substates is known?

Observation 3 Propagate Backward Assumption Attacker has knowledge of single substate after R n

Observation 3 Invert R n , R n − 1 Assumption Attacker has knowledge of single substate after R n

Observation 3 Apply Inverse Shuffle Assumption Attacker has knowledge of single substate after R n

Observation 3 Invert R n − 2 and α n − 3 Assumption Attacker has knowledge of single substate after R n

Observation 3 One-Fourth Inversion Implication Using one substate one can invert up to the state after R n − 3 Mix-Columns One-Fourth Inversion One-Fourth of every column known after inversion

Meet-in-the-middle When do Observations 2 and 3 converge?

Meet-in-the-middle Theorem (Meet-in-the-middle) For n = 6 , the Three-fourth Rule and One-Fourth Inversion strategy converge at the input and output of µ 3 respectively which results in a unique solution for input of µ 3 . ◮ Main result used in all attacks here

Gain − (G)uess (A)nd (In)vert Key Recovery Attacks

Gain Primary Aim How can we make the assumption in One-Fourth Inversion true from the observable part of output? ◮ Recall: At least one substate in output of Round 6 must be known/determined Strategy ◮ Identify which bytes to guess ◮ Combine Guess-and-Invert steps

Note What Attacker Actually Observes

6 - Round Attack Just Guess and Invert

Guess and Invert Gain - 6 Rounds ◮ Guess substate with minimum Byte-Entropy ◮ Invert and apply MITM Theorem ◮ Recover internal state = ⇒ Key Recovery ◮ Complexity?

7 - Round Attack Invert last round first

Invert-Guess-Invert Gain - 7 Rounds ◮ Invert last round first ◮ Note: Uniform Byte-Entropy for each PAEQ variant ◮ Next apply 6 round attack ◮ Complexity?

8 - Round Attack Guess, invert and repeat

Guess-Invert-Guess-Invert Gain - 8 Rounds ◮ Note: Last Shuffle has to be dropped for this to work ◮ Guess first then invert ◮ We get same Byte-Entropy for all PAEQ variants ◮ Next apply 6 round attack ◮ Complexity?

Complexities Gain Gain Complexities PAEQ Variant Security Level 6-Rounds 7-Rounds 8-Rounds 2 24 2 48 64-bit 1 paeq-64 2 16 2 32 2 48 80-bit paeq-80 2 32 2 40 2 48 128-bit paeq-128

Epilogue Gain ◮ Made some interesting observations on PAEQ ◮ Developed a meet-in-the-middle scenario using them ◮ Devised guess-and-determine strategies to satisfy the scenario ◮ Got Key-Recovery for up to 8 out of 20 rounds ◮ Practical complexities ◮ Current strategy cannot be extended beyond 8 rounds ◮ No other key-recovery attacks known News: 15th Aug 2016 PAEQ did not make it to Round 3!!!

Thanks! Queries crypto@dhimans.in