Block Cipher Cryptanalysis II: Block Cipher Cryptanalysis II: Linear - PowerPoint PPT Presentation

Block Cipher Cryptanalysis II: Block Cipher Cryptanalysis II: Linear Cryptanalysis yp y Andrey Bogdanov Andrey Bogdanov K.U.Leuven, ESAT/COSIC

Outline Outline • Distribution of Correlation • Data Complexity • Linear Hulls • Zero Correlation Linear Cryptanalysis • Related ‐ Key Linear Cryptanalysis Related Key Linear Cryptanalysis

Linear Cryptanalysis: Basics I Action of an n ‐ bit block cipher on plaintext P : Action of an n bit block cipher on plaintext P : Input and output linear masks: , Linear approximation : Probability of linear approximation: Correlation of linear approximation: Correlation of linear approximation:

Linear Cryptanalysis: Basics II • Since probability varies from 0 to 1, the correlation p y , varies from ‐ 1 to 1 • For probability 1/2, one gets correlation 0 • Of course, there is much more behind the notion of correlation – correlation matrices [D94]

Linear Cryptanalysis: Distribution of Correlation I • Fix a non ‐ trivial approximation • Randomly choose an n ‐ bit permutation • What is the probability for to have a particular value? [O94] particular value? [O94] • Normal approximation [DR07]:

Linear Cryptanalysis: Distribution of Correlation I • Fix an n ‐ bit permutation Fi bi i • What is the probability for to have a particular value? [BT11, work in progress] i l l ? [BT11 k i ] • Normal approximation: • The distribution holds already for just a single randomly picked permutation with n=8 y p p (experiments)

Linear Cryptanalysis: Distribution of Correlation II • Which correlations are in basic linear cryptanalysis exploitable? – Very roughly speaking, those with – About 68.5% of linear approximations do not fulfill that • In basic linear attacks, this has to hold for (at least) a large part of the key space, once the linear approximation is fixed – Not the case for a randomly picked block cipher y p p • The average proportion of linear approximations with e.g. with e.g. is still relatively high is still relatively high

Linear Cryptanalysis: Distribution of Correlation III • Two more observations: – Zero is the most frequent single correlation value – For a randomly drawn permutation, a non ‐ trivial linear approximation is unlikely to have correlation linear approximation is unlikely to have correlation significantly deviating from 0 • For permutations with structure however non ‐ trivial • For permutations with structure, however, non ‐ trivial linear approximations with high deviation of correlation might exist for each key correlation might exist for each key

Linear Cryptanalysis: Procedure [M93] • Let a linear approximation be over all but L li i i b ll b last round of an iterative block cipher last round all but last round with key k • N PC ‐ pairs given for right key k 0 • For each key guess of the last round k i , partially decrypt from C to V in each PC ‐ pair and count the number of times T i the approximation is satisfied ti fi d • We want T 0 (corresponding to right key k 0 ) to deviate f from N/2 significantly N/2 i ifi tl

Linear Cryptanalysis: Advantage [S08] • For instance, we want T 0 be among the top counters T i for p>1/2 • Say, we guess m bits in the last round key, i.e. there are candidates • Advantage a is m – r , i.e., the number of bits gained

Linear Cryptanalysis: Data Complexity [S08] • If (essential assumptions) – Counters T i are independent – For wrong key guesses, approximation has correlation 0 has correlation 0 – N and m are sufficiently large • Then for s ccess probabilit P • Then for success probability P S

Linear Cryptanalysis: Linear Hulls I • Iterative structure of a block cipher: • Correlation of a linear approximation over one round one round : : Linear trail Linear trail : …

Linear Cryptanalysis: Linear Hulls II [N94], [D94], [DR02] • Linear hull = linear approximation of an iterative block cipher • Linear hull contains many linear trails U • Each U has its correlation contribution C U Each U has its correlation contribution C U • Correlation of linear hull

Linear Cryptanalysis: Linear Hulls III Rounds in a key ‐ alternating block cipher look like: S S S S S S S S S S S S S S S S Key schedule map Linear diffusion S S S S S S S S Key schedule map Key schedule map Linear diffusion

Linear Cryptanalysis: Linear Hulls IV [D94], [DR02] • The correlation of a linear hull in a key ‐ alternating block cipher can be computed as – d U is the sign of correlation contribution for key 0 – K is the expanded key K is the expanded key – The sum is over all compatible linear trails • Thus the correlation value varies due to the key only • Thus, the correlation value varies due to the key only

Linear Cryptanalysis: Linear Hulls V [L11], [O09] • For vast classes of keys, the correlation value can deviate greatly from the average over all keys • Correlation amplification [O09] for PRESENT

Linear Cryptanalysis: Some Extensions • Zero correlation linear cryptanalysis yp y – Linear approximations with probability 1/2 • Related ‐ key linear cryptanalysis – Equal correlations under different keys – For key ‐ alternating ciphers with simple key For key alternating ciphers with simple key schedule

Linear Cryptanalysis: Zero Correlation I [BR11] • Standard linear cryptanalysis tries to make use of S d d li l i i k f linear approximations with highly nonzero correlation values correlation values • Zero correlation linear cryptanalysis uses linear Z l i li l i li approximations with correlation exactly zero • It is the counterpart of impossible differential cryptanalysis in the domain of linear cryptanalysis t l i i th d i f li t l i • Cf. [ER10], [CS11], [RN11]

Linear Cryptanalysis: Zero Correlation II [BR11] • Zero correlation linear hulls exist in many popular cipher constructions • Feistel networks CAST256 Balanced Feistel Skipjack CLEFIA

Linear Cryptanalysis: Zero Correlation III [BR11]

Linear Cryptanalysis: Zero Correlation IV [BR11] • For each subkey guess: – Partially decrypt the ciphertext and encrypt the plaintext up to the boundaries of the zero correlation linear hull – Evaluate the correlation value C – If C=0 , the subkey guess survives the test • Low probability that a wrong key exhibits zero correlation • Exact evaluation of correlation needed for this • Exact evaluation of correlation needed for this distinguisher

Linear Cryptanalysis: Zero Correlation V [BR11] • Round ‐ reduced AES ‐ 192 and AES ‐ 256: Round reduced AES 192 and AES 256:

Linear Cryptanalysis: Related ‐ Key I [BR11] • The attack uses the properties of linear hulls for key ‐ Th k h i f li h ll f k alternating block ciphers • Differential related ‐ key model: – Adversary supplies two unknown keys with a specified known difference • Distinguisher is based on the equality for correlations C=C’ under two distinct keys K and K’ C=C under two distinct keys K and K • Cf. [K06], [BDK07], [ZWZF06] Cf [K06] [BDK07] [ZWZF06]

Linear Cryptanalysis: Related ‐ Key II [BR11] • For two randomly drawn permutations and a fixed linear hull, their correlations are equal C=C’ with a probability of about • Now, if we choose a relation between keys K and K’ in a way that C C’ deterministically we have a in a way that C=C’ deterministically, we have a distinguisher based on correlation evaluation

Linear Cryptanalysis: Related ‐ Key III [BR11] • Correlation for a key ‐ alternating cipher under two expanded keys: • The difference of two correlations:

Linear Cryptanalysis: Related ‐ Key IV [BR11] A way to turn the sum to 0 is to make each summand 0: with ith Th Thus, if for each linear trail in the hull, then if f h li t il i th h ll th

Linear Cryptanalysis: Related ‐ Key V [BR11] • 5 rounds of AES ‐ 256 are distinguishable using this fact, since AES ‐ 256 is a key ‐ alternating block cipher with relatively sparse key schedule • Key difference • Input/output masks /

Linear Cryptanalysis: Related ‐ Key VI [BR11] • 5 rounds of AES ‐ 256 • This exhibits C=C’ for every pair of keys with the specified difference • To distinguish, exact evaluation of C and C’ is needed g ,

Linear Cryptanalysis: Selected Further Topics • Linear cryptanalysis with multiple linear approximations [HCN08], [HCN09], [GT09], pp [ ] [ ] [ ] [HN10] • Equivalence to some saturation attacks [L11] • Equivalence to some saturation attacks [L11] • Related ‐ key differential ‐ linear attacks [BDK06], [K06] • Experiments with linear approximations • Experiments with linear approximations [CSQ08], [CS10]

Linear Cryptanalysis: Selected Open Problems • Provable bounds on ELP for real ‐ world ciphers • Linear hull effect for real ‐ world ciphers Linear hull effect for real world ciphers • Reduction of data requirements for zero correlation linear cryptanalysis l i li l i • More linear techniques in related ‐ key attacks q y • More precise models for attack complexity estimations in linear attacks ti ti i li tt k