Boomerang Connectivity Table Revisited Ling Song 1,2 , Xianrui Qin 3 - PowerPoint PPT Presentation

Boomerang Connectivity Table Revisited Ling Song 1,2 , Xianrui Qin 3 , Lei Hu 2 1. Nanyang Technological University, Singapore 2. Institute of Information Engineering, CAS, China 3. Shandong University, China FSE 2019 @ Paris

Boomerang Attacks Proposed by [Wag99] to 𝑄 𝑄 3 1 combine two diff. trails: 𝛽 𝛽 𝑄 2 𝑄 𝐹 0 𝐹 0 4 • 𝐹 0 : Pr 𝛽 → 𝛾 = 𝑞 𝛿 • 𝐹 1 : Pr 𝛿 → 𝜀 = 𝑟 𝐹 0 𝐹 0 𝛾 Distinguishing probability: 𝛾 𝐹 1 𝐹 1 𝑞 2 𝑟 2 𝛿 𝐹 1 𝐹 1 𝜀 𝐷 1 𝐷 3 𝐷 2 𝜀 𝐷 4 2 /24

Boomerang Attacks Proposed by [Wag99] to 𝑄 𝑄 3 1 combine two diff. trails: 𝛽 𝛽 𝑄 2 𝑄 𝐹 0 𝐹 0 4 • 𝐹 0 : Pr 𝛽 → 𝛾 = 𝑞 𝛿 • 𝐹 1 : Pr 𝛿 → 𝜀 = 𝑟 𝐹 0 𝐹 0 𝛾 Distinguishing probability: 𝛾 𝐹 1 𝐹 1 𝑞 2 𝑟 2 𝛿 𝐹 1 𝐹 1 Bo Boomer merang ang at attacks tacks: When you 𝜀 𝐷 1 𝐷 3 send it properly, it always comes back to you. 𝐷 2 𝜀 𝐷 4 https://www.australiathegift.com.au/shop/boomerang-with-stand/ 2 /24

Boomerang Attacks Proposed by [Wag99] to 𝑄 𝑄 3 1 combine two diff. trails: 𝛽 𝛽 𝑄 2 𝑄 𝐹 0 𝐹 0 4 • 𝐹 0 : Pr 𝛽 → 𝛾 = 𝑞 𝛿 • 𝐹 1 : Pr 𝛿 → 𝜀 = 𝑟 𝐹 0 𝐹 0 𝛾 Distinguishing probability: 𝛾 𝐹 1 𝐹 1 𝑞 2 𝑟 2 𝛿 𝐹 1 𝐹 1 Bo Boomer merang ang at attacks tacks: When you 𝜀 𝐷 1 𝐷 3 send it properly, it always comes back to you. 𝐷 2 𝜀 𝐷 4 https://www.australiathegift.com.au/shop/boomerang-with-stand/ [Wag99]: Assumed two trails are independent . 2 /24 NOT always correct

Two Trails in Boomerang Attacks Dependency can help attackers [BDD03]: Middle-round S-box trick • [BK09]: Boomerang switch: Ladder switch / • Feistel switch / S-box switch Dependency can spoil attacks. [Mer09]: Incompatible trails • 3 /24

Sandwich Attacks [DKS10] 𝑄 𝑄 3 1 𝛽 𝛽 Decompose the cipher into 𝑄 2 𝑄 ෨ ෨ 𝐹 0 𝐹 0 4 three parts ෨ ෨ 𝐹 0 𝐹 0 • 𝐹 𝑛 handles the dependency. 𝑦 1 𝑦 3 𝛾 𝛾 ෨ 𝐹 𝑛 𝐹 𝑛 𝐹 0 ← 𝐹 0 \𝐹 𝑛 : Pr 𝛽 → 𝛾 = ෤ 𝑞 • 𝑦 2 𝑦 4 𝑧 1 𝑧 3 𝛿 ෨ 𝐹 1 ← 𝐹 1 \𝐹 𝑛 : Pr 𝛿 → 𝜀 = ෤ 𝑟 • 𝐹 𝑛 𝐹 𝑛 𝑧 2 𝑧 4 ෨ ෨ 𝐹 1 𝐹 1 𝛿 Distinguishing probability: ෨ ෨ 𝐹 1 𝐹 1 𝜀 𝐷 3 𝐷 1 𝑞 2 ෤ 𝑟 2 𝑠 ෤ 𝜀 𝐷 2 𝐷 4 4 /24

Sandwich Attacks [DKS10] 𝑄 𝑄 3 1 𝛽 𝛽 Decompose the cipher into 𝑄 2 𝑄 ෨ ෨ 𝐹 0 𝐹 0 4 three parts ෨ ෨ 𝐹 0 𝐹 0 • 𝐹 𝑛 handles the dependency. 𝑦 1 𝑦 3 𝜸? 𝛾 ෨ 𝐹 𝑛 𝐹 𝑛 𝐹 0 ← 𝐹 0 \𝐹 𝑛 : Pr 𝛽 → 𝛾 = ෤ 𝑞 • 𝑦 2 𝑦 4 𝑧 1 𝑧 3 𝛿 ෨ 𝐹 1 ← 𝐹 1 \𝐹 𝑛 : Pr 𝛿 → 𝜀 = ෤ 𝑟 • 𝐹 𝑛 𝐹 𝑛 𝑧 2 𝑧 4 ෨ ෨ 𝐹 1 𝐹 1 𝛿 Distinguishing probability: ෨ ෨ 𝐹 1 𝐹 1 𝜀 𝐷 3 𝐷 1 𝑞 2 ෤ 𝑟 2 𝑠 ෤ 𝜀 𝐷 2 𝐷 4 𝑠 = Pr[𝑦 3 ⊕ 𝑦 4 = 𝛾|(𝑦 1 ⊕ 𝑦 2 = 𝛾)⋀(𝑧 1 ⊕ 𝑧 3 = 𝛿)⋀(𝑧 2 ⊕ 𝑧 4 = 𝛿)] 4 /24

BCT [CHP+18] Boomerang Connectivity Table (BCT) Calculate 𝑠 theoretically when 𝐹 𝑛 is composed of a • single S−box layer . Unify previous observations on the S-box (incompa- • tibilities and switches) 𝑦 1 𝑦 3 𝛽 𝛽 𝑦 2 𝑦 4 𝑇 𝑇 𝑇 𝑇 𝛾 𝑧 1 𝑧 3 𝑧 2 𝑧 4 𝛾 5 /24

Our Work Motivation The actual boundaries of 𝐹 𝑛 which contains • dependency How to calculate 𝑠 when 𝐹 𝑛 contains multiple • rounds? Contribution Generalized framework of BCT • – Determine the boundaries of 𝐹 𝑛 Calculate 𝑠 of 𝐹 𝑛 in the sandwich attack – 6 /24

DDT: Difference Distribution Table 𝐸𝐸𝑈 𝛽, 𝛾 = #{𝑦 ∈ {0,1} 𝑜 |𝑇 𝑦 ⨁𝑇 𝑦⨁𝛽 = 𝛾 } 𝛾 𝛽 SKINNY’s 4 -bit S-box 7 /24

BCT: Boomerang Connectivity Table 𝐶𝐷𝑈 𝛽, 𝛾 = #{𝑦 ∈ {0,1} 𝑜 |𝑇 −1 (𝑇 𝑦 ⊕ 𝛾)⨁𝑇 −1 (𝑇 𝑦⨁𝛽 ⊕ 𝛾) = 𝛽 } 𝛾 𝑦 1 𝑦 3 𝛽 𝛽 𝑦 2 𝑦 4 𝑇 𝑇 𝛾 𝑇 𝑇 𝑧 1 𝑧 3 𝛾 𝑧 2 𝑧 4 𝛽 SKINNY’s 4 -bit S-box 8 /24

Relation between DDT and BCT Let 9 /24

Relation between DDT and BCT Let 9 /24

Relation between DDT and BCT Let Eq. 1 can be re-written as 9 /24

New Explanation of BCT 𝑠 for 𝐹 𝑛 with one S-box layer at the boundary of E 0 and E 1 10 /24

New Explanation of BCT 𝑠 for 𝐹 𝑛 with one S-box layer at the boundary of E 0 and E 1 Similarly, 10 /24

New Explanation of BCT 𝑠 for 𝐹 𝑛 with one S-box layer at the boundary of E 0 and E 1 Similarly, In this case, 𝛽 and 𝛾 are regarded as fixed. 10 /24

Generalization: S-box in E 0 or E 1 Upper crossing difference Lower crossing difference S-box in E 0 S-box in E 1 11 /24

Generalization: S-box in E 0 or E 1 Upper crossing difference Lower crossing difference S-box in E 0 S-box in E 1 What if 𝛽 or 𝛾 (crossing differences) are not fixed? 11 /24

Generalization: S-box in E 0 12 /24

Generalization: S-box in E 0 (1) 𝛾 is independent of the upper trail 12 /24

Generalization: S-box in E 0 (1) 𝛾 is independent of the upper trail (2) 𝛾 is uniformly distributed which becomes identical to 𝑞 2 𝑟 2 in the classical boomerang attack. 12 /24

Generalization: S-box in E 1 (1) 𝛽 is independent of the lower trail (2) 𝛽 is uniformly distributed which becomes identical to 𝑞 2 𝑟 2 in the classical boomerang attack. 13 /24

Generalization: Interrelated S-boxes Lower crossing diff. ( 𝛾 ) of A comes from B. Upper crossing diff. ( 𝛽′ ) of B comes from A. S-boxes A and B are interrelated. 14 /24

Generalization: Interrelated S-boxes Lower crossing diff. ( 𝛾 ) of A comes from B. Upper crossing diff. ( 𝛽′ ) of B comes from A. S-boxes A and B are interrelated. 14 /24

Generalization: Interrelated S-boxes Lower crossing diff. ( 𝛾 ) of A comes from B. Upper crossing diff. ( 𝛽′ ) of B comes from A. S-boxes A and B are interrelated. 14 /24

Generalized Framework of BCT 𝑚𝑏𝑡𝑢 . 𝑔𝑗𝑠𝑡𝑢 ||𝐹 0 1. Initialization: 𝐹 𝑛 ← 𝐹 1 𝐹 0 𝛾 −⇢ , ⇠ −(𝛿 ← 𝐹 1 𝜀) . 𝐹 1 𝐹 0 2. Extend both trails: 𝛽 → Pr = 1 Pr = 1 3. Prepend 𝐹 𝑛 with one more round a) If the lower crossing differences are distributed uni formly, peel off the first round and go to Step 4. b) Go to Step 3 4. Append 𝐹 𝑛 with one more round a) If the upper crossing differences are distributed uni formly, peel off the last round and go to Step 5. b) Go to Step 4. 5. Calculate r using formulas in the previous slides Boundaries of 𝐹 𝑛 : where crossing differences are distr ibuted (almost) uniformly. 15 /24

Applications Re-evaluate prob of four BM dist. of SKINNY 𝑞 2 ො Prev: prob evaluated by Ƹ 𝑟 2 • New: prob evaluated by the generalized BCT • Construct related-subkey BM dist. Of AES-128 Prev: related-subkey BM dist. Of AES-192/256 • New: 6-round related-subkey BM dist. Of AES- • 128 with 2 −109.42 16 /24

SKINNY SKINNY [BJK+16] is an SPN cipher, with a linear key schedule. SKINNY-n-t where n is block size and t • tweakey size Example 𝐹 𝑛 of SKINNY-64-128 in the related- tweakey setting Upper trail: 2 rounds, 2 −8 • Lower trail: 4 rounds, 2 −14 • 𝑞 2 𝑟 2 = 2 −44 • 17 /24

𝑭 𝒏 with 6 Middle Rounds Rd Diff before and after SB ∆K ∇ K Pr. R1 2 −2 0,0,0,0, 0,0,0,0, 0,0,0,b, 0,0,0,0 0,0,0,0, 0,0,0,0 b,0,0,0, 0,0,0,0 0,0,0,0, 0,0,0,0, 0,0,0,1, 0,0,0,0 R2 2 −2∗3 0,1,0,0, 0,0,0,0, 0,1,0,0, 0,1,0,0 0,0,0,0, 0,c,0,0 0,0,0,0, 5,0,0,0 0,8,0,0, 0,0,0,0, 0,8,0,0, 0,8,0,0 R3 2 −2 0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,2 0,0,0,0, 0,0,0,0 0,0,3,0, 0,0,0,0 0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,3 R4 2 −3∗2 0,0,0,0, 0,0,3,0, 0,0,0,0, 0,0,3,0 0,0,0,3, 0,0,0,0 0,0,0,0, 0,0,9,0 0,0,0,0, 0,0,d,0, 0,0,0,0, 0,0,c,0 R5 2 −2∗2 0,c,0,0, 0,0,0,0, 0,0,0,4, 0,0,0,0 0,0,0,0, 0,0,0,0 0,0,0,0, 2,0,0,0 0,2,0,0, 0,0,0,0, 0,0,0,2, 0,0,0,0 R6 2 −2 0,0,0,0, 0,2,0,0, 0,0,0,0, 0,0,0,0 0,0,0,0, 0,0,0,d 0,0,0,0, 0,1,0,0 0,0,0,0, 0,1,0,0, 0,0,0,0, 0,0,0,0 18 /24

Evaluation of 𝒔 Rounds 𝑠 (new) 𝒒 𝟑 𝒓 𝟑 𝒒 𝟑 ෝ 𝒓 𝟑 ෝ 1+1 2 −16 2 −8.41 2 −2 2+1 … 2 −20 2 −2.79 2+2 … 2 −32 2 −5.69 2+3 … 2 −40 2 −10.56 2+4 2 −44 2 −29.91 2 −12.96 Experiments confirm the results of 𝑠 . 19 /24

Ƹ Summary of the results on SKINNY Prob. of BM dist. and comparison 𝑭 = ෩ 𝑭 𝟐 ∘ 𝑭 𝒏 ∘ ෩ 𝑭 𝒏 𝑭 𝟏 Ver. n 𝑞 2 ෤ 𝑞 2 ො 𝑟 2 [LGS17] 𝑟 2 𝑠 | 𝑭 𝒏 | 𝑠 | 𝐹 | ෤ 2 −12.96 2 −48.72 2 −29.78 64 6(13) 17 n-2n 2 −11.45 2 −103.84 2 −77.83 128 5(12) 18 2 −10.50 2 −54.94 2 −42.98 64 5(17) 22 n-3n 2 −9.88 2 −76.84 2 −48.30 128 5(17) 22 Take seconds to calculate 𝑠 • 20 /24