Introduction Three Easy, Automated Techniques Tools for Cryptography Conclusion Cryptanalysis of Symmetric-Key Primitives: Automated Techniques Nicky Mouha ESAT/COSIC, KU Leuven, Belgium IBBT, Belgium Summer School on Tools, Mykonos Tuesday, May 29, 2012 1 / 39
Introduction Three Easy, Automated Techniques Tools for Cryptography Conclusion Outline Introduction 1 Three Easy, Automated Techniques 2 MILP Programming SAT Solvers Regular Expressions Tools for Cryptography 3 Conclusion 4 2 / 39
Introduction Three Easy, Automated Techniques Tools for Cryptography Conclusion Symmetric-key Ciphers: Types of attacks Statistical attacks Linear and differential cryptanalysis, slide attacks,... Detect statistical non-randomness 3 / 39
Introduction Three Easy, Automated Techniques Tools for Cryptography Conclusion Symmetric-key Ciphers: Types of attacks Statistical attacks Linear and differential cryptanalysis, slide attacks,... Detect statistical non-randomness Meet-in-the-middle attacks Many techniques (splice-and cut, partial matching, partial fi xing,...), guess-and-determine attacks, attack on 2DES,... Separate equations into two or more groups to solve them more ef fi ciently 3 / 39
Introduction Three Easy, Automated Techniques Tools for Cryptography Conclusion Symmetric-key Ciphers: Types of attacks Statistical attacks Linear and differential cryptanalysis, slide attacks,... Detect statistical non-randomness Meet-in-the-middle attacks Many techniques (splice-and cut, partial matching, partial fi xing,...), guess-and-determine attacks, attack on 2DES,... Separate equations into two or more groups to solve them more ef fi ciently Algebraic attacks See next slide 3 / 39
Introduction Three Easy, Automated Techniques Tools for Cryptography Conclusion Algebraic Attacks: De fi nition Represent cryptographic primitive as system of equations Use equation solver to retrieve key 4 / 39
Introduction Three Easy, Automated Techniques Tools for Cryptography Conclusion Algebraic Attacks: De fi nition Represent cryptographic primitive as system of equations Use equation solver to retrieve key SAT solvers MiniSat2, CryptoMiniSat,... Gröbner basis method Buchberger’s algorithm, F 4 , F 5 ,... Mixed Integer Linear Programming (MILP) CPLEX, SYMPHONY,... 4 / 39
Introduction Three Easy, Automated Techniques Tools for Cryptography Conclusion Algebraic Attacks: De fi nition Represent cryptographic primitive as system of equations Use equation solver to retrieve key SAT solvers MiniSat2, CryptoMiniSat,... Gröbner basis method Buchberger’s algorithm, F 4 , F 5 ,... Mixed Integer Linear Programming (MILP) CPLEX, SYMPHONY,... Hopefully detects inherent structure, and solves equations faster than brute force! 4 / 39
Introduction Three Easy, Automated Techniques Tools for Cryptography Conclusion Algebraic Attacks: Advantages and Disadvantages Algebraic attacks on symmetric-key ciphers Biggest disadvantages : Can only fi nd practical attacks, no high-complexity attacks 5 / 39
Introduction Three Easy, Automated Techniques Tools for Cryptography Conclusion Algebraic Attacks: Advantages and Disadvantages Algebraic attacks on symmetric-key ciphers Biggest disadvantages : Can only fi nd practical attacks, no high-complexity attacks Execution time (and memory requirements): unpredictable 5 / 39
Introduction Three Easy, Automated Techniques Tools for Cryptography Conclusion Algebraic Attacks: Advantages and Disadvantages Algebraic attacks on symmetric-key ciphers Biggest disadvantages : Can only fi nd practical attacks, no high-complexity attacks Execution time (and memory requirements): unpredictable “Not a single proper block cipher has been broken using pure algebraic techniques faster than with other techniques.” (Albrecht) 5 / 39
Introduction Three Easy, Automated Techniques Tools for Cryptography Conclusion Algebraic Attacks: Advantages and Disadvantages Algebraic attacks on symmetric-key ciphers Biggest disadvantages : Can only fi nd practical attacks, no high-complexity attacks Execution time (and memory requirements): unpredictable “Not a single proper block cipher has been broken using pure algebraic techniques faster than with other techniques.” (Albrecht) Biggest advantages : “Black box” technique, no crypto knowledge required 5 / 39
Introduction Three Easy, Automated Techniques Tools for Cryptography Conclusion Algebraic Attacks: Advantages and Disadvantages Algebraic attacks on symmetric-key ciphers Biggest disadvantages : Can only fi nd practical attacks, no high-complexity attacks Execution time (and memory requirements): unpredictable “Not a single proper block cipher has been broken using pure algebraic techniques faster than with other techniques.” (Albrecht) Biggest advantages : “Black box” technique, no crypto knowledge required Can work with very few plaintext-ciphertext pairs 5 / 39
Introduction Three Easy, Automated Techniques Tools for Cryptography Conclusion Algebraic Attacks: Advantages and Disadvantages Algebraic attacks on symmetric-key ciphers Biggest disadvantages : Can only fi nd practical attacks, no high-complexity attacks Execution time (and memory requirements): unpredictable “Not a single proper block cipher has been broken using pure algebraic techniques faster than with other techniques.” (Albrecht) Biggest advantages : “Black box” technique, no crypto knowledge required Can work with very few plaintext-ciphertext pairs Useful to break extremely weak ciphers: Crypto-1 in 40s, HiTag2 in 6.5h on one Xeon E5345 @ 2.33GHz (Soos) 5 / 39
Introduction Three Easy, Automated Techniques Tools for Cryptography Conclusion Automated Techniques: Still Useful Tool to construct statistical and MitM attacks Therefore, program execution time: not so important 6 / 39
Introduction Three Easy, Automated Techniques Tools for Cryptography Conclusion Automated Techniques: Still Useful Tool to construct statistical and MitM attacks Therefore, program execution time: not so important Program: executed only once 6 / 39
Introduction Three Easy, Automated Techniques Tools for Cryptography Conclusion Automated Techniques: Still Useful Tool to construct statistical and MitM attacks Therefore, program execution time: not so important Program: executed only once More time spent on: coding, debugging, optimizing, parallel implementation, verifying,... Verifying correctness: very dif fi cult 6 / 39
Introduction Three Easy, Automated Techniques Tools for Cryptography Conclusion Automated Techniques: Still Useful Tool to construct statistical and MitM attacks Therefore, program execution time: not so important Program: executed only once More time spent on: coding, debugging, optimizing, parallel implementation, verifying,... Verifying correctness: very dif fi cult Programmer’s time: costs more than CPU time! 6 / 39
Introduction Three Easy, Automated Techniques Tools for Cryptography Conclusion Automated Techniques: Still Useful Tool to construct statistical and MitM attacks Therefore, program execution time: not so important Program: executed only once More time spent on: coding, debugging, optimizing, parallel implementation, verifying,... Verifying correctness: very dif fi cult Programmer’s time: costs more than CPU time! More important: Easy to program Easy to verify Easy to parallelize 6 / 39
Introduction Three Easy, Automated Techniques Tools for Cryptography Conclusion Goal of this lecture Use three easy, automated techniques MILP programming SAT solvers Regular expressions as tools to construct attacks ... and start breaking ciphers today! 7 / 39
Introduction MILP Programming Three Easy, Automated Techniques SAT Solvers Tools for Cryptography Regular Expressions Conclusion Outline Introduction 1 Three Easy, Automated Techniques 2 MILP Programming SAT Solvers Regular Expressions Tools for Cryptography 3 Conclusion 4 8 / 39
Introduction MILP Programming Three Easy, Automated Techniques SAT Solvers Tools for Cryptography Regular Expressions Conclusion Differential Cryptanalysis Differential characteristic a 1 a 2 Δ a b 1 b 2 Δ b c 1 c 2 Δ c Δ d d 1 d 2 9 / 39
Δ α Introduction MILP Programming Three Easy, Automated Techniques SAT Solvers Tools for Cryptography Regular Expressions Conclusion Differential Cryptanalysis: S-box Differential Probability DP ( Δ α → Δ β ) : # { 0 ≤ a < 2 8 : S ( a ) ⊕ S ( a ⊕ Δ α ) = Δ β } a a ⊕ Δ α 2 8 Max. diff. prob. (MDP): 4/256 = 2 − 6 S S AES: only component that is non-linear in GF ( 2 8 ) S ( a ) S ( a ⊕ Δ α ) Non-active S-box: DP ( 0 → 0 ) = 1 = Δ β ? Count active S-boxes! 10 / 39
Introduction MILP Programming Three Easy, Automated Techniques SAT Solvers Tools for Cryptography Regular Expressions Conclusion Representation of variables Every pair of bytes is “shrunk” to one bit x i : x i = 0 if the bytes are the same x i = 1 if the bytes are different 11 / 39
Introduction MILP Programming Three Easy, Automated Techniques SAT Solvers Tools for Cryptography Regular Expressions Conclusion Representation of variables Every pair of bytes is “shrunk” to one bit x i : x i = 0 if the bytes are the same x i = 1 if the bytes are different Note: simpli fi es the analysis! Our results prove lower bounds, but characteristics may contain a contradiction 11 / 39
Recommend
More recommend
