Design Strategies for ARX with Provable Bounds: SPARX and LAX Daniel Dinu 1 , Léo Perrin 1 , Aleksei Udovenko 1 , Vesselin Velichkov 1 , Johann Großschädl 1 , Alex Biryukov 1 1 SnT, University of Luxembourg https://www.cryptolux.org December 7, 2016 ASIACRYPT
Design of an ARX-cipher (allegory) source: Wiki Commons Can we use ARX and have provable bounds? Block Cipher Design )︃ # active S-Boxes (︃ ∆ S P difg ≤ 2 b Design of an S-Box based SPN (wide-trail strategy) Cryptolux Team SPARX and LAX 1 / 24
Can we use ARX and have provable bounds? Block Cipher Design )︃ # active S-Boxes (︃ ∆ S P difg ≤ 2 b Design of an ARX-cipher Design of an S-Box based SPN (allegory) (wide-trail strategy) source: Wiki Commons Cryptolux Team SPARX and LAX 1 / 24
Block Cipher Design )︃ # active S-Boxes (︃ ∆ S P difg ≤ 2 b Design of an ARX-cipher Design of an S-Box based SPN (allegory) (wide-trail strategy) source: Wiki Commons Can we use ARX and have provable bounds? Cryptolux Team SPARX and LAX 1 / 24
Talk Outline Outline 1 The Long-Trail Strategy 2 The SPARX Family of LW-BC Methodology Results 3 The LAX Approach 4 Conclusion Cryptolux Team SPARX and LAX 2 / 24
The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion Plan 1 The Long-Trail Strategy The Wide Trail Strategy ARX-Boxes The Long Trail Strategy 2 The SPARX Family of LW-BC Methodology Results 3 The LAX Approach 4 Conclusion Cryptolux Team SPARX and LAX 2 / 24
Used to design the AES! Application to ARX Can we use this to build an ARX-based cipher? The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion The Wide Trail Strategy (WTS) Wide Trail Argument MEDCP ( F r ) ≤ p S a ( r ) MEDCP ( F r ) = max ( P [ any trail covering r rounds of F ]) P [ S ( x ⊕ c ) ⊕ S ( x ) = d ] ≤ p S # { active S-Boxes on r rounds } ≥ a ( r ) Cryptolux Team SPARX and LAX 3 / 24
Application to ARX Can we use this to build an ARX-based cipher? The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion The Wide Trail Strategy (WTS) Wide Trail Argument MEDCP ( F r ) ≤ p S a ( r ) MEDCP ( F r ) = max ( P [ any trail covering r rounds of F ]) P [ S ( x ⊕ c ) ⊕ S ( x ) = d ] ≤ p S # { active S-Boxes on r rounds } ≥ a ( r ) Used to design the AES! Cryptolux Team SPARX and LAX 3 / 24
The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion The Wide Trail Strategy (WTS) Wide Trail Argument MEDCP ( F r ) ≤ p S a ( r ) MEDCP ( F r ) = max ( P [ any trail covering r rounds of F ]) P [ S ( x ⊕ c ) ⊕ S ( x ) = d ] ≤ p S # { active S-Boxes on r rounds } ≥ a ( r ) Used to design the AES! Application to ARX Can we use this to build an ARX-based cipher? Cryptolux Team SPARX and LAX 3 / 24
Parameter Search Rotations 7 2 Second best crypto properties, lightest Indeed NSA design strategy (see DAC’15). The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion ARX-Boxes (1/2) SPECKEY ⊕ 1 Start from SPECK-32 ≫ 7 2 XOR key in full state (Markov assumption) ⊞ 3 Find best trails ≪ 2 ⊕ SPECKEY. Cryptolux Team SPARX and LAX 4 / 24
The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion ARX-Boxes (1/2) SPECKEY ⊕ 1 Start from SPECK-32 ≫ 7 2 XOR key in full state (Markov assumption) ⊞ 3 Find best trails ≪ 2 Parameter Search ⊕ Rotations 7 , − 2 Second best crypto properties, lightest SPECKEY. Indeed NSA design strategy (see DAC’15). Cryptolux Team SPARX and LAX 4 / 24
The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion ARX-Boxes (2/2) Difgerential/Linear bounds r 1 2 3 4 5 6 7 8 9 10 MEDCP ( A r ) − 0 − 1 − 3 − 5 − 9 − 13 − 18 − 24 − 30 − 34 MELCC ( A r ) − 0 − 0 − 1 − 3 − 5 − 7 − 9 − 12 − 14 − 17 Maximum expected difgerential characteristic probabilities (MEDCP) and maximum expected absolute linear characteristic correlations (MELCC) of SPECKEY ( log 2 scale); r is the number of rounds. Cryptolux Team SPARX and LAX 5 / 24
The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion Notations k 0 k 0 ⊕ ⊕ L R ≫ 7 A ⊞ k r − 1 k r − 1 ⊕ ⊕ L R ≪ 2 A ⊕ A r k . A . Cryptolux Team SPARX and LAX 6 / 24
Active ARX-Boxes: a 2 s 5 s , log 2 MEDCP A 4 5 MEDCP A 4 log 2 P difg. trail on 2s steps 5 s log 2 P difg. trail on 2s steps 25 s Need 2 128 25 12 steps, i.e. 48 ARX rounds! The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion Naive Approach S-Box: A 4 ; Linear layer: 128-bit MixColumns. A 4 k A 4 k A 4 k A 4 k 1 step MixColumns A 4 k A 4 k A 4 k A 4 k MixColumns Cryptolux Team SPARX and LAX 7 / 24
MEDCP A 4 log 2 P difg. trail on 2s steps 5 s log 2 P difg. trail on 2s steps 25 s Need 2 128 25 12 steps, i.e. 48 ARX rounds! The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion Naive Approach S-Box: A 4 ; Linear layer: 128-bit MixColumns. A 4 k A 4 k A 4 k A 4 k 1 step Active ARX-Boxes: MixColumns a ( 2 s ) ≥ 5 s , A 4 k A 4 k A 4 k A 4 k MEDCP ( A 4 ) (︁ )︁ log 2 = − 5 MixColumns Cryptolux Team SPARX and LAX 7 / 24
Need 2 128 25 12 steps, i.e. 48 ARX rounds! The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion Naive Approach S-Box: A 4 ; Linear layer: 128-bit MixColumns. A 4 k A 4 k A 4 k A 4 k 1 step Active ARX-Boxes: MixColumns a ( 2 s ) ≥ 5 s , A 4 k A 4 k A 4 k A 4 k MEDCP ( A 4 ) (︁ )︁ log 2 = − 5 MixColumns log 2 ( P [ difg. trail on 2s steps ]) ≤ 5 s × MEDCP ( A 4 ) log 2 ( P [ difg. trail on 2s steps ]) ≤ − 25 s Cryptolux Team SPARX and LAX 7 / 24
The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion Naive Approach S-Box: A 4 ; Linear layer: 128-bit MixColumns. A 4 k A 4 k A 4 k A 4 k 1 step Active ARX-Boxes: MixColumns a ( 2 s ) ≥ 5 s , A 4 k A 4 k A 4 k A 4 k MEDCP ( A 4 ) (︁ )︁ log 2 = − 5 MixColumns log 2 ( P [ difg. trail on 2s steps ]) ≤ 5 s × MEDCP ( A 4 ) log 2 ( P [ difg. trail on 2s steps ]) ≤ − 25 s Need 2 ⌈ 128 / 25 ⌉ = 12 steps, i.e. 48 ARX rounds! Cryptolux Team SPARX and LAX 7 / 24
A New Hope log 2 MEDCP A 4 5 log 2 MEDCP A 8 24 5 2 The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion Drawbacks The Wide Trail Strategy fails here Two (bad) options: 1 design a very weak cipher, or 2 design a very slow cipher. Cryptolux Team SPARX and LAX 8 / 24
The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion Drawbacks The Wide Trail Strategy fails here Two (bad) options: 1 design a very weak cipher, or 2 design a very slow cipher. A New Hope (︁ MEDCP ( A 4 ) )︁ log 2 = − 5 MEDCP ( A 8 ) (︁ )︁ log 2 = − 24 ≪ − 5 × 2 Cryptolux Team SPARX and LAX 8 / 24
we can use MEDCP A 12 instead of 3 . MEDCP A 4 We can use MEDCP A 8 instead of 2 . MEDCP A 4 If left half has zero difgerences, The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion Better Approach A 4 k A 4 k A 4 k A 4 k ⊕ ℓ New linear layer “chaining” ⊕ ARX-Boxes. A 4 k A 4 k A 4 k A 4 k ⊕ ℓ ⊕ A 4 k A 4 k A 4 k A 4 k Cryptolux Team SPARX and LAX 9 / 24
we can use MEDCP A 12 instead of 3 . MEDCP A 4 We can use MEDCP A 8 instead of 2 . MEDCP A 4 If left half has zero difgerences, The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion Better Approach A 4 k A 4 k A 4 k A 4 k ⊕ ℓ New linear layer “chaining” ⊕ ARX-Boxes. A 4 k A 4 k A 4 k A 4 k ⊕ ℓ ⊕ A 4 k A 4 k A 4 k A 4 k Cryptolux Team SPARX and LAX 9 / 24
we can use MEDCP A 12 instead of 3 . MEDCP A 4 If left half has zero difgerences, The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion Better Approach A 4 k A 4 k A 4 k A 4 k ⊕ ℓ New linear layer “chaining” ⊕ ARX-Boxes. We can use MEDCP ( A 8 ) instead of A 4 k A 4 k A 4 k A 4 k )︁ 2 . MEDCP ( A 4 ) (︁ ⊕ ℓ ⊕ A 4 k A 4 k A 4 k A 4 k Cryptolux Team SPARX and LAX 9 / 24
we can use MEDCP A 12 instead of 3 . MEDCP A 4 The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion Better Approach A 4 k A 4 k A 4 k A 4 k ⊕ ℓ New linear layer “chaining” ⊕ ARX-Boxes. We can use MEDCP ( A 8 ) instead of A 4 k A 4 k A 4 k A 4 k )︁ 2 . MEDCP ( A 4 ) (︁ If left half has zero ⊕ ℓ difgerences, ⊕ A 4 k A 4 k A 4 k A 4 k Cryptolux Team SPARX and LAX 9 / 24
The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion Better Approach A 4 k A 4 k A 4 k A 4 k ⊕ ℓ New linear layer “chaining” ⊕ ARX-Boxes. We can use MEDCP ( A 8 ) instead of A 4 k A 4 k A 4 k A 4 k )︁ 2 . MEDCP ( A 4 ) (︁ If left half has zero ⊕ ℓ difgerences, we can use ⊕ MEDCP ( A 12 ) instead of )︁ 3 . (︁ MEDCP ( A 4 ) A 4 k A 4 k A 4 k A 4 k Cryptolux Team SPARX and LAX 9 / 24
Defjnition (Truncated Trail) 0 1 4 : 1 if ARX-Box i is active, else 0. A sequence of values in The Long-Trail Strategy The SPARX Family of LW-BC The LAX Approach Conclusion The Long Trail Argument (1/2) Defjnition (Long Trail) A Long Trail (LT) is a trail covering several ARX-Boxes without receiving any outside difgerence. Can be static (probability = 1) or dynamic (depends on the trail). Cryptolux Team SPARX and LAX 10 / 24
Recommend
More recommend
