Differential propagation analysis of Keccak Joan Daemen and Gilles - PowerPoint PPT Presentation

Differential propagation analysis of Keccak Differential propagation analysis of Keccak Joan Daemen and Gilles Van Assche STMicroelectronics Fast Software Encryption, March 19-21, 2012 1 / 28

Differential propagation analysis of Keccak Outline 1 Introduction 2 Trails in Keccak - f 3 Generating all trails up to some weight 4 Illustration 5 Conclusions 2 / 28

Differential propagation analysis of Keccak Introduction Outline 1 Introduction 2 Trails in Keccak - f 3 Generating all trails up to some weight 4 Illustration 5 Conclusions 3 / 28

Differential propagation analysis of Keccak Introduction Differential trails and iterated mappings Differential trails in iterated mappings Trail: sequence of differences 4 / 28 DP ( Q ) : fraction of pairs that exhibit q i differences

Differential propagation analysis of Keccak Introduction Differential trails and iterated mappings Differential trails and weight 5 / 28 w = − log 2 ( DP ) If independent rounds and w ( Q ) < b : # pairs ( Q ) ≈ 2 b − w ( Q )

Differential propagation analysis of Keccak Introduction …but proving strong lower bounds also cryptanalysis seems hard Keccak : weak alignment revert to pre-DC/LC folklore such as avalanche effect no strong trail weight bounds ARX still, truncated trails, rebound attack, … easy demonstration of strong trail weight bounds Rijndael-inspired: strong alignment Different design approaches Design approaches 6 / 28 estimating # pairs ( Q ) from Q : easy estimating # pairs ( Q ) from Q : hard # pairs ( Q ) from Q : easy

Differential propagation analysis of Keccak Introduction Round function with 5 steps: 7 / 28 Operates on 3D state: Keccak - f : an iterative permutation Keccak - f : an iterative permutation θ : mixing layer ρ : inter-slice bit transposition π : intra-slice bit transposition χ : non-linear layer state y ι : round constants z # rounds: 12 + 2 ℓ for width b = 2 ℓ 25 x 12 rounds in Keccak - f [ 25 ] 24 rounds in Keccak - f [ 1600 ] ( 5 × 5 ) -bit slices 2 ℓ -bit lanes parameter 0 ≤ ℓ < 7

Differential propagation analysis of Keccak Introduction Round function with 5 steps: 7 / 28 Operates on 3D state: Keccak - f : an iterative permutation Keccak - f : an iterative permutation θ : mixing layer ρ : inter-slice bit transposition π : intra-slice bit transposition χ : non-linear layer slice y ι : round constants z # rounds: 12 + 2 ℓ for width b = 2 ℓ 25 x 12 rounds in Keccak - f [ 25 ] 24 rounds in Keccak - f [ 1600 ] ( 5 × 5 ) -bit slices 2 ℓ -bit lanes parameter 0 ≤ ℓ < 7

Differential propagation analysis of Keccak Introduction Round function with 5 steps: 7 / 28 Operates on 3D state: Keccak - f : an iterative permutation Keccak - f : an iterative permutation θ : mixing layer ρ : inter-slice bit transposition π : intra-slice bit transposition χ : non-linear layer row y ι : round constants z # rounds: 12 + 2 ℓ for width b = 2 ℓ 25 x 12 rounds in Keccak - f [ 25 ] 24 rounds in Keccak - f [ 1600 ] ( 5 × 5 ) -bit slices 2 ℓ -bit lanes parameter 0 ≤ ℓ < 7

Differential propagation analysis of Keccak Introduction Round function with 5 steps: 7 / 28 Operates on 3D state: Keccak - f : an iterative permutation Keccak - f : an iterative permutation θ : mixing layer ρ : inter-slice bit transposition π : intra-slice bit transposition χ : non-linear layer column y ι : round constants z # rounds: 12 + 2 ℓ for width b = 2 ℓ 25 x 12 rounds in Keccak - f [ 25 ] 24 rounds in Keccak - f [ 1600 ] ( 5 × 5 ) -bit slices 2 ℓ -bit lanes parameter 0 ≤ ℓ < 7

Differential propagation analysis of Keccak tight MD6 [Rivest et al., SHA-3 2008][Heilman, Ecrypt Hash 2011] Noekeon [Nessie, 2000] Inspired by similar efforts for this work 1600 non-tight 206 per 18 rounds 200 non-tight 146 per 16 rounds 100 54 per 6 rounds Introduction 50 tight 30 per 5 rounds 25 bound b Bounds for small versions of Keccak - f …and not on presumed hardness of finding them Security of Keccak relies on absence of exploitable trails This work Goal of this work 8 / 28

Differential propagation analysis of Keccak Trails in Keccak - f Outline 1 Introduction 2 Trails in Keccak - f 3 Generating all trails up to some weight 4 Illustration 5 Conclusions 9 / 28

Differential propagation analysis of Keccak Trails in Keccak - f Conventions and concepts Trails in Keccak - f 10 / 28 Round: linear step λ = π ◦ ρ ◦ θ and non-linear step χ a i fully determines b i = λ ( a i ) χ has degree 2: w ( b i − 1 ) independent of a i

Differential propagation analysis of Keccak Trails in Keccak - f Conventions and concepts Trails in Keccak - f For Keccak - f : 10 / 28 w ( Q ) : # conditions on intermediate state bits b : # degree of freedom

Differential propagation analysis of Keccak Trails in Keccak - f Trail generation techniques Trail generation techniques Given a trail, we can extend it: Tree search: extension can be done recursively pruning as soon as weight exceeds some limit 11 / 28 forward: iterate a r + 1 over A ( b r ) backward: iterate b − 1 over all differences χ − 1 -compatible with a 0 = λ − 1 ( b 0 )

Differential propagation analysis of Keccak Generating all trails up to some weight Outline 1 Introduction 2 Trails in Keccak - f 3 Generating all trails up to some weight 4 Illustration 5 Conclusions 12 / 28

Differential propagation analysis of Keccak Generating all trails up to some weight First order approach First-order approach Fact Generating trails up to weight T , first order approach extend backward down to b 0 prune as soon as weight exceeds T 13 / 28 An r -round trail Q with w ( Q ) ≤ T has at least one b i with weight ≤ T / r Generate V 1 = { b | w ( b ) ≤ t avg } with t avg = T / r ∀ 0 ≤ i < r , iterate b i over V 1 extend forward up to b r − 1

Differential propagation analysis of Keccak Generating all trails up to some weight First order approach Limits of first-order approach 14 / 28 V 1 grows quickly with t avg and Keccak - f width:

Differential propagation analysis of Keccak Generating all trails up to some weight Second order approach Definitions: minimum reverse weight and trail cores Minimum reverse weight : min Can be used to lower bound of set of trails 15 / 28 w rev ( a ) � b : a ∈A ( b ) w ( b ) Trail core : set of trails with b 1 , b 2 , . . . in common

Differential propagation analysis of Keccak Generating all trails up to some weight Second order approach Definitions: minimum reverse weight and trail cores Minimum reverse weight : min Can be used to lower bound of set of trails 15 / 28 w rev ( a ) � b : a ∈A ( b ) w ( b ) Trail core : set of trails with b 1 , b 2 , . . . in common

Differential propagation analysis of Keccak Generating all trails up to some weight Second order approach Second-order approach Observation high weight and vice versa Generating trails up to weight T , second order approach extend backward down to b 0 prune as soon as weight exceeds T 16 / 28 For most low-weight a , b = λ ( a ) has Generate V 2 = { b | b = λ ( a ) and w rev ( a ) + w ( b ) ≤ 2 t avg } ∀ 0 ≤ i < r , iterate b i over V 2 extend forward up to b r − 1 But how does the size of V 2 behave with t avg ?

Differential propagation analysis of Keccak Generating all trails up to some weight Add to each cell the parities of two nearby columns 17 / 28 Intermezzo: θ properties θ , the mixing layer + = column parity θ effect combine Compute parity c x , z of each column

Differential propagation analysis of Keccak Generating all trails up to some weight Single-bit parity flips already 10 bits 17 / 28 Intermezzo: θ properties θ , the mixing layer + = column parity θ effect combine Other linear mapping ρ and π just move bits around

Differential propagation analysis of Keccak Generating all trails up to some weight Effect collapses if parity is zero The kernel 17 / 28 Intermezzo: θ properties θ , the mixing layer + = column parity θ effect combine

Differential propagation analysis of Keccak Generating all trails up to some weight Limits of the second-order approach Limits of second-order approach 18 / 28 V 2 still grows quickly with t avg and Keccak - f width Reason: V 2 contains states in kernel

Differential propagation analysis of Keccak Generating all trails up to some weight Third-order approach Third-order approach: dealing with the kernel 19 / 28 V 3 : trail cores ( b , d ) with w rev ( a ) + w ( b ) + w ( d ) ≤ 3 t avg a = λ − 1 ( b ) is in the kernel c = λ − 1 ( d ) is in the kernel Elements of V 3 can then be extended as usual

Differential propagation analysis of Keccak Generating all trails up to some weight Third-order approach Third-order approach: dealing with the kernel 19 / 28 V 3 : trail cores ( b , d ) with w rev ( a ) + w ( b ) + w ( d ) ≤ 3 t avg a = λ − 1 ( b ) is in the kernel c = λ − 1 ( d ) is in the kernel Elements of V 3 can then be extended as usual