Exponential S-Boxes: a Link Between the S-Boxes of BelT and - PowerPoint PPT Presentation

Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog Léo Perrin 1 , Aleksei Udovenko 1 1 SnT, University of Luxembourg https://www.cryptolux.org March 6, 2017 Fast Sofware Encryption 2017

Introduction S-Box Design Léo Perrin, Aleksei Udovenko Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog 1 / 22

Introduction S-Box Design Léo Perrin, Aleksei Udovenko Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog 1 / 22

Introduction S-Box Design AES → ← Whirlpool ← Scream Léo Perrin, Aleksei Udovenko Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog 1 / 22

Introduction S-Box Reverse-Engineering ? Léo Perrin, Aleksei Udovenko Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog 2 / 22

Introduction Results on Kuznyechik/Streebog π Feistel-like Exponential-like Léo Perrin, Aleksei Udovenko Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog 3 / 22

Introduction Results on Kuznyechik/Streebog π Feistel-like Exponential-like Léo Perrin, Aleksei Udovenko Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog 3 / 22

Talk Outline Outline 1 Introduction 2 Reminder About π A Detour Through Belarus 3 New Decompositions of π 4 Conclusion 5 Léo Perrin, Aleksei Udovenko Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog 4 / 22

Introduction Reminder About π A Detour Through Belarus New Decompositions of π Conclusion Plan Introduction 1 Reminder About π 2 Previous Decomposition of π How Was It Found? A Detour Through Belarus 3 4 New Decompositions of π 5 Conclusion Léo Perrin, Aleksei Udovenko Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog 4 / 22

Introduction Reminder About π A Detour Through Belarus New Decompositions of π Conclusion A First Decomposition of π α From Eurocrypt’16 ⊙ I α , ω : linear 8-bit permutations ν 0 ν 1 ν 0 , ν 1 , σ : 4-bit permutations ϕ : 4-bit function ( ϕ ( x ) � 0) ⊙ ϕ I multiplicative inverse in F 16 σ ⊙ multiplication in F 16 ω Léo Perrin, Aleksei Udovenko Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog 5 / 22

Introduction Reminder About π A Detour Through Belarus New Decompositions of π Conclusion How was it found? Decomposition Procedure Overview 1 Identify paterns in LAT; Léo Perrin, Aleksei Udovenko Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog 6 / 22

Introduction Reminder About π A Detour Through Belarus New Decompositions of π Conclusion How was it found? Decomposition Procedure Overview µ 1 Identify paterns in LAT; 2 Deduce linear layers µ , η such that T π is decomposed as in right picture; U η Léo Perrin, Aleksei Udovenko Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog 6 / 22

Introduction Reminder About π A Detour Through Belarus New Decompositions of π Conclusion How was it found? Decomposition Procedure Overview µ 1 Identify paterns in LAT; 2 Deduce linear layers µ , η such that T π is decomposed as in right picture; U 3 Decompose U , T ; η Léo Perrin, Aleksei Udovenko Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog 6 / 22

Introduction Reminder About π A Detour Through Belarus New Decompositions of π Conclusion How was it found? Decomposition Procedure Overview µ 1 Identify paterns in LAT; 2 Deduce linear layers µ , η such that T π is decomposed as in right picture; U 3 Decompose U , T ; 4 Put it all together. η Léo Perrin, Aleksei Udovenko Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog 6 / 22

Introduction Reminder About π A Detour Through Belarus New Decompositions of π Conclusion Pollock to the Rescue Léo Perrin, Aleksei Udovenko Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog 7 / 22

Introduction Reminder About π A Detour Through Belarus New Decompositions of π Conclusion Pollock to the Rescue Léo Perrin, Aleksei Udovenko Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog 7 / 22

Introduction Reminder About π A Detour Through Belarus New Decompositions of π Conclusion What the Lines Mean ✸✵ ✷✺ ❱❛r✐❛♥❝❡ ✷✵ ✶✺ ✶✵ ✺ ✵ ✺✵ ✶✵✵ ✶✺✵ ✷✵✵ ✷✺✵ ❈♦❧✉♠♥ ✐♥❞❡① Variance of the absolute value of the coefficients in each column of the LAT of π . Léo Perrin, Aleksei Udovenko Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog 8 / 22

Introduction Reminder About π A Detour Through Belarus New Decompositions of π Conclusion Plan Introduction 1 Reminder About π 2 A Detour Through Belarus 3 Qick Overview of BelT Paterns in the LAT of H The Actual Structure of H New Decompositions of π 4 Conclusion 5 Léo Perrin, Aleksei Udovenko Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog 8 / 22

Introduction Reminder About π A Detour Through Belarus New Decompositions of π Conclusion Round Function of BelT a c b d K 7 i − 6 K 7 i − 5 G 5 G 21 ⊕ ⊕ ⊞ ⊞ K 7 i − 4 G 13 H K 7 i − 3 ⊟ ⊞ ⊞ G 21 H ≪ r ⊕ K 7 i − 2 ⊞ ⊟ G 13 ⊞ ⊞ H i K 7 i − 1 K 7 i G 21 ⊕ ⊕ G 5 ⊞ ⊞ H The 32-bit function G r . The round function of BelT. Léo Perrin, Aleksei Udovenko Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog 9 / 22

Introduction Reminder About π A Detour Through Belarus New Decompositions of π Conclusion Properties of H DDT LAT max(DDT) = 8 Algebraic degree 7 (all max(LAT) = 26 coordinates) P [ random ] ≤ 2 − 122 Léo Perrin, Aleksei Udovenko Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog 10 / 22

Introduction Reminder About π A Detour Through Belarus New Decompositions of π Conclusion Structure of H (1/3) Is H structured? Léo Perrin, Aleksei Udovenko Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog 11 / 22

Introduction Reminder About π A Detour Through Belarus New Decompositions of π Conclusion Structure of H (1/3) Is H structured? Yes! Léo Perrin, Aleksei Udovenko Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog 11 / 22

Introduction Reminder About π A Detour Through Belarus New Decompositions of π Conclusion LAT Row Variance ✸✵ ✷✺ ❱❛r✐❛♥❝❡ ✷✵ ✶✺ ✶✵ ✺ ✵ ✺✵ ✶✵✵ ✶✺✵ ✷✵✵ ✷✺✵ ▲✐♥❡ ✐♥❞❡① Variance of the absolute value of the coefficients in each row of the LAT of H . Léo Perrin, Aleksei Udovenko Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog 12 / 22

Introduction Reminder About π A Detour Through Belarus New Decompositions of π Conclusion The Actual Structure The BelT S-Box Construction (translated) The look-up tables of the S-Box coordinate functions were chosen as different segments of length 255 of different linear recurrences defined by the irreducible polynomial p ( λ ) : p ( λ ) = λ 8 + λ 6 + λ 5 + λ 2 + 1 . Additionally, a zero element was inserted in a fixed position of each segment. 1 http://eprint.iacr.org/2004/024 Léo Perrin, Aleksei Udovenko Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog 13 / 22

Introduction Reminder About π A Detour Through Belarus New Decompositions of π Conclusion The Actual Structure The BelT S-Box Construction (translated) The look-up tables of the S-Box coordinate functions were chosen as different segments of length 255 of different linear recurrences defined by the irreducible polynomial p ( λ ) : p ( λ ) = λ 8 + λ 6 + λ 5 + λ 2 + 1 . Additionally, a zero element was inserted in a fixed position of each segment. Equivalent Pseudo-Exponential Representation S : = [ w i , i < z ] + [ 0 ] + [ w i , z ≤ i ] Exponential (case z = 0) studied in [AA04] 1 1 http://eprint.iacr.org/2004/024 Léo Perrin, Aleksei Udovenko Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog 13 / 22

Introduction Reminder About π A Detour Through Belarus New Decompositions of π Conclusion Properties of (Pseudo-)Exponentials Exponential ( z = 0) Pseudo-Exponential ( z � 0) � Léo Perrin, Aleksei Udovenko Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog 14 / 22

Introduction Reminder About π A Detour Through Belarus New Decompositions of π Conclusion Properties of (Pseudo-)Exponentials Exponential ( z = 0) Pseudo-Exponential ( z � 0) � “Exponential” definition inconsistent in literature... z = 0? z = 255? Léo Perrin, Aleksei Udovenko Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog 14 / 22