Fitness Comparison by Statistical Testing in Construction of - PowerPoint PPT Presentation

Fitness Comparison by Statistical Testing in Construction of SAT-Based Guess-and-Determine Cryptographic Attacks Artem Pavlenko, Maxim Buzdalov, Vladimir Ulyantsev GECCO 2019, July 16

Symmetric cryptography Alice wants to send a secret Plaintext 0 0 1 0 1 1 1 0 message to Bob. To do that, she generates a Keystream � Then she applies bitwise XOR. 1 0 0 1 1 0 1 1 random sequence. Initial state Keystream The keystreams should be identical Ciphertext 1 0 1 1 0 1 0 1 1 1 1 0 0 generator and have no regularity. Bob also generates the same and also applies bitwise XOR Keystream 1 0 0 1 1 0 1 1 � random sequence. . . to recover the message. Plaintext 0 0 1 0 1 1 1 0 1 / 13

Symmetric cryptography Alice wants to send a secret Plaintext 0 0 1 0 1 1 1 0 message to Bob. To do that, she generates a Keystream � Then she applies bitwise XOR. 1 0 0 1 1 0 1 1 random sequence. Initial state Keystream The keystreams should be identical Ciphertext 1 0 1 1 0 1 0 1 1 1 1 0 0 generator and have no regularity. Bob also generates the same and also applies bitwise XOR Keystream 1 0 0 1 1 0 1 1 � random sequence. . . to recover the message. Plaintext 0 0 1 0 1 1 1 0 1 / 13

Symmetric cryptography Alice wants to send a secret Plaintext 0 0 1 0 1 1 1 0 message to Bob. To do that, she generates a Keystream � Then she applies bitwise XOR. 1 0 0 1 1 0 1 1 random sequence. Initial state Keystream The keystreams should be identical Ciphertext 1 0 1 1 0 1 0 1 1 1 1 0 0 generator and have no regularity. Bob also generates the same and also applies bitwise XOR Keystream 1 0 0 1 1 0 1 1 � random sequence. . . to recover the message. Plaintext 0 0 1 0 1 1 1 0 1 / 13

Symmetric cryptography Alice wants to send a secret Plaintext 0 0 1 0 1 1 1 0 message to Bob. To do that, she generates a Keystream � Then she applies bitwise XOR. 1 0 0 1 1 0 1 1 random sequence. Initial state Keystream The keystreams should be identical Ciphertext 1 0 1 1 0 1 0 1 1 1 1 0 0 generator and have no regularity. Bob also generates the same and also applies bitwise XOR Keystream 1 0 0 1 1 0 1 1 � random sequence. . . to recover the message. Plaintext 0 0 1 0 1 1 1 0 1 / 13

Symmetric cryptography Alice wants to send a secret Plaintext 0 0 1 0 1 1 1 0 message to Bob. To do that, she generates a Keystream � Then she applies bitwise XOR. 1 0 0 1 1 0 1 1 random sequence. Initial state Keystream The keystreams should be identical Ciphertext 1 0 1 1 0 1 0 1 1 1 1 0 0 generator and have no regularity. Bob also generates the same and also applies bitwise XOR Keystream 1 0 0 1 1 0 1 1 � random sequence. . . to recover the message. Plaintext 0 0 1 0 1 1 1 0 1 / 13

Symmetric cryptography Alice wants to send a secret Plaintext 0 0 1 0 1 1 1 0 message to Bob. To do that, she generates a Keystream � Then she applies bitwise XOR. 1 0 0 1 1 0 1 1 random sequence. Initial state Keystream The keystreams should be identical Ciphertext 1 0 1 1 0 1 0 1 1 1 1 0 0 generator and have no regularity. Bob also generates the same and also applies bitwise XOR Keystream 1 0 0 1 1 0 1 1 � random sequence. . . to recover the message. Plaintext 0 0 1 0 1 1 1 0 1 / 13

Symmetric cryptography Alice wants to send a secret Plaintext 0 0 1 0 1 1 1 0 message to Bob. To do that, she generates a Keystream � Then she applies bitwise XOR. 1 0 0 1 1 0 1 1 random sequence. Initial state Keystream The keystreams should be identical Ciphertext 1 0 1 1 0 1 0 1 1 1 1 0 0 generator and have no regularity. Bob also generates the same and also applies bitwise XOR Keystream 1 0 0 1 1 0 1 1 � random sequence. . . to recover the message. Plaintext 0 0 1 0 1 1 1 0 1 / 13

Attack on the keystream generator Part of plaintext 0 0 1 0 1 Eve has eavesdropped matching She applies bitwise XOR to reveal Part of ciphertext � 1 0 1 1 0 parts of plaintext and ciphertext. a part of keystream. Initial state Keystream Part of keystream 1 0 0 1 1 ? ? ? ? ? generator Generator is known. Eve needs to restore initial state, so that the rest of the transmission is cracked. 2 / 13

Attack on the keystream generator Part of plaintext 0 0 1 0 1 Eve has eavesdropped matching She applies bitwise XOR to reveal Part of ciphertext � 1 0 1 1 0 parts of plaintext and ciphertext. a part of keystream. Initial state Keystream Part of keystream 1 0 0 1 1 ? ? ? ? ? generator Generator is known. Eve needs to restore initial state, so that the rest of the transmission is cracked. 2 / 13

Attack on the keystream generator Part of plaintext 0 0 1 0 1 Eve has eavesdropped matching She applies bitwise XOR to reveal Part of ciphertext � 1 0 1 1 0 parts of plaintext and ciphertext. a part of keystream. Initial state Keystream Part of keystream 1 0 0 1 1 ? ? ? ? ? generator Generator is known. Eve needs to restore initial state, so that the rest of the transmission is cracked. 2 / 13

Attack on the keystream generator Part of plaintext 0 0 1 0 1 Eve has eavesdropped matching She applies bitwise XOR to reveal Part of ciphertext � 1 0 1 1 0 parts of plaintext and ciphertext. a part of keystream. Initial state Keystream Part of keystream 1 0 0 1 1 ? ? ? ? ? generator Generator is known. Eve needs to restore initial state, so that the rest of the transmission is cracked. 2 / 13

Example of a keystream generator: Trivium-64 3 / 13

Algebraic cryptoanalysis Produced keystream Initial state Keystream z 0 z 1 z 2 z 3 z 4 x 0 x 1 x 2 x 3 x 4 generator SAT formula generator, y i – auxiliary variables f ( x 0 , . . . , x n , y 0 , . . . , y m , z 0 , . . . , z k ) = true Actual keystream Cracked state SAT 1 0 0 1 1 1 1 1 0 0 solver 4 / 13

Algebraic cryptoanalysis Produced keystream Initial state Keystream z 0 z 1 z 2 z 3 z 4 x 0 x 1 x 2 x 3 x 4 generator SAT formula generator, y i – auxiliary variables f ( x 0 , . . . , x n , y 0 , . . . , y m , z 0 , . . . , z k ) = true Actual keystream Cracked state SAT 1 0 0 1 1 1 1 1 0 0 solver 4 / 13

Algebraic cryptoanalysis Produced keystream Initial state Keystream z 0 z 1 z 2 z 3 z 4 x 0 x 1 x 2 x 3 x 4 generator SAT formula generator, y i – auxiliary variables f ( x 0 , . . . , x n , y 0 , . . . , y m , z 0 , . . . , z k ) = true Actual keystream Cracked state SAT 1 0 0 1 1 1 1 1 0 0 solver 4 / 13

Guess-and-determine attacks Standard way to solve SAT problems ◮ Take the formula ◮ Pass it to the SAT solver 5 / 13

Guess-and-determine attacks Standard way to solve SAT problems ◮ Take the formula ◮ Pass it to the SAT solver A possible alternative when solving hard SAT problems ◮ Choose a subset B of the formula’s variables – the guessed bit set ◮ Iterate over all 2 | B | combinations of their values ◮ For each combination: ◮ Take the formula, substitute these variables with their values ◮ Pass it to the SAT solver ◮ If solution found, terminate 5 / 13

Guess-and-determine attacks Standard way to solve SAT problems ◮ Take the formula ◮ Pass it to the SAT solver A possible alternative when solving hard SAT problems ◮ Choose a subset B of the formula’s variables – the guessed bit set ◮ Iterate over all 2 | B | combinations of their values ◮ For each combination: ◮ Take the formula, substitute these variables with their values ◮ Pass it to the SAT solver ◮ If solution found, terminate ◮ Sometimes this is faster. In cryptanalysis, it happens quite often 5 / 13

Attack time of a guess-and-determine attack Several definitions possible. We use the following: ◮ Assume the keystream is infinite ◮ Set a time limit T for an attempt to solve one piece ◮ Found a solution within T → congratulations! ◮ Did not manage to find → continue with the next piece ◮ Let p be the (very small) probability that we find a solution: ◮ Expected time of an attack: T / p ◮ Time with 95% of confidence: ≈ 3 T / p 6 / 13

Attack time of a guess-and-determine attack Several definitions possible. We use the following: ◮ Assume the keystream is infinite ◮ Set a time limit T for an attempt to solve one piece ◮ Found a solution within T → congratulations! ◮ Did not manage to find → continue with the next piece ◮ Let p be the (very small) probability that we find a solution: ◮ Expected time of an attack: T / p ◮ Time with 95% of confidence: ≈ 3 T / p What is a good time of an attack? ◮ Any non-trivial result is important ◮ Example: “SHA-1 collisions now 2 52 ” ◮ A hint of a weakness → move to non-compromised ciphers until too late! 6 / 13

How to measure the attack time Direct measurement? ◮ Well, possible, but it will take way too long 7 / 13

How to measure the attack time Direct measurement? ◮ Well, possible, but it will take way too long Clever indirect measurement ◮ A Monte-Carlo technique 7 / 13

How to measure the attack time Direct measurement? ◮ Well, possible, but it will take way too long Clever indirect measurement ◮ A Monte-Carlo technique ◮ Generate a random initial state 7 / 13

How to measure the attack time Direct measurement? ◮ Well, possible, but it will take way too long Clever indirect measurement ◮ A Monte-Carlo technique ◮ Generate a random initial state ◮ Compute the keystream of the needed length 7 / 13