Generic Attacks on Feistel Ciphers With Internal Permutations Joana Treger, Jacques Patarin PRiSM, Universit´ e de Versailles 2008-11-27 Joana Treger, Jacques Patarin (PRiSM, Universit´ Generic Attacks on Feistel Ciphers With Internal Permutations e de Versailles) 2008-11-27 1 / 39
Summary Introduction 1 Generic attacks on the first 5 rounds 2 Generic attacks for any number of rounds 3 General method Computation of the H -coefficients Example on 3 rounds Attacking Feistel permutation generators Example on 6 rounds Table of results and conclusion 4 Joana Treger, Jacques Patarin (PRiSM, Universit´ Generic Attacks on Feistel Ciphers With Internal Permutations e de Versailles) 2008-11-27 2 / 39
Feistel ciphers (1/3) Definition Let f be a function from { 1 , . . . , 2 n } to { 1 , . . . , 2 n } . A Feistel cipher with round function f is defined by : L R f S T Fig. : 1-round Feistel scheme We call ψ ( f ) or simply ψ such a construction. ψ ([ L , R ]) = [ R , L ⊕ f ( R )] = [ S , T ] Joana Treger, Jacques Patarin (PRiSM, Universit´ Generic Attacks on Feistel Ciphers With Internal Permutations e de Versailles) 2008-11-27 3 / 39
Feistel ciphers (2/3) ψ is a permutation of { 1 , . . . , 2 2 n } : ψ − 1 ([ S , T ]) = [ T ⊕ f ( S ) , S ] = [ L , R ] S T T S f R L L R Fig. : ψ − 1 = τ ◦ ψ ◦ τ Joana Treger, Jacques Patarin (PRiSM, Universit´ Generic Attacks on Feistel Ciphers With Internal Permutations e de Versailles) 2008-11-27 4 / 39
Feistel ciphers 3/3 Definition Let f 1 , . . . , f k be k functions from { 1 , . . . , 2 n } to { 1 , . . . , 2 n } . A k-round Feistel cipher with round functions f 1 , . . . , f k is defined by the succesion of k rounds of a Feistel cipher with round function f i : ψ k ( f 1 , . . . , f k ):= ψ ( f k ) ◦ . . . ◦ ψ ( f 1 ) L R f 1 R X 1 X S k−2 f k X 1 X 2 k−2 L R f f f X S f T 1 2 3 f k k −1 S T Joana Treger, Jacques Patarin (PRiSM, Universit´ Generic Attacks on Feistel Ciphers With Internal Permutations e de Versailles) 2008-11-27 5 / 39
Luby-Rackoff revisited Derived structures : Classical Feistel ciphers. Unbalanced Feistel ciphers with expanding internal functions. Unbalanced Feistel ciphers with contracting internal functions. Feistel ciphers with internal permutations. Used in the design of Twofish, Camellia, DEAL. [Knudsen-02] : attack on 5 rounds, impossible differential [Piret-05] : security proofs for 3 and 4 rounds, ≥ O (2 n / 2 ) messages 3-round CPA − 2, 4-round CPCA − 2 Joana Treger, Jacques Patarin (PRiSM, Universit´ Generic Attacks on Feistel Ciphers With Internal Permutations e de Versailles) 2008-11-27 6 / 39
Feistel ciphers with internal permutations Different behaviour of these Feistel networks and the classical ones. Example (3 rounds) : L R f X f S T 1 2 f 3 Attack on 3 round classical Feistel ciphers : Relations considered between two input/output couples : R 1 ⊕ S 1 = R 2 ⊕ S 2 . Random permutation : probability 1 / 2 n ; Feistel cipher : probability 2 / 2 n R 1 ⊕ S 1 = R 2 ⊕ S 2 ⇔ f 2 ( X 1 ) = f 2 ( X 2 ) f 2 ( X 1 ) = f 2 ( X 2 ) ⇔ X 1 = X 2 or ( X 1 � = X 2 and f 2 ( X 1 ) = f 2 ( X 2 )). Chosen plaintext attack : O (2 n / 2 ) messages. Joana Treger, Jacques Patarin (PRiSM, Universit´ Generic Attacks on Feistel Ciphers With Internal Permutations e de Versailles) 2008-11-27 7 / 39
Feistel ciphers with internal permutations Different behaviour of these Feistel networks and the classical ones. Example (3 rounds) : L R f X f S T 1 2 f 3 Attack on 3 round classical Feistel ciphers : Relations considered between two input/output couples : R 1 ⊕ S 1 = R 2 ⊕ S 2 . Random permutation : probability 1 / 2 n ; Feistel cipher : probability 2 / 2 n R 1 ⊕ S 1 = R 2 ⊕ S 2 ⇔ f 2 ( X 1 ) = f 2 ( X 2 ) f 2 ( X 1 ) = f 2 ( X 2 ) ⇔ X 1 = X 2 or ( X 1 � = X 2 and f 2 ( X 1 ) = f 2 ( X 2 )). Chosen plaintext attack : O (2 n / 2 ) messages. Known plaintext attack : O (2 n / 2 ) messages. Does not work on Feistel cipher with round permutations ! Joana Treger, Jacques Patarin (PRiSM, Universit´ Generic Attacks on Feistel Ciphers With Internal Permutations e de Versailles) 2008-11-27 7 / 39
Generic attacks Definition A generic attack on a Feistel cipher with internal permutations, is an attack allowing to distinguish with high probability a Feistel cipher from a random permutation, when the round permutations are randomly chosen. We interest ourselves in generic attacks, necessiting < O (2 2 n ) messages (exhaustive search on the inputs). When the complexity is ≥ O (2 2 n ), we interest ourselves in attacks on Feistel permutation generators. Joana Treger, Jacques Patarin (PRiSM, Universit´ Generic Attacks on Feistel Ciphers With Internal Permutations e de Versailles) 2008-11-27 8 / 39
Two-point attacks Definition two-point attacks are attacks using correlations between blocks of pairs of distinct messages. Example : previous attack on 3 rounds, relations considered between 2 messages were R 1 ⊕ S 1 = R 2 ⊕ S 2 . Best known attacks against classical Feistel ciphers (except on 3 rounds, CPCA-2). Efficient against Feistel ciphers with internal permutations : the complexities of the two-point attacks found (except on 3 rounds, CPCA − 2) coincide with the known bounds of security (3 and 4 rounds, [Piret-05]). Joana Treger, Jacques Patarin (PRiSM, Universit´ Generic Attacks on Feistel Ciphers With Internal Permutations e de Versailles) 2008-11-27 9 / 39
Notations KPA : known plaintext attack CPA − 1 : non-adaptive chosen plaintext attack CPA − 2 : adaptive chosen plaintext attack CPCA − 1 : non-adaptive chosen plaintext and ciphertext attack CPCA − 2 : adaptive chosen plaintext and ciphertext attack B n : permutation on n bits. Joana Treger, Jacques Patarin (PRiSM, Universit´ Generic Attacks on Feistel Ciphers With Internal Permutations e de Versailles) 2008-11-27 10 / 39
Generic attack by hand : 1 and 2 rounds R=S L f T 1 Relation considered : R = S . Random permutation : probability 1 / 2 n ; Feistel cipher : probability 1. KPA : 1 message. Joana Treger, Jacques Patarin (PRiSM, Universit´ Generic Attacks on Feistel Ciphers With Internal Permutations e de Versailles) 2008-11-27 11 / 39
Generic attack by hand : 1 and 2 rounds R=S L f T 1 Relation considered : R = S . Random permutation : probability 1 / 2 n ; Feistel cipher : probability 1. KPA : 1 message. L R f S f T 1 3 Relations considered : R 1 = R 2 , S 1 ⊕ S 2 = L 1 ⊕ L 2 . CPA − 1. Random permutation : probability 1 / 2 n ; Feistel cipher : probability 1. CPA − 1 : 2 messages. KPA : O (2 n / 2 ) messages. Joana Treger, Jacques Patarin (PRiSM, Universit´ Generic Attacks on Feistel Ciphers With Internal Permutations e de Versailles) 2008-11-27 11 / 39
Generic attacks by hand : 3 rounds L R X f f S f T 1 2 3 Relation considered : L 1 = L 2 , R 1 ⊕ R 2 = S 1 ⊕ S 2 . CPA − 1. Random permutation : probability 1 / 2 n ; Feistel cipher : probability 0 R 1 ⊕ R 2 = S 1 ⊕ S 2 ⇒ X 1 = X 2 ⇒ R 1 = R 2 . CPA − 1 : O (2 n / 2 ) messages. KPA : O (2 n ) messages. Joana Treger, Jacques Patarin (PRiSM, Universit´ Generic Attacks on Feistel Ciphers With Internal Permutations e de Versailles) 2008-11-27 12 / 39
Generic attack by hand : 4 rounds 1 2 L R X f X f f S f T 1 2 3 4 Relation considered : R 1 = R 2 , L 1 ⊕ L 2 = S 1 ⊕ S 2 . CPA − 1. Random permutation : probability 1 / 2 n ; Feistel cipher : probability 0 R 1 = R 2 ⇒ X 1 1 ⊕ X 1 2 = L 1 ⊕ L 2 . L 1 ⊕ L 2 = S 1 ⊕ S 2 = X 1 1 ⊕ X 1 2 ⇒ X 2 1 = X 2 2 ⇒ L 1 = L 2 . CPA − 1 : O (2 n / 2 ) messages. KPA : O (2 n ) messages. Joana Treger, Jacques Patarin (PRiSM, Universit´ Generic Attacks on Feistel Ciphers With Internal Permutations e de Versailles) 2008-11-27 13 / 39
Generic attack by hand : 5 rounds [Knudsen-02] 1 2 3 L R f X f X f X S T 1 f 4 f 2 3 5 Relation considered : R 1 = R 2 , S 1 = S 2 , L 1 ⊕ L 2 = T 1 ⊕ T 2 . CPA − 1. Random permutation : probability 1 / 2 2 n ; Feistel cipher : probability 0. S 1 = S 2 ⇒ X 3 1 ⊕ X 3 2 = T 1 ⊕ T 2 . R 1 = R 2 ⇒ X 1 1 ⊕ X 1 2 = L 1 ⊕ L 2 . T 1 ⊕ T 2 = L 1 ⊕ L 2 ⇒ X 2 1 = X 2 2 ⇒ X 1 1 = X 1 2 ⇒ L 1 = L 2 . CPA − 1 : O (2 n ) messages. KPA : O (2 3 n / 2 ) messages. Joana Treger, Jacques Patarin (PRiSM, Universit´ Generic Attacks on Feistel Ciphers With Internal Permutations e de Versailles) 2008-11-27 14 / 39
Special case : 3 rounds, CPCA − 2 L R X S T f f f 1 2 3 Best attack is 3-point attack. The same attack as for classical Feistel ciphers [LR-88]. 3 messages : [ L 1 , R 1 ] / [ S 1 , T 1 ], [ L 2 , R 1 ] / [ S 2 , T 2 ] and [ L 3 , R 3 ] / [ S 1 , T 1 ⊕ L 1 ⊕ L 2 ]. Relation considered : R 2 ⊕ R 3 = S 2 ⊕ S 3 . CPCA − 2. Feistel cipher : probability 1 ; Random permutation : probability 1 / 2 n R 1 = R 2 ⇒ X 1 ⊕ X 2 = L 1 ⊕ L 2 . S 1 = S 3 ⇒ X 1 ⊕ X 3 = T 1 ⊕ T 3 . T 3 ⊕ T 1 = L 1 ⊕ L 2 ⇒ X 2 = X 3 . X 2 = X 3 ⇒ R 2 ⊕ R 3 = S 2 ⊕ S 3 . CPCA − 2 : 3 messages. Joana Treger, Jacques Patarin (PRiSM, Universit´ Generic Attacks on Feistel Ciphers With Internal Permutations e de Versailles) 2008-11-27 15 / 39
Recommend
More recommend
