Improved Cryptanalysis of Py Paul Crowley LShift Ltd State of the - PowerPoint PPT Presentation

Py SPP attack Improving on the attack Improved Cryptanalysis of Py Paul Crowley LShift Ltd State of the Art in Stream Ciphers 2006

Py SPP attack Improving on the attack Py ✎ eSTREAM entrant by Eli Biham and Jennifer Seberry ✎ Fast in software (2.6 cycles/byte on some platforms) ✎ SPP attack: 2 88 bytes of output ✎ Our attack: 2 72 bytes

Py SPP attack Improving on the attack Output O 1 P O 2

Py SPP attack Improving on the attack Update P P

Py SPP attack Improving on the attack SPP attack ✎ Gautham Sekar, Souradyuti Paul, Bart Preneel ✎ Defines event L with Pr ❬ L ❪ ✙ 2 � 41 ✿ 91 ✎ When L occurs, two output bits are the same

Py SPP attack Improving on the attack Event L (1) S P S

Py SPP attack Improving on the attack Event L (2) O 1 ❀ 1 A B S A B A B O 2 ❀ 3

Py SPP attack Improving on the attack Result of event L A S B O 1 ❀ 1 O 2 ❀ 3

Py SPP attack Improving on the attack Improving on the attack ✎ Use all bits of O 1 ❀ 1 ❀ O 2 ❀ 3 ✎ Group output by column bitwise ✎ Find exact probability Pr ❬ O 1 ❀ 1 ❀ O 2 ❀ 3 ❂ o 1 ❀ 1 ❀ o 2 ❀ 3 ❥ L ❪ ✎ Apply optimal distinguisher

Py SPP attack Improving on the attack Addition ❬ X ❪ 3 ❬ Y ❪ 3 ❬ X ❪ 2 ❬ Y ❪ 2 ❬ X ❪ 1 ❬ Y ❪ 1 ❬ X ❪ 0 ❬ Y ❪ 0 ❬ c ❪ 0 ❬ c ❪ 3 ❬ c ❪ 2 ❬ c ❪ 1 ❬ X ✰ Y ❪ 3 ❬ X ✰ Y ❪ 2 ❬ X ✰ Y ❪ 1 ❬ X ✰ Y ❪ 0

Py SPP attack Improving on the attack Carry propagation ❬ A ❪ i ❬ S ❪ i ❬ B ❪ i ❬ c 1 ❪ i ✰ 1 ❬ c 1 ❪ i ❬ c 3 ❪ i ✰ 1 ❬ c 3 ❪ i ❬ O 1 ❀ 1 ❪ i ❬ O 2 ❀ 3 ❪ i

Py SPP attack Improving on the attack Hidden Markov model 1 1 1 8 8 2 1 ❀ 0 1 ❀ 0 0 ❀ 0 0 ❀ 0 1 0 1 0 0 1

Py SPP attack Improving on the attack The forward algorithm ✔ 1 ✕ 0 1 Pr ❂ 1 1 ✂ 4 M 1 ❀ 0 M 0 ❀ 0 M 1 ❀ 1 ✙ 0 0 0 1 ✵ ✶ 1 0 ❇ ❈ � ✁ where 1 1 ✂ 4 ❂ 1 1 1 1 and ✙ 0 ❂ ❇ ❈ 0 ❅ ❆ 0

Py SPP attack Improving on the attack Optimal distinguisher ✎ Thomas Baignères, Pascal Junod, Serge Vaudenay ✎ Optimal distinguisher chooses the distribution which has the highest probability of producing the observed output

Py SPP attack Improving on the attack Optimal distinguisher s 0 s 1 s 2

Py SPP attack Improving on the attack Optimal distinguisher ❥❩❥ � 1 ❥❩❥ � 1 ❥❩❥ � 1 s 0 s 1 s 2

Py SPP attack Improving on the attack Optimal distinguisher ❥❩❥ � 3 ❥❩❥ � 1 ❥❩❥ � 1 ❥❩❥ � 1 s 0 s 1 s 2

Py SPP attack Improving on the attack Optimal distinguisher ❥❩❥ � 3 ❥❩❥ � 1 ❥❩❥ � 1 ❥❩❥ � 1 s 0 s 1 s 2 Pr ❬ s 0 ❥ L ❪ Pr ❬ s 1 ❥ L ❪ Pr ❬ s 2 ❥ L ❪

Py SPP attack Improving on the attack Optimal distinguisher ❥❩❥ � 3 ❥❩❥ � 1 ❥❩❥ � 1 ❥❩❥ � 1 s 0 s 1 s 2 ❥❩❥ � 1 ❥❩❥ � 1 ❥❩❥ � 1 Pr ❬ s 0 ❥ L ❪ Pr ❬ s 1 ❥ L ❪ Pr ❬ s 2 ❥ L ❪

Py SPP attack Improving on the attack Optimal distinguisher ❥❩❥ � 3 ❥❩❥ � 1 ❥❩❥ � 1 ❥❩❥ � 1 s 0 s 1 s 2 ❥❩❥ � 1 ❥❩❥ � 1 ❥❩❥ � 1 Pr ❬ s 0 ❥ L ❪ Pr ❬ s 1 ❥ L ❪ Pr ❬ s 2 ❥ L ❪ Pr ❬ s 0 ❪ Pr ❬ s 1 ❪ Pr ❬ s 2 ❪

Py SPP attack Improving on the attack Optimal distinguisher ❥❩❥ � 3 ❥❩❥ � 1 ❥❩❥ � 1 ❥❩❥ � 1 s 0 s 1 s 2 ❥❩❥ � 1 ❥❩❥ � 1 ❥❩❥ � 1 Pr ❬ s 0 ❥ L ❪ Pr ❬ s 1 ❥ L ❪ Pr ❬ s 2 ❥ L ❪ Pr ❬ s 0 ❪ Pr ❬ s 1 ❪ Pr ❬ s 2 ❪ Pr ❬ s 0 ❫ s 1 ❫ s 2 ❪

✎ ☞ ✎ � �P ✁ ✁ ☞ ❂ ❬ ❪ ❥❩❥ ❬ ❥ ❪ � ✷❩ ✎ ☞ ❂ ❬ ❪ Py SPP attack Improving on the attack Efficacy of optimal distinguisher ✎ Where distribution is “close” to uniform random, efficacy ✑ 2 ✏ 1 ☞ ❂ ❥❩❥ P Pr ❬ z ❪ � z ✷❩ ❥❩❥

✎ � �P ✁ ✁ ☞ ❂ ❬ ❪ ❥❩❥ ❬ ❥ ❪ � ✷❩ ✎ ☞ ❂ ❬ ❪ Py SPP attack Improving on the attack Efficacy of optimal distinguisher ✎ Where distribution is “close” to uniform random, efficacy ✑ 2 ✏ 1 ☞ ❂ ❥❩❥ P Pr ❬ z ❪ � z ✷❩ ❥❩❥ ✎ Need around 2 ☞ samples

✎ ☞ ❂ ❬ ❪ Py SPP attack Improving on the attack Efficacy of optimal distinguisher ✎ Where distribution is “close” to uniform random, efficacy ✑ 2 ✏ 1 ☞ ❂ ❥❩❥ P Pr ❬ z ❪ � z ✷❩ ❥❩❥ ✎ Need around 2 ☞ samples ✎ Both distinguishers: ☞ ❂ Pr ❬ L ❪ 2 � z ✷❩ Pr ❬ z ❥ L ❪ 2 ✁ �P ✁ ❥❩❥ � 1

Py SPP attack Improving on the attack Efficacy of optimal distinguisher ✎ Where distribution is “close” to uniform random, efficacy ✑ 2 ✏ 1 ☞ ❂ ❥❩❥ P Pr ❬ z ❪ � z ✷❩ ❥❩❥ ✎ Need around 2 ☞ samples ✎ Both distinguishers: ☞ ❂ Pr ❬ L ❪ 2 � z ✷❩ Pr ❬ z ❥ L ❪ 2 ✁ �P ✁ ❥❩❥ � 1 ✎ SPP attack: ☞ ❂ Pr ❬ L ❪ 2 so around 2 85 samples

❳ ❂ ✭ ✙ ✮ ✿ ✿ ✿ ✂ ❳ ❂ ✭ ✙ ✮ ✭ ✙ ✮ ✿ ✿ ✿ ✿ ✿ ✿ ✂ ✂ ❳ ✏ ✑ ❂ ✿ ✿ ✿ ✙ ✙ ✿ ✿ ✿ ✂ ✂ ❳ ✏ ✑ ❂ ✿ ✿ ✿ ✙ ✙ ✿ ✿ ✿ ✂ ✂ ✷ ❢ ❀ ❀ ❀ ❀ ❀ ❀ ❀ ❣ Py SPP attack Improving on the attack Efficacy of our distinguisher ❳ Pr ❬ z ❥ L ❪ 2 z ✷❩

❳ ❂ ✭ ✙ ✮ ✭ ✙ ✮ ✿ ✿ ✿ ✿ ✿ ✿ ✂ ✂ ❳ ✏ ✑ ❂ ✿ ✿ ✿ ✙ ✙ ✿ ✿ ✿ ✂ ✂ ❳ ✏ ✑ ❂ ✿ ✿ ✿ ✙ ✙ ✿ ✿ ✿ ✂ ✂ Py SPP attack Improving on the attack Efficacy of our distinguisher ❳ Pr ❬ z ❥ L ❪ 2 z ✷❩ ❳ ✭ 1 1 ✂ 4 M 31 M 30 ✿ ✿ ✿ M 0 ✙ 0 ✮ 2 ❂ M i ✷ ❢ M 0 ❀ 0 ❀ M 0 ❀ 1 ❀ M 1 ❀ 0 ❀ M 1 ❀ 1 ❣

❳ ✏ ✑ ❂ ✿ ✿ ✿ ✙ ✙ ✿ ✿ ✿ ✂ ✂ ❳ ✏ ✑ ❂ ✿ ✿ ✿ ✙ ✙ ✿ ✿ ✿ ✂ ✂ Py SPP attack Improving on the attack Efficacy of our distinguisher ❳ Pr ❬ z ❥ L ❪ 2 z ✷❩ ❳ ✭ 1 1 ✂ 4 M 31 M 30 ✿ ✿ ✿ M 0 ✙ 0 ✮ 2 ❂ ❳ ✭ 1 1 ✂ 4 M 31 M 30 ✿ ✿ ✿ M 0 ✙ 0 ✮ ✭ 1 1 ✂ 4 M 31 M 30 ✿ ✿ ✿ M 0 ✙ 0 ✮ T ❂ M i ✷ ❢ M 0 ❀ 0 ❀ M 0 ❀ 1 ❀ M 1 ❀ 0 ❀ M 1 ❀ 1 ❣

❳ ✏ ✑ ❂ ✿ ✿ ✿ ✙ ✙ ✿ ✿ ✿ ✂ ✂ Py SPP attack Improving on the attack Efficacy of our distinguisher ❳ Pr ❬ z ❥ L ❪ 2 z ✷❩ ❳ ✭ 1 1 ✂ 4 M 31 M 30 ✿ ✿ ✿ M 0 ✙ 0 ✮ 2 ❂ ❳ ✭ 1 1 ✂ 4 M 31 M 30 ✿ ✿ ✿ M 0 ✙ 0 ✮ ✭ 1 1 ✂ 4 M 31 M 30 ✿ ✿ ✿ M 0 ✙ 0 ✮ T ❂ ❳ ✏ ✑ 1 1 ✂ 4 M 31 M 30 ✿ ✿ ✿ M 0 ✙ 0 ✙ T 0 M T 0 ✿ ✿ ✿ M T 30 M T 31 1 T ❂ 1 ✂ 4 M i ✷ ❢ M 0 ❀ 0 ❀ M 0 ❀ 1 ❀ M 1 ❀ 0 ❀ M 1 ❀ 1 ❣

Py SPP attack Improving on the attack Efficacy of our distinguisher ❳ Pr ❬ z ❥ L ❪ 2 z ✷❩ ❳ ✭ 1 1 ✂ 4 M 31 M 30 ✿ ✿ ✿ M 0 ✙ 0 ✮ 2 ❂ ❳ ✭ 1 1 ✂ 4 M 31 M 30 ✿ ✿ ✿ M 0 ✙ 0 ✮ ✭ 1 1 ✂ 4 M 31 M 30 ✿ ✿ ✿ M 0 ✙ 0 ✮ T ❂ ❳ ✏ ✑ 1 1 ✂ 4 M 31 M 30 ✿ ✿ ✿ M 0 ✙ 0 ✙ T 0 M T 0 ✿ ✿ ✿ M T 30 M T 31 1 T ❂ 1 ✂ 4 ❳ ✏ ✑ M 31 M 30 ✿ ✿ ✿ M 0 ✙ 0 ✙ T 0 M T 0 ✿ ✿ ✿ M T 30 M T 1 T ❂ 1 1 ✂ 4 1 ✂ 4 31 M i ✷ ❢ M 0 ❀ 0 ❀ M 0 ❀ 1 ❀ M 1 ❀ 0 ❀ M 1 ❀ 1 ❣

❂ ✙ ✙ ❳ ❂ ✰ ✷❢ ❀ ❀ ❀ ❀ ❀ ❀ ❀ ❣ ✏ ✏ ✑ ✑ ☞ ❂ ❬ ❪ � ✂ ✂ ✙ ❬ ❪ Py SPP attack Improving on the attack Efficacy of our distinguisher ❳ M i � 1 M i � 2 ✿ ✿ ✿ M 1 M 0 ✙ 0 ✙ T 0 M T 0 M T 1 ✿ ✿ ✿ M T i � 2 M T H i ❂ i � 1

❳ ❂ ✰ ✷❢ ❀ ❀ ❀ ❀ ❀ ❀ ❀ ❣ ✏ ✏ ✑ ✑ ☞ ❂ ❬ ❪ � ✂ ✂ ✙ ❬ ❪ Py SPP attack Improving on the attack Efficacy of our distinguisher ❳ M i � 1 M i � 2 ✿ ✿ ✿ M 1 M 0 ✙ 0 ✙ T 0 M T 0 M T 1 ✿ ✿ ✿ M T i � 2 M T H i ❂ i � 1 ✙ 0 ✙ T H 0 ❂ 0

✏ ✏ ✑ ✑ ☞ ❂ ❬ ❪ � ✂ ✂ ✙ ❬ ❪ Py SPP attack Improving on the attack Efficacy of our distinguisher ❳ M i � 1 M i � 2 ✿ ✿ ✿ M 1 M 0 ✙ 0 ✙ T 0 M T 0 M T 1 ✿ ✿ ✿ M T i � 2 M T H i ❂ i � 1 ✙ 0 ✙ T H 0 ❂ 0 ❳ MH i M T H i ✰ 1 ❂ M ✷❢ M 0 ❀ 0 ❀ M 0 ❀ 1 ❀ M 1 ❀ 0 ❀ M 1 ❀ 1 ❣

✙ ❬ ❪ Py SPP attack Improving on the attack Efficacy of our distinguisher ❳ M i � 1 M i � 2 ✿ ✿ ✿ M 1 M 0 ✙ 0 ✙ T 0 M T 0 M T 1 ✿ ✿ ✿ M T i � 2 M T H i ❂ i � 1 ✙ 0 ✙ T H 0 ❂ 0 ❳ MH i M T H i ✰ 1 ❂ M ✷❢ M 0 ❀ 0 ❀ M 0 ❀ 1 ❀ M 1 ❀ 0 ❀ M 1 ❀ 1 ❣ Pr ❬ L ❪ 2 ✏ 2 64 ✏ ✑ ✑ 1 1 ✂ 4 H 32 1 T ☞ ❂ � 1 1 ✂ 4

Improved Cryptanalysis of Py Paul Crowley LShift Ltd State of the - PowerPoint PPT Presentation

Py SPP attack Improving on the attack Improved Cryptanalysis of Py Paul Crowley LShift Ltd State of the Art in Stream Ciphers 2006 Py SPP attack Improving on the attack Py eSTREAM entrant by Eli Biham and Jennifer Seberry Fast in

The Super-Sbox Cryptanalysis Improved Attacks for AES-like Permutations Henri Gilbert and Thomas

Improved Differential-Linear Cryptanalysis of 7-round Chaskey with Partitioning Gatan Leurent

An Improved Cryptanalysis of Lightweight Stream Cipher Grain-v1 Miodrag J. Mihaljevi 1 , Nishant

Improved Cryptanalysis of the AJPS Mersenne Based Cryptosystem Jean-Sbastien Coron and Agnese

Improved Slender-set Linear Cryptanalysis Guo-Qiang Liu 1 Chen-Hui Jin 1 Chuan-Da Qi 2 1

Objectives Models for Cryptanalysis Cryptanalysis of Monoalphabetic Ciphers

Improved Cryptanalysis of HFEv- via Projection Jintai Ding, Ray Perlner, Albrecht Petzoldt, Daniel

Improved Parameter Estimates for Correlation and Capacity Deviates in Linear Cryptanalysis C

Linear Statistics Jung-Keun Lee and Woo-Hwan Kim ETRI Our contribution improved and extended

Side Channel Cryptanalysis of a Higher Order Schemes Generic Masking Scheme Scheme Improved

Block Cipher Cryptanalysis II: Block Cipher Cryptanalysis II: Linear Cryptanalysis yp y Andrey

Statistics in Cryptanalysis Subhabrata Samajder Indian Statistical Institute, Kolkata 24 th May,

Differential and Linear Cryptanalysis Lars R. Knudsen June 2014 L.R. Knudsen Differential and

Differential Cryptanalysis - quite similar to linear cryptanalysis - exploits the relationship

Rotational Cryptanalysis in the Presence of Constants Tomer Ashur Yunwen Liu ESAT/COSIC, KU

Differential Cryptanalysis The first method which reduced the complexity of attacking DES below

Cryptanalysis of LAC G. Leurent (Inria) Cryptanalysis of LAC DIAC 2014 1 / 9 . . . . . . . .

Automatic Cryptanalysis of Block Ciphers with CP A case study: related key differential

Probabilistic Slide Cryptanalysis and Its Applications to LED-64 and Zorro Hadi Soleimany

Cryptanalysis of RadioGatn Thomas Fuhr 1 Thomas Peyrin 2 1 Direction Centrale de la Scurit

Correlation of Quadratic Boolean Functions: Cryptanalysis of All Versions of Full MORUS Siwei Sun

Bilinear Cryptanalysis of Multivariate Schemes Pierre-Alain FOUQUE Crypto Team cole normale

Separable Statistics and Multidimensional Linear Cryptanalysis Stian Fauskanger Igor Semaev

Cryptanalysis of Lightweight Block Ciphers: Theory Meets Dependencies Orr Dunkelman Computer