Improved Differential-Linear Cryptanalysis of 7-round Chaskey with - PowerPoint PPT Presentation

Chaskey ARX Cryptanalysis Improved Differential-Linear Conclusion Improved Differential-Linear Cryptanalysis of 7-round Chaskey with Partitioning Gaëtan Leurent Inria, Paris Eurocrypt 2016 m 0 m 1 m 2 K ′ K ′ π π π τ K Gaëtan Leurent (Inria, Paris) Differential-Linear Cryptanalysis of 7-round Chaskey Eurocrypt 2016 1 / 19

Chaskey ARX Cryptanalysis Improved Differential-Linear Conclusion Chaskey N. Mouha, B. Mennink, A. Van Herrewege, D. Watanabe, B. Preneel, I. Verbauwhede Chaskey: An Efficient MAC Algorithm for 32-bit Microcontrollers SAC 2014 m 0 m 1 m 2 K ′ K ′ π π π τ K Gaëtan Leurent (Inria, Paris) Differential-Linear Cryptanalysis of 7-round Chaskey Eurocrypt 2016 2 / 19

Chaskey ARX Cryptanalysis Improved Differential-Linear Conclusion Chaskey ◮ Message Authentication Code ◮ Authenticity ◮ τ = MAC K ( m ) Computed by Alice 1 Transmitted with m 2 Verified by Bob (same key) 3 ◮ For microcontrollers ◮ Typical use-case: sensor network (lightweight) ◮ “Ten times faster than AES” ◮ Considered for ISO standardisation m 0 m 1 m 2 K ′ K ′ π π π τ K Gaëtan Leurent (Inria, Paris) Differential-Linear Cryptanalysis of 7-round Chaskey Eurocrypt 2016 2 / 19

Chaskey ARX Cryptanalysis Improved Differential-Linear Conclusion Chaskey ◮ CBC-MAC with an Even-Mansour cipher ◮ Permutation based (sponge-like) ◮ Birthday security ◮ 128-bit key ( K ′ = 2 · K ) ◮ 128-bit state ◮ Security claim: 2 48 data, 2 80 time ( TD > 2 128 ). m 0 m 1 m 2 K ′ K ′ π π π τ K Gaëtan Leurent (Inria, Paris) Differential-Linear Cryptanalysis of 7-round Chaskey Eurocrypt 2016 2 / 19

Chaskey ARX Cryptanalysis Improved Differential-Linear Conclusion Chaskey permutation v 1 v 0 v 2 v 3 ◮ 32-bit words 5 8 ◮ 128-bit state 16 ◮ ARX scheme ◮ Additions ( mod 2 32 ) ◮ Rotations (bitwise) ◮ Xor 7 13 ◮ Same structure as Siphash 16 ◮ 8 rounds Gaëtan Leurent (Inria, Paris) Differential-Linear Cryptanalysis of 7-round Chaskey Eurocrypt 2016 3 / 19

Chaskey ARX Cryptanalysis Improved Differential-Linear Conclusion Cryptanalysis of Chaskey Exploiting properties of the π permutation ◮ Use single-block messages ◮ Chaskey becomes an Even-Mansour cipher ◮ No decryption oracle ◮ Previous work: 4-round bias by the designers ◮ 5-round attack? K ⊕ K ′ K ′ m π τ Gaëtan Leurent (Inria, Paris) Differential-Linear Cryptanalysis of 7-round Chaskey Eurocrypt 2016 4 / 19

Chaskey ARX Cryptanalysis Improved Differential-Linear Conclusion Main Cryptanalysis Techniques Differential Cryptanalysis Linear Cryptanalysis Track difference propagation Track linear approximations [Biham & Shamir, 1990] [Matsui, 1992] ◮ Input/output differences δ P , δ C ◮ Input/output masks χ P , χ C ◮ E ( x ⊕ δ P ) ≈ E ( x ) ⊕ δ C ◮ E ( x )[ χ C ] ≈ x [ χ P ] � − 1 � � � p = Pr E ( P ⊕ δ P ) = E ( P ) ⊕ δ C ε = 2 Pr E ( x )[ χ C ] = x [ χ P ] ◮ Concatenate trails: ε = ∏ ε i ◮ Concatenate trails: p = ∏ p i ◮ Complexity 1 / ε 2 ◮ Complexity 1 / p ◮ Require ε ≫ 2 − n / 2 ◮ Require p ≫ 2 − n x [ χ 1 . . . χ ℓ ] = x [ χ 1 ] ⊕ x [ χ 2 ] · · · x [ χ ℓ ] Gaëtan Leurent (Inria, Paris) Differential-Linear Cryptanalysis of 7-round Chaskey Eurocrypt 2016 5 / 19

Chaskey ARX Cryptanalysis Improved Differential-Linear Conclusion Cryptanalysis of ARX schemes ◮ No iterative differential/linear trails ◮ Small difference in the middle and propagate ◮ Only short trails with high probability Complexity Rounds Gaëtan Leurent (Inria, Paris) Differential-Linear Cryptanalysis of 7-round Chaskey Eurocrypt 2016 6 / 19

Chaskey ARX Cryptanalysis Improved Differential-Linear Conclusion Cryptanalysis of ARX schemes ◮ No iterative differential/linear trails ◮ Small difference in the middle and propagate ◮ Only short trails ◮ Can we combine two trails? with high probability Complexity Rounds Rounds Gaëtan Leurent (Inria, Paris) Differential-Linear Cryptanalysis of 7-round Chaskey Eurocrypt 2016 6 / 19

Chaskey ARX Cryptanalysis Improved Differential-Linear Conclusion Differential-Linear Cryptanalysis δ x ′ x [Langford & Hellman, 1994] [Biham, Dunkelman & Keller, 2002] E ⊤ E ⊤ ◮ Divide E in two sub-ciphers E = E ⊥ ◦ E ⊤ γ ◮ Let y = E ⊤ ( x ) , z = E ⊥ ( y ) y ′ y α α ◮ Find a differential δ → γ for E ⊤ ◮ Pr [ E ⊤ ( x ⊕ δ ) = E ⊤ ( x ) ⊕ γ ] = p E ⊥ E ⊥ ◮ Find a linear approximation α → β of E ⊥ ◮ Pr [ y [ α ] = E ⊥ ( y )[ β ]] = 1 2 ( 1 + ε ) z ′ β z β Gaëtan Leurent (Inria, Paris) Differential-Linear Cryptanalysis of 7-round Chaskey Eurocrypt 2016 7 / 19

Chaskey ARX Cryptanalysis Improved Differential-Linear Conclusion Differential-Linear Cryptanalysis δ x ′ x [Langford & Hellman, 1994] [Biham, Dunkelman & Keller, 2002] E ⊤ E ⊤ ◮ Divide E in two sub-ciphers E = E ⊥ ◦ E ⊤ γ ◮ Let y = E ⊤ ( x ) , z = E ⊥ ( y ) y ′ y α α ◮ Find a differential δ → γ for E ⊤ ◮ Pr [ E ⊤ ( x ⊕ δ ) = E ⊤ ( x ) ⊕ γ ] = p E ⊥ E ⊥ ◮ Find a linear approximation α → β of E ⊥ ◮ Pr [ y [ α ] = E ⊥ ( y )[ β ]] = 1 2 ( 1 + ε ) z ′ β z β Gaëtan Leurent (Inria, Paris) Differential-Linear Cryptanalysis of 7-round Chaskey Eurocrypt 2016 7 / 19

Chaskey ARX Cryptanalysis Improved Differential-Linear Conclusion Differential-Linear Cryptanalysis δ x ′ x [Langford & Hellman, 1994] [Biham, Dunkelman & Keller, 2002] E ⊤ E ⊤ ◮ Divide E in two sub-ciphers E = E ⊥ ◦ E ⊤ γ ◮ Let y = E ⊤ ( x ) , z = E ⊥ ( y ) y ′ y α α ◮ Find a differential δ → γ for E ⊤ ◮ Pr [ E ⊤ ( x ⊕ δ ) = E ⊤ ( x ) ⊕ γ ] = p E ⊥ E ⊥ ◮ Find a linear approximation α → β of E ⊥ ◮ Pr [ y [ α ] = E ⊥ ( y )[ β ]] = 1 2 ( 1 + ε ) z ′ β z β Gaëtan Leurent (Inria, Paris) Differential-Linear Cryptanalysis of 7-round Chaskey Eurocrypt 2016 7 / 19

Chaskey ARX Cryptanalysis Improved Differential-Linear Conclusion Differential-Linear Cryptanalysis δ x ′ x ◮ Query a pair ( x , x ′ = x ⊕ δ ) : E ⊤ E ⊤ y ⊕ y ′ = γ proba p γ ( y ⊕ y ′ )[ α ] = γ [ α ] proba ≈ p + 1 / 2 ( 1 − p ) y ′ y α α z [ β ] = y [ α ] proba 1 / 2 ( 1 + ε ) z ′ [ β ] = y ′ [ α ] proba 1 / 2 ( 1 + ε ) proba 1 / 2 ( 1 + p ε 2 ) E ⊥ E ⊥ ( z ⊕ z ′ )[ β ] = γ [ α ] ◮ Distinguisher with complexity ≈ p − 2 ε − 4 z ′ β z β Gaëtan Leurent (Inria, Paris) Differential-Linear Cryptanalysis of 7-round Chaskey Eurocrypt 2016 7 / 19

Chaskey ARX Cryptanalysis Improved Differential-Linear Conclusion Differential-Linear Cryptanalysis δ x ′ x ◮ Query a pair ( x , x ′ = x ⊕ δ ) : E ⊤ E ⊤ y ⊕ y ′ = γ proba p γ ( y ⊕ y ′ )[ α ] = γ [ α ] proba ≈ p + 1 / 2 ( 1 − p ) y ′ y α α z [ β ] = y [ α ] proba 1 / 2 ( 1 + ε ) z ′ [ β ] = y ′ [ α ] proba 1 / 2 ( 1 + ε ) proba 1 / 2 ( 1 + p ε 2 ) E ⊥ E ⊥ ( z ⊕ z ′ )[ β ] = γ [ α ] ◮ Distinguisher with complexity ≈ p − 2 ε − 4 z ′ β z β Gaëtan Leurent (Inria, Paris) Differential-Linear Cryptanalysis of 7-round Chaskey Eurocrypt 2016 7 / 19

Chaskey ARX Cryptanalysis Improved Differential-Linear Conclusion Differential-Linear Cryptanalysis δ x ′ x ◮ Query a pair ( x , x ′ = x ⊕ δ ) : E ⊤ E ⊤ y ⊕ y ′ = γ proba p γ ( y ⊕ y ′ )[ α ] = γ [ α ] proba ≈ p + 1 / 2 ( 1 − p ) y ′ y α α z [ β ] = y [ α ] proba 1 / 2 ( 1 + ε ) z ′ [ β ] = y ′ [ α ] proba 1 / 2 ( 1 + ε ) proba 1 / 2 ( 1 + p ε 2 ) E ⊥ E ⊥ ( z ⊕ z ′ )[ β ] = γ [ α ] ◮ Distinguisher with complexity ≈ p − 2 ε − 4 z ′ β z β Gaëtan Leurent (Inria, Paris) Differential-Linear Cryptanalysis of 7-round Chaskey Eurocrypt 2016 7 / 19

Chaskey ARX Cryptanalysis Improved Differential-Linear Conclusion Differential-Linear Cryptanalysis δ x ′ x ◮ Query a pair ( x , x ′ = x ⊕ δ ) : E ⊤ E ⊤ y ⊕ y ′ = γ proba p γ ( y ⊕ y ′ )[ α ] = γ [ α ] proba ≈ 1 / 2 ( 1 + p ) y ′ y α α z [ β ] = y [ α ] proba 1 / 2 ( 1 + ε ) z ′ [ β ] = y ′ [ α ] proba 1 / 2 ( 1 + ε ) proba 1 / 2 ( 1 + p ε 2 ) E ⊥ E ⊥ ( z ⊕ z ′ )[ β ] = γ [ α ] ◮ Distinguisher with complexity ≈ p − 2 ε − 4 z ′ β z β Gaëtan Leurent (Inria, Paris) Differential-Linear Cryptanalysis of 7-round Chaskey Eurocrypt 2016 7 / 19

Chaskey ARX Cryptanalysis Improved Differential-Linear Conclusion Differential-Linear Cryptanalysis δ x ′ x ◮ Query a pair ( x , x ′ = x ⊕ δ ) : E ⊤ E ⊤ y ⊕ y ′ = γ proba p γ ( y ⊕ y ′ )[ α ] = γ [ α ] proba ≈ 1 / 2 ( 1 + p ) y ′ y α α z [ β ] = y [ α ] proba 1 / 2 ( 1 + ε ) z ′ [ β ] = y ′ [ α ] proba 1 / 2 ( 1 + ε ) proba 1 / 2 ( 1 + p ε 2 ) E ⊥ E ⊥ ( z ⊕ z ′ )[ β ] = γ [ α ] ◮ Distinguisher with complexity ≈ p − 2 ε − 4 z ′ β z β Gaëtan Leurent (Inria, Paris) Differential-Linear Cryptanalysis of 7-round Chaskey Eurocrypt 2016 7 / 19