lightweight block cipher design
play

Lightweight Block Cipher Design Gregor Leander HGI, Ruhr University - PowerPoint PPT Presentation

Mar 18, 2023 •968 likes •1.77k views

Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Lightweight Block Cipher Design Gregor Leander HGI, Ruhr University Bochum, Germany Croatia 2014 Motivation Industry Academia A Critical View Lightweight:

  1. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Lightweight Block Cipher Design Gregor Leander HGI, Ruhr University Bochum, Germany Croatia 2014

  2. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Outline Motivation 1 Industry 2 Academia 3 A Critical View 4 Lightweight: 2nd Generation 5 Wrap-Up 6

  3. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Outline Motivation 1 Industry 2 Academia 3 A Critical View 4 Lightweight: 2nd Generation 5 Wrap-Up 6

  4. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Upcoming IT-Landscape Figure: Upcoming IT-Landscape

  5. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up More Precisely: RFID-Tags RFID Tag RFID=Radio-Frequency IDentification

  6. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Example I Electronic Passports

  7. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Example II Logistics

  8. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Example III Pacemaker implants

  9. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Security Question Do we want this?

  10. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Security Question Do we want this? If we want it, we want it secure!

  11. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Attacks I Iron attacks in Russia

  12. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Attacks II Fear: Terrorist attacks on pacemaker

  13. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Lightweight Cryptography What is (not) Lightweight Cryptography Cryptography tailored to (extremely) constrained devices Not intended for everything Not intended for extremely strong adversaries Not weak cryptography

  14. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Lightweight Cryptography Question What about standard algorithms? AES is great for almost everywhere Mainly designed for software It is too expensive for very small devices It protects data stronger than needed

  15. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up AES: The Swiss Army Knife Domain Specific Cipher On specific platforms/for specific criteria one can do better.

  16. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Lightweight Cryptography: Industry vs. Academia Industry Non-existence of lightweight block ciphers a real problem since the 90’s. Many proprietary solutions Often: not very good. Academia Research on Lightweight block ciphers started only recently. Several good proposals available. Developed a bit away from industry demands.

  17. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Outline Motivation 1 Industry 2 Academia 3 A Critical View 4 Lightweight: 2nd Generation 5 Wrap-Up 6

  18. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Lightweight Ciphers in Real Life Example (Algorithms Used In Real Products) Keeloq MIFARE DECT Kindle Cipher What they have in common: efficient proprietary/not public non standard designs not good A lot more out there...

  19. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Keeloq Keeloq A 32 bit block-cipher with a 64 bit key. Developed by Gideon Kuhn (around 1985). Sold for 10M $ to Microchip Technology Inc (1995). Algorithm for remote door openers: Cars, Garage, ... Used by: Chrysler, Daewoo, Fiat, GM, Honda, Toyota, Volvo, Volkswagen Group,...

  20. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up KeeLoq EUROCRYPT 2008

  21. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up MIFARE MIFARE Cipher A stream cipher with an 48 bit key. widely used in contactless smart cards billions of smart card chips electronic bus and train tickets

  22. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up MIFARE Cipher CARDIS 2008

  23. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up DECT DECT Cipher A stream cipher with an 64 bit key. cordless home telephones 30.000.000 base station in Germany also baby phones, traffic lights, etc

  24. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up DECT Cipher FSE 2010

  25. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Kindle Kindle Cipher (PC1) A stream cipher with an 128 bit key. Amazons Kindle ebook DRM system

  26. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Kindle Cipher SAC 2012

  27. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Outline Motivation 1 Industry 2 Academia 3 A Critical View 4 Lightweight: 2nd Generation 5 Wrap-Up 6

  28. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Why? Question Why do they do that? We need secure well analyzed public ciphers for highly resource constrained devices.

  29. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up General Design Philosophy Guidelines/Goals Efficiency: Here mainly area Simplicity Security

  30. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Design Considerations: Hardware Hardware What do things cost in hardware? Suggestion Make it an interdisciplinary project!

  31. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Cost Overview Question What should/should not be used? Rule of Thumb: NOT: 0 . 5 GE NOR: 1 GE AND: 1 . 33 GE OR: 1 . 33 XOR: 2 . 67 Registers/Flipflops: 6 − 12 GE per bit!

  32. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Design Decisions I Question Block size/ Key size? Storage (FF) is expensive in hardware. Block size of 128 is too much. We do not have to keep things secret forever. Decision Relative Small Block Size: 32,48 or 64 Key size: 80 bit often enough

  33. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Block Cipher Parts SP-Network We have to design Non-linear-Layer Linear-Layer Key-scheduling Here we focus on the Non-linear-Layer and the Linear-Layer.

  34. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Design Issues Design Issues The S-Layer has to maximize nonlinearity. It has to be cheap. The S-Layer consist of a number of Sboxes executed in parallel S i : F b 2 → F b 2 In hardware realized as Boolean functions.

  35. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Design Issues Question Different Sboxes vs. all Sboxes the same? A serialized implementation becomes smaller if all Sboxes are the same. Decision Only one Sbox.

  36. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Design Issues Question What size of Sbox? In general: The bigger the Sbox the more expensive it is in hardware.

  37. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Sbox Costs Figure: Comparison of Sboxes

  38. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up P-Layer Design Issues The P-Layer has to maximize diffusion. It has to be cheap. Many modern ciphers: MDS codes (great diffusion!) DES: Bit permutation (no cost!) Design Decision Use less diffusion per round Use more rounds

  39. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Examples Modern Lightweight block ciphers SEA DESL PRESENT KATAN/ KTANTAN HIGHT PrintCIPHER A lot more out there...

  40. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up A comparison: (To be taken with care) A fair comparison is difficult Many dimensions Depends on the technology

  41. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up First Example: PRESENT PRESENT (CHES 2007) A 64 bit block cipher with 80/128 bit key and 31 rounds. Developed by RUB/DTU/ORANGE SP-network 4 bit Sbox Bit permutation as P-layer

  42. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up PRESENT: Overview Figure: Overview of PRESENT

  43. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up Second Example: KATAN KATAN (CHES 2009) A 32 / 48 / 64 bit block cipher with 80 bit key and 254 rounds. Developed by KUL A (kind of) Feistel-cipher Highly unbalanced Inspired by Trivium Very simple non-linear function

  44. Motivation Industry Academia A Critical View Lightweight: 2nd Generation Wrap-Up KATAN: Overview Figure: Overview of KATAN

Recommend

Lightweight Block Cipher Design Gregor Leander DTU Mathematics, Denmark ECRYPT II summer school

Lightweight Block Cipher Design Gregor Leander DTU Mathematics, Denmark ECRYPT II summer school

Motivation Industry Academia We Start To Cheat... And Fail! Lightweight Block Cipher Design Gregor Leander DTU Mathematics, Denmark ECRYPT II summer school May/June 2011 G. Leander Lightweight Block Cipher Design Motivation Industry

577 views • 56 slides
Advanced Block Cipher Design My crazy boss asked me to design a new block cipher. Whats next?

Advanced Block Cipher Design My crazy boss asked me to design a new block cipher. Whats next?

Advanced Block Cipher Design My crazy boss asked me to design a new block cipher. Whats next? Pascal Junod University of Applied Sciences Western Switzerland Pascal Junod -- Advanced Block Cipher Design 1 ECRYPT II Summer School - May

914 views • 56 slides
Problem 1 k zero bits n bits IV Block Block Block Block Cipher Cipher Cipher Cipher

Problem 1 k zero bits n bits IV Block Block Block Block Cipher Cipher Cipher Cipher

Problem 1 k zero bits n bits IV Block Block Block Block Cipher Cipher Cipher Cipher removed January 27, 2011 Practical Aspects of Modern Cryptography 2 Problem 1 IV Inverse Inverse Inverse Inverse Cipher Cipher Cipher Cipher

464 views • 20 slides
Lightweight Block Cipher Design Gregor Leander HGI, Ruhr University Bochum, Germany Sardinia

Lightweight Block Cipher Design Gregor Leander HGI, Ruhr University Bochum, Germany Sardinia

Motivation Industry Academia Lightweight: 2nd Generation NIST Initiative Lightweight Block Cipher Design Gregor Leander HGI, Ruhr University Bochum, Germany Sardinia 2015 Motivation Industry Academia Lightweight: 2nd Generation NIST

1.4k views • 95 slides
Practical Attack on 8 Rounds of the Lightweight Block Cipher KLEIN Jean-Philippe Aumasson NAGRA,

Practical Attack on 8 Rounds of the Lightweight Block Cipher KLEIN Jean-Philippe Aumasson NAGRA,

Practical Attack on 8 Rounds of the Lightweight Block Cipher KLEIN Jean-Philippe Aumasson NAGRA, Switzerland - Mara Naya-Plasencia FHNW, Windisch, Switzerland and University of Versailles, France - Markku-Juhani O. Saarinen Revere

263 views • 15 slides
Tweakable Block Cipher Secure Beyond the Birthday Bound in the Ideal Cipher Model Jooyoung Lee ,

Tweakable Block Cipher Secure Beyond the Birthday Bound in the Ideal Cipher Model Jooyoung Lee ,

Tweakable Block Cipher Secure Beyond the Birthday Bound in the Ideal Cipher Model Jooyoung Lee , Byeonghak Lee KAIST Tweakable Block Cipher A tweakable block cipher accepts an additional input "tweak - Tweaks are publicly used

519 views • 30 slides
Block Cipher Modes of Operation Electronic Code Book Cipher Block Chaining Mode Cryptography

Block Cipher Modes of Operation Electronic Code Book Cipher Block Chaining Mode Cryptography

Cryptography Block Cipher Modes of Operation Block Ciphers with Multiple Blocks Block Cipher Modes of Operation Electronic Code Book Cipher Block Chaining Mode Cryptography Cipher Feedback Mode School of Engineering and Technology

428 views • 32 slides
observations on the simon block cipher family Stefan Klbl 1 lightweight cryptography What is

observations on the simon block cipher family Stefan Klbl 1 lightweight cryptography What is

Gregor Leander 2 Tyge Tiessen 1 August 17, 2015 1 DTU Compute, Technical University of Denmark, Denmark 2 Horst Grtz Institute for IT Security, Ruhr-Universitt Bochum, Germany observations on the simon block cipher family Stefan Klbl 1

809 views • 60 slides
Small-Footprint Block Cipher Design - How far can you go? A. Bogdanov 1 , L.R. Knudsen 2 , G.

Small-Footprint Block Cipher Design - How far can you go? A. Bogdanov 1 , L.R. Knudsen 2 , G.

Small-Footprint Block Cipher Design - How far can you go? A. Bogdanov 1 , L.R. Knudsen 2 , G. Leander 1 , C. Paar 1 , A. Poschmann 1 , M.J.B. Robshaw 3 , Y. Seurin 3 , and C. Vikkelsoe 2 1 Horst-G ortz-Institute for IT-Security, Ruhr-University

400 views • 15 slides
ACORN v3 A Lightweight Authenticated Cipher Hongjun Wu Nanyang Technological University DIAC

ACORN v3 A Lightweight Authenticated Cipher Hongjun Wu Nanyang Technological University DIAC

ACORN v3 A Lightweight Authenticated Cipher Hongjun Wu Nanyang Technological University DIAC 2016 ACORN 1 Different Design Approaches: AES-NI (AEGIS) Fast SIMD (MORUS) Mode (JAMBU) Lightweight Dedicated ( ACORN ) DIAC 2016 ACORN 2

358 views • 15 slides
Block Cipher Cryptanalysis: An Overview Subhabrata Samajder Indian Statistical Institute, Kolkata

Block Cipher Cryptanalysis: An Overview Subhabrata Samajder Indian Statistical Institute, Kolkata

Block Cipher Cryptanalysis: An Overview Subhabrata Samajder Indian Statistical Institute, Kolkata 17 th May, 2017 0/52 Iterated Block Cipher Outline Iterated Block Cipher 1 S-Boxes 2 A Basic Substitution Permutation Network 3 Linear

1.58k views • 113 slides
Encryption and Attacks Attacks on Encryption Block Cipher Design Principles Cryptography

Encryption and Attacks Attacks on Encryption Block Cipher Design Principles Cryptography

Cryptography Encryption and Attacks Encryption Building Blocks Encryption and Attacks Attacks on Encryption Block Cipher Design Principles Cryptography Stream Cipher Design Principles Example: Brute School of Engineering and Technology

681 views • 51 slides
Encryption and Attacks Attacks on Encryption Block Cipher Design Principles Cryptography

Encryption and Attacks Attacks on Encryption Block Cipher Design Principles Cryptography

Cryptography Encryption and Attacks Encryption Building Blocks Encryption and Attacks Attacks on Encryption Block Cipher Design Principles Cryptography Stream Cipher Design Principles Example: Brute School of Engineering and Technology

923 views • 51 slides
Block Cipher Cryptanalysis II: Block Cipher Cryptanalysis II: Linear Cryptanalysis yp y Andrey

Block Cipher Cryptanalysis II: Block Cipher Cryptanalysis II: Linear Cryptanalysis yp y Andrey

Block Cipher Cryptanalysis II: Block Cipher Cryptanalysis II: Linear Cryptanalysis yp y Andrey Bogdanov Andrey Bogdanov K.U.Leuven, ESAT/COSIC Outline Outline Distribution of Correlation Data Complexity Linear Hulls Zero

659 views • 30 slides
ACORN A Lightweight Authenticated Cipher Hongjun Wu Nanyang Technological University DIAC 2014

ACORN A Lightweight Authenticated Cipher Hongjun Wu Nanyang Technological University DIAC 2014

ACORN A Lightweight Authenticated Cipher Hongjun Wu Nanyang Technological University DIAC 2014 ACORN 1 ACORN DIAC 2014 ACORN 2 Different Design Approaches: AES-NI (AEGIS) Fast SIMD (MORUS) Mode (JAMBU) Lightweight Dedicated ( ACORN

1.06k views • 13 slides
Simon: NSA-designed Cipher in the Post-snowden World Tomer Ashur KU Leuven 28/12/2015 The

Simon: NSA-designed Cipher in the Post-snowden World Tomer Ashur KU Leuven 28/12/2015 The

Simon: NSA-designed Cipher in the Post-snowden World Tomer Ashur KU Leuven 28/12/2015 The SIMON and SPECK Families of Lightweight Block Ciphers Two families of lightweight block ciphers (10 variants for each) Tomer Ashur Simon:

784 views • 51 slides
HOST Cryptography III ECE 525 AES Block Cipher Blockciphers are central tool in the design of

HOST Cryptography III ECE 525 AES Block Cipher Blockciphers are central tool in the design of

HOST Cryptography III ECE 525 AES Block Cipher Blockciphers are central tool in the design of protocols for shared-key cryptography What is a blockcipher? } k } n } n { , { , { , It is a function E of parameters k and n that maps

329 views • 17 slides
On the Lightweight Design Choices for Diffusion Layer of Block Ciphers SUMANTA SARKAR TCS

On the Lightweight Design Choices for Diffusion Layer of Block Ciphers SUMANTA SARKAR TCS

On the Lightweight Design Choices for Diffusion Layer of Block Ciphers SUMANTA SARKAR TCS Innovation Labs December 11, 2017 SUMANTA SARKAR Lightweight Cryptography Internet of Things / Connected Cars Internet of things (IoT): Network of

786 views • 45 slides
COBRA: A Parallelizable Authenticated Online Cipher without Block Cipher Inverse 1 Atul Luykx

COBRA: A Parallelizable Authenticated Online Cipher without Block Cipher Inverse 1 Atul Luykx

COBRA: A Parallelizable Authenticated Online Cipher without Block Cipher Inverse 1 Atul Luykx COSIC KU Leuven and iMinds March 3, 2014 1 Joint work with E. Andreeva, B. Mennink, and K. Yasuda. 1 / 23 Overview COBRA 1 Misuse resistance 2

711 views • 58 slides
Block Cipher Operation CBC CFB OFB CSS441: Security and Cryptography CTR Feedback Sirindhorn

Block Cipher Operation CBC CFB OFB CSS441: Security and Cryptography CTR Feedback Sirindhorn

CSS441 Block Cipher Operation Modes ECB Block Cipher Operation CBC CFB OFB CSS441: Security and Cryptography CTR Feedback Sirindhorn International Institute of Technology XTS-AES Thammasat University Prepared by Steven Gordon on 20

871 views • 32 slides
PSEUDO-RANDOM FUNCTIONS We want to answer the question: What is a good block cipher? where

PSEUDO-RANDOM FUNCTIONS We want to answer the question: What is a good block cipher? where

Recall We studied security of function families (in particular, block ciphers) against key recovery. But we saw that security against key recovery is not su ffi cient to ensure that natural usages of a block cipher are secure. PSEUDO-RANDOM

268 views • 13 slides
Overview of the DES A block cipher: encrypts blocks of 64 bits using a 64 bit key

Overview of the DES A block cipher: encrypts blocks of 64 bits using a 64 bit key

Overview of the DES A block cipher: encrypts blocks of 64 bits using a 64 bit key outputs 64 bits of ciphertext A product cipher basic unit is the bit performs both substitution and transposition (permutation) on the

512 views • 35 slides
The RC6 Block Cipher: A simple f ast secure AES proposal Ronald L. Rivest MI T Mat t

The RC6 Block Cipher: A simple f ast secure AES proposal Ronald L. Rivest MI T Mat t

The RC6 Block Cipher: A simple f ast secure AES proposal Ronald L. Rivest MI T Mat t Robshaw RSA Labs Ray Sidney RSA Labs Yiqun Lisa Yin RSA Labs (August 21, 1998) Out line N Design Philosophy N Descr ipt ion of

421 views • 19 slides
Attacks on the KeeLoq Block Cipher and Authentication Systems Andrey Bogdanov Chair for

Attacks on the KeeLoq Block Cipher and Authentication Systems Andrey Bogdanov Chair for

Attacks on the KeeLoq Block Cipher and Authentication Systems Andrey Bogdanov Chair for Communication Security Ruhr University Bochum, Germany abogdanov@crypto.rub.de www.crypto.rub.de Abstract. KeeLoq is a block cipher used in numerous

143 views • 13 slides

More recommend