Introduction First attack Clamping attacks Low-Data Attack Conclusion Low-Memory Attacks against 2-Round Even-Mansour using the 3-XOR Problem Gaëtan Leurent, Ferdinand Sibleyras Inria, France Crypto 2019 1 / 23
Introduction First attack Clamping attacks Low-Data Attack Conclusion 1-Round Even-Mansour 1EM Most-Simple permutation-based block cipher. m Original by Even and Mansour, Asiacrypt 91. Single-key by Dunkelman et al. , Eurocrypt 2012. K P K E ( m ) 2 / 23
Introduction First attack Clamping attacks Low-Data Attack Conclusion 1-Round Even-Mansour 1EM Most-Simple permutation-based block cipher. m Original by Even and Mansour, Asiacrypt 91. Single-key by Dunkelman et al. , Eurocrypt 2012. K � n -bit to n -bit public permutation P . secure block cipher E . n -bit secret key K . P K E ( m ) 2 / 23
Introduction First attack Clamping attacks Low-Data Attack Conclusion 1-Round Even-Mansour 1EM Most-Simple permutation-based block cipher. m Original by Even and Mansour, Asiacrypt 91. Single-key by Dunkelman et al. , Eurocrypt 2012. K � n -bit to n -bit public permutation P . secure block cipher E . n -bit secret key K . P D = number of calls to keyed E , Q = number of calls to the public P , 1EM provable security up to DQ ≪ 2 n . K ⇒ Security up to birthday bound 2 n / 2 . = E ( m ) 2 / 23
Introduction First attack Clamping attacks Low-Data Attack Conclusion 1-Round Even-Mansour 1EM Cryptanalysis in DQ = DT = 2 n originally by Daemen, Asiacrypt 91. m K P K E ( m ) 3 / 23
Introduction First attack Clamping attacks Low-Data Attack Conclusion 1-Round Even-Mansour 1EM Cryptanalysis in DQ = DT = 2 n originally by Daemen, Asiacrypt 91. x ∀ x , y ∈ { 0 , 1 } n , K x ⊕ y = K ⇐ ⇒ P ( y ) ⊕ E ( x ) = K y P P ( y ) K E ( x ) 3 / 23
Introduction First attack Clamping attacks Low-Data Attack Conclusion 1-Round Even-Mansour 1EM Cryptanalysis in DQ = DT = 2 n originally by Daemen, Asiacrypt 91. x ∀ x , y ∈ { 0 , 1 } n , K x ⊕ y = K ⇐ ⇒ P ( y ) ⊕ E ( x ) = K y = ⇒ x ⊕ E ( x ) ⊕ y ⊕ P ( y ) = 0 P P ( y ) K E ( x ) 3 / 23
Introduction First attack Clamping attacks Low-Data Attack Conclusion 1-Round Even-Mansour 1EM Cryptanalysis in DQ = DT = 2 n originally by Daemen, Asiacrypt 91. x ∀ x , y ∈ { 0 , 1 } n , K x ⊕ y = K ⇐ ⇒ P ( y ) ⊕ E ( x ) = K y = ⇒ x ⊕ E ( x ) ⊕ y ⊕ P ( y ) = 0 P Cryptanalysis via n -bit collision search P ( y ) Let f 0 ( x ) = x ⊕ E ( x ) and f 1 ( y ) = y ⊕ P ( y ). Find a collision between f 0 and f 1 , guess K = x ⊕ y . K = ⇒ No gap between the best proofs and attacks. E ( x ) 3 / 23
Introduction First attack Clamping attacks Low-Data Attack Conclusion 2-Round Even-Mansour 2EM m Extension by Bogdanov et al. , Eurocrypt 2012. Keeps it simple and secure beyond birthday-bound. K P 1 K P 2 K E ( m ) 4 / 23
Introduction First attack Clamping attacks Low-Data Attack Conclusion 2-Round Even-Mansour 2EM m Extension by Bogdanov et al. , Eurocrypt 2012. Keeps it simple and secure beyond birthday-bound. K Provably secure up to 2 2 n / 3 . P 1 Best cryptanalysis time complexity: T = 2 n / n . K P 2 K E ( m ) 4 / 23
Introduction First attack Clamping attacks Low-Data Attack Conclusion 2-Round Even-Mansour 2EM m Extension by Bogdanov et al. , Eurocrypt 2012. Keeps it simple and secure beyond birthday-bound. K Provably secure up to 2 2 n / 3 . P 1 Best cryptanalysis time complexity: T = 2 n / n . K GAP There remains a significant gap between the proof, 2 2 n / 3 , and the P 2 best attacks in T = 2 n / n . K E ( m ) 4 / 23
Introduction First attack Clamping attacks Low-Data Attack Conclusion Our Approach Best information theoretic attack trade-off: DQ 2 = 2 2 n . 2EM This matches the proof only in D = Q = 2 2 n / 3 . m Best time complexity cryptanalysis in T = 2 n / n but it uses also a lot of memory and/or online data! K P 1 K P 2 K E ( m ) 5 / 23
Introduction First attack Clamping attacks Low-Data Attack Conclusion Our Approach Best information theoretic attack trade-off: DQ 2 = 2 2 n . 2EM This matches the proof only in D = Q = 2 2 n / 3 . x Best time complexity cryptanalysis in T = 2 n / n but it uses also a lot of memory and/or online data! K y In this work, we use the fact that: P 1 ∀ x , y , z ∈ { 0 , 1 } n , P 1 ( y ) K x ⊕ y = K � z x ⊕ y = K = K ⇐ ⇒ P 1 ( y ) ⊕ z = K P 1 ( y ) ⊕ z P 2 P 2 ( z ) ⊕ E ( x ) = K P 2 ( z ) K E ( x ) 5 / 23
Introduction First attack Clamping attacks Low-Data Attack Conclusion Our Approach Best information theoretic attack trade-off: DQ 2 = 2 2 n . 2EM This matches the proof only in D = Q = 2 2 n / 3 . x Best time complexity cryptanalysis in T = 2 n / n but it uses also a lot of memory and/or online data! K y In this work, we use the fact that: P 1 ∀ x , y , z ∈ { 0 , 1 } n , P 1 ( y ) K x ⊕ y = K � z x ⊕ y = K = K ⇐ ⇒ P 1 ( y ) ⊕ z = K P 1 ( y ) ⊕ z P 2 P 2 ( z ) ⊕ E ( x ) = K P 2 ( z ) � x ⊕ y ⊕ P 1 ( y ) ⊕ z = 0 K = ⇒ x ⊕ E ( x ) ⊕ ⊕ P 2 ( z ) = 0 y E ( x ) 5 / 23
Introduction First attack Clamping attacks Low-Data Attack Conclusion First result : A Link to the 3-XOR 2EM x ⊕ y ⊕ P 1 ( y ) ⊕ = 0 x z K x ⊕ E ( x ) ⊕ y ⊕ P 2 ( z ) = 0 y P 1 P 1 ( y ) K z P 2 P 2 ( z ) K E ( x ) 6 / 23
Introduction First attack Clamping attacks Low-Data Attack Conclusion First result : A Link to the 3-XOR 2EM x ⊕ y ⊕ P 1 ( y ) ⊕ = 0 x z K x ⊕ E ( x ) ⊕ y ⊕ P 2 ( z ) = 0 y P 1 Cryptanalysis via the 3-XOR Problem with 2 n -bit functions P 1 ( y ) f 0 ( x )= x || x ⊕ E ( x ) K z y f 1 ( y )= y ⊕ P 1 ( y ) || P 2 f 2 ( z )= z || P 2 ( z ) P 2 ( z ) Solve the 3-XOR problem between f 0 , f 1 and f 2 . K Guess K = x ⊕ y . E ( x ) 6 / 23
Introduction First attack Clamping attacks Low-Data Attack Conclusion 3-XOR Problem Definition (Collision problem) Given two functions f 0 , f 1 , find two inputs ( x 0 , x 1 ) such that f 0 ( x 0 ) ⊕ f 1 ( x 1 ) = 0. 7 / 23
Introduction First attack Clamping attacks Low-Data Attack Conclusion 3-XOR Problem Definition (Collision problem) Given two functions f 0 , f 1 , find two inputs ( x 0 , x 1 ) such that f 0 ( x 0 ) ⊕ f 1 ( x 1 ) = 0. Definition (3-XOR problem) Given three functions f 0 , f 1 , f 2 , find three inputs ( x 0 , x 1 , x 2 ) such that f 0 ( x 0 ) ⊕ f 1 ( x 1 ) ⊕ f 2 ( x 2 ) = 0. 7 / 23
Introduction First attack Clamping attacks Low-Data Attack Conclusion 3-XOR Problem Definition (Collision problem) Given two functions f 0 , f 1 , find two inputs ( x 0 , x 1 ) such that f 0 ( x 0 ) ⊕ f 1 ( x 1 ) = 0. Definition (3-XOR problem) Given three functions f 0 , f 1 , f 2 , find three inputs ( x 0 , x 1 , x 2 ) such that f 0 ( x 0 ) ⊕ f 1 ( x 1 ) ⊕ f 2 ( x 2 ) = 0. Definition (3-XOR problem with lists) Given three lists L 0 , L 1 , L 2 , find three elements ( e 0 , e 1 , e 2 ) ∈ L 0 × L 1 × L 2 such that e 0 ⊕ e 1 ⊕ e 2 = 0. 7 / 23
Introduction First attack Clamping attacks Low-Data Attack Conclusion Gap of the 3-XOR Problem Definition (3-XOR problem with lists) Given three lists L 0 , L 1 , L 2 , find three elements ( e 0 , e 1 , e 2 ) ∈ L 0 × L 1 × L 2 such that e 0 ⊕ e 1 ⊕ e 2 = 0. Cryptanalysis of n -bit 2EM as a 3-XOR with 2 n -bit elements. 8 / 23
Introduction First attack Clamping attacks Low-Data Attack Conclusion Gap of the 3-XOR Problem Definition (3-XOR problem with lists) Given three lists L 0 , L 1 , L 2 , find three elements ( e 0 , e 1 , e 2 ) ∈ L 0 × L 1 × L 2 such that e 0 ⊕ e 1 ⊕ e 2 = 0. Cryptanalysis of n -bit 2EM as a 3-XOR with 2 n -bit elements. Solving Random 3-XOR with 2 n -bit elements Requires | L 0 | · | L 1 | · | L 2 | = 2 2 n so at least one list of size 2 2 n / 3 . | L 0 | = | L 1 | = | L 2 | = 2 2 n / 3 is enough: compute sum of all triples to find a solution. So we have a proof and Information Theoretical attack in 2 2 n / 3 . However best algorithms run in time T = O (2 n / n )... 8 / 23
Introduction First attack Clamping attacks Low-Data Attack Conclusion Gap of the 3-XOR Problem Definition (3-XOR problem with lists) Given three lists L 0 , L 1 , L 2 , find three elements ( e 0 , e 1 , e 2 ) ∈ L 0 × L 1 × L 2 such that e 0 ⊕ e 1 ⊕ e 2 = 0. Cryptanalysis of n -bit 2EM as a 3-XOR with 2 n -bit elements. Solving Random 3-XOR with 2 n -bit elements Requires | L 0 | · | L 1 | · | L 2 | = 2 2 n so at least one list of size 2 2 n / 3 . | L 0 | = | L 1 | = | L 2 | = 2 2 n / 3 is enough: compute sum of all triples to find a solution. So we have a proof and Information Theoretical attack in 2 2 n / 3 . However best algorithms run in time T = O (2 n / n )... = ⇒ We found the same gap... again ! 8 / 23
Introduction First attack Clamping attacks Low-Data Attack Conclusion Our Strategy 3-XOR solving Two main techniques: Multicollision based [Nikolic&Sasaki15] and Linear algebra based [Joux09]. Roughly same asymptotic time complexity. 9 / 23
Recommend
More recommend
