Making (near) Optimal Choices for the Design of Block Ciphers - PowerPoint PPT Presentation

Making (near) Optimal Choices for the Design of Block Ciphers Making (near) Optimal Choices for the Design of Block Ciphers Baptiste Lambin Horst G¨ ortz Institute for IT Security, Ruhr University Bochum 26/02/2020 Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 1 / 47

Making (near) Optimal Choices for the Design of Block Ciphers Introduction 1 Efficient Search for Optimal Diffusion Layers of GFNs 2 Variants of the AES Key-Schedule for Better Truncated Differential 3 Bounds Perspectives 4 Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 2 / 47

Making (near) Optimal Choices for the Design of Block Ciphers Introduction Introduction 1 Efficient Search for Optimal Diffusion Layers of GFNs 2 Variants of the AES Key-Schedule for Better Truncated Differential Bounds 3 4 Perspectives Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 3 / 47

Making (near) Optimal Choices for the Design of Block Ciphers Introduction Cryptography and Encryption plaintext plaintext Encrypt Decrypt unsecure channel ciphertext ciphertext Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 4 / 47

Making (near) Optimal Choices for the Design of Block Ciphers Introduction Symmetric Encryption plaintext plaintext E − 1 E key key unsecure channel ciphertext ciphertext Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 5 / 47

Making (near) Optimal Choices for the Design of Block Ciphers Introduction Symmetric Encryption plaintext plaintext E − 1 E key same key key unsecure channel ciphertext ciphertext Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 5 / 47

Making (near) Optimal Choices for the Design of Block Ciphers Introduction Block Ciphers k p c E Block Cipher A block cipher is a family of permutations E : F s 2 × F n 2 → F n 2 such that for any k ∈ F s 2 , E k = E ( k , · ) : F n 2 → F n 2 is a permutation. k is called the key s is called the key length n is called the block length Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 6 / 47

Making (near) Optimal Choices for the Design of Block Ciphers Introduction Distinguishers ⇒ Behavior of the block cipher that a random function does not have. Block cipher Random f f f ( x ) ⊕ f ( x ⊕ 0x13 ) = 0x37 f ( x ) ⊕ f ( x ⊕ 0x13 ) = 0x37 true with probability 2 − ( n − 1) true with probability p p ≫ 2 − ( n − 1) ⇒ we have a distinguisher Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 7 / 47

Making (near) Optimal Choices for the Design of Block Ciphers Introduction Substitution-Permutation Networks p k 0 S-box layer . . . S S S S Linear layer L k 1 Key-Schedule k . . . S S S S . . . L k r c Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 8 / 47

Making (near) Optimal Choices for the Design of Block Ciphers Introduction A partial example k : 0111011010101110 . . . Key-Schedule k 0 : 0111011010101110 k 1 : 1011101001011100 k 2 : 0111010100000111 k 3 : 1111111100010110 . . . Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 9 / 47

Making (near) Optimal Choices for the Design of Block Ciphers Introduction A partial example p = x 0 : 0101 1010 0111 0101 Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 10 / 47

Making (near) Optimal Choices for the Design of Block Ciphers Introduction A partial example p = x 0 : 0101 1010 0111 0101 0111 0110 1010 1110 : k 0 y 0 : 0010 1100 1101 1011 Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 10 / 47

Making (near) Optimal Choices for the Design of Block Ciphers Introduction A partial example p = x 0 : 0101 1010 0111 0101 0111 0110 1010 1110 : k 0 y 0 : 0010 1100 1101 1011 S S S S z 0 : 1000 1101 0001 0011 Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 10 / 47

Making (near) Optimal Choices for the Design of Block Ciphers Introduction A partial example p = x 0 : 0101 1010 0111 0101 0111 0110 1010 1110 : k 0 y 0 : 0010 1100 1101 1011 S S S S z 0 : 1000 1101 0001 0011 L x 1 : 1010 1000 1100 1001 Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 10 / 47

Making (near) Optimal Choices for the Design of Block Ciphers Introduction A partial example p = x 0 : 0101 1010 0111 0101 0111 0110 1010 1110 : k 0 y 0 : 0010 1100 1101 1011 S S S S z 0 : 1000 1101 0001 0011 L x 1 : 1010 1000 1100 1001 : k 1 1011 1010 0101 1100 y 1 : 0001 0010 1001 0101 . . . Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 10 / 47

Making (near) Optimal Choices for the Design of Block Ciphers Introduction Feistel Networks p k 0 F Key-Schedule k k r F c Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 11 / 47

Making (near) Optimal Choices for the Design of Block Ciphers Introduction p k 0 p . . . S S S S k 0 L F KS k k 1 KS k k r . . . S S S S . . F . L c k r c Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 12 / 47

Making (near) Optimal Choices for the Design of Block Ciphers Introduction Finding Optimal Components Na¨ ıve algorithm : exhaustive search Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 13 / 47

Making (near) Optimal Choices for the Design of Block Ciphers Introduction Finding Optimal Components Na¨ ıve algorithm : exhaustive search Pros : (Relatively) easy to implement Optimality is easy to prove Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 13 / 47

Making (near) Optimal Choices for the Design of Block Ciphers Introduction Finding Optimal Components Na¨ ıve algorithm : exhaustive search Pros : (Relatively) easy to implement Optimality is easy to prove Cons (non-exclusive) : The search space can be very large e.g. From 2 52 up to 2 75 in the first part of this presentation Testing one candidate can be expensive e.g. In the second part of this presentation, ”only” 2 44 candidates but testing each of them is expensive Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 13 / 47

Making (near) Optimal Choices for the Design of Block Ciphers Introduction Tools for Optimization (Mixed) Integer Linear Programming (and some other variants) Constraint Programming Metaheuristics (near optimality) SAT (somewhat) Dedicated algorithms Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 14 / 47

Making (near) Optimal Choices for the Design of Block Ciphers Introduction Tools for Optimization (Mixed) Integer Linear Programming (and some other variants) Constraint Programming Metaheuristics (near optimality) SAT (somewhat) Dedicated algorithms In this talk : Part 1 : Dedicated algorithm ( ∼ Branch-and-Bound) + efficient testing for the small cases Part 2 : Metaheuristics + Constraint Programming Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 14 / 47

Making (near) Optimal Choices for the Design of Block Ciphers Efficient Search for Optimal Diffusion Layers of GFNs Introduction 1 Efficient Search for Optimal Diffusion Layers of GFNs 2 Variants of the AES Key-Schedule for Better Truncated Differential Bounds 3 4 Perspectives Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 15 / 47

Making (near) Optimal Choices for the Design of Block Ciphers Efficient Search for Optimal Diffusion Layers of GFNs Generalized Feistel Network F key F key F key F key 0 1 k − 2 k − 1 π State composed of 2 k blocks k Feistels in parallel followed by a permutation π Easier to design but slower diffusion Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 16 / 47

Making (near) Optimal Choices for the Design of Block Ciphers Efficient Search for Optimal Diffusion Layers of GFNs Generalized Feistel Network S S S S π State composed of 2 k blocks k Feistels in parallel followed by a permutation π Easier to design but slower diffusion In this work, the key and the definition of the F-functions don’t matter Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 16 / 47

Making (near) Optimal Choices for the Design of Block Ciphers Efficient Search for Optimal Diffusion Layers of GFNs Diffusion Round S S S S S S S S S S S S S S S S S S S S S S S S Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 17 / 47

Making (near) Optimal Choices for the Design of Block Ciphers Efficient Search for Optimal Diffusion Layers of GFNs Diffusion Round S S S S S S S S S S S S S S S S S S S S S S S S Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 17 / 47

Making (near) Optimal Choices for the Design of Block Ciphers Efficient Search for Optimal Diffusion Layers of GFNs Diffusion Round S S S S S S S S S S S S S S S S S S S S S S S S Baptiste Lambin Making (near) Optimal Choices for the Design of Block Ciphers 17 / 47