More Accurate Differential Properties of LED64 and Midori64 Ling Sun - PowerPoint PPT Presentation

More Accurate Differential Properties of LED64 and Midori64 Ling Sun 1 , 2 , Wei Wang 1 , Meiqin Wang 1 1. Shandong University, Jinan, China 2. Nanyang Technological University, Singapore FSE 2019, Paris, France @ March 25, 2019

Outline Background & Contribution Preliminaries Automatic Search of Differentials Differential Analysis of the LED64 Block Cipher Differentials of Midori64 Considering Key-Schedule Conclusion

Background & Contribution Differential Cryptanalysis � Most fundamental techniques Biham and Shamir @ CRYPTO 1990 � More accurate distribution of the fixed-key differential probability Automatic Search � Automatic tools for the search of differential trails or differentials Essential Problems � Fixed-key probability of a differential trail � Fixed-key probability of a differential when multiple trails are available � Weak-key ratio of the differential distinguisher Contribution � Automatic method based on SAT for the search of differentials � Automatically search for right pairs of the STEP functions of LED64 ◮ Improved differential attacks � Models for the estimation of the weak-key space of a differential ◮ Applying to the analysis of Midori64

Outline Background & Contribution Preliminaries Automatic Search of Differentials Differential Analysis of the LED64 Block Cipher Differentials of Midori64 Considering Key-Schedule Conclusion

Preliminaries Differential Cryptanalysis � An r -round differential characteristic / trail C = ( C 0 , C 1 , . . . , C r ) . � The differential probability (DP) of a differential ( α, β ) is DP f ( α, β ) = { x ∈ F n 2 | f ( x ) ⊕ f ( x ⊕ α ) = β } . 2 n ◮ For a keyed function f ( · , k ) : DP f [ k ]( α, β ) & DP f [ k ]( C ) � Expected differential probability (EDP): � � EDP f ( α, β ) = mean DP f [ k ]( α, β ) . k ∈K � The weight of a differential or a trail: − log 2 ( EDP f ( α, β )) .

Preliminaries Markov Cipher Theory (Lai et al. @ EUROCRYPT 1991) � A Markov cipher is an iterative cipher for which the average differential probability over one round is independent of the input of the round function. C i − 1 C i C i +1 f i f i +1 � With the assumption of independent round keys, we have r � EDP f ( C ) = EDP f i ( C i − 1 , C i ) , i = 1 � EDP f ( α, β ) = EDP f ( C ) . C 0 = α, C r = β � Since Markov cipher is an ideal primitive, the EDP may deviate from the real differential probability. Hypothesis of Stochastic Equivalence For all differentials ( α, β ) , it holds that for most values of the key k , DP f [ k ]( α, β ) = EDP f ( α, β ) .

Preliminaries Distribution of the Fixed-key Probability Theorem 1 (Daemen and Rijmen @ 2007) In a key-alternating cipher f ( · , k ) , the fixed-key cardinality N f [ k ]( α, β ) of a differential ( α, β ) is a stochastic variable with the following distribution: Pr( N f [ k ]( α, β ) = i ) ≈ Poisson ( i ; 2 n − 1 EDP ( α, β )) , where the distribution function measures the probability over all possible values of the key and all possible choices of the key schedule. k i − 1 k i k i +1 f i f i +1 0 . 5 2 n − 1 EDP( α, β ) � Since the key-alternating cipher is an abstract of the real cipher, the distribution might not fit the real one, entirely. � We call the keys fulfilling N [ k ]( α, β ) � 2 n − 1 EDP ( α, β ) the weak-keys . � The set of weak-keys is denoted as W K ( α, β ) .

Outline Background & Contribution Preliminaries Automatic Search of Differentials Differential Analysis of the LED64 Block Cipher Differentials of Midori64 Considering Key-Schedule Conclusion

Automatic Search of Differentials Main Idea SAT Problem � The boolean satisfiability problem (SAT) considers the satisfiability of a given Boolean formula. � Cryptominisat ◮ Compatible with the XOR operation ◮ The usage of searching for multiple solutions SAT Solver P-layer Model Model S-layer CNF Trail Differential Model Objective Function

Automatic Search of Differentials Main Idea SAT Solver P-layer Model Model S-layer CNF Trail Differential Model Objective Function � The number of solutions handled by the solver is determined by the individual SAT problem. � According to our experience, 2 32 is an upper-bound. � The crucial problem is how to use these trails to conduct differential cryptanalysis more accurately.

Outline Background & Contribution Preliminaries Automatic Search of Differentials Differential Analysis of the LED64 Block Cipher Differentials of Midori64 Considering Key-Schedule Conclusion

Differential Analysis of the LED64 Block Cipher Main Idea Equivalent Computing the probability Searching for the right pairs of a differential of a differential SAT solver Constraints on the values Right pairs Planar Trail 0 Right pairs for the differential mapping of the right pairs for Trail 0 Differential Right pairs Constraints on the values Planar Trail 1 mapping of the right pairs for Trail 1 . . . Constraints on the values Right pairs Planar Trail m − 1 mapping of the right pairs for Trail 1

Differential Analysis of the LED64 Block Cipher Planar Differentials and Maps � For the differential ( α, β ) of the function f , F f ( α, β ) = { x | f ( x ) ⊕ f ( x ⊕ α ) = β } , G f ( α, β ) = { y | y = f ( x ) , x ∈ F f ( α, β ) } . � ( α, β ) is called a planar differential if F f ( α, β ) and G f ( α, β ) are affine subspaces. � A mapping is planar if all differentials over it are planar. � The S-layer composed of the parallel applications of S-boxes is planar when all the S-boxes have differential uniformity of 4. k i +1 ∆ x i +2 ∆ y i ∆ y i +1 ∆ x i k i ∆ x i +1 x i y i x i +1 y i +1 x i +2 S P S P x i ∈ F S (∆ x i , ∆ y i ) if and only if Mat i F · x i = Vec i F , y i ∈ G S (∆ x i , ∆ y i ) if and only if Mat i G · y i = Vec i G .

Differential Analysis of the LED64 Block Cipher Constraints for the Right Pairs ∆ y i ∆ x i AC ( c i ) MC SC SR x i y i Mat i Vec i � � � � G y i � G � · = . Mat i + 1 Vec i + 1 ⊕ Mat i + 1 · c i + 1 · P F F F y i SC ( x i ) . = x i + 1 MC ◦ SR ( y i ) ⊕ c i + 1 . = Framework for the Search of Right Pairs � To obtain the right pairs of a given differential ◮ Searching for many characteristics within the differential ◮ Generating Mat G , Mat F , Vec G and Vec F corresponding to the differential trail ◮ Applying SAT solver to get the right pairs for every trail

Differential Analysis of the LED64 Block Cipher Improved Differential Attacks 3- STEP Related-key Attack for LED64 (Mendel et al. @ ASIACRYPT 2012) ∆ ∆ ∆ ∆ 2 59 . 00 ց 2 56 . 50 ∆ ⊕ ∆ ∗ F i F i +1 F i +2 ∆ C ∆ ∗ → ∆ Probability 1 ∆ → ? 4- STEP Related-key Attack for LED64 (Mendel et al. @ ASIACRYPT 2012) ∆ ∆ ∆ ∆ ∆ 2 62 . 71 ց 2 60 . 82 F i F i +1 F i +2 F i +3 ∆ ∆ C Probability 1 Probability 1 ∆ → ? ∆ → ∆ 5- STEP Related-key Attack for LED64 (Nikolić et al. @ FSE 2013) ∆ ∆ ∆ ∆ ∆ ∆ 2 60 . 20 ց 2 57 . 70 ∆ F i F i +1 F i +2 F i +3 F i +4 ∆ C Probability 1 Probability 1 ∆ → ∆ ∗ Meet-in-the-middle

Outline Background & Contribution Preliminaries Automatic Search of Differentials Differential Analysis of the LED64 Block Cipher Differentials of Midori64 Considering Key-Schedule Conclusion

Differentials of Midori64 Considering Key-Schedule Outline Minimising the weak-key ratio K Trail 0 Differential V (0) V (1) K K Trail 1 . . . V ( m − 1) K Trail m − 1 Designer View K V (0) V (1) K K V ( m − 1) Detecting the maximum number K of compatible characteristics K Attacker View V (0) V (1) K K V ( m − 1) K

Weak-key Space of a Differential k i +1 ∆ x i +2 ∆ y i ∆ y i +1 ∆ x i k i ∆ x i +1 y i y i +1 x i x i +1 x i +2 S P S P y i ∈ G S (∆ x i , ∆ y i ) if and only if Mat i G · y i = Vec i G . · x i + 1 = Mat i + 1 P · y i ⊕ k i � · P · y i ⊕ Mat i + 1 · k i = Vec i + 1 � Mat i + 1 = Mat i + 1 · . F F F F F � Vec i � y i Mat i � � � � U U ⇒ · = . Mat i k i Vec i 0 K K Necessary Condition � The i -th subkey k i falls into the affine space { x | Mat i K · x = Vec i K } . � For an r -round differential consisting of m characteristics, if a particular key leads all m characteristics to become impossible trails, the differential under this fixed-key turns into an impossible differential . � For the differential ( α, β ) , we denote the set of these keys as I K ( α, β ) , which satisfies W K ( α, β ) ⊆ K − I K ( α, β ) .

Upper-Bound for Weak-key Ratio of Differential Estimating the Cardinality of the Weak-key Space K m − 1 V ( j ) � W K ( α, β ) ⊆ � K . V (0) V (1) K K j = 0 m − 1 V ( j ) V ( m − 1) � Pr { K | K ∈ � K } : a natural K j = 0 upper-bound for the weak-key ratio. � By De Morgan’s laws, we know m − 1 m − 1 � � � V ( j ) � K − V ( j ) K − = . K K j = 0 j = 0 � Main idea: converting the restrictions on the set into clauses in CNF.