Multiple Differential Cryptanalysis of Round-Reduced Prince Anne - PowerPoint PPT Presentation

Multiple Differential Cryptanalysis of Round-Reduced Prince Anne Canteaut 1 , Thomas Fuhr 2 , Henri Gilbert 2 , María Naya-Plasencia 1 , Jean-René Reinhard 2 1 INRIA, France 2 ANSSI, France FSE 2014 - March 5, 2014 Canteaut, Fuhr, Gilbert, Naya-Plasencia, Reinhard Cryptanalysis of Prince FSE 2014 1 / 17

Introduction PRINCE Low latency lightweight blockcipher Published by Borghoff et al. at Asiacrypt 2012 64-bit blocks, 128-bit keys 12-round SP Network Security claim: No attack with Data × Time ≤ 2 126 Due to the specific structure of the cipher Canteaut, Fuhr, Gilbert, Naya-Plasencia, Reinhard Cryptanalysis of Prince FSE 2014 2 / 17

Introduction PRINCE - General structure FX Construction k 1 k 0 P ( k 0 ) m PRINCE core c PRINCE core : Internal keyed permutation using a 64-bit key P ( k 0 ) = ( k 0 ≫ 1 ) ⊕ ( k 0 ≫ 63 ) 2 × 64 = 128-bit key ( k 0 , k 1 ) Generic attack in DT = 2 126 Canteaut, Fuhr, Gilbert, Naya-Plasencia, Reinhard Cryptanalysis of Prince FSE 2014 3 / 17

Introduction Cryptanalyses of PRINCE Several related publication [AbedLL12] : Biclique attack on 12 rounds of PRINCE core [JeanNPWW13] : integral attack on 6 rounds [SoleimanyBYWNZZW13] : reflection attack on 6 rounds [CanteautNV13] : sieve-in-the-middle on 8 rounds [LiJW13] : meet-in-the-middle on 9 rounds Our results 9-round PRINCE: DT = 2 98 . 1 10-round PRINCE: DT = 2 118 . 6 11-round PRINCE with modified S-box: up to DT = 2 122 . 2 S-box choice allowed by the designers Canteaut, Fuhr, Gilbert, Naya-Plasencia, Reinhard Cryptanalysis of Prince FSE 2014 4 / 17

Description of Prince PRINCE core - Description k ⊕ RC 0 No key schedule S , MC , SR 5 rounds, 2 middle rounds, 5 inverse rounds k ⊕ RC 1 . . . S: 4 → 4 S-box layer k ⊕ RC 5 MC: Involutive linear S , MC , S − 1 diffusion layer SR: Wire-crossing k ⊕ RC 5 ⊕ α . . . operation k ⊕ RC 1 ⊕ α Use of a constant α SR − 1 , MC , S − 1 E k = E − 1 k ⊕ α k ⊕ RC 0 ⊕ α Canteaut, Fuhr, Gilbert, Naya-Plasencia, Reinhard Cryptanalysis of Prince FSE 2014 5 / 17

Description of Prince PRINCE block representation Representation of the block using a 4 × 4 nibble array . . . Row Column . . . or using a 4 × 16 bit array Row Nibble Column Slice Canteaut, Fuhr, Gilbert, Naya-Plasencia, Reinhard Cryptanalysis of Prince FSE 2014 6 / 17

Description of Prince PRINCE core round transformation Substitution layer S 16 identical 4-bit to 4-bit S-boxes working on nibbles A specific choice for PRINCE 8 affine equivalent classes allowed by the authors (family of ciphers) Linear layer L composed of Involutive linear diffusion (MixColumns): composition of "Mirror" on the rows: ( r 0 , r 1 , r 2 , r 3 ) ← ( r 3 , r 2 , r 1 , r 0 ) Addition of a parity bit: r i ← r i ⊕ ( r 0 ⊕ r 1 ⊕ r 2 ⊕ r 3 ) Slice-wise rotations by 0,1,2 or 3 positions Wire-crossing (ShiftRows): similar to AES ShiftRows Canteaut, Fuhr, Gilbert, Naya-Plasencia, Reinhard Cryptanalysis of Prince FSE 2014 7 / 17

Differential properties of PRINCE core Principle of our attack Study of the differential properties of PRINCE core Aggregation of several differentials on up 6 rounds Cancellation of differences on the parity bits Use of iterative differential patterns Extension to a key recovery attack on 10 rounds Generalization with different S-boxes Canteaut, Fuhr, Gilbert, Naya-Plasencia, Reinhard Cryptanalysis of Prince FSE 2014 8 / 17

Differential properties of PRINCE core A key observation on differences Linear Layer of PRINCE MixColumns ≪ 3 ≪ 2 ≪ 1 ≪ 3 ≪ 2 ≪ 1 ≪ 3 ≪ 2 ≪ 1 ≪ 3 ≪ 2 ≪ 1 ShiftRows Canteaut, Fuhr, Gilbert, Naya-Plasencia, Reinhard Cryptanalysis of Prince FSE 2014 9 / 17

Differential properties of PRINCE core A key observation on differences Linear Layer of PRINCE Difference MixColumns ≪ 3 ≪ 2 ≪ 1 ≪ 3 ≪ 2 ≪ 1 ≪ 3 ≪ 2 ≪ 1 ≪ 3 ≪ 2 ≪ 1 ShiftRows Canteaut, Fuhr, Gilbert, Naya-Plasencia, Reinhard Cryptanalysis of Prince FSE 2014 9 / 17

Differential properties of PRINCE core A key observation on differences Linear Layer of PRINCE Difference MixColumns ≪ 3 ≪ 2 ≪ 1 ≪ 3 ≪ 2 ≪ 1 ≪ 3 ≪ 2 ≪ 1 ≪ 3 ≪ 2 ≪ 1 ShiftRows The same 4 active nibbles Canteaut, Fuhr, Gilbert, Naya-Plasencia, Reinhard Cryptanalysis of Prince FSE 2014 9 / 17

Differential properties of PRINCE core A key observation on differences Linear Layer of PRINCE Difference MixColumns ≪ 3 ≪ 2 ≪ 1 ≪ 3 ≪ 2 ≪ 1 ≪ 3 ≪ 2 ≪ 1 ≪ 3 ≪ 2 ≪ 1 ShiftRows Another square active pattern Canteaut, Fuhr, Gilbert, Naya-Plasencia, Reinhard Cryptanalysis of Prince FSE 2014 9 / 17

Differential properties of PRINCE core 1-round differentials on square patterns δ 1 , δ 2 ∈ (∆ 1 × ∆ 2 ) ∪ (∆ 2 × ∆ 1 ) with ∆ 1 = { 1 , 4 , 5 } , ∆ 2 = { 2 , 8 , 10 } 18 admissible differences after each S-box layer δ 2 δ 1 δ 2 δ 1 δ 2 δ 1 δ 2 δ 1 δ 1 δ 2 δ 1 δ 2 δ 1 δ 2 δ 1 δ 2 S S S S δ ′ δ ′ δ ′ δ ′ 1 2 1 2 δ ′ δ ′ δ ′ δ ′ 1 2 1 2 δ ′ δ ′ δ ′ δ ′ 1 2 1 2 δ ′ δ ′ δ ′ δ ′ 1 2 1 2 ∆ 1 × ∆ 2 ∆ 2 × ∆ 1 ∆ 1 × ∆ 2 ∆ 2 × ∆ 1 ∆ 1 × ∆ 2 ∆ 2 × ∆ 1 ∆ 1 × ∆ 2 ∆ 2 × ∆ 1 δ ′ δ ′ δ ′ δ ′ δ ′ δ ′ δ ′ δ ′ 1 2 1 2 1 2 1 2 δ ′ δ ′ δ ′ δ ′ δ ′ δ ′ δ ′ δ ′ 2 1 2 1 1 2 1 2 δ ′ δ ′ δ ′ δ ′ δ ′ δ ′ δ ′ δ ′ 2 1 2 1 2 1 2 1 δ ′ δ ′ δ ′ δ ′ δ ′ δ ′ δ ′ δ ′ 1 2 1 2 2 1 2 1 Canteaut, Fuhr, Gilbert, Naya-Plasencia, Reinhard Cryptanalysis of Prince FSE 2014 10 / 17

Differential properties of PRINCE core Differentials over several rounds On several rounds: aggregation of differential trails on square patterns Complexity evaluation Under the classical assumption that round keys are independent Multiplication of probabilities of 1-round differentials Addition of probabilities of aggregated trails Middle rounds: no key addition between 2 S-box layers ⇒ treated as a layer of 4 S-boxes on 16 bits Canteaut, Fuhr, Gilbert, Naya-Plasencia, Reinhard Cryptanalysis of Prince FSE 2014 11 / 17

Differential properties of PRINCE core Differentials for round-reduced PRINCE Most probable differentials found Original PRINCE: 2 − 47 . 42 on 5 rounds, 2 − 56 . 42 on 6 rounds PRINCE, modified S-box: 2 − 50 on 6 rounds, 2 − 58 on 7 rounds x 0 1 2 3 4 5 6 7 8 9 A B C D E F S[x] 0 A 6 5 8 D 3 4 7 C 2 E 9 F B 1 Experimental validation Random choice of keys Exhaustive search for pairs following one of our differential trails Canteaut, Fuhr, Gilbert, Naya-Plasencia, Reinhard Cryptanalysis of Prince FSE 2014 12 / 17

Extension to a key recovery attack Extension by four rounds Plaintext S L S r S-box layers S and r + 1 linear layers L S − 1 L − 1 S − 1 Ciphertext Key additions do not modify differences Observation: no full diffusion after two rounds Canteaut, Fuhr, Gilbert, Naya-Plasencia, Reinhard Cryptanalysis of Prince FSE 2014 13 / 17

Extension to a key recovery attack Extension by four rounds Difference δ in Plaintext δ 1 δ 2 S L S δ 1 δ 2 Differential over r S-box layers S and r + 1 linear layers L δ ′ δ ′ 1 2 S − 1 L − 1 S − 1 δ ′ δ ′ 1 2 Difference δ out Ciphertext Key additions do not modify differences Observation: no full diffusion after two rounds Canteaut, Fuhr, Gilbert, Naya-Plasencia, Reinhard Cryptanalysis of Prince FSE 2014 13 / 17

Multiple Differential Cryptanalysis of Round-Reduced Prince Anne - PowerPoint PPT Presentation

Multiple Differential Cryptanalysis of Round-Reduced Prince Anne Canteaut 1 , Thomas Fuhr 2 , Henri Gilbert 2 , Mara Naya-Plasencia 1 , Jean-Ren Reinhard 2 1 INRIA, France 2 ANSSI, France FSE 2014 - March 5, 2014 Canteaut, Fuhr, Gilbert,

New Observations on Impossible Differential Cryptanalysis of Reduced-Round Camellia Ya Liu 1 ,

Mixture Differential Cryptanalysis: a New Approach to Distinguishers and Attacks on round-reduced

Differential Cryptanalysis of Round-Reduced PRINT CIPHER : Computing Roots of Permutations

Experiments on the Multiple Linear Cryptanalysis of Reduced Round Serpent B. Collard , F.-X.

Differential Cryptanalysis The first method which reduced the complexity of attacking DES below

/ 33 1 Cryptanalysis of Reduced round SKINNY Block Cipher Outline A brief description of

Differential Cryptanalysis of Round-Reduced Simon and Speck Farzaneh Abed Eik List Stefan Lucks

Multiple Differential Cryptanalysis: Theory and Practice C eline Blondeau, Beno t G

Cryptanalysis of Round-Reduced KECCAK using Non-Linear Structures Mahesh Sreekumar Rajasree

Improved Differential-Linear Cryptanalysis of 7-round Chaskey with Partitioning Gatan Leurent

Cube-Attack-Like Cryptanalysis of Round-Reduced Keccak Using MILP Ling Song , Jian Guo FSE 2019 @

Cryptanalysis of Round-Reduced LED Ivica Nikoli, Lei Wang and Shuang Wu FSE 2013 Singapore

Algebraic Cryptanalysis of Round-Reduced Keccak with Linear Structures Meicheng Liu joint work

Differential Analysis of Round-Reduced AES Faulty Ciphertexts Amir-Pasha Mirbaha Jean-Max

Linear Structures: Applications to Cryptanalysis of Round-Reduced Keccak Meicheng Liu joint work

Differential and Linear Cryptanalysis Lars R. Knudsen June 2014 L.R. Knudsen Differential and

Improved Key Recovery Attacks on Reduced-Round AES on Reduced-Round AES with Practical Data and

Truncated Differential Analysis of Reduced-Round LBlock Sareh Emami, Cameron McDonald, Josef

Cryptanalysis of Modern Symmetric-Key Block Ciphers [Based on A Tutorial on Linear and

Exhausting Demirci-Sel cuk Meet-in-the-Middle Attacks against Reduced-Round AES Patrick Derbez

Automatic Cryptanalysis of Block Ciphers with CP A case study: related key differential

Differential Cryptanalysis - quite similar to linear cryptanalysis - exploits the relationship

Practical Analysis of Reduced-Round K ECCAK Mar a Naya-Plasencia, Andrea R ock and Willi

Reduced Basis Collocation Methods for Partial Differential Equations with Random Coefficients