New MILP Modelings for Symmetric-Key Primitives Christina Boura - PowerPoint PPT Presentation

New MILP Modelings for Symmetric-Key Primitives Christina Boura (Joint-work with Daniel Coggia) University of Versailles and Inria de Paris August 6, 2020 1 / 43

Symmetric-key encryption Alice and Bob share the same secret key for encryption and decryption. Encryption Decryption Families of symmetric algorithms: 1 Stream ciphers 2 Block ciphers 3 Hash functions 2 / 43

Block ciphers Encrypt a block of message m into a block of ciphertext c under the action of the key k . E : { 0 , 1 } n × { 0 , 1 } κ { 0 , 1 } n → �→ ( m, k ) E ( m, k ) = c k c m E 3 / 43

Substitution Permutation Network (SPN) m k 1 S S S S Linear Layer k 2 S S S S Linear Layer S S S S Linear Layer k r c 4 / 43

Sbox An Sbox can be seen as a vectorial Boolean function S : F n 2 → F m 2 S Typically n = m and n ∈ { 3 , 4 , 5 , 6 , 7 , 8 } Example (Sbox of PRESENT) x 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 S ( x ) 12 5 6 11 9 0 10 13 3 14 15 8 4 7 1 2 An Sbox is usually the only nonlinear component of the cipher. Security arguments for the cipher heavily depend on the properties of the Sbox. 5 / 43

Differential attacks Design strategy : A block cipher should resist all state-of-the-art attacks. Differential cryptanalysis: one of the most prominent attacks against block ciphers [Biham - Shamir ’90]. x + α x α For an SPN cipher, the security against differential cryptanalysis F F reduces on the differential properties of the Sbox. β F ( x ) F ( x + α ) 6 / 43

Difference Distribution Table (DDT) DDT ( α, β ) = # { x ∈ F n 2 : F ( x + α ) + F ( x ) = β } α / β 0 1 2 3 4 5 6 7 8 . . . . . . . 0 . 2 . 2 . 2 . 2 1 . . 2 2 . . 2 2 2 . 2 2 . . 2 2 . 2 . . . . 2 2 2 2 4 . 2 . 2 2 . 2 . 5 . . 2 2 2 2 . . 6 . 2 2 . 2 . . 2 7 2 3 = 1 2 Maximal differential probability p max = 4 . 7 / 43

Provable security against differential cryptanalysis m k 1 p max : Sbox’s maximal differential S S S S probability B r : Lower bound on the number of k 2 active Sboxes for any differential S S S S characteristic on r rounds k 3 The success probability of any r -round S S S S differential attack is upper bounded by p B r max . k 4 S S S S S Question : How to determine B r ? k 5 c 8 / 43

Mixed Integer Linear Programming (MILP) Objectif c 1 x 1 + · · · + c n x n c · x Constraints a 1 , 1 x 1 + · · · + a 1 ,n x n ≤ b 1 a 2 , 1 x 1 + · · · + a 2 ,n x n ≤ b 2 A · x ≤ b . . . a m, 1 x 1 + · · · + a m,n x n ≤ b m Domain x 1 , . . . , x d ∈ Z , x d +1 , . . . , x n ∈ R x 1 , . . . , x n ∈ { 0 , 1 } Objective function and all constraints are linear. Some variables are integers, some variables are continuous. Typically in our applications, almost all variables are Boolean. 9 / 43

Example of a MILP Problem − x 1 − x 2 Minimize Subject To − 2 x 1 + 2 x 2 ≥ 1 − 8 x 1 + 10 x 2 ≤ 13 where x 1 , x 2 ∈ Z and x 1 , x 2 ≥ 0 . Many good available solvers: Gurobi, CPLEX, . . . 10 / 43

First use of MILP in cryptography In 2011, Mouha et al. and Wu and Wang proposed to use MILP for finding the minimum number of differentially and linearly active Sboxes. Example AES x 0 x 4 x 8 x 12 x 16 x 20 x 24 x 28 x 1 x 5 x 9 x 13 x 17 x 21 x 25 x 29 R R x 2 x 6 x 10 x 14 x 18 x 22 x 26 x 30 x 3 x 7 x 11 x 15 x 19 x 23 x 27 x 31 Define 16 r variables x i ∈ { 0 , 1 } : x i = 1 has a non-zero difference (active) x i = 0 is (inactive) Write propagation rules as linear inequalities. Objective function: Minimize � x i . 11 / 43

Wordwise vs bitwise models Wordwise model One variable per word of the state (byte or nibble) The properties of the Sbox do not influence the propagation (only activeness counts) Only the branch number of the linear layer counts. Few variables, small system of inequalities Not that precise. Bitwise model Binary variables are assigned to each bit of the state. Propagation through linear layer becomes precise and simple to write down. However, too many inequalities may be needed. Propagation rules through Sbox complicated. 12 / 43

Modeling possible transitions through an Sbox 0 1 2 3 4 5 6 7 0 8 . . . . . . . 1 . 2 . 2 . 2 . 2 2 . . 2 2 . . 2 2 Input diff. x = ( x 0 , x 1 , x 2 ) 3 . 2 2 * . 2 2 * Output diff. y = ( y 0 , y 1 , y 2 ) 4 . . . . 2 2 2 2 5 . 2 . 2 2 . 2 . 6 . . 2 2 2 2 . . 7 . 2 2 * 2 . . 2 − 2 x 0 − 2 x 1 + x 2 − 2 y 0 − 2 y 1 + y 2 ≥ − 6 13 / 43

Modeling possible transitions through an Sbox 0 1 2 3 4 5 6 7 0 8 . . . . . . . 1 . 2 . 2 . 2 . 2 2 . . 2 2 . . 2 2 Input diff. x = ( x 0 , x 1 , x 2 , x 3 ) 3 . 2 2 . . 2 2 . Output diff. y = ( y 0 , y 1 , y 2 , y 3 ) 4 . . . . 2 2 2 2 5 . 2 . 2 2 * 2 * 6 . . 2 2 2 2 . . 7 . 2 2 . 2 * . 2 − 2 x 0 − 2 x 1 + x 2 − 2 y 0 − 2 y 1 + y 2 ≥ − 6 − 2 x 0 + x 1 − 2 x 2 − 2 y 0 + y 1 − 2 y 2 ≥ − 6 13 / 43

Modeling possible transitions through an Sbox 0 1 2 3 4 5 6 7 0 8 . . . . . . . 1 . 2 . 2 . 2 . 2 2 . . 2 2 . . 2 2 Input diff. x = ( x 0 , x 1 , x 2 , x 3 ) 3 . 2 2 . . 2 2 . Output diff. y = ( y 0 , y 1 , y 2 , y 3 ) 4 . . . . 2 2 2 2 5 . 2 . 2 2 . 2 . 6 . . 2 2 2 2 * * 7 . 2 2 . 2 . * 2 − 2 x 0 − 2 x 1 + x 2 − 2 y 0 − 2 y 1 + y 2 ≥ − 6 − 2 x 0 + x 1 − 2 x 2 − 2 y 0 + y 1 − 2 y 2 ≥ − 6 x 0 − 2 x 1 − 2 x 2 + y 0 − 2 y 1 − 2 y 2 ≥ − 6 13 / 43

Modeling possible transitions through an Sbox 0 1 2 3 4 5 6 7 0 8 * * * * * * * 1 * 2 * 2 * 2 * 2 2 * * 2 2 * * 2 2 Input diff. x = ( x 0 , x 1 , x 2 , x 3 ) 3 * 2 2 * * 2 2 * Output diff. y = ( y 0 , y 1 , y 2 , y 3 ) 4 * * * * 2 2 2 2 5 * 2 * 2 2 * 2 * 6 * * 2 2 2 2 * * 7 * 2 2 * 2 * * 2 − 2 x 0 − 2 x 1 + x 2 − 2 y 0 − 2 y 1 + y 2 ≥ − 6 − 2 x 0 + x 1 − 2 x 2 − 2 y 0 + y 1 − 2 y 2 ≥ − 6 x 0 − 2 x 1 − 2 x 2 + y 0 − 2 y 1 − 2 y 2 ≥ − 6 x 0 + 2 x 1 + 4 x 2 + 3 y 0 + 2 y 1 − 4 y 2 ≥ 0 − 3 x 0 + 2 x 1 − x 2 + 4 y 0 + 2 y 1 + 4 y 2 ≥ 0 4 x 0 − 2 x 1 + x 2 − 2 y 0 + 4 y 1 + 3 y 2 ≥ 0 13 / 43

How to model an Sbox? Goal: Given an Sbox, model efficiently all possible transitions by a system of linear inequalities. Two sub-problems: Problem 1 How to generate a (possibly large) set of inequalities that correctly models a DDT? Problem 2 How to choose a (typically much smaller) subset of this set of inequalities that still correctly represents the DDT but leads to more efficient MILP models? Two different approches proposed in 2014 by Sun et al. for Problem 1: 1 Convex hull approach 2 Logical condition modeling 14 / 43

Convex Hull Method Let S be a n -bit Sbox. Entry in the DDT: ( x 0 , . . . , x n − 1 , y 0 , . . . , y n − 1 ) ∈ R 2 n . Compute the H-representation of the convex hull of all possible transitions seen as vectors of R 2 n . The (2 n − 1) -dimensional faces of the convex hull yields a correct set of linear inequalities excluding all impossible points. Compute the H-representation with an al- gebra computer system (eg. Sage ). 15 / 43

Logical Condition Modeling Let a be an impossible transition a = ( a 0 , . . . , a m − 1 ) . The inequality m − 1 � (1 − a i ) x i + a i (1 − x i ) ≥ 1 i =0 only discards this transition a . Example Suppose (0x1,0x6) is an impossible transition. ( (100) � (011) ). Then, − x 0 + x 1 + x 2 + y 0 − y 1 − y 2 ≥ − 2 is satisfied by all points in F 6 2 but (0x1,0x6) . This method yields easily a system of inequalities with as many constraints as the number of impossible transitions through the DDT. 16 / 43

Problem for large Sboxes Advantage : Both methods provide a solution for Problem 1, that is relatively efficient for small Sboxes ( n ≤ 5 ). Disadvantage : Not efficient for modeling 8 -bit Sboxes. Computing the convex hull for 8 -bit Sboxes is computationally hard. The second method yields a very high number of initial inequalities with by construction no hope for a correct subset for Problem 2. For example: AES 33150 impossible transitions SKINNY-128 54067 impossible transitions 17 / 43

Use of the Quine-McCluskey (QM) algorithm Abdelkhalek et al. made in 2017 a step forwards for the 8 -bit Sbox problem: Search for good inequalities for 8 -bit Sboxes = Minimize the product-of-sum representation of a Boolean function ⇒ Use the Quine-McCluskey (QM) algorithm. Solve at once the two steps of the Sbox modelization problem: 1 Find many good inequalities (the prime implicants in the QM vocabulary) 2 Keep among them a good representative set. 18 / 43

About the QM approach Advantages 1 First interesting method for 8 -bit Sboxes 2 Good results for some Sboxes (e.g. SKINNY-128 ) But: QM needs high memory ressources and it can be slow. Some heuristic algorithm (e.g. Espresso) must be used instead. The number of inequalities given with this method for some Sboxes is still too high to be efficient. Algorithm # impossible trans. QM Espresso 33150 - 8302 AES SKINNY-128 54067 372 376 19 / 43