Motivation Partial DDT-s Results Conclusions On the Construction of Partial Difference Distribution Tables for ARX Ciphers A. Biryukov V. Velichkov LACS, Luxembourg University ESC 2013, January 14-18, Mondorf-les-Bains, Luxembourg (Luxembourg University) On the Construction of DDTs for ARX ESC 2013 1 / 37
Motivation Partial DDT-s Results Conclusions Outline Motivation 1 Partial DDT-s 2 Results 3 Computation of pDDT-s: Timings Preliminary Results on TEA Conclusions 4 (Luxembourg University) On the Construction of DDTs for ARX ESC 2013 2 / 37
Motivation Partial DDT-s Results Conclusions Outline Motivation 1 Partial DDT-s 2 Results 3 Computation of pDDT-s: Timings Preliminary Results on TEA Conclusions 4 (Luxembourg University) On the Construction of DDTs for ARX ESC 2013 3 / 37
Motivation Partial DDT-s Results Conclusions Differential Cryptanalysis [Biham,Shamir,1991] α = P ⊕ P ⋆ P ⋆ P round round X ⋆ X 1 ∆ X 1 1 round round X ⋆ X 2 ∆ X 2 2 round round β = C ⊕ C ⋆ C ⋆ C DP ( α → β ) =? (Luxembourg University) On the Construction of DDTs for ARX ESC 2013 4 / 37
Motivation Partial DDT-s Results Conclusions Substitution Box (S-box): a Source of Non-linearity An example 4-bit S-box: a S b = S [ a ] 0 1 2 3 4 5 6 7 8 9 A B C D E F a E 4 D 1 2 F B 8 3 A 6 C 5 9 0 7 S [ a ] The differential probability of an S-box: DP ( α → β ) = # { a : S [ a ⊕ α ] ⊕ S [ a ] = β } . # { a } S-boxes make differential cryptanalysis harder (Luxembourg University) On the Construction of DDTs for ARX ESC 2013 5 / 37
Motivation Partial DDT-s Results Conclusions Difference Distribution Table (DDT) for 4-bit S-box 0 1 2 3 4 5 6 7 8 9 A B C D E F α , β 0 16 . . . . . . . . . . . . . . . 1 . . . 2 . . . 2 . 2 4 . 4 2 . . 2 . . . 2 . 6 2 2 . 2 . . . . 2 . 3 . . 2 . 2 . . . . 4 2 . 2 . . 4 4 . . . 2 . . 6 . . 2 . 4 2 . . . 5 . 4 . . . 2 2 . . . 4 . 2 . . 2 6 . . . 4 . 4 . . . . . . 2 2 2 2 7 . . 2 2 2 . 2 . . 2 2 . . . . 4 8 . . . . . . 2 2 . . . 4 . 4 2 2 9 . 2 . . 2 . . 4 2 . 2 2 2 . . . A . 2 2 . . . . . 6 . . 2 . . 4 . B . . 8 . . 2 . 2 . . . . . 2 . 2 C . 2 . . 2 2 2 . . . . 2 . 6 . . D . 4 . . . . . 4 2 . 2 . 2 . 2 . E . . 2 4 2 . . . 6 . . . . . 2 . F . 2 . . 6 . . . . 4 . 2 . . 2 . (Luxembourg University) On the Construction of DDTs for ARX ESC 2013 6 / 37
Motivation Partial DDT-s Results Conclusions DDT: Analyzing the Differential Properties of an S-box A DDT reflects the differential properties of an S-box Many useful parameters can be computed from the DDT e.g. the maximum differential probability: α,β DP ( α → β ) = DP ( 0xB → 0x2 ) = 8 max 16 = 0 . 5 . Used to estimate the strength against DC e.g. set upper bound on the max. probability of a differential (Luxembourg University) On the Construction of DDTs for ARX ESC 2013 7 / 37
Motivation Partial DDT-s Results Conclusions Cipher Designs that Use S-boxes Many cipher designs use S-boxes as a component S S S S P Examples: DES, AES, PRESENT, etc. (Luxembourg University) On the Construction of DDTs for ARX ESC 2013 8 / 37
Motivation Partial DDT-s Results Conclusions Modular Addition and XOR as Sources of Non-linearity a a b b a + b a ⊕ b ADD XOR ADD is non-linear w.r.t. XOR differences: ( a ⊕ α )+( b ⊕ β ) � = ( a + b ) ⊕ ( α + β ) . XOR is non-linear w.r.t. ADD differences ( a + α ) ⊕ ( b + β ) � = ( a ⊕ b ) + ( α ⊕ β ) . (Luxembourg University) On the Construction of DDTs for ARX ESC 2013 9 / 37
Motivation Partial DDT-s Results Conclusions Designs Based on ADD and XOR (ARX) ADD and XOR provide non-linearity similarly to an S-box ≪ ≪ ≪ ≪ Examples: FEAL, MD4, MD5, Salsa20, Skein, etc. (Luxembourg University) On the Construction of DDTs for ARX ESC 2013 10 / 37
Motivation Partial DDT-s Results Conclusions The XOR Differential Probability of Modular Addition α , β , γ are XOR differences: α β xdp + γ xdp + ( α, β → γ ) = # { ( a , b ) : (( a ⊕ α ) + ( b ⊕ β ) ⊕ ( a + b )) = γ } . # { ( a , b ) } (Luxembourg University) On the Construction of DDTs for ARX ESC 2013 11 / 37
Motivation Partial DDT-s Results Conclusions The Additive Differential Probability of XOR α , β , γ are additive ( ADD ) differences: α β adp ⊕ γ adp ⊕ ( α, β → γ ) = # { ( a , b ) : (( a + α ) ⊕ ( b + β )) − ( a + b ) = γ } . # { ( a , b ) } (Luxembourg University) On the Construction of DDTs for ARX ESC 2013 12 / 37
Motivation Partial DDT-s Results Conclusions A DDT for ADD (resp. XOR )? Viewing the ADD operation as an S-box: S c = a + b = S [ a || b ] ( a , b ) The DDT of this S-box is huge: 2 64 × 2 32 Infeasible to compute and store the full table! Maybe we can only store part of the DDT, say, the top k differentials: k ≪ 2 64 × 2 32 . (1) A partial DDT? (Luxembourg University) On the Construction of DDTs for ARX ESC 2013 13 / 37
Motivation Partial DDT-s Results Conclusions Outline Motivation 1 Partial DDT-s 2 Results 3 Computation of pDDT-s: Timings Preliminary Results on TEA Conclusions 4 (Luxembourg University) On the Construction of DDTs for ARX ESC 2013 14 / 37
Motivation Partial DDT-s Results Conclusions Partial DDT for XOR and ADD Definition A partial difference distribution table D for ADD (resp. XOR ) is a DDT that contains all XOR (resp. ADD ) differentials ( α, β → γ ) whose probabilities are larger than or equal to a pre-defined threshold p thres : ⇒ DP ( α, β → γ ) ≥ p thres . ( α, β, γ ) ∈ D ⇐ (Luxembourg University) On the Construction of DDTs for ARX ESC 2013 15 / 37
Motivation Partial DDT-s Results Conclusions Computation of a Partial DDT Proposition The differential probabilities (DP) of ADD and XOR (resp. xdp + and adp ⊕ ) are monotonously decreasing with the word size n of the differences α, β, γ : p n ≤ . . . ≤ p k + 1 ≤ p k ≤ p k − 1 ≤ . . . ≤ p 1 , where p k = DP ( α k , β k → γ k ) , n ≤ k ≤ 1 , and x k denotes the k LSB-s of the difference x. (Luxembourg University) On the Construction of DDTs for ARX ESC 2013 16 / 37
Motivation Partial DDT-s Results Conclusions The DP of ADD and XOR is Decreasing with n For ADD , the proposition follows from a result by [LM01]: i = 0 ¬ eq ( α [ i ] ,β [ i ] ,γ [ i ]) , xdp + ( α, β → γ ) = 2 − � n − 2 where eq ( α [ i ] , β [ i ] , γ [ i ]) = 1 ⇐ ⇒ α [ i ] = β [ i ] = γ [ i ] . Is also true for adp ⊕ . [LM01] Lipmaa, Moriai: Efficient Algorithms for Computing Differential Properties of Addition. FSE 2001: 336-350 (Luxembourg University) On the Construction of DDTs for ARX ESC 2013 17 / 37
Motivation Partial DDT-s Results Conclusions Example: the DP of ADD is Decreasing with n n = 1 α β 0 1 1 . 0 1 γ 1 . 0 (Luxembourg University) On the Construction of DDTs for ARX ESC 2013 18 / 37
Motivation Partial DDT-s Results Conclusions Example: the DP of ADD is Decreasing with n n = 2 α β 10 01 0 . 5 01 γ 0 . 5 ≤ 1 . 0 (Luxembourg University) On the Construction of DDTs for ARX ESC 2013 18 / 37
Motivation Partial DDT-s Results Conclusions Example: the DP of ADD is Decreasing with n n = 3 α β 110 001 0 . 25 001 γ 0 . 25 ≤ 0 . 5 ≤ 1 . 0 (Luxembourg University) On the Construction of DDTs for ARX ESC 2013 18 / 37
Motivation Partial DDT-s Results Conclusions Example: the DP of ADD is Decreasing with n n = 4 α β 1110 0001 0 . 125 0001 γ 0 . 125 ≤ 0 . 25 ≤ 0 . 5 ≤ 1 . 0 (Luxembourg University) On the Construction of DDTs for ARX ESC 2013 18 / 37
Motivation Partial DDT-s Results Conclusions Example: the DP of ADD is Decreasing with n n = 5 α β 01110 00001 0 . 0625 00001 γ 0 . 0625 ≤ 0 . 125 ≤ 0 . 25 ≤ 0 . 5 ≤ 1 . 0 (Luxembourg University) On the Construction of DDTs for ARX ESC 2013 18 / 37
Motivation Partial DDT-s Results Conclusions Example: the DP of ADD is Decreasing with n n = 6 α β 101110 000001 0 . 0625 100001 γ 0 . 0625 ≤ 0 . 0625 ≤ 0 . 125 ≤ 0 . 25 ≤ 0 . 5 ≤ 1 . 0 (Luxembourg University) On the Construction of DDTs for ARX ESC 2013 18 / 37
Motivation Partial DDT-s Results Conclusions Example: the DP of ADD is Decreasing with n n = 7 α β 0101110 1000001 0 . 03125 1100001 γ 0 . 03125 ≤ 0 . 0625 ≤ 0 . 0625 ≤ 0 . 125 ≤ 0 . 25 ≤ 0 . 5 ≤ 1 . 0 (Luxembourg University) On the Construction of DDTs for ARX ESC 2013 18 / 37
Motivation Partial DDT-s Results Conclusions Example: the DP of ADD is Decreasing with n n = 8 α β 00101110 11000001 0 . 015625 11100001 γ 0 . 015625 ≤ 0 . 03125 ≤ 0 . 0625 ≤ 0 . 0625 ≤ 0 . 125 ≤ 0 . 25 ≤ 0 . 5 ≤ 1 . 0 (Luxembourg University) On the Construction of DDTs for ARX ESC 2013 18 / 37
Recommend
More recommend
