On the Provable Security of the Iterated Even-Mansour Cipher against - PowerPoint PPT Presentation

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion On the Provable Security of the Iterated Even-Mansour Cipher against Related-Key and Chosen-Key Attacks Benoît Cogliati 1 and Yannick Seurin 2 1 Versailles University, France 2 ANSSI, France April 29, 2015 — EUROCRYPT 2015 B. Cogliati and Y. Seurin RKA and CKA security for the IEM April 29, 2015 — EC 2015 1 / 29

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion Outline Introduction: Key-Alternating Ciphers in the Random Permutation Model Security Against Related-Key Attacks Security Against Chosen-Key Attacks B. Cogliati and Y. Seurin RKA and CKA security for the IEM April 29, 2015 — EC 2015 2 / 29

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion Outline Introduction: Key-Alternating Ciphers in the Random Permutation Model Security Against Related-Key Attacks Security Against Chosen-Key Attacks B. Cogliati and Y. Seurin RKA and CKA security for the IEM April 29, 2015 — EC 2015 3 / 29

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion Key-Alternating Cipher (KAC): Definition k f 0 f 1 f r k 0 k 1 k r n y x P 1 P 2 P r An r -round key-alternating cipher: • plaintext x ∈ { 0 , 1 } n , ciphertext y ∈ { 0 , 1 } n • master key k ∈ { 0 , 1 } κ • the P i ’s are public permutations on { 0 , 1 } n • the f i ’s are key derivation functions mapping k to n -bit “round keys” • examples: most SPNs (AES, SERPENT, PRESENT, LED, . . . ) B. Cogliati and Y. Seurin RKA and CKA security for the IEM April 29, 2015 — EC 2015 4 / 29

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion Key-Alternating Cipher (KAC): Definition k f 0 f 1 f r k 0 k 1 k r n y x P 1 P 2 P r An r -round key-alternating cipher: • plaintext x ∈ { 0 , 1 } n , ciphertext y ∈ { 0 , 1 } n • master key k ∈ { 0 , 1 } κ • the P i ’s are public permutations on { 0 , 1 } n • the f i ’s are key derivation functions mapping k to n -bit “round keys” • examples: most SPNs (AES, SERPENT, PRESENT, LED, . . . ) B. Cogliati and Y. Seurin RKA and CKA security for the IEM April 29, 2015 — EC 2015 4 / 29

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion Various Key-Schedule Types k 0 k 1 k r n y x P 1 P 2 P r Round keys can be: • independent (total key-length κ = ( r + 1) n ) • derived from an n -bit master key ( κ = n ), e.g. • trivial key-schedule: ( k , k , . . . , k ) • more complex: ( f 0 ( k ) , f 1 ( k ) , . . . , f r ( k )) • anything else (e.g. 2 n -bit master key ( k 0 , k 1 ) and round keys ( k 0 , k 1 , k 0 , k 1 , . . . ) as in LED-128) B. Cogliati and Y. Seurin RKA and CKA security for the IEM April 29, 2015 — EC 2015 5 / 29

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion Various Key-Schedule Types k 0 k 1 k r n y x P 1 P 2 P r Round keys can be: • independent (total key-length κ = ( r + 1) n ) • derived from an n -bit master key ( κ = n ), e.g. • trivial key-schedule: ( k , k , . . . , k ) • more complex: ( f 0 ( k ) , f 1 ( k ) , . . . , f r ( k )) • anything else (e.g. 2 n -bit master key ( k 0 , k 1 ) and round keys ( k 0 , k 1 , k 0 , k 1 , . . . ) as in LED-128) B. Cogliati and Y. Seurin RKA and CKA security for the IEM April 29, 2015 — EC 2015 5 / 29

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion Various Key-Schedule Types k 0 k 1 k r n y x P 1 P 2 P r Round keys can be: • independent (total key-length κ = ( r + 1) n ) • derived from an n -bit master key ( κ = n ), e.g. • trivial key-schedule: ( k , k , . . . , k ) • more complex: ( f 0 ( k ) , f 1 ( k ) , . . . , f r ( k )) • anything else (e.g. 2 n -bit master key ( k 0 , k 1 ) and round keys ( k 0 , k 1 , k 0 , k 1 , . . . ) as in LED-128) B. Cogliati and Y. Seurin RKA and CKA security for the IEM April 29, 2015 — EC 2015 5 / 29

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion Various Key-Schedule Types k k k n y x P 1 P 2 P r Round keys can be: • independent (total key-length κ = ( r + 1) n ) • derived from an n -bit master key ( κ = n ), e.g. • trivial key-schedule: ( k , k , . . . , k ) • more complex: ( f 0 ( k ) , f 1 ( k ) , . . . , f r ( k )) • anything else (e.g. 2 n -bit master key ( k 0 , k 1 ) and round keys ( k 0 , k 1 , k 0 , k 1 , . . . ) as in LED-128) B. Cogliati and Y. Seurin RKA and CKA security for the IEM April 29, 2015 — EC 2015 5 / 29

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion Various Key-Schedule Types n k f 0 f 1 f r k 0 k 1 k r n y x P 1 P 2 P r Round keys can be: • independent (total key-length κ = ( r + 1) n ) • derived from an n -bit master key ( κ = n ), e.g. • trivial key-schedule: ( k , k , . . . , k ) • more complex: ( f 0 ( k ) , f 1 ( k ) , . . . , f r ( k )) • anything else (e.g. 2 n -bit master key ( k 0 , k 1 ) and round keys ( k 0 , k 1 , k 0 , k 1 , . . . ) as in LED-128) B. Cogliati and Y. Seurin RKA and CKA security for the IEM April 29, 2015 — EC 2015 5 / 29

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion Various Key-Schedule Types n k f 0 f 1 f r k 0 k 1 k r n y x P 1 P 2 P r Round keys can be: • independent (total key-length κ = ( r + 1) n ) • derived from an n -bit master key ( κ = n ), e.g. • trivial key-schedule: ( k , k , . . . , k ) • more complex: ( f 0 ( k ) , f 1 ( k ) , . . . , f r ( k )) • anything else (e.g. 2 n -bit master key ( k 0 , k 1 ) and round keys ( k 0 , k 1 , k 0 , k 1 , . . . ) as in LED-128) B. Cogliati and Y. Seurin RKA and CKA security for the IEM April 29, 2015 — EC 2015 5 / 29

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion Proving the Security of KACs n k f 0 f 1 f r n y x P 1 P 2 P r Question How can we “prove” security? • against a general adversary: ⇒ too hard (unconditional complexity lower bound!) • against specific attacks (differential, linear. . . ): ⇒ use specific design of P 1 , . . . , P r (count active S-boxes, etc.) • against generic attacks: ⇒ Random Permutation Model for P 1 , . . . , P r B. Cogliati and Y. Seurin RKA and CKA security for the IEM April 29, 2015 — EC 2015 6 / 29

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion Proving the Security of KACs n k f 0 f 1 f r n y x P 1 P 2 P r Question How can we “prove” security? • against a general adversary: ⇒ too hard (unconditional complexity lower bound!) • against specific attacks (differential, linear. . . ): ⇒ use specific design of P 1 , . . . , P r (count active S-boxes, etc.) • against generic attacks: ⇒ Random Permutation Model for P 1 , . . . , P r B. Cogliati and Y. Seurin RKA and CKA security for the IEM April 29, 2015 — EC 2015 6 / 29

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion Proving the Security of KACs n k f 0 f 1 f r n y x P 1 P 2 P r Question How can we “prove” security? • against a general adversary: ⇒ too hard (unconditional complexity lower bound!) • against specific attacks (differential, linear. . . ): ⇒ use specific design of P 1 , . . . , P r (count active S-boxes, etc.) • against generic attacks: ⇒ Random Permutation Model for P 1 , . . . , P r B. Cogliati and Y. Seurin RKA and CKA security for the IEM April 29, 2015 — EC 2015 6 / 29

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion Proving the Security of KACs n k f 0 f 1 f r n y x P 1 P 2 P r Question How can we “prove” security? • against a general adversary: ⇒ too hard (unconditional complexity lower bound!) • against specific attacks (differential, linear. . . ): ⇒ use specific design of P 1 , . . . , P r (count active S-boxes, etc.) • against generic attacks: ⇒ Random Permutation Model for P 1 , . . . , P r B. Cogliati and Y. Seurin RKA and CKA security for the IEM April 29, 2015 — EC 2015 6 / 29

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion Analyzing KACs in the Random Permutation Model k f 0 f 1 f r P 1 · · · P r x P 1 P 2 P r y q c q p q p • the P i ’s are modeled as public random permutation oracles to which the adversary can only make black-box queries (both to P i and P − 1 ) i • adversary cannot exploit any weakness of the P i ’s ⇒ generic attacks • trades complexity for randomness ( ≃ Random Oracle Model) • complexity measure of the adversary: • q c = # queries to the cipher = plaintext/ciphertext pairs (data D ) • q p = # queries to each internal permutation oracle (time T ) • but otherwise computationally unbounded • ⇒ information-theoretic proof of security B. Cogliati and Y. Seurin RKA and CKA security for the IEM April 29, 2015 — EC 2015 7 / 29

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion Analyzing KACs in the Random Permutation Model k f 0 f 1 f r P 1 · · · P r x P 1 P 2 P r y q c q p q p • the P i ’s are modeled as public random permutation oracles to which the adversary can only make black-box queries (both to P i and P − 1 ) i • adversary cannot exploit any weakness of the P i ’s ⇒ generic attacks • trades complexity for randomness ( ≃ Random Oracle Model) • complexity measure of the adversary: • q c = # queries to the cipher = plaintext/ciphertext pairs (data D ) • q p = # queries to each internal permutation oracle (time T ) • but otherwise computationally unbounded • ⇒ information-theoretic proof of security B. Cogliati and Y. Seurin RKA and CKA security for the IEM April 29, 2015 — EC 2015 7 / 29