Practical Cryptanalysis of ARMADILLO-2 Mar a Naya-Plasencia and - PowerPoint PPT Presentation

The ARMADILLO-2 function Free-start collision attack Semi-free-start collision attack Conclusion Practical Cryptanalysis of ARMADILLO-2 Mar´ ıa Naya-Plasencia and Thomas Peyrin University of Versailles - France Nanyang Technological University - Singapore FSE 2012 Washington - March 19, 2012

The ARMADILLO-2 function Free-start collision attack Semi-free-start collision attack Conclusion Outline The ARMADILLO-2 function Free-start collision attack Semi-free-start collision attack Conclusion

The ARMADILLO-2 function Free-start collision attack Semi-free-start collision attack Conclusion Outline The ARMADILLO-2 function Free-start collision attack Semi-free-start collision attack Conclusion

The ARMADILLO-2 function Free-start collision attack Semi-free-start collision attack Conclusion What is ARMADILLO-2 ? • ARMADILLO-2 is a lightweight , multi-purpose cryptographic primitive published by Badel et al. at CHES 2010 • in the original article, ARMADILLO-1 is proposed but the authors identified a security issue and advised to use ARMADILLO-2 • ARMADILLO-2 is • a FIL-MAC • a stream-cipher • a hash function • they are all based on an internal function that uses data-dependent bit transpositions • 5 different parameters sizes defined

The ARMADILLO-2 function Free-start collision attack Semi-free-start collision attack Conclusion The basic building block: a parametrized permutation Q X ARMADILLO-2 uses a permutation Q A ( B ) as basic building block: • the internal state is initialized with input B we apply a steps, where a is the bitsize of the input parameter A • for each step i : • extract bit i from A • if A[i]=0, apply the bitwise permutations σ 0 , otherwise σ 1 • bitwise XOR the constant 1010 · · · 10 to the internal state Q A ( B ) A B

The ARMADILLO-2 function Free-start collision attack Semi-free-start collision attack Conclusion The basic building block: a parametrized permutation Q X ARMADILLO-2 uses a permutation Q A ( B ) as basic building block: • the internal state is initialized with input B we apply a steps, where a is the bitsize of the input parameter A • for each step i : • extract bit i from A • if A[i]=0, apply the bitwise permutations σ 0 , otherwise σ 1 • bitwise XOR the constant 1010 · · · 10 to the internal state 1010 · · · 10 Q A ( B ) A 1 − → apply σ 1 and xor B

The ARMADILLO-2 function Free-start collision attack Semi-free-start collision attack Conclusion The basic building block: a parametrized permutation Q X ARMADILLO-2 uses a permutation Q A ( B ) as basic building block: • the internal state is initialized with input B we apply a steps, where a is the bitsize of the input parameter A • for each step i : • extract bit i from A • if A[i]=0, apply the bitwise permutations σ 0 , otherwise σ 1 • bitwise XOR the constant 1010 · · · 10 to the internal state 1010 · · · 10 1010 · · · 10 Q A ( B ) A 1 − → apply σ 1 and xor 1 − → apply σ 1 and xor B

The ARMADILLO-2 function Free-start collision attack Semi-free-start collision attack Conclusion The basic building block: a parametrized permutation Q X ARMADILLO-2 uses a permutation Q A ( B ) as basic building block: • the internal state is initialized with input B we apply a steps, where a is the bitsize of the input parameter A • for each step i : • extract bit i from A • if A[i]=0, apply the bitwise permutations σ 0 , otherwise σ 1 • bitwise XOR the constant 1010 · · · 10 to the internal state 1010 · · · 10 1010 · · · 10 1010 · · · 10 Q A ( B ) A 0 − → apply σ 0 and xor 1 − → apply σ 1 and xor 1 − → apply σ 1 and xor B

The ARMADILLO-2 function Free-start collision attack Semi-free-start collision attack Conclusion The basic building block: a parametrized permutation Q X ARMADILLO-2 uses a permutation Q A ( B ) as basic building block: • the internal state is initialized with input B we apply a steps, where a is the bitsize of the input parameter A • for each step i : • extract bit i from A • if A[i]=0, apply the bitwise permutations σ 0 , otherwise σ 1 • bitwise XOR the constant 1010 · · · 10 to the internal state 1010 · · · 10 1010 · · · 10 1010 · · · 10 1010 · · · 10 0 − → apply σ 0 and xor Q A ( B ) A 0 − → apply σ 0 and xor 1 − → apply σ 1 and xor 1 − → apply σ 1 and xor B

The ARMADILLO-2 function Free-start collision attack Semi-free-start collision attack Conclusion The basic building block: a parametrized permutation Q X ARMADILLO-2 uses a permutation Q A ( B ) as basic building block: • the internal state is initialized with input B we apply a steps, where a is the bitsize of the input parameter A • for each step i : • extract bit i from A • if A[i]=0, apply the bitwise permutations σ 0 , otherwise σ 1 1010 · · · 10 • bitwise XOR the constant 1010 · · · 10 to the internal state 1010 · · · 10 1010 · · · 10 1010 · · · 10 1010 · · · 10 1 − → apply σ 1 and xor 0 − → apply σ 0 and xor Q A ( B ) A 0 − → apply σ 0 and xor 1 − → apply σ 1 and xor 1 − → apply σ 1 and xor B

The ARMADILLO-2 function Free-start collision attack Semi-free-start collision attack Conclusion The basic building block: a parametrized permutation Q X ARMADILLO-2 uses a permutation Q A ( B ) as basic building block: • the internal state is initialized with input B we apply a steps, where a is the bitsize of the input parameter A • for each step i : • extract bit i from A 1010 · · · 10 • if A[i]=0, apply the bitwise permutations σ 0 , otherwise σ 1 1010 · · · 10 • bitwise XOR the constant 1010 · · · 10 to the internal state 1010 · · · 10 1010 · · · 10 1010 · · · 10 1010 · · · 10 0 − → apply σ 0 and xor 1 − → apply σ 1 and xor 0 − → apply σ 0 and xor Q A ( B ) A 0 − → apply σ 0 and xor 1 − → apply σ 1 and xor 1 − → apply σ 1 and xor B

The ARMADILLO-2 function Free-start collision attack Semi-free-start collision attack Conclusion The ARMADILLO-2 compression function C ′ • two inputs: - the chaining variable C - the message block M Y • one output: - the chaining variable C ′ Q X ( C || M ) X Q M ( C || M ) M C M C M

The ARMADILLO-2 function Free-start collision attack Semi-free-start collision attack Conclusion The ARMADILLO-2 compression function k c m C ′ 128 80 48 192 128 64 Y 240 160 80 288 192 96 384 256 128 Q X ( C || M ) X Q M ( C || M ) M C M C M

The ARMADILLO-2 function Free-start collision attack Semi-free-start collision attack Conclusion Cryptanalysis of ARMADILLO-2 Abdelraheem et al. (ASIACRYPT 2011): • key recovery attack on the FIL-MAC • key recovery attack on the stream cipher • (second)-preimage attack on the hash function ... but computation and memory complexity is very high , often close to the generic complexity (example 256-bit preimage with 2 208 computations and 2 205 memory or 2 249 computations and 2 45 memory) We provide very practical attacks (only a few operations): • distinguisher and related-key recovery on the stream cipher • free-start collision on the compression function (chosen-related IVs) • semi-free-start collision on the compression/hash function (chosen IV)

The ARMADILLO-2 function Free-start collision attack Semi-free-start collision attack Conclusion First tools For two random k -bit words A and B of Hamming weight a and b respectively, the probability that HAM ( A ∧ B ) = i is � a �� k − a � b �� k − b � � i b − i i a − i P and ( k , a , b , i ) = = . � k � k � � b a For two random k -bit words A and B of Hamming weight a and b respectively, the probability that HAM ( A ⊕ B ) = i is P and ( k , a , b , a + b − i � ) for ( a + b − i ) even 2 P xor ( k , a , b , i ) = 0 for ( a + b − i ) odd

The ARMADILLO-2 function Free-start collision attack Semi-free-start collision attack Conclusion Outline The ARMADILLO-2 function Free-start collision attack Semi-free-start collision attack Conclusion

The ARMADILLO-2 function Free-start collision attack Semi-free-start collision attack Conclusion The differential path - right side C ′ Y Q X ( C || M ) X Q M ( C || M ) M C M C M

b b The ARMADILLO-2 function Free-start collision attack Semi-free-start collision attack Conclusion The differential path - right side M ∆ M = 0 C M HAM (∆ C ) = 1 ∆ M = 0

b b b b b b b The ARMADILLO-2 function Free-start collision attack Semi-free-start collision attack Conclusion The differential path - right side HAM (∆ X ) = 1 M ∆ M = 0 C M HAM (∆ C ) = 1 ∆ M = 0 We have HAM (∆ X ) = 1 with probability 1

b b b b b b b The ARMADILLO-2 function Free-start collision attack Semi-free-start collision attack Conclusion The differential path - right side ∆ X = 0 . . . 01 ∆ M = 0 M C M HAM (∆ C ) = 1 ∆ M = 0 We have ∆ X = 0 . . . 01 with probability P X = 1 k

The ARMADILLO-2 function Free-start collision attack Semi-free-start collision attack Conclusion The differential path - left side C ′ Y Q X ( C || M ) X Q M ( C || M ) M C M C M

b b b The ARMADILLO-2 function Free-start collision attack Semi-free-start collision attack Conclusion The differential path - left side C ′ Y X ∆ X = 0 . . . 01 C M HAM (∆ C ) = 1 ∆ M = 0