Probabilistic Slide Cryptanalysis and Its Applications to LED-64 and - PowerPoint PPT Presentation

Probabilistic Slide Cryptanalysis and Its Applications to LED-64 and Zorro Hadi Soleimany Department of Information and Computer Science, Aalto University School of Science, Finland FSE 2014 1 / 21

Outline Introduction Slide Cryptanalysis Even-Mansour Scheme with a Single Key Probabilistic Slide Cryptanalysis Applications on LED-64 and Zorro Conclusion 2 / 21

Introduction Slide Cryptanalysis Even-Mansour Scheme with a Single Key Probabilistic Slide Cryptanalysis Applications on LED-64 and Zorro Conclusion 3 / 21

Iterated Block Cipher Block cipher: E K ( P ) : { 0 , 1 } k × { 0 , 1 } n → { 0 , 1 } n Iterated block cipher: · · · R k n − 1 R k 1 R k 2 R k 3 R k 4 R k n P C C = R k n ◦ · · · ◦ R k 2 ◦ R k 1 ( P ) 4 / 21

Iterated Block Cipher with Periodic Subkeys R k 1 · · · R k m R k 1 · · · R k m · · · R k 1 · · · R k m P C 5 / 21

Iterated Block Cipher with Periodic Subkeys R k 1 · · · R k m R k 1 · · · R k m · · · R k 1 · · · R k m P C { { { F k F k F k ◮ The cipher can be presented as a cascade of identical functions F k . 5 / 21

Slide Cryptanalysis [Biryukov Wagner 99] F k F k · · · F k F k P C P ′ F k F k · · · F k F k C ′ 6 / 21

Slide Cryptanalysis [Biryukov Wagner 99] F k F k · · · F k F k P C P ′ F k F k · · · F k F k C ′ P ′ = F k ( P ) 6 / 21

Slide Cryptanalysis [Biryukov Wagner 99] F k F k · · · F k F k P C P ′ F k F k · · · F k F k C ′ P ′ = F k ( P ) C ′ = F k ( C ) (Slid pair) = ⇒ 6 / 21

Slide Cryptanalysis [Biryukov Wagner 99] F k F k · · · F k F k P C P ′ F k F k · · · F k F k C ′ P ′ = F k ( P ) C ′ = F k ( C ) (Slid pair) = ⇒ Pr [ P ′ = F k ( P )] = 2 − n ( C ′ ) , P ′ = F k ( P )] = 2 − n > 2 − 2 n Pr [ C = F − 1 k ⇒ 2 n pairs (( P , C ) , ( P ′ , C ′ )) are expected to find a slid pair. = 6 / 21

Slide Cryptanalysis [Biryukov Wagner 99] F k F k · · · F k F k P C P ′ F k F k · · · F k F k C ′ P ′ = F k ( P ) C ′ = F k ( C ) (Slid pair) = ⇒ Pr [ P ′ = F k ( P )] = 2 − n ( C ′ ) , P ′ = F k ( P )] = 2 − n > 2 − 2 n Pr [ C = F − 1 k ⇒ 2 n pairs (( P , C ) , ( P ′ , C ′ )) are expected to find a slid pair. = Typical countermeasures: Key-schedule or round constants. 6 / 21

Slide Cryptanalysis [Biryukov Wagner 99] F k F k · · · F k F k P C P ′ F k F k · · · F k F k C ′ P ′ = F k ( P ) C ′ = F k ( C ) (Slid pair) = ⇒ Pr [ P ′ = F k ( P )] = 2 − n ( C ′ ) , P ′ = F k ( P )] = 2 − n > 2 − 2 n Pr [ C = F − 1 k ⇒ 2 n pairs (( P , C ) , ( P ′ , C ′ )) are expected to find a slid pair. = Typical countermeasures: Key-schedule or round constants. This Work: Probabilistic technique to overcome round constants in block ciphers based on the Even-Mansour scheme with a single key. 6 / 21

Even-Mansour Scheme with a Single Key K K K K K K · · · · · · F 1 F i F s P C 7 / 21

Even-Mansour Scheme with a Single Key K K K K K K · · · · · · F 1 F i F s P C R RC j R RC j + 1 R RC j + m · · · Known as Step ◮ Block ciphers like LED-64, PRINCE core , Zorro and PRINTcipher. 7 / 21

LED-64 AddConstants SubCells ShiftRows MixColumns ⊕ ⊕ S S S S ⊕ ⊕ S S S S ⊕ ⊕ S S S S ⊕ ⊕ S S S S ◮ Presented at CHES 2011 [Guo et al 11] ◮ 64-bit block cipher and supports 64-bit key ◮ 6 steps ◮ Each step consists of four rounds. 8 / 21

Zorro SubCells AddConstants ShiftRows MixColumns S S S S ⊕ ⊕ ⊕ ⊕ ◮ Presented at CHES 2013 [G´ erard et al 13] ◮ 128-bit block cipher and supports 128-bit key ◮ 6 steps ◮ Each step consists of four rounds 9 / 21

Introduction Slide Cryptanalysis Even-Mansour Scheme with a Single Key Probabilistic Slide Cryptanalysis Applications on LED-64 and Zorro Conclusion 10 / 21

Overview of Previous Attacks ◮ Slide cryptanalysis requires known plaintexts. 11 / 21

Overview of Previous Attacks ◮ Slide cryptanalysis requires known plaintexts. ◮ But it is limited to the ciphers with identical rounds. 11 / 21

Overview of Previous Attacks ◮ Slide cryptanalysis requires known plaintexts. ◮ But it is limited to the ciphers with identical rounds. ◮ Differential cryptanalysis is usually applicable on any round functions [Biham Shamir 90] . 11 / 21

Overview of Previous Attacks ◮ Slide cryptanalysis requires known plaintexts. ◮ But it is limited to the ciphers with identical rounds. ◮ Differential cryptanalysis is usually applicable on any round functions [Biham Shamir 90] . ◮ But there exists a lower bound for active S-boxes and it usually requires chosen plaintexts. 11 / 21

Overview of Previous Attacks ◮ Slide cryptanalysis requires known plaintexts. ◮ But it is limited to the ciphers with identical rounds. ◮ Differential cryptanalysis is usually applicable on any round functions [Biham Shamir 90] . ◮ But there exists a lower bound for active S-boxes and it usually requires chosen plaintexts. ◮ Related-key differential usually has less active S-boxes and applicable on more rounds [Kelsey et al 97] . 11 / 21

Overview of Previous Attacks ◮ Slide cryptanalysis requires known plaintexts. ◮ But it is limited to the ciphers with identical rounds. ◮ Differential cryptanalysis is usually applicable on any round functions [Biham Shamir 90] . ◮ But there exists a lower bound for active S-boxes and it usually requires chosen plaintexts. ◮ Related-key differential usually has less active S-boxes and applicable on more rounds [Kelsey et al 97] . ◮ But usually it is not a realistic model. 11 / 21

Overview of Previous Attacks ◮ Slide cryptanalysis requires known plaintexts. ◮ But it is limited to the ciphers with identical rounds. ◮ Differential cryptanalysis is usually applicable on any round functions [Biham Shamir 90] . ◮ But there exists a lower bound for active S-boxes and it usually requires chosen plaintexts. ◮ Related-key differential usually has less active S-boxes and applicable on more rounds [Kelsey et al 97] . ◮ But usually it is not a realistic model. ◮ Probabilistic reflection attack is applicable on block ciphers with almost symmetric rounds [Soleimany et al 13] . 11 / 21

Overview of Previous Attacks ◮ Slide cryptanalysis requires known plaintexts. ◮ But it is limited to the ciphers with identical rounds. ◮ Differential cryptanalysis is usually applicable on any round functions [Biham Shamir 90] . ◮ But there exists a lower bound for active S-boxes and it usually requires chosen plaintexts. ◮ Related-key differential usually has less active S-boxes and applicable on more rounds [Kelsey et al 97] . ◮ But usually it is not a realistic model. ◮ Probabilistic reflection attack is applicable on block ciphers with almost symmetric rounds [Soleimany et al 13] . ◮ But its application is limited to involutional block ciphers. 11 / 21

Overview of Previous Attacks ◮ Slide cryptanalysis requires known plaintexts. ◮ But it is limited to the ciphers with identical rounds. ◮ Differential cryptanalysis is usually applicable on any round functions [Biham Shamir 90] . ◮ But there exists a lower bound for active S-boxes and it usually requires chosen plaintexts. ◮ Related-key differential usually has less active S-boxes and applicable on more rounds [Kelsey et al 97] . ◮ But usually it is not a realistic model. ◮ Probabilistic reflection attack is applicable on block ciphers with almost symmetric rounds [Soleimany et al 13] . ◮ But its application is limited to involutional block ciphers. This Work Exploit previous ideas to take advantage of the positive properties and overcome the negative aspects! 11 / 21

Probabilistic Slide Distinguisher K K K K K K F 1 F 2 · · · F s − 1 F s P C ∆ 0 ∆ 1 ∆ s-2 ∆ s-1 K P ′ F 1 F 2 · · · F s − 1 F s C ′ K K K K K ◮ Assume there exists a sequence of differences D = { ∆ 0 , . . . , ∆ s − 1 } such that Pr [ F r ( x ) ⊕ F r − 1 ( x ⊕ ∆ r − 2 ) = ∆ r − 1 ] = 2 − p r − 1 where 0 ≤ p r . ◮ A differential-type characteristic with input difference ∆ in = ∆ 0 and output difference ∆ out = ∆ s − 1 can be obtained with probability 2 − p = Π s − 1 r = 1 2 − p r . 12 / 21

Probabilistic Slide Distinguisher K K K K K K · · · F s − 1 F 1 F 2 F s P C ∆ in ∆ out K P ′ · · · F s − 1 C ′ F 1 F 2 F s K K K K K P ′ ⊕ F 1 ( P ⊕ K ) = ∆ in 12 / 21

Probabilistic Slide Distinguisher K K K K K K · · · F s − 1 F 1 F 2 F s P C ∆ in ∆ out K P ′ · · · F s − 1 C ′ F 1 F 2 F s K K K K K probability 2 − p P ′ ⊕ F 1 ( P ⊕ K ) = ∆ in ( C ′ ⊕ K ) = ∆ out C ⊕ F − 1 = ⇒ s 12 / 21

Probabilistic Slide Distinguisher K K K K K K · · · F s − 1 F 1 F 2 F s P C ∆ in ∆ out K P ′ · · · F s − 1 C ′ F 1 F 2 F s K K K K K probability 2 − p P ′ ⊕ F 1 ( P ⊕ K ) = ∆ in ( C ′ ⊕ K ) = ∆ out C ⊕ F − 1 = ⇒ s Pr [ P ′ ⊕ F 1 ( P ⊕ K ) = ∆ in ] = 2 − n ( C ′ ⊕ K ) = ∆ out , P ′ ⊕ F 1 ( P ⊕ K ) = ∆ in ] = 2 − n − p Pr [ C ⊕ F − 1 s ⇒ 2 ( n + p ) pairs (( P , C ) , ( P ′ , C ′ )) are expected to find a right slid pair = 12 / 21