Programming the Demirci-Selc uk Meet-in-the-Middle Attack with - PowerPoint PPT Presentation

Programming the Demirci-Selc ¸uk Meet-in-the-Middle Attack with Constraints Danping Shi 1 Siwei Sun 1 Patrick Derbez 2 Yosuke Todo 3 Bing Sun 4 Lei Hu 1 1 Institute of Information Engineering, Chinese Academy of Sciences, China 2 Universit Rennes 1 / IRISA 3 NTT Secure Platform Laboratories 4 College of Science, National University of Defense Technology,China ASK2017 2017.12.11 Shi et al. Programming the Demirci-Selc ¸uk Meet-in-the-Middle Attack with Constraints ASK2017 2017.12.11 1 / 22

Outlines Introduction 1 Modelling the MITM attack 2 MITM and Impossible differential application in design 3 Conclusion 4 Shi et al. Programming the Demirci-Selc ¸uk Meet-in-the-Middle Attack with Constraints ASK2017 2017.12.11 2 / 22

Introduction Outline 1 Introduction Searching methods Distinguisher of Demirci-Selc ¸uk MITM Key recovery attack of MITM Modelling the MITM attack 2 MITM and Impossible differential application in design 3 Conclusion 4 Shi et al. Programming the Demirci-Selc ¸uk Meet-in-the-Middle Attack with Constraints ASK2017 2017.12.11 3 / 22

Introduction Searching methods Automatic Cryptanalysis Dedicated search MILP ,CP ,SAT,SMT Shi et al. Programming the Demirci-Selc ¸uk Meet-in-the-Middle Attack with Constraints ASK2017 2017.12.11 3 / 22

Introduction Searching methods Searching methods for MITM Demirci-Selc ¸uk MITM, FSE 2008. Derbez and Fouque: Dedicated search algorithm Li Lin, Wenling Wu: General model based on MILP Shi et al. Programming the Demirci-Selc ¸uk Meet-in-the-Middle Attack with Constraints ASK2017 2017.12.11 4 / 22

Introduction Distinguisher of Demirci-Selc ¸uk MITM MITM Distinguisher E

Introduction Distinguisher of Demirci-Selc ¸uk MITM MITM Distinguisher δ ( A ) -set: { P 0 , P 1 , . . . , P N − 1 } A E

Introduction Distinguisher of Demirci-Selc ¸uk MITM MITM Distinguisher δ ( A ) -set: { P 0 , P 1 , . . . , P N − 1 } A E B { C 0 , C 1 , . . . , C N − 1 }

Introduction Distinguisher of Demirci-Selc ¸uk MITM MITM Distinguisher δ ( A ) -set: { P 0 , P 1 , . . . , P N − 1 } A E B { C 0 , C 1 , . . . , C N − 1 } ∆ E ( A , B ) : { C 0 [ B ] ⊕ C 1 [ B ] , C 0 [ B ] ⊕ C 2 [ B ] , . . . , C 0 [ B ] ⊕ C N − 1 [ B ] } Shi et al. Programming the Demirci-Selc ¸uk Meet-in-the-Middle Attack with Constraints ASK2017 2017.12.11 5 / 22

Introduction Distinguisher of Demirci-Selc ¸uk MITM A E B Shi et al. Programming the Demirci-Selc ¸uk Meet-in-the-Middle Attack with Constraints ASK2017 2017.12.11 6 / 22

Introduction Distinguisher of Demirci-Selc ¸uk MITM Random Cipher: N R A E B Shi et al. Programming the Demirci-Selc ¸uk Meet-in-the-Middle Attack with Constraints ASK2017 2017.12.11 6 / 22

Introduction Distinguisher of Demirci-Selc ¸uk MITM Random Cipher: N R A Block Cipher : N E (save into a hash table) E B

Introduction Distinguisher of Demirci-Selc ¸uk MITM Random Cipher: N R A Block Cipher : N E (save into a hash table) E N R Condition N E < N R N E B

Introduction Distinguisher of Demirci-Selc ¸uk MITM Random Cipher: N R A Block Cipher : N E (save into a hash table) E N R Condition N E < N R N E B Distinguisher: ( A , B , N E ) Shi et al. Programming the Demirci-Selc ¸uk Meet-in-the-Middle Attack with Constraints ASK2017 2017.12.11 6 / 22

Introduction Key recovery attack of MITM Structure of the attack a cipher is divided in three keyed permutations: E 0 , E 1 , E 2 Construct distinguisher ( A , B , N E ) at E 1 state 0 state 0 E 0 state 2 r 0 A E 1 state 2( r 0+ r 1) B E 2 state 2( r 0+ r 1+ r 2) Shi et al. Programming the Demirci-Selc ¸uk Meet-in-the-Middle Attack with Constraints ASK2017 2017.12.11 7 / 22

Modelling the MITM attack Outline Introduction 1 Modelling the MITM attack 2 Modelling the distinguisher Modelling the Key-Recovery Process 3 MITM and Impossible differential application in design Conclusion 4 Shi et al. Programming the Demirci-Selc ¸uk Meet-in-the-Middle Attack with Constraints ASK2017 2017.12.11 8 / 22

Modelling the MITM attack Modelling the distinguisher Variables state 0 state 0 M E 0 state 2 r 0 X, Y, Z, M E 1 X, Y, Z state 2( r 0+ r 1) X, Y, Z, W E 2 W state 2( r 0+ r 1+ r 2) Var(X) describe the forward differential Var(Y) describe the backward determination Var(Z) models the relation between Var(X) and Var(Y) Shi et al. Programming the Demirci-Selc ¸uk Meet-in-the-Middle Attack with Constraints ASK2017 2017.12.11 8 / 22

Modelling the MITM attack Modelling the distinguisher Forward differential Variables Var(X) X r [ j ] = 0 iff P 0 r [ j ] ⊕ P i r [ j ] = 0, ∀ i ∈ 1 , . . . , N − 1. state 0 A x 0 x 1 NL state 1 Round 0 L state 2 x 2 x 3 NL state 3 Round 1 L x 2 = x 0 state 4 x 0 + x 1 2 x 3 ≥ NL state 5 Round 2 x 3 ≤ x 0 + x 1 L state 6

Modelling the MITM attack Modelling the distinguisher Forward differential Variables Var(X) X r [ j ] = 0 iff P 0 r [ j ] ⊕ P i r [ j ] = 0, ∀ i ∈ 1 , . . . , N − 1. state 0 A x 0 x 1 NL state 1 Round 0 L state 2 x 2 x 3 NL state 3 Round 1 L x 2 = x 0 state 4 x 0 + x 1 2 x 3 ≥ NL state 5 Round 2 x 3 ≤ x 0 + x 1 L state 6

Modelling the MITM attack Modelling the distinguisher Forward differential Variables Var(X) X r [ j ] = 0 iff P 0 r [ j ] ⊕ P i r [ j ] = 0, ∀ i ∈ 1 , . . . , N − 1. state 0 A x 0 x 1 NL state 1 Round 0 L state 2 x 2 x 3 NL state 3 Round 1 L x 2 = x 0 state 4 x 0 + x 1 2 x 3 ≥ NL state 5 Round 2 x 3 ≤ x 0 + x 1 L state 6

Modelling the MITM attack Modelling the distinguisher Forward differential Variables Var(X) X r [ j ] = 0 iff P 0 r [ j ] ⊕ P i r [ j ] = 0, ∀ i ∈ 1 , . . . , N − 1. state 0 A x 0 x 1 NL state 1 Round 0 L state 2 x 2 x 3 NL state 3 Round 1 L x 2 = x 0 state 4 x 0 + x 1 2 x 3 ≥ NL state 5 Round 2 x 3 ≤ x 0 + x 1 L state 6 Shi et al. Programming the Demirci-Selc ¸uk Meet-in-the-Middle Attack with Constraints ASK2017 2017.12.11 9 / 22

Modelling the MITM attack Modelling the distinguisher Backward determination Variables Var(Y) y 0 y 1 state 0 NL state 1 Round 0 L y 2 y 3 state 2 NL state 3 Round 1 L y 2 + y 3 2 y 0 ≤ state 4 NL y 2 + y 3 ≥ y 0 state 5 Round 2 y 1 = y 3 L state 6 B

Modelling the MITM attack Modelling the distinguisher Backward determination Variables Var(Y) y 0 y 1 state 0 NL state 1 Round 0 L y 2 y 3 state 2 NL state 3 Round 1 L y 2 + y 3 2 y 0 ≤ state 4 NL y 2 + y 3 ≥ y 0 state 5 Round 2 y 1 = y 3 L state 6 B

Modelling the MITM attack Modelling the distinguisher Backward determination Variables Var(Y) y 0 y 1 state 0 NL state 1 Round 0 L y 2 y 3 state 2 NL state 3 Round 1 L y 2 + y 3 2 y 0 ≤ state 4 NL y 2 + y 3 ≥ y 0 state 5 Round 2 y 1 = y 3 L state 6 B

Modelling the MITM attack Modelling the distinguisher Backward determination Variables Var(Y) y 0 y 1 state 0 NL state 1 Round 0 L y 2 y 3 state 2 NL state 3 Round 1 L y 2 + y 3 2 y 0 ≤ state 4 NL y 2 + y 3 ≥ y 0 state 5 Round 2 y 1 = y 3 L state 6 B Shi et al. Programming the Demirci-Selc ¸uk Meet-in-the-Middle Attack with Constraints ASK2017 2017.12.11 10 / 22

Modelling the MITM attack Modelling the distinguisher Constraints for Var(Z) Variables Var(Z) describe the relation between Var(X) and Var(Y) : Z r [ j ] = 1 iff X r [ j ] = Y r [ j ] = 1 state 0 A NL state 1 Round 0 L state 2 NL state 3 Round 1 L state 4 NL state 5 Round 2 L state 6 B objective function: Minimize � r 0 + r 1 − 1 r = r 0 + 1 Z 2 r

Modelling the MITM attack Modelling the distinguisher Constraints for Var(Z) Variables Var(Z) describe the relation between Var(X) and Var(Y) : Z r [ j ] = 1 iff X r [ j ] = Y r [ j ] = 1 state 0 A NL state 1 Round 0 L state 2 NL state 3 Round 1 L state 4 NL state 5 Round 2 L state 6 B objective function: Minimize � r 0 + r 1 − 1 r = r 0 + 1 Z 2 r Shi et al. Programming the Demirci-Selc ¸uk Meet-in-the-Middle Attack with Constraints ASK2017 2017.12.11 11 / 22

Modelling the MITM attack Modelling the distinguisher Round 1 Round 2 SB , AC MC SB , AC MC AK , SR AK , SR Round 3 Round 4 SB , AC MC SB , AC MC AK , SR AK , SR Round 5 Round 6  1 0 1 1  SB , AC MC SB , AC MC       1 0 0 0   AK , SR AK , SR   MC =       0 1 1 0     Round 7 Round 8       SB , AC MC SB , AC MC   1 0 1 0 AK , SR AK , SR Round 9 Round 10 SB , AC MC SB , AC MC AK , SR AK , SR Round 11 SB , AC AK , SR

Modelling the MITM attack Modelling the distinguisher Round 1 Round 2 SB , AC MC SB , AC MC AK , SR AK , SR Round 3 Round 4 SB , AC MC SB , AC MC AK , SR AK , SR Round 5 Round 6  1 0 1 1  SB , AC MC SB , AC MC       1 0 0 0   AK , SR AK , SR   MC =       0 1 1 0     Round 7 Round 8       SB , AC MC SB , AC MC   1 0 1 0 AK , SR AK , SR Round 9 Round 10 SB , AC MC SB , AC MC AK , SR AK , SR Round 11 SB , AC AK , SR