Rotational Cryptanalysis in the Presence of Constants Tomer Ashur - PowerPoint PPT Presentation

Rotational Cryptanalysis in the Presence of Constants Tomer Ashur Yunwen Liu ESAT/COSIC, KU Leuven, and imec, Belgium FSE, March 2017 1

Table of Contents ARX & Rotational Cryptanalysis Rotational cryptanalysis with constants Experiment Verification Conclusion 2

ARX • Symmetric-key designs 3

ARX • Symmetric-key designs • Addition + Rotation + XOR 3

ARX • Symmetric-key designs • Addition + Rotation + XOR • Differential cryptanalysis and linear cryptanalysis 3

ARX • Symmetric-key designs • Addition + Rotation + XOR • Differential cryptanalysis and linear cryptanalysis • Rotational cryptanalysis 3

Differences 4

Differences XOR difference x ⊕ δ x E k E k y y ⊕ ∆ 4

Differences Modular difference XOR difference x x ⊞ δ x ⊕ δ x E k E k E k E k y y ⊞ ∆ y y ⊕ ∆ 4

Differences Modular difference Rotational difference XOR difference x x ⊞ δ x x ≪ r x ⊕ δ x E k E k E k E k E k E k y y y ≪ r y ⊞ ∆ y y ⊕ ∆ 4

Rotational Cryptanalysis 5

Rotational Cryptanalysis Circular Rotation ( x ≪ r ) ≪ s = x ≪ ( r + s ) 5

Rotational Cryptanalysis Circular Rotation ( x ≪ r ) ≪ s = x ≪ ( r + s ) XOR ( x ≪ r ) ⊕ ( y ≪ r ) = ( x ⊕ y ) ≪ r 5

Rotational Cryptanalysis Circular Rotation ( x ≪ r ) ≪ s = x ≪ ( r + s ) XOR ( x ≪ r ) ⊕ ( y ≪ r ) = ( x ⊕ y ) ≪ r Modular Addition ( x ≪ r ) ⊞ ( y ≪ r ) = ( x ⊞ y ) ≪ r with probability p 5

Rotational Cryptanalysis Modular Addition ( x ≪ r ) ⊞ ( y ≪ r ) = ( x ⊞ y ) ≪ r with probability p 6

Rotational Cryptanalysis Modular Addition ( x ≪ r ) ⊞ ( y ≪ r ) = ( x ⊞ y ) ≪ r with probability p When r = 1 , p achieves the maximum. p = 2 − 1 . 415 6

Rotational Cryptanalysis Modular Addition ( x ≪ r ) ⊞ ( y ≪ r ) = ( x ⊞ y ) ≪ r with probability p When r = 1 , p achieves the maximum. p = 2 − 1 . 415 Denote x ≪ 1 by ← − x for simplicity. 6

Rotational Cryptanalysis Rotational Cryptanalysis (v1), [KN10] The probability that a rotational distinguisher holds for an ARX primitive is determined by the number of modular additions. Pr = (2 − 1 . 415 ) # ⊞ [KN10]: D. Khovratovich, I. Nikolic: Rotational Cryptanalysis of ARX, FSE 2010 7

Rotational Cryptanalysis Rotational Cryptanalysis (v2), [KNP+15] The probability that a rotational distinguisher holds for an ARX primitive is dependent with the chained modular additions. 8

Rotational Cryptanalysis Rotational Cryptanalysis (v2), [KNP+15] The probability that a rotational distinguisher holds for an ARX primitive is dependent with the chained modular additions. ( x ≪ r ) ⊞ ( y ≪ r ) = ( x ⊞ y ) ≪ r ( x ≪ r ) ⊞ ( y ≪ r ) ⊞ ( z ≪ r ) = ( x ⊞ y ⊞ z ) ≪ r [KNP+15]: D. Khovratovich, I. Nikolic, J. Pieprzyk, P. Sokolowski, R. Steinfeld: Rotational Cryptanalysis of ARX Revisited. FSE 2015 8

Table of Contents ARX & Rotational Cryptanalysis Rotational cryptanalysis with constants Experiment Verification Conclusion 9

ARX with constants 10

ARX with constants • Complete system ARX-C 10

ARX with constants • Complete system ARX-C • Constants come with keys and round constants 10

ARX with constants • Complete system ARX-C • Constants come with keys and round constants XOR with a rotational variable ( x ≪ r ) ⊕ ( y ≪ r ) = ( x ⊕ y ) ≪ r 10

ARX with constants • Complete system ARX-C • Constants come with keys and round constants XOR with a rotational variable ( x ≪ r ) ⊕ ( y ≪ r ) = ( x ⊕ y ) ≪ r XOR with a constant ( x ≪ r ) ⊕ k 10

ARX with constants • Complete system ARX-C • Constants come with keys and round constants XOR with a rotational variable ( x ≪ r ) ⊕ ( y ≪ r ) = ( x ⊕ y ) ≪ r XOR with a constant ( x ≪ r ) ⊕ k • Previous analyses: experiment 10

Rotational cryptanalysis on ARX-C 11

Rotational cryptanalysis on ARX-C x ≪ r x E k E k y y ≪ r 11

Rotational cryptanalysis on ARX-C x ′ = x ≪ r x x ≪ r x E k E k E k E k y y ≪ r y y ′ ⊕ δ = y ≪ r 11

Rotational-XOR difference Combine rotational difference with XOR difference ( x, ( x ≪ γ ) 12

Rotational-XOR difference Combine rotational difference with XOR difference ( x, ( x ≪ γ ) ⊕ a ) 12

Rotational-XOR difference Combine rotational difference with XOR difference ( x, ( x ≪ γ ) ⊕ a ) (( a 1 , a 2 ) , γ ) -Rotational-XOR difference (RX-difference) ( x ⊕ a 1 , ( x ≪ γ ) ⊕ a 2 ) 12

Rotational-XOR difference Combine rotational difference with XOR difference ( x, ( x ≪ γ ) ⊕ a ) (( a 1 , a 2 ) , γ ) -Rotational-XOR difference (RX-difference) ( x ⊕ a 1 , ( x ≪ γ ) ⊕ a 2 ) equivalent to (˜ x, (˜ x ≪ γ ) ⊕ ( a 1 ≪ γ ) ⊕ a 2 ) 12

Rotational-XOR difference through ARX 13

Rotational-XOR difference through ARX Rotation ≪ γ x → x ≪ γ − − − ≪ γ → ← − − − − ← − x ⊕ a x ≪ γ ⊕ ( a ≪ γ ) − − − ≪ γ ⇒ ((0 , a ) , 1) → ((0 , a ≪ γ ) , 1) − − − 13

Rotational-XOR difference through ARX Rotation ≪ γ x → x ≪ γ − − − ≪ γ → ← − − − − ← − x ⊕ a x ≪ γ ⊕ ( a ≪ γ ) − − − ≪ γ ⇒ ((0 , a ) , 1) → ((0 , a ≪ γ ) , 1) − − − XOR ⊕ x, y → x ⊕ y − − → ← − − − ← x ⊕ a, ← − − ⊕ y ⊕ b x ⊕ y ⊕ ( a ⊕ b ) − − ⊕ ⇒ ((0 , a ) , 1) , ((0 , b ) , 1) → ((0 , a ⊕ b ) , 1) − − 13

Rotational-XOR difference through ARX Modular addition 14

Rotational-XOR difference through ARX Modular addition ← − − − − − − − − − − − − − − − − − − ( x ⊕ a 1 ) ⊞ ( y ⊕ b 1 ) ⊕ ∆ 1 = ( ← − x ⊕ a 2 ) ⊞ ( ← − y ⊕ b 2 ) ⊕ ∆ 2 14

Rotational-XOR difference through ARX Modular addition ← − − − − − − − − − − − − − − − − − − ( x ⊕ a 1 ) ⊞ ( y ⊕ b 1 ) ⊕ ∆ 1 = ( ← − x ⊕ a 2 ) ⊞ ( ← − y ⊕ b 2 ) ⊕ ∆ 2 Sketch of proof: 14

Rotational-XOR difference through ARX Modular addition ← − − − − − − − − − − − − − − − − − − ( x ⊕ a 1 ) ⊞ ( y ⊕ b 1 ) ⊕ ∆ 1 = ( ← − x ⊕ a 2 ) ⊞ ( ← − y ⊕ b 2 ) ⊕ ∆ 2 Sketch of proof: x = L ( x ) R ( x ) = L 0 ( x ) R 0 ( x ) γ bits γ bits 14

Rotational-XOR difference through ARX Modular addition ← − − − − − − − − − − − − − − − − − − ( x ⊕ a 1 ) ⊞ ( y ⊕ b 1 ) ⊕ ∆ 1 = ( ← x ⊕ a 2 ) ⊞ ( ← − − y ⊕ b 2 ) ⊕ ∆ 2 Sketch of proof: x = L ( x ) R ( x ) = L 0 ( x ) R 0 ( x ) γ bits γ bits The addition of two variables: L ( x ) R ( x ) L ( y ) R ( y ) x one bit of carry � L ( x ) � L ( y ) � C 1 R ( x ) � R ( y ) n − γ 14

proof continued LHS: ← − − − − − − − − − − − − − − − − − − ( x ⊕ a 1 ) ⊞ ( y ⊕ b 1 ) ⊕ ∆ 1 ← − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − (( L ( x ) ⊕ L ( a 1 )) ⊞ ( L ( y ) ⊕ L ( b 1 )) ⊞ C 1 = n − γ ) ⊕ L (∆ 1 ) || (( R ( x ) ⊕ R ( a 1 )) ⊞ ( R ( y ) ⊕ R ( b 1 ))) ⊕ R (∆ 1 ) 15

proof continued LHS: ← − − − − − − − − − − − − − − − − − − ( x ⊕ a 1 ) ⊞ ( y ⊕ b 1 ) ⊕ ∆ 1 ← − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − (( L ( x ) ⊕ L ( a 1 )) ⊞ ( L ( y ) ⊕ L ( b 1 )) ⊞ C 1 = n − γ ) ⊕ L (∆ 1 ) || (( R ( x ) ⊕ R ( a 1 )) ⊞ ( R ( y ) ⊕ R ( b 1 ))) ⊕ R (∆ 1 ) = (( R ( x ) ⊕ R ( a 1 )) ⊞ ( R ( y ) ⊕ R ( b 1 ))) ⊕ R (∆ 1 ) || (( L ( x ) ⊕ L ( a 1 )) ⊞ ( L ( y ) ⊕ L ( b 1 )) ⊞ C 1 n − γ ) ⊕ L (∆ 1 ) . 15

proof continued LHS: ← − − − − − − − − − − − − − − − − − − ( x ⊕ a 1 ) ⊞ ( y ⊕ b 1 ) ⊕ ∆ 1 ← − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − (( L ( x ) ⊕ L ( a 1 )) ⊞ ( L ( y ) ⊕ L ( b 1 )) ⊞ C 1 = n − γ ) ⊕ L (∆ 1 ) || (( R ( x ) ⊕ R ( a 1 )) ⊞ ( R ( y ) ⊕ R ( b 1 ))) ⊕ R (∆ 1 ) = (( R ( x ) ⊕ R ( a 1 )) ⊞ ( R ( y ) ⊕ R ( b 1 ))) ⊕ R (∆ 1 ) || (( L ( x ) ⊕ L ( a 1 )) ⊞ ( L ( y ) ⊕ L ( b 1 )) ⊞ C 1 n − γ ) ⊕ L (∆ 1 ) . RHS: ( ← − x ⊕ a 2 ) ⊞ ( ← − y ⊕ b 2 ) ⊕ ∆ 2 ′ ( a 2 )) ⊞ ( R ( y ) ⊕ L ′ ( b 2 )) ⊞ C 2 ′ (∆ 2 ) || = (( R ( x ) ⊕ L γ ) ⊕ L ′ ( a 2 )) ⊞ ( L ( y ) ⊕ R ′ ( b 2 ))) ⊕ R ′ (∆ 2 ) . (( L ( x ) ⊕ R 15

Rotational Cryptanalysis in the Presence of Constants Tomer Ashur - PowerPoint PPT Presentation

Rotational Cryptanalysis in the Presence of Constants Tomer Ashur Yunwen Liu ESAT/COSIC, KU Leuven, and imec, Belgium FSE, March 2017 1 Table of Contents ARX & Rotational Cryptanalysis Rotational cryptanalysis with constants Experiment

Rotational-XOR cryptanalysis on ARX and AND-RX ciphers Yunwen Liu ASK 2019 at Kobe National

Objectives Models for Cryptanalysis Cryptanalysis of Monoalphabetic Ciphers

1 AP Physics C Mechanics Rotational Motion 20151203 www.njctl.org 2 Table of Contents

AP Physics C - Mechanics Rotational Motion 2015-12-03 www.njctl.org Slide 3 / 130 Table of

Rotational Dynamics I Rotational Kinetic Energy Moment of Inertia Calculating the

Rotation of a Rigid Body Topics: Rotational Motion Rotation About the Center of Mass

Block Cipher Cryptanalysis II: Block Cipher Cryptanalysis II: Linear Cryptanalysis yp y Andrey

Rotational-vibrational spectroscopy: Rotation and Vibration Rotational-vibrational

6. A Constants and IOL Formula www.medsalesacademy.co.uk www.medsalesacademy.co.uk Today we will

Fundamental constants, gravitation and cosmology Jean-Philippe UZAN Constants Physical theories

Statistics in Cryptanalysis Subhabrata Samajder Indian Statistical Institute, Kolkata 24 th May,

Constants Objectives Describe ways to create constants const readonly enum 2

Differential and Linear Cryptanalysis Lars R. Knudsen June 2014 L.R. Knudsen Differential and

The Super-Sbox Cryptanalysis Improved Attacks for AES-like Permutations Henri Gilbert and Thomas

A New Post-processing Method to Deal with the Rotational Indeterminacy Problem in MCMC Estimation

3D orientation 48 rotational DOFs Each joint can have up to 3 DOFs 1 DOF: knee 2 DOF: wrist 3

AP Physics C Rotational Motion Multiple Choice www.njctl.org Slide 3 / 42 1 Torque is the

Differential Cryptanalysis - quite similar to linear cryptanalysis - exploits the relationship

k ISTLER The Art of Fabricating a Rotational Accelerometer OBJECTIVE Briefly review the need

Rotational Motion www.njctl.org Slide 3 / 132 Slide 4 / 132 Table of Contents How to Use this

Differential Cryptanalysis The first method which reduced the complexity of attacking DES below

Cryptanalysis of LAC G. Leurent (Inria) Cryptanalysis of LAC DIAC 2014 1 / 9 . . . . . . . .

Macros Eric McCreath Constants Macros provide a simple way of creating constants in your code.

Automatic Cryptanalysis of Block Ciphers with CP A case study: related key differential