S-Box Reverse-Engineering Boolean Functions, American/Russian - PowerPoint PPT Presentation

S-Box Reverse-Engineering Boolean Functions, American/Russian Standards, and Butterflies Léo Perrin Based on joint works with Biryukov, Canteaut, Duval and Udovenko June 6, 2018 CECC’18

Building Blocks for Symmetric Cryptography Statistics and Skipjack TU-Decomposition and Kuznyechik The Butterfly Permutations and Functions Conclusion Outline 1 Building Blocks for Symmetric Cryptography 2 Statistics and Skipjack 3 TU-Decomposition and Kuznyechik The Butterfly Permutations and Functions 4 Conclusion 5 1 / 46

Building Blocks for Symmetric Cryptography Statistics and Skipjack Basics of Symmetric Cryptography TU-Decomposition and Kuznyechik Block Cipher Design The Butterfly Permutations and Functions Conclusion Outline 1 Building Blocks for Symmetric Cryptography 2 Statistics and Skipjack 3 TU-Decomposition and Kuznyechik The Butterfly Permutations and Functions 4 Conclusion 5 1 / 46

Definition (Block Cipher) x Input: n -bit block x Parameter: k -bit key E Output: n -bit block E x 1 use the same Symmetry: E and E E x Properties needed: Diffusion Confusion No cryptanalysis! Building Blocks for Symmetric Cryptography Statistics and Skipjack Basics of Symmetric Cryptography TU-Decomposition and Kuznyechik Block Cipher Design The Butterfly Permutations and Functions Conclusion Symmetric Cryptography There are many symmetric algorithms! Hash functions, MACs... 2 / 46

Properties needed: Diffusion Confusion No cryptanalysis! Building Blocks for Symmetric Cryptography Statistics and Skipjack Basics of Symmetric Cryptography TU-Decomposition and Kuznyechik Block Cipher Design The Butterfly Permutations and Functions Conclusion Symmetric Cryptography There are many symmetric algorithms! Hash functions, MACs... Definition (Block Cipher) x Input: n -bit block x Parameter: k -bit key κ κ E Output: n -bit block E κ ( x ) Symmetry: E and E − 1 use the same κ E κ ( x ) 2 / 46

Building Blocks for Symmetric Cryptography Statistics and Skipjack Basics of Symmetric Cryptography TU-Decomposition and Kuznyechik Block Cipher Design The Butterfly Permutations and Functions Conclusion Symmetric Cryptography There are many symmetric algorithms! Hash functions, MACs... Definition (Block Cipher) x Input: n -bit block x Parameter: k -bit key κ κ E Output: n -bit block E κ ( x ) Symmetry: E and E − 1 use the same κ E κ ( x ) Properties needed: Diffusion Confusion No cryptanalysis! 2 / 46

Building Blocks for Symmetric Cryptography Statistics and Skipjack Basics of Symmetric Cryptography TU-Decomposition and Kuznyechik Block Cipher Design The Butterfly Permutations and Functions Conclusion No Cryptanalysis? Let us look at a typical cryptanalysis technique: the differential attack. 3 / 46

x x a a E E E x E x a b b Differential Attack If there are many x such that E x E x a b , then the cipher is not secure . 6ec1067e5c5390ae 6ec1067e5c5391ae 7abb3f43c4989a22 0x04d4595257eb06c8 0x7e6f661193739cea Building Blocks for Symmetric Cryptography Statistics and Skipjack Basics of Symmetric Cryptography TU-Decomposition and Kuznyechik Block Cipher Design The Butterfly Permutations and Functions Conclusion Differential Attacks ⊕ a = 0000000000000100 4 / 46

x x a a E x E x a b b Differential Attack If there are many x such that E x E x a b , then the cipher is not secure . 6ec1067e5c5390ae 6ec1067e5c5391ae 7abb3f43c4989a22 0x04d4595257eb06c8 0x7e6f661193739cea Building Blocks for Symmetric Cryptography Statistics and Skipjack Basics of Symmetric Cryptography TU-Decomposition and Kuznyechik Block Cipher Design The Butterfly Permutations and Functions Conclusion Differential Attacks ⊕ a = 0000000000000100 E κ E κ 4 / 46

x x a a E x E x a b b Differential Attack If there are many x such that E x E x a b , then the cipher is not secure . 6ec1067e5c5390ae 6ec1067e5c5391ae 7abb3f43c4989a22 0x04d4595257eb06c8 0x7e6f661193739cea Building Blocks for Symmetric Cryptography Statistics and Skipjack Basics of Symmetric Cryptography TU-Decomposition and Kuznyechik Block Cipher Design The Butterfly Permutations and Functions Conclusion Differential Attacks ⊕ a = 0000000000000100 E κ E κ 4 / 46

x x a a E x E x a b Differential Attack If there are many x such that E x E x a b , then the cipher is not secure . 0x04d4595257eb06c8 0x7e6f661193739cea 6ec1067e5c5391ae 6ec1067e5c5390ae Building Blocks for Symmetric Cryptography Statistics and Skipjack Basics of Symmetric Cryptography TU-Decomposition and Kuznyechik Block Cipher Design The Butterfly Permutations and Functions Conclusion Differential Attacks ⊕ a = 0000000000000100 E κ E κ ⊕ b = 7abb3f43c4989a22 4 / 46

a 0000000000000100 b Differential Attack If there are many x such that E x E x a b , then the cipher is not secure . 0x7e6f661193739cea 7abb3f43c4989a22 6ec1067e5c5391ae 6ec1067e5c5390ae 0x04d4595257eb06c8 Building Blocks for Symmetric Cryptography Statistics and Skipjack Basics of Symmetric Cryptography TU-Decomposition and Kuznyechik Block Cipher Design The Butterfly Permutations and Functions Conclusion Differential Attacks ⊕ x ⊕ a x a E κ E κ E κ ( x ) ⊕ E κ ( x ⊕ a ) b 4 / 46

a 0000000000000100 b 0x04d4595257eb06c8 0x7e6f661193739cea 7abb3f43c4989a22 6ec1067e5c5390ae 6ec1067e5c5391ae Building Blocks for Symmetric Cryptography Statistics and Skipjack Basics of Symmetric Cryptography TU-Decomposition and Kuznyechik Block Cipher Design The Butterfly Permutations and Functions Conclusion Differential Attacks ⊕ x ⊕ a x a E κ E κ E κ ( x ) ⊕ E κ ( x ⊕ a ) b Differential Attack If there are many x such that E κ ( x ) ⊕ E κ ( x ⊕ a ) = b , then the cipher is not secure . 4 / 46

i S S S S S S S S L Substitution-Permutation Network Such a block cipher iterates the round function above several times. S is the S ubstitution B ox (S-Box). Building Blocks for Symmetric Cryptography Statistics and Skipjack Basics of Symmetric Cryptography TU-Decomposition and Kuznyechik Block Cipher Design The Butterfly Permutations and Functions Conclusion Basic Block Cipher Structure How do we build block ciphers that prevent such attacks (as well as others)? 5 / 46

Substitution-Permutation Network Such a block cipher iterates the round function above several times. S is the S ubstitution B ox (S-Box). Building Blocks for Symmetric Cryptography Statistics and Skipjack Basics of Symmetric Cryptography TU-Decomposition and Kuznyechik Block Cipher Design The Butterfly Permutations and Functions Conclusion Basic Block Cipher Structure How do we build block ciphers that prevent such attacks (as well as others)? κ i ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ S S S S S S S S L 5 / 46

Building Blocks for Symmetric Cryptography Statistics and Skipjack Basics of Symmetric Cryptography TU-Decomposition and Kuznyechik Block Cipher Design The Butterfly Permutations and Functions Conclusion Basic Block Cipher Structure How do we build block ciphers that prevent such attacks (as well as others)? κ i ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ S S S S S S S S L Substitution-Permutation Network Such a block cipher iterates the round function above several times. S is the S ubstitution B ox (S-Box). 5 / 46

Building Blocks for Symmetric Cryptography Statistics and Skipjack Basics of Symmetric Cryptography TU-Decomposition and Kuznyechik Block Cipher Design The Butterfly Permutations and Functions Conclusion The S-Box (1/2) The S-Box π of the latest Russian standards, Kuznyechik (BC) and Streebog (HF). 6 / 46

In academic papers presenting new block ciphers, the choice of S is carefully explained. Building Blocks for Symmetric Cryptography Statistics and Skipjack Basics of Symmetric Cryptography TU-Decomposition and Kuznyechik Block Cipher Design The Butterfly Permutations and Functions Conclusion The S-Box (2/2) Importance of the S-Box If S is such that S ( x ) ⊕ S ( x ⊕ a ) = b does not have many solutions x for all ( a , b ) then the cipher may be proved secure against differential attacks. 7 / 46

Building Blocks for Symmetric Cryptography Statistics and Skipjack Basics of Symmetric Cryptography TU-Decomposition and Kuznyechik Block Cipher Design The Butterfly Permutations and Functions Conclusion The S-Box (2/2) Importance of the S-Box If S is such that S ( x ) ⊕ S ( x ⊕ a ) = b does not have many solutions x for all ( a , b ) then the cipher may be proved secure against differential attacks. In academic papers presenting new block ciphers, the choice of S is carefully explained. 7 / 46

Building Blocks for Symmetric Cryptography Statistics and Skipjack Basics of Symmetric Cryptography TU-Decomposition and Kuznyechik Block Cipher Design The Butterfly Permutations and Functions Conclusion S-Box Design 8 / 46

Building Blocks for Symmetric Cryptography Statistics and Skipjack Basics of Symmetric Cryptography TU-Decomposition and Kuznyechik Block Cipher Design The Butterfly Permutations and Functions Conclusion S-Box Design 8 / 46

Building Blocks for Symmetric Cryptography Statistics and Skipjack Basics of Symmetric Cryptography TU-Decomposition and Kuznyechik Block Cipher Design The Butterfly Permutations and Functions Conclusion S-Box Design Grøstl... iScream... Khazad... 8 / 46