Searching for Subspace Trails and Truncated Differentials March - PowerPoint PPT Presentation

RUHR-UNIVERSITÄT BOCHUM Searching for Subspace Trails and Truncated Differentials March 5th, 2018 Horst Görtz Institute for IT Security Ruhr-Universität Bochum Gregor Leander, Cihangir Teczan, and Friedrich Wiemer Friedrich Wiemer | Searching for Subspace Trails and Truncated Differentials | March 5th, 2018 1

RUHR-UNIVERSITÄT BOCHUM Differential Cryptanalysis SPN Cipher k 0 k 1 k t x E k ( x ) ... S L S L E k ( x + α ) x + α Friedrich Wiemer | Searching for Subspace Trails and Truncated Differentials | March 5th, 2018 2

RUHR-UNIVERSITÄT BOCHUM Differential Cryptanalysis SPN Cipher k 0 k 1 k t x E k ( x ) ... S L S L E k ( x + α ) x + α Definition [Knu94; BLN14] Let F : � n 2 . A truncated differential of probability one is a pair of affine subspaces U + s and V + t 2 → � n of � n 2 , s. t. ∀ u ∈ U : ∀ x ∈ � n F ( x ) + F ( x + u + s ) ∈ V + t 2 : Friedrich Wiemer | Searching for Subspace Trails and Truncated Differentials | March 5th, 2018 2

RUHR-UNIVERSITÄT BOCHUM Structural Attacks Subspace Trail Cryptanalysis Main Idea b U + a r s + V . . . ... F U + a 1 b 1 + V V U Friedrich Wiemer | Searching for Subspace Trails and Truncated Differentials | March 5th, 2018 3

RUHR-UNIVERSITÄT BOCHUM Structural Attacks Subspace Trail Cryptanalysis Main Idea W b U + a r s + + V c t . . . . . . ... ... F F W U + a 1 b 1 + + c V 1 W V U Friedrich Wiemer | Searching for Subspace Trails and Truncated Differentials | March 5th, 2018 3

RUHR-UNIVERSITÄT BOCHUM Structural Attacks Subspace Trail Cryptanalysis Main Idea W b U + a r s + + V c t . . . . . . ... ... F F W U + a 1 b 1 + + c V 1 W V U Subspace Trail Cryptanalysis [GRR16] (Last Year’s FSE) F F Let U 0 ,..., U r ⊆ � n 2 , and F : � n 2 . We write U 0 → U r , iff 2 → � n → ··· ∀ a ∈ U ⊥ i : ∃ b ∈ U ⊥ F ( U i + a ) ⊆ U i + 1 + b i + 1 : Friedrich Wiemer | Searching for Subspace Trails and Truncated Differentials | March 5th, 2018 3

RUHR-UNIVERSITÄT BOCHUM Outline Outline Motivation 1 Link to Truncated Differentials 2 Security against Subspace Trail Attacks 3 Friedrich Wiemer | Searching for Subspace Trails and Truncated Differentials | March 5th, 2018 4

RUHR-UNIVERSITÄT BOCHUM Intuition The Image of the Derivative is in the Subspace Lemma F Let U → V be a subspace trail. Then for all u ∈ U and all x : F ( x ) + F ( x + u ) ∈ V . Proof b U + a s t + V . . . ... F ( x ) F · x · V U Friedrich Wiemer | Searching for Subspace Trails and Truncated Differentials | March 5th, 2018 5

RUHR-UNIVERSITÄT BOCHUM Intuition The Image of the Derivative is in the Subspace Lemma F Let U → V be a subspace trail. Then for all u ∈ U and all x : F ( x ) + F ( x + u ) ∈ V . Proof b U + a s t + V . . . ... F ( x ) F · x · x + u · u · V U · F ( x + u ) Friedrich Wiemer | Searching for Subspace Trails and Truncated Differentials | March 5th, 2018 5

RUHR-UNIVERSITÄT BOCHUM Intuition The Image of the Derivative is in the Subspace Lemma F Let U → V be a subspace trail. Then for all u ∈ U and all x : F ( x ) + F ( x + u ) ∈ V . Proof b U + a s t + V . . . ... F ( x ) F · x · x + u · u v · · V U · F ( x + u ) Friedrich Wiemer | Searching for Subspace Trails and Truncated Differentials | March 5th, 2018 5

RUHR-UNIVERSITÄT BOCHUM Link to Truncated Differentials Direct consequence from above Lemma Theorem (Subspaces Trails are Truncated Differentials with probability one) F Let U → V be a subspace trail. Then U + 0 and V + 0 form a truncated differential with probabiliy one. Subspace Trails are thus a special case of truncated differentials. Friedrich Wiemer | Searching for Subspace Trails and Truncated Differentials | March 5th, 2018 6

RUHR-UNIVERSITÄT BOCHUM Provable Resistant against Subspace Trails How to search efficiently for Subspace Trails? Security against Subspace Trails? Given the round function F : � n 2 of an SPN cipher, prove the resistance against subspace trail 2 → � n attacks! 1 Friedrich Wiemer | Searching for Subspace Trails and Truncated Differentials | March 5th, 2018 7

RUHR-UNIVERSITÄT BOCHUM Provable Resistant against Subspace Trails How to search efficiently for Subspace Trails? Security against Subspace Trails? Given the round function F : � n 2 of an SPN cipher, prove the resistance against subspace trail 2 → � n attacks! Main problem: Too many possible starting points. Already for initially one-dimensional subspaces there are 2 n − 1 possibilities. Can’t we just activate a single S-box and check to what this leads us? 1 Friedrich Wiemer | Searching for Subspace Trails and Truncated Differentials | March 5th, 2018 7

RUHR-UNIVERSITÄT BOCHUM Provable Resistant against Subspace Trails How to search efficiently for Subspace Trails? Security against Subspace Trails? Given the round function F : � n 2 of an SPN cipher, prove the resistance against subspace trail 2 → � n attacks! Main problem: Too many possible starting points. Already for initially one-dimensional subspaces there are 2 n − 1 possibilities. Can’t we just activate a single S-box and check to what this leads us? The short answer is: No! 1 1 The long answer is: Read our paper Friedrich Wiemer | Searching for Subspace Trails and Truncated Differentials | March 5th, 2018 7

RUHR-UNIVERSITÄT BOCHUM Approach to the Algorithm How to reduce the number of starting points? SPN Cipher k 0 k 1 k t x E k ( x ) ... S L S L E k ( x + α ) x + α Easy parts Given a starting subspace, computing the trail is easy. The effect of the linear layer L to a subspace U is clear: L → L ( U ) U Friedrich Wiemer | Searching for Subspace Trails and Truncated Differentials | March 5th, 2018 8

RUHR-UNIVERSITÄT BOCHUM Approach to the Algorithm How to reduce the number of starting points? SPN Cipher k 0 k 1 k t x E k ( x ) ... S L S L E k ( x + α ) x + α Easy parts S-box: First Observation S For an S-box S and U → V , because of the above lemma, Given a starting subspace, 2 and ∀ u ∈ U : computing the trail is easy. ∀ x ∈ � n The effect of the linear layer S ( x ) + S ( x + u ) ∈ V L to a subspace U is clear: ∀ α ∈ V ⊥ . ⇔ 〈 α , S ( x ) + S ( x + u ) 〉 = 0 L → L ( U ) U Friedrich Wiemer | Searching for Subspace Trails and Truncated Differentials | March 5th, 2018 8

RUHR-UNIVERSITÄT BOCHUM Approach to the Algorithm How to reduce the number of starting points? SPN Cipher k 0 k 1 k t x E k ( x ) ... S L S L E k ( x + α ) x + α Easy parts S-box: First Observation S For an S-box S and U → V , because of the above lemma, Given a starting subspace, 2 and ∀ u ∈ U : computing the trail is easy. ∀ x ∈ � n The effect of the linear layer S ( x ) + S ( x + u ) ∈ V L to a subspace U is clear: ∀ α ∈ V ⊥ . ⇔ 〈 α , S ( x ) + S ( x + u ) 〉 = 0 L → L ( U ) U By definition, V ⊥ is the set of zero-linear structures of S . Friedrich Wiemer | Searching for Subspace Trails and Truncated Differentials | March 5th, 2018 8

RUHR-UNIVERSITÄT BOCHUM Possibility I The short one Theorem SPN Round: S-box layer Let F : � kn 2 → � kn 2 be an S-box layer that applies k S-boxes with no non-trivial linear structures in parallel. U 1 V 1 S F Then every essential subspace trail U → V is of the form × × U 2 V 2 S U = V = U 1 × ··· × U k , × × U = = V � � where U i ∈ . { 0 } , � n U 3 V 3 S 2 × × In particular, in this case, bounds from activating S-boxes U 4 V 4 S are optimal. Friedrich Wiemer | Searching for Subspace Trails and Truncated Differentials | March 5th, 2018 9

RUHR-UNIVERSITÄT BOCHUM Possibility I Algorithm Algorithm Complexity (No. of starting U s) For k S-boxes: 2 k (can be further de- Simply (de-)activate S-boxes creased to k ). Compute resulting subspace trail This approach is independent of the S-box, i. e. any S-box without linear structures behaves the same with respect to subspace trails. Friedrich Wiemer | Searching for Subspace Trails and Truncated Differentials | March 5th, 2018 10

RUHR-UNIVERSITÄT BOCHUM Possibility I Algorithm Algorithm Complexity (No. of starting U s) For k S-boxes: 2 k (can be further de- Simply (de-)activate S-boxes creased to k ). Compute resulting subspace trail This approach is independent of the S-box, i. e. any S-box without linear structures behaves the same with respect to subspace trails. The problem with S-boxes that have linear structures Subspace trails through S-box layers with one -linear structures are not necessarily a direct product of subspaces (see e. g. PRESENT). Friedrich Wiemer | Searching for Subspace Trails and Truncated Differentials | March 5th, 2018 10

RUHR-UNIVERSITÄT BOCHUM Possibility II S-boxes with linear structures Observation S   0   S   α     U V ∋     0 S     0 S Friedrich Wiemer | Searching for Subspace Trails and Truncated Differentials | March 5th, 2018 11