Some Cryptanalytic Results on TRIAD Abhishek Kesarwani IIT Madras, - PowerPoint PPT Presentation

Some Cryptanalytic Results on TRIAD Abhishek Kesarwani IIT Madras, India INDOCRYPT 2019 16 December 2019 (Joint work Santanu Sarkar and Ayineedi Venkateswarlu)

Outline 2 Introduction TRIAD adopts Trivium -like Structure Attacks on Trivium -like ciphers Our Contribution Conclusion

◮ Call for Lightweight Cryptographic Algorithms

◮ Call for Lightweight Cryptographic Algorithms ◮ Total 56 candidates selected for Round 1

◮ Call for Lightweight Cryptographic Algorithms ◮ Total 56 candidates selected for Round 1 ◮ TRIAD [2] is one of them

TRIAD Family 4 TRIAD TRIAD-AE TRIAD-HASH Triad-SC Triad-MAC ◮ TRIAD-AE provides authenticated encryption with associated data

TRIAD Family 4 TRIAD TRIAD-AE TRIAD-HASH Triad-SC Triad-MAC ◮ TRIAD-AE provides authenticated encryption with associated data ◮ TRIAD-HASH follows the extended sponge based construction

TRIAD Family 5 TRIAD TRIAD-AE TRIAD-HASH Triad-SC Triad-MAC ◮ TRIAD-AE provides authenticated encryption with associated data ◮ TRIAD-HASH follows the extended sponge based construction

TRIAD adopts Trivium -like Structure

TRIAD - AE Vs Trivium

TRIAD - AE Vs Trivium State size 256 bits 288 bits

TRIAD - AE Vs Trivium State size 256 bits 288 bits Key size 128 bits 80 bits

TRIAD - AE Vs Trivium State size 256 bits 288 bits Key size 128 bits 80 bits Nonce/IV size 96 bits 80 bits

TRIAD - AE Vs Trivium State size 256 bits 288 bits Key size 128 bits 80 bits Nonce/IV size 96 bits 80 bits Initialization 1024 round 1152 round

TRIAD - AE Vs Trivium State size 256 bits 288 bits Key size 128 bits 80 bits Nonce/IV size 96 bits 80 bits Initialization 1024 round 1152 round Type AEAD - AEAD - Authenticated encryption with associated data

Attacks on Trivium -like ciphers

Cube Attack 9 ◮ Introduced by Dinur and Shamir [3] in 2009

Cube Attack 9 ◮ Introduced by Dinur and Shamir [3] in 2009 ◮ Attempts to guess atleast one bit of secret key

Cube Attack 9 ◮ Introduced by Dinur and Shamir [3] in 2009 ◮ Attempts to guess atleast one bit of secret key ◮ With complexity less than the brute-force attack

Cube Attack 9 ◮ Introduced by Dinur and Shamir [3] in 2009 ◮ Attempts to guess atleast one bit of secret key ◮ With complexity less than the brute-force attack ◮ Cube attacks are closely related to higher order differential attacks

Cube Attack 9 ◮ Introduced by Dinur and Shamir [3] in 2009 ◮ Attempts to guess atleast one bit of secret key ◮ With complexity less than the brute-force attack ◮ Cube attacks are closely related to higher order differential attacks ◮ Cube attacks use algebraic rather than statistical techniques to find the secret key

Cube Tester 10 ◮ Introduced by Aumasson et. al [1] in 2009

Cube Tester 10 ◮ Introduced by Aumasson et. al [1] in 2009 ◮ Cube testers detect non-random behavior rather than performing key extraction

Cube Tester 10 ◮ Introduced by Aumasson et. al [1] in 2009 ◮ Cube testers detect non-random behavior rather than performing key extraction ◮ Cube tester distinguishes a given cipher from a truly random scenario

Cube Tester 10 ◮ Introduced by Aumasson et. al [1] in 2009 ◮ Cube testers detect non-random behavior rather than performing key extraction ◮ Cube tester distinguishes a given cipher from a truly random scenario ◮ Cube testers are based on efficient testing properties

Cube Tester 10 ◮ Introduced by Aumasson et. al [1] in 2009 ◮ Cube testers detect non-random behavior rather than performing key extraction ◮ Cube tester distinguishes a given cipher from a truly random scenario ◮ Cube testers are based on efficient testing properties Distinguisher Non-randomness (control over the public variables only) (control over the public and private variables both)

Structure of TRIAD-AE 11 z t = f ( K, IV ), where f is a Boolean function

Cube and Superpoly 12 Example ◮ f ( k 1 , k 2 , k 3 , n 1 , n 2 , n 3 ) = k 1 + k 1 k 2 n 1 + k 3 n 1 n 2 + n 1 n 2

Cube and Superpoly 12 Example ◮ f ( k 1 , k 2 , k 3 , n 1 , n 2 , n 3 ) = k 1 + k 1 k 2 n 1 + k 3 n 1 n 2 + n 1 n 2 ◮ Rewrite f as term ���� f ( k 1 , k 2 , k 3 , n 1 , n 2 , n 3 ) = ( k 3 + 1) n 1 n 2 +( k 1 + k 1 k 2 n 1 ) � �� � superpoly

Cube and Superpoly 12 Example ◮ f ( k 1 , k 2 , k 3 , n 1 , n 2 , n 3 ) = k 1 + k 1 k 2 n 1 + k 3 n 1 n 2 + n 1 n 2 ◮ Rewrite f as term ���� f ( k 1 , k 2 , k 3 , n 1 , n 2 , n 3 ) = ( k 3 + 1) n 1 n 2 +( k 1 + k 1 k 2 n 1 ) � �� � superpoly ◮ { n 1 , n 2 } involved in term are referred as cube variables

Cube and Superpoly 12 Example ◮ f ( k 1 , k 2 , k 3 , n 1 , n 2 , n 3 ) = k 1 + k 1 k 2 n 1 + k 3 n 1 n 2 + n 1 n 2 ◮ Rewrite f as term ���� f ( k 1 , k 2 , k 3 , n 1 , n 2 , n 3 ) = ( k 3 + 1) n 1 n 2 +( k 1 + k 1 k 2 n 1 ) � �� � superpoly ◮ { n 1 , n 2 } involved in term are referred as cube variables ◮ Observe � f ( · ) = k 3 + 1 = superpoly { n 1 ,n 2 }∈ F 2 2

Algebraic Degree 13 ◮ The no. of variables in the highest order monomial with non-zero coefficient

Algebraic Degree 13 ◮ The no. of variables in the highest order monomial with non-zero coefficient Ex. The algebraic degree of f w.r.t. IV as variable is 2

Algebraic Degree 13 ◮ The no. of variables in the highest order monomial with non-zero coefficient Ex. The algebraic degree of f w.r.t. IV as variable is 2 ◮ Cryptographic primitives with low algebraic degree are vulnerable to many attacks

Algebraic Degree 13 ◮ The no. of variables in the highest order monomial with non-zero coefficient Ex. The algebraic degree of f w.r.t. IV as variable is 2 ◮ Cryptographic primitives with low algebraic degree are vulnerable to many attacks Question: Can we do the algebraic calculation?

Algebraic Degree 13 ◮ The no. of variables in the highest order monomial with non-zero coefficient Ex. The algebraic degree of f w.r.t. IV as variable is 2 ◮ Cryptographic primitives with low algebraic degree are vulnerable to many attacks Question: Can we do the algebraic calculation? Answer: It is a hard problem.

Algebraic Degree 13 ◮ The no. of variables in the highest order monomial with non-zero coefficient Ex. The algebraic degree of f w.r.t. IV as variable is 2 ◮ Cryptographic primitives with low algebraic degree are vulnerable to many attacks Question: Can we do the algebraic calculation? Answer: It is a hard problem. Since after sufficient no. of rounds, a well-designed stream cipher has complicated expression

Our Contribution

Our Contribution 15 ◮ We give an algorithm which iteratively approximates the algebraic degree of TRIAD-AE

Our Contribution 15 ◮ We give an algorithm which iteratively approximates the algebraic degree of TRIAD-AE ◮ We provide a method to search good cube

Our Contribution 15 ◮ We give an algorithm which iteratively approximates the algebraic degree of TRIAD-AE ◮ We provide a method to search good cube ◮ We observe some cubes in the reduced version of the cipher

Approximation of Algebraic Degree of TRIAD-AE 16 Let A t , B t and C t be the corresponding states of NFSRs 1 A , B and C (resp. of length n A , n B and n C ) at clock t given by 1 Non-linear feedback shift registers

Approximation of Algebraic Degree of TRIAD-AE 16 Let A t , B t and C t be the corresponding states of NFSRs 1 A , B and C (resp. of length n A , n B and n C ) at clock t given by A t = ( a t , a t − 1 , . . . , a t − n A +1 ) , B t = ( b t , b t − 1 , . . . , b t − n B +1 ) , C t = ( c t , c t − 1 , . . . , c t − n C +1 ) . And the corresponding feedback functions are given by a t = c t − i 1 · c t − i 2 ⊕ l A ( s ( t − 1) ) , b t = a t − j 1 · a t − j 2 ⊕ b t − j 3 · c t − j 3 ⊕ l B ( s ( t − 1) ) , c t = b t − k 1 · b t − k 2 ⊕ l C ( s ( t − 1) ) , 1 Non-linear feedback shift registers

Approximation of Algebraic Degree of TRIAD-AE 16 Let A t , B t and C t be the corresponding states of NFSRs 1 A , B and C (resp. of length n A , n B and n C ) at clock t given by A t = ( a t , a t − 1 , . . . , a t − n A +1 ) , B t = ( b t , b t − 1 , . . . , b t − n B +1 ) , C t = ( c t , c t − 1 , . . . , c t − n C +1 ) . And the corresponding feedback functions are given by a t = c t − i 1 · c t − i 2 ⊕ l A ( s ( t − 1) ) , b t = a t − j 1 · a t − j 2 ⊕ b t − j 3 · c t − j 3 ⊕ l B ( s ( t − 1) ) , c t = b t − k 1 · b t − k 2 ⊕ l C ( s ( t − 1) ) , where 1 ≤ j 1 < j 2 < n A and j 2 < j 3 < n B = n C . 1 Non-linear feedback shift registers

Algorithm 1 17 ◮ To estimate the degree of b t , calculate the degree of quadratic and linear part separately and take their max

Algorithm 1 17 ◮ To estimate the degree of b t , calculate the degree of quadratic and linear part separately and take their max ◮ Handle 4 different cases for clock t ◮ ( t − j 1 ) ≤ 0

Algorithm 1 17 ◮ To estimate the degree of b t , calculate the degree of quadratic and linear part separately and take their max ◮ Handle 4 different cases for clock t ◮ ( t − j 1 ) ≤ 0 ◮ 1 + j 1 ≤ t ≤ j 2