The Marvellous Universe of Arithmetization-Oriented Primitives - PowerPoint PPT Presentation

The Marvellous Universe of Arithmetization-Oriented Primitives Abdelrahaman Aly, Tomer Ashur , Eli Ben-Sasson, Siemen Dhooghe, Alan Szepieniec

The Goal ◮ The goal is to design a hash function that:

The Goal ◮ The goal is to design a hash function that: ◮ is secure;

The Goal ◮ The goal is to design a hash function that: ◮ is secure; ◮ operates on field elements (e.g., no bit fiddling);

The Goal ◮ The goal is to design a hash function that: ◮ is secure; ◮ operates on field elements (e.g., no bit fiddling); ◮ minimizes the number of field multiplications.

The Goal ◮ The goal is to design a ◮ AES! hash function that: ◮ is secure; ◮ operates on field elements (e.g., no bit fiddling); ◮ minimizes the number of field multiplications.

The Goal ◮ The goal is to design a ◮ AES! hash function that: ◮ is secure; ◮ Is secure; ◮ operates on field elements (e.g., no bit fiddling); ◮ minimizes the number of field multiplications.

The Goal ◮ The goal is to design a ◮ AES! hash function that: ◮ is secure; ◮ Is secure; ◮ operates on field ◮ natively operates on elements in GF(2 8 ); elements (e.g., no bit fiddling); ◮ minimizes the number of field multiplications.

The Goal ◮ The goal is to design a ◮ AES! hash function that: ◮ is secure; ◮ Is secure; ◮ operates on field ◮ natively operates on elements in GF(2 8 ); elements (e.g., no bit ◮ well understood and fiddling); ◮ minimizes the number heavily cryptanaylzed; of field multiplications. but

The Goal ◮ The goal is to design a ◮ AES! hash function that: ◮ is secure; ◮ Is secure; ◮ operates on field ◮ natively operates on elements in GF(2 8 ); elements (e.g., no bit ◮ well understood and fiddling); ◮ minimizes the number heavily cryptanaylzed; of field multiplications. but ◮ does not minimize the number of field multiplications.

AES as a Starting Point ◮ AES has 4 operations: ◮ S-box ◮ ShiftRows ◮ MixColumns (a) S-box (b) ShiftRows ◮ AddRoundKey (c) (d) MixColumns AddRoundKey

AES as a Starting Point ◮ AES has 4 operations: ◮ S-box ◮ ShiftRows ◮ MixColumns (a) S-box (b) ShiftRows ◮ AddRoundKey ◮ All the multiplications are inside the S-box (c) (d) MixColumns AddRoundKey

The S-box ◮ The S-box consists of two operations: ◮ Multiplicative inverse (11 multiplications) (see Damg˚ ard & Keller FC’10) ◮ Affine polynomial (7 multiplications)

Cost ◮ Multiplications per S-box: (11 + 7) = 18

Cost ◮ Multiplications per S-box: (11 + 7) = 18 ◮ Multiplications per round: (11 + 7) · 16 = 288

Cost ◮ Multiplications per S-box: (11 + 7) = 18 ◮ Multiplications per round: (11 + 7) · 16 = 288 ◮ Multiplications per AES evaluation: (11 + 7) · 16 10 = 2880 · ���� ���� � �� � state rounds S-box

Observations ◮ Non-procedural computation

Non-Procedural Computation ◮ Verification, not computation

Non-Procedural Computation ◮ Verification, not computation ◮ Given ( x 1 , y 1 ) to verify that y 1 = 1 x 1 we can

Non-Procedural Computation ◮ Verification, not computation ◮ Given ( x 1 , y 1 ) to verify that y 1 = 1 x 1 we can ◮ directly compute ( x 1 ) 254 ; or

Non-Procedural Computation ◮ Verification, not computation ◮ Given ( x 1 , y 1 ) to verify that y 1 = 1 x 1 we can ◮ directly compute ( x 1 ) 254 ; or ◮ check if x 1 · y 1 = 1

Non-Procedural Computation ◮ Verification, not computation ◮ Given ( x 1 , y 1 ) to verify that y 1 = 1 x 1 we can ◮ directly compute ( x 1 ) 254 ; or ◮ check if x 1 · y 1 = 1 ◮ Don’t forget 0 → 0: x (1 − xy ) = 0

Non-Procedural Computation ◮ Verification, not computation ◮ Given ( x 1 , y 1 ) to verify that y 1 = 1 x 1 we can ◮ directly compute ( x 1 ) 254 ; or ◮ check if x 1 · y 1 = 1 ◮ Don’t forget 0 → 0: x (1 − xy ) = 0 ◮ Cost of the multiplicative inverse 11 2

Cost ◮ Multiplications per AES evaluation (old): (11 + 7) · 16 10 = 2880 · ���� ���� � �� � state rounds S-box

Cost ◮ Multiplications per AES evaluation (old): (11 + 7) · 16 10 = 2880 · ���� ���� � �� � state rounds S-box ◮ Multiplications per AES evaluation (new): (2 + 7) · 16 10 = 1440 (50% of AES-128) · ���� ���� � �� � state rounds S-box

The Affine Polynomial i c i · 2 2 i (linearized polynomials) ◮ Polynomials of the form � are efficiently computable

The Affine Polynomial i c i · 2 2 i (linearized polynomials) ◮ Polynomials of the form � are efficiently computable ◮ The inverse of a low degree, linearized polynomial is not linearized nor low-degree

The Affine Polynomial i c i · 2 2 i (linearized polynomials) ◮ Polynomials of the form � are efficiently computable ◮ The inverse of a low degree, linearized polynomial is not linearized nor low-degree ◮ Take two linearized polynomials of degree 4 and compose one with the inverse of the other. This

The Affine Polynomial i c i · 2 2 i (linearized polynomials) ◮ Polynomials of the form � are efficiently computable ◮ The inverse of a low degree, linearized polynomial is not linearized nor low-degree ◮ Take two linearized polynomials of degree 4 and compose one with the inverse of the other. This ◮ Requires many multiplications to compute directly; but

The Affine Polynomial i c i · 2 2 i (linearized polynomials) ◮ Polynomials of the form � are efficiently computable ◮ The inverse of a low degree, linearized polynomial is not linearized nor low-degree ◮ Take two linearized polynomials of degree 4 and compose one with the inverse of the other. This ◮ Requires many multiplications to compute directly; but ◮ requires only (2 + 2) = 4 a few multiplications to verify.

Cost ◮ Multiplications per AES evaluation (old): (2 + 7) · 16 10 = 1440 (50% of AES-128) · ���� ���� � �� � state rounds S-box

Cost ◮ Multiplications per AES evaluation (old): (2 + 7) · 16 10 = 1440 (50% of AES-128) · ���� ���� � �� � state rounds S-box ◮ Multiplications per AES evaluation (new): (2 + (2 + 2)) · 16 10 = 960 (33% of AES-128) · ���� ���� � �� � state rounds S-box

Observations ◮ Non-determinism ◮ Cost of multiplication is independent of the field size

Reducing the State ◮ Instead of a 4 × 4 state of bytes, we now use a 1 x 1 state of 128-bit elements.

Reducing the State ◮ Instead of a 4 × 4 state of bytes, we now use a 1 x 1 state of 128-bit elements. ◮ No need for ShiftRows and MixColumns

Reducing the State ◮ Instead of a 4 × 4 state of bytes, we now use a 1 x 1 state of 128-bit elements. ◮ No need for ShiftRows and MixColumns ◮ One S-box per round

Cost ◮ Multiplications per AES evaluation (old): (2 + (2 + 2)) · 16 10 = 960 (33% of AES-128) · ���� ���� � �� � state rounds S-box

Cost ◮ Multiplications per AES evaluation (old): (2 + (2 + 2)) · 16 10 = 960 (33% of AES-128) · ���� ���� � �� � state rounds S-box ◮ Multiplications per AES evaluation (new): (2 + (2 + 2)) 1 10 = 60 (2% of AES-128) · · ���� ���� � �� � state rounds S-box

Setting the Number of Rounds ◮ The way to determine the proper number of rounds is to try all known attacks, see which one reaches most rounds, add a safety margin, and viola!

Observations ◮ Non-determinism ◮ Cost of multiplication is independent of the field size ◮ Increasing the field size kills statistical attacks (e.g., differential and linear cryptanalysis) faster

Jarvis

Alas

Vision ◮ An m × 1 state ◮ MDS matrix to mix the elements ◮ Alternate between a linearized polynomial of low degree and its inverse ◮ Particular attention to Gr¨ obner basis attacks

Vision

Rescue ◮ Operates over prime fields ◮ Alternate between x α (e.g., α = 3) and x 1 a (resp., cubic root)

Rescue

Breaking News

Cleaning Roberto’s Mess

The Team