Truncated Differentials Lars R. Knudsen June 2014 Lars R. Knudsen - PowerPoint PPT Presentation

Truncated differentials Impossible differentials Truncated Differentials Lars R. Knudsen June 2014 Lars R. Knudsen Truncated Differentials

Truncated differentials Impossible differentials Outline Truncated differentials 1 Impossible differentials 2 Lars R. Knudsen Truncated Differentials

Truncated differentials Impossible differentials Differential cryptanalysis: the idea Differential cryptanalysis on iterated ciphers trace difference in chosen plaintexts through encryption process; predict difference in next to last round of encryption; guess key in last round, compute backwards. Lars R. Knudsen Truncated Differentials

Truncated differentials Impossible differentials C IPHER FOUR m ❄ ✲ ❞ k 0 ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ S S S S P ✏ ❍ ✏✏✏✏✏✏ P ❍ ✟ ✟ ✟✟✟✟ ❍ ✟✟✟✟ ❍ P ❅ � ❅ � ❅ � ❅ � ❍ ❅ P � ❍ ❅ � P ❍ ❍ P � ❅ � ❍ ❅ � P ❍ ❅ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ✲ ❞ k 1 ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ S S S S P ✏ ❍ ✏✏✏✏✏✏ P ❍ ✟ ✟ ✟✟✟✟ ❍ ✟✟✟✟ ❍ P ❅ � ❅ � ❅ � ❅ � ❍ ❅ P � ❍ ❅ � P ❍ ❍ P � ❅ � ❍ ❅ � P ❍ ❅ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ Lars R. Knudsen Truncated Differentials

Truncated differentials Impossible differentials 5 rounds of C IPHER FOUR ❄ ✲ ❞ k 2 ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ S S S S P ✏ ❍ ✏✏✏✏✏✏ P ❍ ✟ ✟ ✟✟✟✟ ❍ ✟✟✟✟ ❍ P ❅ � ❅ � ❅ � ❅ � ❍ ❅ P � ❍ ❅ � P ❍ ❍ P � ❅ � ❍ ❅ � P ❍ ❅ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ✲ ❞ k 3 ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ S S S S P ✏ ❍ ✏✏✏✏✏✏ P ❍ ✟ ✟ ✟✟✟✟ ❍ ✟✟✟✟ ❍ P ❅ � ❅ � ❅ � ❅ � ❍ ❅ P � ❍ ❅ � P ❍ ❍ P � ❅ � ❍ ❅ � P ❍ ❅ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ✲ ❞ k 4 ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ S S S S ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ✲ ❞ k 5 ❄ c Lars R. Knudsen Truncated Differentials

Truncated differentials Impossible differentials Characteristic Consider ( S , S , S , S ) ( 0 , 0 , 2 , 0 ) → ( 0 , 0 , 2 , 0 ) which has probability 6 / 16 and note that ( 0 , 0 , 2 , 0 ) P → ( 0 , 0 , 2 , 0 ) Thus ( 0 , 0 , 2 , 0 ) R → ( 0 , 0 , 2 , 0 ) Lars R. Knudsen Truncated Differentials

Truncated differentials Impossible differentials Characteristic ( 0 , 0 , 2 , 0 ) R → ( 0 , 0 , 2 , 0 ) R → ( 0 , 0 , 2 , 0 ) with probability ( 6 / 16 ) 2 and ( 0 , 0 , 2 , 0 ) R → ( 0 , 0 , 2 , 0 ) R → ( 0 , 0 , 2 , 0 ) R → ( 0 , 0 , 2 , 0 ) R → ( 0 , 0 , 2 , 0 ) with probability ( 6 / 16 ) 4 ≈ 0 . 02 . Example Attack 5 rounds by guessing (parts of) the last round key. Lars R. Knudsen Truncated Differentials

Truncated differentials Impossible differentials Differential Attack of C IPHER FOUR ❄ ✲ ❢ k 3 0 0 ❄ 2 0 ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ S S S S P ✏✏✏✏✏✏✏✏ P ✏ ❍ ❍ ✟ ✟ ✟✟✟✟✟ ❍ P ✟✟✟✟✟ ❍ ❅ � ❅ � ❅ � P ❍ ❍ P ❅ � ❍ ❅ � P ❍ ❅ � P ❍ ❍ P � ❅ � ❍ ❅ � P ❍ ❅ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ✲ ❢ k 4 0 0 ❄ 2 0 ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ S S S S ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ 0 0 ? 0 ❄ ✲ ❢ k 5 ❄ c 0 c 1 c 2 c 3 Lars R. Knudsen Truncated Differentials

Truncated differentials Impossible differentials Differentials Observation When using ( 0 , 0 , 2 , 0 ) R → ( 0 , 0 , 2 , 0 ) R → ( 0 , 0 , 2 , 0 ) R → ( 0 , 0 , 2 , 0 ) R → ( 0 , 0 , 2 , 0 ) we do not care about the intermediate differences! What we are really interested in is ( 0 , 0 , 2 , 0 ) R → ? R → ? R → ? R → ( 0 , 0 , 2 , 0 ) or ( 0 , 0 , 2 , 0 ) 4 R → ( 0 , 0 , 2 , 0 ) . Lars R. Knudsen Truncated Differentials

Truncated differentials Impossible differentials Differentials ( 0 , 0 , 2 , 0 ) 4 R → ( 0 , 0 , 2 , 0 ) . There are at least four characteristics involved ( 0 , 0 , 2 , 0 ) R → ( 0 , 0 , 2 , 0 ) R → ( 0 , 0 , 2 , 0 ) R → ( 0 , 0 , 2 , 0 ) R − − − − → ( 0 , 0 , 2 , 0 ) , ( 0 , 0 , 2 , 0 ) R → ( 0 , 0 , 0 , 2 ) R → ( 0 , 0 , 0 , 1 ) R → ( 0 , 0 , 1 , 0 ) R − − − − → ( 0 , 0 , 2 , 0 ) , ( 0 , 0 , 2 , 0 ) R → ( 0 , 0 , 0 , 2 ) R → ( 0 , 0 , 1 , 0 ) R → ( 0 , 0 , 2 , 0 ) R − − − − → ( 0 , 0 , 2 , 0 ) , ( 0 , 0 , 2 , 0 ) R → ( 0 , 0 , 2 , 0 ) R → ( 0 , 0 , 0 , 2 ) R → ( 0 , 0 , 1 , 0 ) R − − − − → ( 0 , 0 , 2 , 0 ) . P (( 0 , 0 , 2 , 0 ) 4 R → ( 0 , 0 , 2 , 0 )) ≈ 0 . 081 > 0 . 02 . Lars R. Knudsen Truncated Differentials

Truncated differentials Impossible differentials Differential Attack of C IPHER FOUR ❄ ✲ ❢ k 3 ? ? ❄ ? ? ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ S S S S P ✏✏✏✏✏✏✏✏ P ✏ ❍ ❍ ✟ ✟ ✟✟✟✟✟ ❍ P ✟✟✟✟✟ ❍ ❅ � ❅ � ❅ � P ❍ ❍ P ❅ � ❍ ❅ � P ❍ ❅ � P ❍ ❍ P � ❅ � ❍ ❅ � P ❍ ❅ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ✲ ❢ k 4 0 0 ❄ 2 0 ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ S S S S ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ 0 0 ? 0 ❄ ✲ ❢ k 5 ❄ c 0 c 1 c 2 c 3 Lars R. Knudsen Truncated Differentials

Truncated differentials Impossible differentials C IPHER FOUR: Experimental Results Differential attack on 5 rounds Attacker tries to determine four bits of the key Experiment Number of texts Differential attack 32 64% 64 76% 128 85% 256 96% Lars R. Knudsen Truncated Differentials

Truncated differentials Impossible differentials Truncated differentials Definition A (differential) characteristic predicts the difference in a pair of texts after each round of encryption. Definition A differential is a collection of characteristics. Lars R. Knudsen Truncated Differentials

Truncated differentials Impossible differentials Truncated differentials Definition A truncated characteristic predicts only part of the difference in a pair of texts after each round of encryption. Definition A truncated differential is a collection of truncated characteristics. Lars R. Knudsen Truncated Differentials

Truncated differentials Impossible differentials Truncated differentials S-box from before Bit notation: 0010 S 6 → 0001 has probability 16 . 0010 S 6 → 0010 has probability 16 . 0010 S 2 → 1001 has probability 16 . 0010 S 2 → 1010 has probability 16 . 0010 S → ⋆ 0 ⋆ ⋆ has probability 1. Lars R. Knudsen Truncated Differentials

Truncated differentials Impossible differentials Distribution table in \ out 0 1 2 3 4 5 6 7 8 9 a b c d e f 16 - - - - - - - - - - - - - - - 0 - - 6 - - - - 2 - 2 - - 2 - 4 - 1 - 6 6 - - - - - - 2 2 - - - - - 2 - - - 6 - 2 - - 2 - - - 4 - 2 - 3 - - - 2 - 2 4 - - 2 2 2 - - 2 - 4 - 2 2 - 4 - - 4 2 - - 2 - - - - 5 6 - - 2 - 4 - - 2 2 - 2 2 2 - - - 7 - - - - - 4 4 - 2 2 2 2 - - - - 8 - - - - - 2 - 2 4 - - 4 - 2 - 2 9 - 2 - - - 2 2 2 - 4 2 - - - - 2 a - - - - 2 2 - - - 4 4 - 2 2 - - b - - - 2 2 - 2 2 2 - - 4 - - 2 - c - 4 - 2 - 2 - - 2 - - - - - 6 - d - - - - - - 2 2 - - - - 6 2 - 4 e - 2 - 4 2 - - - - - 2 - - - - 6 f - - - - 2 - 2 - - - - - - 10 - 2 Lars R. Knudsen Truncated Differentials

Truncated differentials Impossible differentials Truncated differentials Input difference 2 to S-box lead only to output differences 1 , 2 , 9 , and a . So for one round  ( 0000 0000 0010 0000 ) or   ( 0000 0000 0000 0010 ) or  ( 0000 0000 0010 0000 ) R − → ( 0010 0000 0010 0000 ) or   ( 0010 0000 0000 0010 )  Lars R. Knudsen Truncated Differentials

Truncated differentials Impossible differentials Truncated differentials R ( 0000 0000 ) ( 00 ⋆ 0 00 ⋆ 0 00 ⋆ 0 ) 0000 0010 − → 0000 R ( 0000 0000 0000 0010 ) ( 000 ⋆ 0000 000 ⋆ 000 ⋆ ) − → R ( 0010 0000 0010 0000 ) − → ( ⋆ 0 ⋆ 0 0000 ⋆ 0 ⋆ 0 ⋆ 0 ⋆ 0 ) R ( 0010 0000 0000 0010 ) − → ( ⋆ 00 ⋆ 0000 ⋆ 00 ⋆ ⋆ 00 ⋆ )  ( 0000 0000 0010 0000 )   ( 0000 0000 0000 0010 )  R → ( ⋆ 0 ⋆⋆ 0000 ⋆ 0 ⋆⋆ ⋆ 0 ⋆⋆ ) − ( 0010 0000 0010 0000 )   ( 0010 0010 ) 0000 0000  Lars R. Knudsen Truncated Differentials