UNAF: A Special Set of Additive Differences with Application to the - PowerPoint PPT Presentation

Introduction The UNAF Framework Salsa20 Applications Conclusions UNAF: A Special Set of Additive Differences with Application to the Differential Analysis of ARX V. Velichkov N. Mouha C. De Cannière B. Preneel COSIC, KU Leuven; IBBT FSE 2012, March 19-21, Washington DC, USA Velichkov et al. (KU Leuven) UNAF: A Special Set of Additive Differences FSE 2012 1 / 24

Introduction The UNAF Framework Salsa20 Applications Conclusions UNAF Differences Cluster Multiple Characteristics ∆ + x ∆ U x ∆ U ∆ + 1 1 ∆ U ∆ + 2 2 = ⇒ ∆ U ∆ + 3 3 ∆ U ∆ + 4 4 ∆ U y ∆ + y Velichkov et al. (KU Leuven) UNAF: A Special Set of Additive Differences FSE 2012 2 / 24

Introduction The UNAF Framework Salsa20 Applications Conclusions Applications of UNAF Differences Improved estimations of probabilities of differentials through ARX. New (better ? ) attacks. Velichkov et al. (KU Leuven) UNAF: A Special Set of Additive Differences FSE 2012 3 / 24

Introduction The UNAF Framework Salsa20 Applications Conclusions Differential Cryptanalysis [Biham and Shamir,1991] P ∆ P = P ⊕ P P ′ ′ round round X 1 ∆ X 1 X ′ 1 round round X 2 ∆ X 2 X ′ 2 round round C ∆ C = C ⊕ C C ′ ′ Pr (∆ P → ∆ C ) =? Velichkov et al. (KU Leuven) UNAF: A Special Set of Additive Differences FSE 2012 4 / 24

Introduction The UNAF Framework Salsa20 Applications Conclusions Addition, Rotation, XOR (ARX) P Addition ( ⊞ ) : confusion Rotation ( ≪ ) : diffusion within a word ARX XOR ( ⊕ ): diffusion between words C SHA-1 FEAL MD4 TEA Skein RC2 MD5 RC5 SHA-2 Salsa20 BLAKE 1987 1990 1994 2001 2006 2008 Velichkov et al. (KU Leuven) UNAF: A Special Set of Additive Differences FSE 2012 5 / 24

Introduction The UNAF Framework Salsa20 Applications Conclusions Types of Differences Additive difference ∆ + Definition ′ − X . ∆ + X = X Example = X ′ 1000 2 = X − 0101 2 = ∆ + X 0011 2 Velichkov et al. (KU Leuven) UNAF: A Special Set of Additive Differences FSE 2012 6 / 24

Introduction The UNAF Framework Salsa20 Applications Conclusions Types of Differences XOR difference ∆ ⊕ Definition ′ ⊕ X . ∆ ⊕ X = X Example = X ′ 1000 2 = X ⊕ 0101 2 = ∆ ⊕ X 1101 2 Velichkov et al. (KU Leuven) UNAF: A Special Set of Additive Differences FSE 2012 6 / 24

Introduction The UNAF Framework Salsa20 Applications Conclusions Types of Differences BSD (Binary-Signed Digit) Difference ∆ ± Definition ∆ ± X : ∆ ± X [ i ] = ( X ′ [ i ] − X [ i ]) ∈ { 1 , 0 , 1 } , 0 ≤ i < n . Example = X ′ 1000 2 = X − 0101 2 = ∆ ± X 1101 2 Velichkov et al. (KU Leuven) UNAF: A Special Set of Additive Differences FSE 2012 6 / 24

Introduction The UNAF Framework Salsa20 Applications Conclusions Types of Differences NAF (Non-Adjacent Form) Difference ∆ N Definition A NAF is a special BSD diff. s.t. no two consecutive bits are non-zero: (∆ N X [ i ] � = 0 ) ∧ (∆ N X [ i + 1 ] � = 0 ) , ∄ i : 0 ≤ i < n − 1 . Example � + 1 · 2 3 − 1 · 2 2 − 1 · 2 0 = 1101 2 = ∆ ± X , ∆ + X = 3 = + 1 · 2 2 − 1 · 2 0 = 0101 2 = ∆ N X . Velichkov et al. (KU Leuven) UNAF: A Special Set of Additive Differences FSE 2012 6 / 24

Introduction The UNAF Framework Salsa20 Applications Conclusions UNAF (Unsigned NAF) Difference Definition ∆ U X = { ∆ + a : | ∆ N a | = | ∆ N X |} . Example ∆ U X = 5 = ⇒ ∆ U X = { 3 , 13 , 5 , 11 } .  3 = + 1 · 2 2 − 1 · 2 0 ( mod 2 4 ) = 010 ¯ 1    13 = − 1 · 2 2 + 1 · 2 0 ( mod 2 4 ) = 0 ¯  101 ∆ U X = 5 =  = 0101 . 5 = + 1 · 2 2 + 1 · 2 0 ( mod 2 4 ) = 0101    11 = − 1 · 2 2 − 1 · 2 0 ( mod 2 4 ) = 0 ¯ 10 ¯  1  Velichkov et al. (KU Leuven) UNAF: A Special Set of Additive Differences FSE 2012 7 / 24

Introduction The UNAF Framework Salsa20 Applications Conclusions The Additive Differential Probability of XOR ( adp ⊕ ) a 1 b 1 ∆ + a + a 1 ∆ + b + b 1 c 1 ∆ + c + c 1 ((∆ + a + a 1 ) ⊕ (∆ + b + b 1 )) − ( a 1 ⊕ b 1 ) = ∆ + c . Velichkov et al. (KU Leuven) UNAF: A Special Set of Additive Differences FSE 2012 8 / 24

Introduction The UNAF Framework Salsa20 Applications Conclusions UNAF: Clustering of Differentials adp ⊕ ( 5 , 1 → 10 ) = 0 . 15625 5 1 10 Velichkov et al. (KU Leuven) UNAF: A Special Set of Additive Differences FSE 2012 9 / 24

Introduction The UNAF Framework Salsa20 Applications Conclusions UNAF: Clustering of Differentials adp ⊕ ( 5 , 1 → 10 ) = 0 . 15625 adp ⊕ ( 5 , 1 → 6 ) = 0 . 15625 5 1 10 6 Velichkov et al. (KU Leuven) UNAF: A Special Set of Additive Differences FSE 2012 9 / 24

Introduction The UNAF Framework Salsa20 Applications Conclusions UNAF: Clustering of Differentials adp ⊕ ( 5 , 1 → 10 ) = 0 . 15625 adp ⊕ ( 5 , 1 → 6 ) = 0 . 15625 adp ⊕ ( 5 , 15 → 10 ) = 0 . 15625 15 5 1 10 6 Velichkov et al. (KU Leuven) UNAF: A Special Set of Additive Differences FSE 2012 9 / 24

Introduction The UNAF Framework Salsa20 Applications Conclusions UNAF: Clustering of Differentials adp ⊕ ( 5 , 1 → 10 ) = 0 . 15625 adp ⊕ ( 5 , 1 → 6 ) = 0 . 15625 adp ⊕ ( 5 , 15 → 10 ) = 0 . 15625 adp ⊕ ( 5 , 15 → 6 ) = 0 . 15625 15 5 1 10 6 Velichkov et al. (KU Leuven) UNAF: A Special Set of Additive Differences FSE 2012 9 / 24

Introduction The UNAF Framework Salsa20 Applications Conclusions UNAF: Clustering of Differentials adp ⊕ ( 5 , 1 → 10 ) = 0 . 15625 adp ⊕ ( 5 , 1 → 6 ) = 0 . 15625 adp ⊕ ( 5 , 15 → 10 ) = 0 . 15625 adp ⊕ ( 5 , 15 → 6 ) = 0 . 15625 11 15 adp ⊕ ( 11 , 1 → 10 ) = 0 . 15625 1 5 10 6 Velichkov et al. (KU Leuven) UNAF: A Special Set of Additive Differences FSE 2012 9 / 24

Introduction The UNAF Framework Salsa20 Applications Conclusions UNAF: Clustering of Differentials adp ⊕ ( 5 , 1 → 10 ) = 0 . 15625 adp ⊕ ( 5 , 1 → 6 ) = 0 . 15625 adp ⊕ ( 5 , 15 → 10 ) = 0 . 15625 adp ⊕ ( 5 , 15 → 6 ) = 0 . 15625 11 15 adp ⊕ ( 11 , 1 → 10 ) = 0 . 15625 1 adp ⊕ ( 11 , 1 → 5 6 ) = 0 . 15625 10 6 Velichkov et al. (KU Leuven) UNAF: A Special Set of Additive Differences FSE 2012 9 / 24

Introduction The UNAF Framework Salsa20 Applications Conclusions UNAF: Clustering of Differentials adp ⊕ ( 5 , 1 → 10 ) = 0 . 15625 adp ⊕ ( 5 , 1 → 6 ) = 0 . 15625 adp ⊕ ( 5 , 15 → 10 ) = 0 . 15625 adp ⊕ ( 5 , 15 → 6 ) = 0 . 15625 11 15 adp ⊕ ( 11 , 1 → 10 ) = 0 . 15625 5 1 adp ⊕ ( 11 , 1 → 6 ) = 0 . 15625 adp ⊕ ( 11 , 15 → 10 ) = 0 . 15625 10 6 Velichkov et al. (KU Leuven) UNAF: A Special Set of Additive Differences FSE 2012 9 / 24

Introduction The UNAF Framework Salsa20 Applications Conclusions UNAF: Clustering of Differentials adp ⊕ ( 5 , 1 → 10 ) = 0 . 15625 adp ⊕ ( 5 , 1 → 6 ) = 0 . 15625 adp ⊕ ( 5 , 15 → 10 ) = 0 . 15625 adp ⊕ ( 5 , 15 → 6 ) = 0 . 15625 11 15 adp ⊕ ( 11 , 1 → 10 ) = 0 . 15625 adp ⊕ ( 11 , 1 → 5 1 6 ) = 0 . 15625 adp ⊕ ( 11 , 15 → 10 ) = 0 . 15625 adp ⊕ ( 11 , 15 → 6 ) = 0 . 15625 10 6 Velichkov et al. (KU Leuven) UNAF: A Special Set of Additive Differences FSE 2012 9 / 24

Introduction The UNAF Framework Salsa20 Applications Conclusions UNAF: Clustering of Differentials adp ⊕ ( 5 , 1 → 10 ) = 0 . 15625 adp ⊕ ( 5 , 1 → 6 ) = 0 . 15625 adp ⊕ ( 5 , 15 → 10 ) = 0 . 15625 3 adp ⊕ ( 5 , 15 → 6 ) = 0 . 15625 11 15 adp ⊕ ( 11 , 1 → 10 ) = 0 . 15625 1 5 adp ⊕ ( 11 , 1 → 6 ) = 0 . 15625 adp ⊕ ( 11 , 15 → 10 ) = 0 . 15625 adp ⊕ ( 11 , 15 → 6 ) = 0 . 15625 adp ⊕ ( 3 , 1 → 10 ) = 0 . 09375 10 6 Velichkov et al. (KU Leuven) UNAF: A Special Set of Additive Differences FSE 2012 9 / 24

Introduction The UNAF Framework Salsa20 Applications Conclusions UNAF: Clustering of Differentials adp ⊕ ( 5 , 1 → 10 ) = 0 . 15625 adp ⊕ ( 5 , 1 → 6 ) = 0 . 15625 adp ⊕ ( 5 , 15 → 10 ) = 0 . 15625 3 adp ⊕ ( 5 , 15 → 6 ) = 0 . 15625 11 15 adp ⊕ ( 11 , 1 → 10 ) = 0 . 15625 1 adp ⊕ ( 11 , 1 → 5 6 ) = 0 . 15625 adp ⊕ ( 11 , 15 → 10 ) = 0 . 15625 adp ⊕ ( 11 , 15 → 6 ) = 0 . 15625 adp ⊕ ( 3 , 1 → 10 ) = 0 . 09375 adp ⊕ ( 3 , 1 → 6 ) = 0 . 09375 10 6 Velichkov et al. (KU Leuven) UNAF: A Special Set of Additive Differences FSE 2012 9 / 24

Introduction The UNAF Framework Salsa20 Applications Conclusions UNAF: Clustering of Differentials adp ⊕ ( 5 , 1 → 10 ) = 0 . 15625 adp ⊕ ( 5 , 1 → 6 ) = 0 . 15625 adp ⊕ ( 5 , 15 → 10 ) = 0 . 15625 3 adp ⊕ ( 5 , 15 → 6 ) = 0 . 15625 15 11 adp ⊕ ( 11 , 1 → 10 ) = 0 . 15625 5 1 adp ⊕ ( 11 , 1 → 6 ) = 0 . 15625 adp ⊕ ( 11 , 15 → 10 ) = 0 . 15625 adp ⊕ ( 11 , 15 → 6 ) = 0 . 15625 adp ⊕ ( 3 , 1 → 10 ) = 0 . 09375 adp ⊕ ( 3 , 1 → 6 ) = 0 . 09375 adp ⊕ ( 3 , 15 → 10 ) = 0 . 09375 10 6 Velichkov et al. (KU Leuven) UNAF: A Special Set of Additive Differences FSE 2012 9 / 24