Understanding brute force Cryptanalyst wants to find secret 128-bit - PowerPoint PPT Presentation

✁ ✁ ✁ Understanding brute force Cryptanalyst wants to find secret 128-bit AES key , D. J. Bernstein � (0). given AES Thanks to: He builds an attack machine. University of Illinois at Chicago NSF CCR–9983950 Machine 1: His desktop PC, Alfred P. Sloan Foundation searching through possibilities for . 2 9 dollars; Machine costs 2 22 seconds; takes 2 128 . succeeds with chance

✁ ✁ ✁ ✁ � ✁ ✁ rute force Cryptanalyst wants to find This is a silly attack secret 128-bit AES key , The cryptanalyst has � (0). given AES Machine 2: desktop He builds an attack machine. each searching through Illinois at Chicago possibilities for CCR–9983950 Machine 1: His desktop PC, Foundation searching through Machine costs 2 2 22 seconds; possibilities for . takes succeeds with chance 2 9 dollars; Machine costs 2 22 seconds; takes Same keys/dollar-second: 2 128 . succeeds with chance Same chance/dolla But larger chance!

✁ ✁ ✁ ✁ ✁ ✁ Cryptanalyst wants to find This is a silly attack machine. secret 128-bit AES key , The cryptanalyst has more money. � (0). given AES Machine 2: desktop PCs, He builds an attack machine. each searching through possibilities for . Machine 1: His desktop PC, 2 9 searching through Machine costs dollars; 2 22 seconds; possibilities for . takes 2 128 . succeeds with chance 2 9 dollars; Machine costs 2 22 seconds; Same keys/dollar-second: 2 13 . takes 2 128 . � 115 . succeeds with chance Same chance/dollar-second: 2 But larger chance!

✁ ✁ � ✁ ✁ ✁ ✁ ✁ ants to find This is a silly attack machine. This is a silly attack AES key , The cryptanalyst has more money. Only a tiny part of is doing anything useful. Machine 2: desktop PCs, Machine 3: tiny attack machine. each searching through each searching through possibilities for . desktop PC, possibilities for 2 9 through Machine costs dollars; 2 22 seconds; AES circuit, in bulk, r . takes is orders of magnitude 2 128 . succeeds with chance 2 9 dollars; less expensive than Same keys/dollar-second: 2 13 . seconds; allowing much larger 2 128 . � 115 . chance Same chance/dollar-second: 2 Cost ratio grows with But larger chance! Recall DES Cracker: 2 19 keys/dollar-second.

✁ ✁ ✁ ✁ This is a silly attack machine. This is a silly attack machine. The cryptanalyst has more money. Only a tiny part of the PC is doing anything useful. Machine 2: desktop PCs, Machine 3: tiny AES circuits, each searching through each searching through possibilities for . possibilities for . 2 9 Machine costs dollars; 2 22 seconds; AES circuit, in bulk, takes is orders of magnitude 2 128 . succeeds with chance less expensive than PC, Same keys/dollar-second: 2 13 . allowing much larger . � 115 . Same chance/dollar-second: 2 Cost ratio grows with PC size! But larger chance! Recall DES Cracker: in 1997, 2 19 keys/dollar-second.

� ✁ � � ✁ ✁ ✁ ✁ ✁ ✁ ✁ attack machine. This is a silly attack machine. This is still silly if cryptanalyst has more money. Only a tiny part of the PC cryptanalyst is actually is doing anything useful. many keys 1 2 desktop PCs, Machine 3: tiny AES circuits, through Complicated but standa each searching through r . brute-force key-sea possibilities for . handles keys 2 9 dollars; using rainbow tables, AES circuit, in bulk, seconds; using distinguished is orders of magnitude 2 128 . chance less expensive than PC, Similar time, price r-second: 2 13 . allowing much larger . Conjecturally � 115 . chance/dollar-second: 2 Cost ratio grows with PC size! of success for every chance! distinguished points, Recall DES Cracker: in 1997, 2 19 keys/dollar-second.

✁ ✁ ✁ ✁ � � � This is a silly attack machine. This is still silly if Only a tiny part of the PC cryptanalyst is actually attacking ✁ . is doing anything useful. many keys 1 2 3 Machine 3: tiny AES circuits, Complicated but standard parallel each searching through brute-force key-search machine possibilities for . handles keys at once using rainbow tables, or AES circuit, in bulk, using distinguished points. is orders of magnitude less expensive than PC, Similar time, price to one key. 2 128 chance allowing much larger . Conjecturally Cost ratio grows with PC size! of success for every key; distinguished points, slightly lower. Recall DES Cracker: in 1997, 2 19 keys/dollar-second.

✁ � ✁ ✁ � ✁ � attack machine. This is still silly if Is this acceptable securit of the PC cryptanalyst is actually attacking If not, what do we ✁ . anything useful. many keys 1 2 3 Option 1: Input-space tiny AES circuits, to stop many-keys Complicated but standard parallel through “Use a large random brute-force key-search machine r . Heavy costs (usually handles keys at once limited benefits. using rainbow tables, or bulk, using distinguished points. magnitude Option 2: Use 32-b than PC, “Randomness in key Similar time, price to one key. 2 128 chance rger . Smaller costs; larger Conjecturally with PC size! of success for every key; See paper for further distinguished points, slightly lower. Cracker: in 1997, http://cr.yp.to r-second. /papers.html#bruteforce

� � � ✁ ✁ ✁ This is still silly if Is this acceptable security? cryptanalyst is actually attacking If not, what do we do? ✁ . many keys 1 2 3 Option 1: Input-space separation, to stop many-keys attacks. Complicated but standard parallel “Use a large random nonce.” brute-force key-search machine Heavy costs (usually understated); handles keys at once limited benefits. using rainbow tables, or using distinguished points. Option 2: Use 32-byte keys. “Randomness in key, not nonce.” Similar time, price to one key. 2 128 chance Smaller costs; larger benefits. Conjecturally of success for every key; See paper for further analysis: distinguished points, slightly lower. http://cr.yp.to /papers.html#bruteforce

� � � ✁ ✁ ✁ Is this acceptable security? Basic cryptanalytic if actually attacking If not, what do we do? A new attack is pointless ✁ . 3 Option 1: Input-space separation, it takes less time to stop many-keys attacks. standard parallel than standard brute-fo “Use a large random nonce.” ey-search machine at the same price Heavy costs (usually understated); eys at once with the same success limited benefits. tables, or Most papers get this distinguished points. Option 2: Use 32-byte keys. Example: The attack “Randomness in key, not nonce.” rice to one key. 9 rounds of 256-bit 2 128 chance Smaller costs; larger benefits. had larger price and every key; complete brute-force See paper for further analysis: through all 2 256 keys. oints, slightly lower. http://cr.yp.to /papers.html#bruteforce

Is this acceptable security? Basic cryptanalytic economics If not, what do we do? A new attack is pointless unless Option 1: Input-space separation, it takes less time to stop many-keys attacks. than standard brute-force machine “Use a large random nonce.” at the same price Heavy costs (usually understated); with the same success chance. limited benefits. Most papers get this wrong. Option 2: Use 32-byte keys. Example: The attack “breaking” “Randomness in key, not nonce.” 9 rounds of 256-bit Serpent Smaller costs; larger benefits. had larger price and time than a complete brute-force search See paper for further analysis: through all 2 256 keys. http://cr.yp.to /papers.html#bruteforce