Vectorized linear approximations for attacks on SNOW 3G Jing Yang 1 Thomas Johansson 1 Alexander Maximov 2 1 Dept. of Electrical and Information Technology, Lund University 2 Ericsson Research, Lund, Sweden FSE ’2020 November, 2020
Outline 1 Motivation 2 The SNOW 3G Cipher 3 Linear Cryptanalysis of SNOW 3G Linear Approximation of FSM Distinguishing Attack Correlation Attack 4 Conclusions 0 / 19
Outline 1 Motivation 2 The SNOW 3G Cipher 3 Linear Cryptanalysis of SNOW 3G Linear Approximation of FSM Distinguishing Attack Correlation Attack 4 Conclusions 1 / 19
Confidentiality and Integrity Protection in Cellular Networks ◮ Three standardized algorithms in LTE: SNOW 3G, AES, ZUC ◮ 128-bit security level 1 / 19
Confidentiality and Integrity Protection in Cellular Networks ◮ Three standardized algorithms in LTE: SNOW 3G, AES, ZUC ◮ 128-bit security level ◮ 5G: 256-bit security algorithms 1 / 19
Confidentiality and Integrity Protection in Cellular Networks ◮ Three standardized algorithms in LTE: SNOW 3G, AES, ZUC ◮ 128-bit security level ◮ 5G: 256-bit security algorithms ◮ One possible solution: reuse existing algorithms ◮ Security under the 256-bit key length should be investigated 1 / 19
Confidentiality and Integrity Protection in Cellular Networks ◮ Three standardized algorithms in LTE: SNOW 3G, AES, ZUC ◮ 128-bit security level ◮ 5G: 256-bit security algorithms ◮ One possible solution: reuse existing algorithms ◮ Security under the 256-bit key length should be investigated ◮ Contribution : give linear cryptanalysis of SNOW 3G ◮ Distinguishing attack 2 172 ◮ Correlation attack 2 177 1 / 19
Outline 1 Motivation 2 The SNOW 3G Cipher 3 Linear Cryptanalysis of SNOW 3G Linear Approximation of FSM Distinguishing Attack Correlation Attack 4 Conclusions 2 / 19
SNOW 3G ◮ A stream cipher with a linear part and a non-linear part α -1 α LFSR s 15 s 11 s 5 s 2 s 1 s 0 FSM z (t) R 1 S 1 R 2 S 2 R 3 ◮ Linear part: linear feedback shift register (LFSR) ◮ Non-linear part : finite state machine (FSM) 2 / 19
LFSR in SNOW 3G α -1 α s 15 s 11 s 5 s 2 s 1 s 0 ◮ Defined over GF (2 32 ) , 16 cells × 32 bits / cell = 512 bits 3 / 19
LFSR in SNOW 3G α -1 α s 15 s 11 s 5 s 2 s 1 s 0 ◮ Defined over GF (2 32 ) , 16 cells × 32 bits / cell = 512 bits ◮ Feedback polynomial : P ( x ) = αx 16 + x 14 + α − 1 x 5 + 1 ∈ GF (2 32 )[ x ] ◮ α is a root of a polynomial in GF (2 8 )[ x ] 3 / 19
LFSR in SNOW 3G α -1 α s 15 s 11 s 5 s 2 s 1 s 0 ◮ Defined over GF (2 32 ) , 16 cells × 32 bits / cell = 512 bits ◮ Feedback polynomial : P ( x ) = αx 16 + x 14 + α − 1 x 5 + 1 ∈ GF (2 32 )[ x ] ◮ α is a root of a polynomial in GF (2 8 )[ x ] ◮ LFSR update : s ( t +1) = s ( t ) i +1 (0 ≤ i ≤ 14) , i s ( t +1) = α − 1 s ( t ) 11 + s ( t ) 2 + αs ( t ) 0 . 15 3 / 19
LFSR in SNOW 3G α -1 α s 15 s 11 s 5 s 2 s 1 s 0 ◮ Defined over GF (2 32 ) , 16 cells × 32 bits / cell = 512 bits ◮ Feedback polynomial : P ( x ) = αx 16 + x 14 + α − 1 x 5 + 1 ∈ GF (2 32 )[ x ] ◮ α is a root of a polynomial in GF (2 8 )[ x ] ◮ LFSR update : s ( t +1) = s ( t ) i +1 (0 ≤ i ≤ 14) , i s ( t +1) = α − 1 s ( t ) 11 + s ( t ) 2 + αs ( t ) 0 . 15 ◮ s ( t ) 15 , s ( t ) 5 , s ( t ) used to update FSM and generate keystream 0 3 / 19
FSM in SNOW 3G ( t ) ( t ) s 15 s 5 ( t ) s 0 z ( t ) R 1 S 1 R 2 S 2 R 3 4 / 19
FSM in SNOW 3G ( t ) ( t ) s 15 s 5 ( t ) s 0 z ( t ) R 1 S 1 R 2 S 2 R 3 ◮ Keystream block : z ( t ) = ( R 1 ( t ) ⊞ s ( t ) 15 ) ⊕ R 2 ( t ) ⊕ s ( t ) 0 4 / 19
FSM in SNOW 3G ( t ) ( t ) s 15 s 5 ( t ) s 0 z ( t ) R 1 S 1 R 2 S 2 R 3 ◮ Keystream block : z ( t ) = ( R 1 ( t ) ⊞ s ( t ) 15 ) ⊕ R 2 ( t ) ⊕ s ( t ) 0 ◮ FSM update : R 1 ( t +1) = R 2 ( t ) ⊞ 32 ( R 3 ( t ) ⊕ s ( t ) 5 ) R 2 ( t +1) = S 1 ( R 1 ( t ) ) R 3 ( t +1) = S 2 ( R 2 ( t ) ) ◮ S 1 , S 2 are 32-to-32 S-transforms 4 / 19
S-transforms in FSM w 0 Sbox r 0 MixColumn w 1 r 1 Sbox w 2 r 2 Sbox w 3 r 3 Sbox 5 / 19
S-transforms in FSM w 0 Sbox r 0 MixColumn w 1 r 1 Sbox w 2 r 2 Sbox w 3 r 3 Sbox ◮ S 1 = L 1 · S R , S R is the AES S-box r 0 x x + 1 1 1 S R ( w 0 ) r 1 1 x x + 1 1 S R ( w 1 ) = · r 2 1 1 x x + 1 S R ( w 2 ) r 3 x + 1 1 1 x S R ( w 3 ) 5 / 19
S-transforms in FSM w 0 Sbox r 0 MixColumn w 1 r 1 Sbox w 2 r 2 Sbox w 3 r 3 Sbox ◮ S 1 = L 1 · S R , S R is the AES S-box r 0 x x + 1 1 1 S R ( w 0 ) r 1 1 x x + 1 1 S R ( w 1 ) = · r 2 1 1 x x + 1 S R ( w 2 ) r 3 x + 1 1 1 x S R ( w 3 ) ◮ S 2 = L 2 · S Q , S Q is derived from the Dickson polynomials r 0 y y + 1 1 1 S Q ( w 0 ) r 1 1 y y + 1 1 S Q ( w 1 ) = · r 2 1 1 y y + 1 S Q ( w 2 ) r 3 y + 1 1 1 y S Q ( w 3 ) 5 / 19
Outline 1 Motivation 2 The SNOW 3G Cipher 3 Linear Cryptanalysis of SNOW 3G Linear Approximation of FSM Distinguishing Attack Correlation Attack 4 Conclusions 6 / 19
Basics for Linear Cryptanalysis of Stream Ciphers ◮ Basic Idea : approximate non-linear components as linear ones, further derive some linear relationships, involving: 6 / 19
Basics for Linear Cryptanalysis of Stream Ciphers ◮ Basic Idea : approximate non-linear components as linear ones, further derive some linear relationships, involving: ◮ LFSR states and keystream symbols ⇒ Correlation attacks 6 / 19
Basics for Linear Cryptanalysis of Stream Ciphers ◮ Basic Idea : approximate non-linear components as linear ones, further derive some linear relationships, involving: ◮ LFSR states and keystream symbols ⇒ Correlation attacks ◮ Keystream symbols only ⇒ Distinguishing attacks 6 / 19
Basics for Linear Cryptanalysis of Stream Ciphers ◮ Basic Idea : approximate non-linear components as linear ones, further derive some linear relationships, involving: ◮ LFSR states and keystream symbols ⇒ Correlation attacks ◮ Keystream symbols only ⇒ Distinguishing attacks ◮ Linear approximation: z = NF ( s ) = LF ( s ) + e [biased noise] 6 / 19
Basics for Linear Cryptanalysis of Stream Ciphers ◮ Basic Idea : approximate non-linear components as linear ones, further derive some linear relationships, involving: ◮ LFSR states and keystream symbols ⇒ Correlation attacks ◮ Keystream symbols only ⇒ Distinguishing attacks ◮ Linear approximation: z = NF ( s ) = LF ( s ) + e [biased noise] ◮ Consider general vectorized linear approximation 6 / 19
Basics for Linear Cryptanalysis of Stream Ciphers ◮ Basic Idea : approximate non-linear components as linear ones, further derive some linear relationships, involving: ◮ LFSR states and keystream symbols ⇒ Correlation attacks ◮ Keystream symbols only ⇒ Distinguishing attacks ◮ Linear approximation: z = NF ( s ) = LF ( s ) + e [biased noise] ◮ Consider general vectorized linear approximation ◮ e has distribution D , the SEI (Squared Euclidean Imbalance): | D |− 1 � 2 � D ( e ) − 1 � ǫ = | D | · | D | e =0 6 / 19
Basics for Linear Cryptanalysis of Stream Ciphers ◮ Basic Idea : approximate non-linear components as linear ones, further derive some linear relationships, involving: ◮ LFSR states and keystream symbols ⇒ Correlation attacks ◮ Keystream symbols only ⇒ Distinguishing attacks ◮ Linear approximation: z = NF ( s ) = LF ( s ) + e [biased noise] ◮ Consider general vectorized linear approximation ◮ e has distribution D , the SEI (Squared Euclidean Imbalance): | D |− 1 � 2 � D ( e ) − 1 � ǫ = | D | · | D | e =0 ◮ Required Samples: n = O (1 /ǫ ) to distinguish e from random 6 / 19
Basics for Linear Cryptanalysis of Stream Ciphers ◮ Basic Idea : approximate non-linear components as linear ones, further derive some linear relationships, involving: ◮ LFSR states and keystream symbols ⇒ Correlation attacks ◮ Keystream symbols only ⇒ Distinguishing attacks ◮ Linear approximation: z = NF ( s ) = LF ( s ) + e [biased noise] ◮ Consider general vectorized linear approximation ◮ e has distribution D , the SEI (Squared Euclidean Imbalance): | D |− 1 � 2 � D ( e ) − 1 � ǫ = | D | · | D | e =0 ◮ Required Samples: n = O (1 /ǫ ) to distinguish e from random 6 / 19
Basics for Linear Cryptanalysis of Stream Ciphers ◮ Basic Idea : approximate non-linear components as linear ones, further derive some linear relationships, involving: ◮ LFSR states and keystream symbols ⇒ Correlation attacks ◮ Keystream symbols only ⇒ Distinguishing attacks ◮ Linear approximation: z = NF ( s ) = LF ( s ) + e [biased noise] ◮ Consider general vectorized linear approximation ◮ e has distribution D , the SEI (Squared Euclidean Imbalance): | D |− 1 � 2 � D ( e ) − 1 � ǫ = | D | · | D | e =0 ◮ Required Samples: n = O (1 /ǫ ) to distinguish e from random ◮ Key Point : to find a good approximation with a large bias 6 / 19
Linear Approximation of FSM in SNOW 3G ( t ) (t) ( t ) s 5 s 0 s 15 z (t) R 1 S 1 R 2 S 2 R 3 7 / 19
Recommend
More recommend
