Cryptanalysis of a discrete-time synchronous chaotic encryption system

Transcription

1 NOTICE: This is the author s version of a work that was accepted b Phsics Letters A in August Changes resulting from the publishing process, such as peer review, editing, corrections, structural formatting, and other qualit control mechanisms ma not be reflected in this document. Changes ma have been made to this work since it was submitted for publication. A definitive version will be published in Phsics Letters A, vol. 372, no. 7, pp , 2008, DOI: /j.phsleta Crptanalsis of a discrete-time snchronous chaotic encrption sstem David Arroo a,, Gonzalo Alvarez a,, Shujun Li b, Chengqing Li c and Juana Nunez a a Instituto de Física Aplicada, Consejo Superior de Investigaciones Científicas, Serrano 144, Madrid, Spain b FernUniversität in Hagen, Lehrgebiet Informationstechnik, Universitätsstraße 27, Hagen, German c Department of Electronic Engineering, Cit Universit of Hong Kong, 83 Tat Chee Avenue, Kowloon Tong, Hong Kong SAR, China Abstract Recentl a chaotic crptosstem based on discrete-time snchronization has been proposed. Some weaknesses of that new encrption sstem are addressed and eploited in order to successfull crptanalze the sstem. Ke words: Chaotic encrption, Hénon map, known-plaintet attack, crptanalsis PACS: Ac, K. 1 Introduction During the last two decades chaotic sstems have been broadl used in crptographic applications [1 5] eploiting its ergodicit, sensitivit to initial con- Corresponding authors: David Arroo (david.arroo@iec.csic.es), Gonzalo Alvarez ( Preprint submitted to Phsics Letter A 3 Februar 2008

2 ditions, miing propert, and simple analtic description but high comple behavior. However, man of the proposed schemes show important securit weaknesses as a result of a bad or noneistent ke definition and bad or noneistent ke space specification [6 14]. In this letter the crptosstem proposed in [15] is analzed and some deficiencies are pointed out. This crptosstem is built upon the Hénon map, defined as k+1 = 1 a 2 k + k, k+1 = b k. (1) The plaintet is divided into blocks {m k } N 1 k=0, where each block has M bits. The encrption of the plain-blocks is carried out for k = 0 N 1 in turn. For the k-th plain-block m k, the corresponding cipher-block is k+1, which is calculated through Eq. (1) b setting a = ψ (m k ) µ 1 ( k ), (2) b = µ 2 ( k ), (3) where ψ() is a bijective function assuring that a is a valid parameter of Eq. (1) and µ i (), i {1, 2}, are piecewise linear functions defined as b i,1 (), if a i,1 () < a i,2 (), µ i () = b i,j (), if a i,j () < a i,j+1 (), b i,l (), if a i,l () < a i,l+1 (), (4) where a i,j () is an function making one and onl one condition on the right hand of Eq. (4) satisfied for an, and b i,j () is an function making a and b valid control parameters of Eq. (1). At the receiver, the decrption of m k following two steps: is carried out snchronousl in the Generate intermediate variable ψ(m k ) b Eq. (5); ψ (m k ) = 1 k+1 + k, (5) µ 1 ( k ) 2 k k+1 = µ 2 ( k ) k. (6) Get m k = ψ 1 (ψ(m k )), where ψ 1 () is the inverse function of ψ(). 2

3 As claimed in [15, Sec. 2], the secret ke of the crptosstem includes the following three subkes: (1) The initial condition of the second component of the Hénon map, i.e., 0. (2) The M-ar switching ke (MSK) mechanism which is the function ψ(). (3) The pseudo-random switching ke (PRSK) mechanism which is given b the functions µ 1 () and µ 2 (). Based on the above general form of the proposed crptosstem, the original authors present a concrete configuration: M = 48, ψ(), µ 1 () and µ 2 () are set in Eqs. (7), (8), (9) respectivel. ψ () = A + B = , (7) , if 0.1 +, , if < µ 1 () =, , if < 0.3 +, , otherwise , if 0.1 +, , if < µ 2 () =, , if < 0.3 +, , otherwise. 10 (8) (9) Obviousl, Eqs. (8), (9) are equivalent to Eqs. (10), (11) respectivel µ 1 () = , otherwise. 10.2, if µ 2 () = , otherwise ,, if < ; < 13 15,, if < ; < 13 10,, if ,, if < ; < ,, if < ; < < , (10) (11) This paper focuses on the securit analsis of the crptosstem under the above specific configuration. For more details about its working, the reader is referred to [15]. The rest of the paper is organized as follows. In the net section some design problems of the crptosstem are emphasized. In the following 3

4 section different attacks are described. Finall, some concluding remarks and conclusions are given. a Unbounded Periodic Fig. 1. Chaotic region for the Hénon map. b 2 Design weaknessses 2.1 Loss of chaoticit of the Hénon map As remarked in [16, Rules 4 and 5], a well designed crptosstem is characterized b a precise definition of the secret ke and a crptographicall large ke space. In [15] the secret ke depends on the selection of the functions that build either the MSK or PRSK mechanisms. However, there is no clue in [15] about how to find those functions. It is onl demanded that the equations in Eq. (1) are alwas bounded. This is a big problem when considering the ke echange and the crptosstem hardware implementation [16, Rules 1 and 3]. The crptosstem s securit analsis of [15, Sec. 6] demonstrates that the decrption process demands that the PRSK and MSK settings are eactl the same as the ones used during the encrption step. Indeed, it makes difficult to guess the ke value, but it also implies the secret ke echange has to be ver precise. Provided that the design for MSK is left open and PRSK is designed using real numbers, the ke echange in the crptosstem proposed in [15] is going to be ver comple. Moreover, it is not eas to find proper functions so that the sstem described b Eq. (1) shows a chaotic behavior. Furthermore, the functions given in [15] 4

5 as an eample for M = 48, i.e, Eqs. (7), (8) and (9), do not allow the crptosstem to work in the chaotic region of the Hénon map. A common method to determine whether a dnamical sstem with the given control parameters is chaotic is to calculate its maimum Lapunov eponent. Figure 1 depicts the set of points (a, b) for which the maimal Lapunov eponent of the Hénon map is positive. (a) (b) Fig. 2. Pseudo-random switching ke analsis: a) a values for random plaintet; b) b values for random plaintet. When a random plaintet generated b the rand() function of Matlab is encrpted with Eqs. (1), (7), (8), (9), M = 48, (0) = 0.4 and (0) = 0.5, the product ψ (m k ) µ 1 ( k ) is alwas out of the chaotic region (see Fig. 2). Figure 3 shows that, after a number of transient values, the ciphertet reaches a constant value or a pair of constant values. This is a result of the crptosstem being alwas working in periodic windows of the Hénon map. The condition for other definitions of ψ(), µ 1 () and µ 2 () ma be better, but it is difficult to make the sstem remain alwas in the chaotic region of the Hénon map. The best solution would be to use other maps with a broader chaotic region. 2.2 Deficient compression performance In [15] it is mentioned that the crptosstem under stud gives a ciphertet that requires a smaller storage size than the one for the plaintet, since each message block of M bits is encrpted into a single-precision floating-point number (a number that is 32-bits long). Therefore, if M is greater than 32 it is epected to reduce the storage size for the resulting ciphertet comparing to the one for the plaintet. However, this is not true. 5

6 Asmptotic values Plaintet block values Fig. 3. Ciphertet values for plaintet blocks with a fied value. The function ψ() has to be a bijective function, i.e., each output value of this function is associated to one and onl one input value. If m k is a 32-bit value it means that there are 2 32 possible values for ψ(m k ). The plaintet block m k is M-bits long and consequentl there are 2 M possible values for m k. Therefore, if M > 32 then ψ(m k ) is not a bijective function. This problem was verified dealing with the crptosstem referred b Eqs. (1), (7), (8), (9), M = 48, 0 = 0.4 and 0 = 0.5. A random block plaintet was encrpted and decrpted being all the operations computed with single-precision floatingpoint numbers, i.e., ever number was 32-bit long. The decrpted tet was compared to the original plaintet and there was a 28% of bits different from the original ones. The bit error rate is approimatel one third, as epected given that 32 bits are used to represent 48-bit values. The authors of [15] might have been using double-precision floating-point (64-bit) numbers in their eperiments, thus overlooking this fact. 2.3 Decrption errors due to finite precision computations The decrption of the ciphertet k involves the inversion of ψ(m k ). In the sample implementation given in [15], ψ(m k ) is determined b Eq. (7) and the 48-bit plaintet block is recovered b inverting Eq. (7): m k = ψ (m k) A, (12) B where ψ (m k ) has been calculated from the ciphertet b using Eq. (5). If the value recovered from Eq. (5) is not eactl the one used during the encrption process for m k, then the value given b Eq. (12) is not an integer. This happens if all the mathematical operations are in finite precision, as it occurs in the 6

7 encrption scheme under eamination. It was actuall verified that the result of Eq. (12) is never an integer. Thus the value returned b the decrption process needs to be rounded in order to recover the original information. This was not mentioned in [15] and poses the following problem: some blocks of the original plaintet are incorrectl recovered from the ciphertet, i.e., it eists a residual bit error rate derived from the fact that ever computation is in finite precision, as shown in Fig. 4. The crptosstem s securit analsis made in [15, Sec. 6] emphasizes that a crptanalst will require identifing a number of ψ(k) output values with high certaint and precision. Figure 4 informs that this high certaint and precision requirement concerns not onl the crptanalst but also the receiver BER (%) Number of 48 bit plaintet blocks 10 4 Fig. 4. Bit Error Rate for M = 48 and different plaintet lengths. 3 Partial ke recover attack In the contet of a secure and robust encrption sstem it is assumed that the partial knowledge of the ke does not reveal information about the rest of the ke and, as a result, the crptostem performance is not harmed [16, Rule 7]. However, in the scenario drawn b [15], partial knowledge of the ke can be used to obtain the rest of the ke. Along the section we describe a knownplaintet attack [17, p. 25], where it is possible to reconstruct the supporting PRSK mechanism functions and 0, assuming that the attacker has access to ψ(m k ) for ever possible value of m k. Given two plaintets {m 1,k } N 1 k=0, {m 2,k} N 1 k=0, then 7

8 1,1 = 1 ψ(m 1,0 ) µ 1 ( 0 ) , (13) 2,1 = 1 ψ(m 2,0 ) µ 1 ( 0 ) (14) and 1,k+1 = 1 ψ(m 1,k ) µ 1 ( k ) 2 1,k + k, (15) 2,k+1 = 1 ψ(m 2,k ) µ 1 ( k ) 2 2,k + k, (16) k = µ 2 ( k 1 ) k 1, (17) where k µ µ (a) (b) µ µ (c) (d) Fig. 5. Recovered and original functions for the PRSK mechanism when the are designed as in [15]: a) µ 1 () for 0 = ; b) image zoom for µ 1 () and 0 = ; c) µ 1 () for 0 = ; and d) image zoom for µ 1 () and 0 = Subtracting Eq. (13) from Eq. (14), one obtains: 8

9 2,1 1,1 = ψ(m 1,0 ) µ 1 ( 0 ) 2 0 ψ(m 2,0 ) µ 1 ( 0 ) 2 0 = (ψ(m 1,0 ) ψ(m 2,0 )) µ 1 ( 0 ) 2 0. (18) In the following discussion, it is shown how to recover the secret ke, assuming that ψ() is known. From Eq. (18), one has r 1 = 2,1 1,1 ψ(m 1,0 ) ψ(m 2,0 ). (19) Because the encrption is generall carried out in floating point operation, the quantization error is ver small in most cases and can be ignored. As a result, r 1 = µ 1 ( 0 ) 2 0, which implies that 0 = 1,1 1 + ψ(m 1,0 ) r 1, and µ 1 ( 0 ) = r Subtracting Eq. (15) from Eq. (16): µ 1 ( k ) = 2,k+1 1,k+1 ψ(m 1,k ) 2 1,k ψ(m 2,k) 2 2,k (20) From Eq. (17): µ 2 ( k 1 ) = 1,k ψ(m 1,k ) µ 1 ( k ) 2 1,k k 1. (21) As mentioned above, b ignoring the quantization error, we have µ 1 ( k ) = µ 1 ( k ) and µ 2 ( k 1 ) = µ 2 ( k 1 ). Repeating this procedure for k = 1,..., N it is possible to reconstruct µ 1 ( k ) and µ 2 ( k ). In order to prove the proposed known-plaintet attack, points for µ 1 ( k ) and µ 2 ( k ) were calculated for 0 = 0.4, 0 = and 0 = 0.4, 0 = In Figs. 5 and 6 it is shown how it was possible to infer µ 1 ( k ), µ 2 ( k ) shape. This is due to the fact that the first component of the Hénon map emploed in the encrption process is sent through the communication channel without appling an masking transformation. However, there eists an underling quantization error in the recovering method due to the fact that all the mathematical operations are done in finite precision. It was verified that (µ 1 ) 10 6 and (µ 2 ) Therefore, the eact µ 1 and µ 2 reconstruction demands an ehaustive search. On the other hand, Figs. 5 and 6 also show that during the encrption process µ 1 ( k ) and µ 2 ( k ) do not go 9

10 µ µ (a) (b) µ µ (c) (d) Fig. 6. Recovered and original functions for the PRSK mechanism when the are designed as in [15]: a) µ 2 () for 0 = ; b) image zoom for µ 2 () and 0 = ; c) µ 2 () for 0 = ; and d) image zoom for µ 2 () and 0 = through all the possible values of the functions referred b Eqs. (8) and (9). In other words, it was verified that, during the encrption process, k never goes through all the possible input values for both functions. This is the reason wh µ 1 () and µ 2 () can not be totall recovered, which has no impact on the efficienc of the crptanalsis. This attack has been carried out in a scenario where the attacker knows ψ(). Nevertheless, the crptosstem allows other kinds of known-plaintet attacks where ψ() is not known. For instance, Eq. (18) clearl reveals a leak of information from ψ(): one can assure that ψ() is a linear function if the value of 2,1 1,1 keep unchanged for different (m 1,0, m 2,0 ) pairs, where (m 1,0 m 2,0 ) is kept fied. To be more precise, in view of Eqs. (5) and (6), different values of ψ() ma be calculated if the rest of the subkes are known. The details of 10

11 this attack are not given because it is an analogue of the one just described and because the weakness of the crptosstem has been profusel proved. 4 Conclusions In this paper some securit and design problems of a chaotic crptosstem based on discrete-time snchronization have been pointed out. First of all, it has been remarked the lack of a description about the ke space and it has been also emphasized the difficult of finding new kes in a crptosstem as the one referred in [15]. Finall it has been shown that it is possible to break the crptosstem when the kes are selected as in [15] using a known plaintet attack and assuming a partial knowledge of the ke. This analsis reveals that the choice of chaotic map is all important. Maps with irregular chaotic regions as those depicted in Fig. 1 should be avoided, in favor of maps with more uniform distributions. In this wa the chaotic behavior for a wider range of parameters can be guaranteed. As has been shown, entering into periodic windows has negative impact on the algorithm s securit. Another important point to be emphasized is that both the ke and ke space should be thoroughl described and should be designed in a wa as to facilitate the selection of valid kes. Acknowledgments The work described in this letter was partiall supported b Ministerio de Educación Ciencia of Spain, Research Grant SEG Shujun Li was supported b the Aleander von Humboldt Foundation, German. References [1] S. Li, Analses and new designs of digital chaotic ciphers, Ph.D. thesis, School of Electronic and Information Engineering, Xi an Jiaotong Universit, Xi an, China, available online at (June 2003). [2] T. Yang, A surve of chaotic secure communication sstems, Int. J. Comp. Cognition 2 (2) (2004) [3] G. Alvarez, F. Montoa, M. Romera, G. Pastor, Chaotic crptosstems, in: L. D. Sanson (Ed.), Proc. 33rd Annual 1999 International Carnahan Conference on Securit Technolog, IEEE, 1999, pp

12 [4] L. Kocarev, Chaos-based crptograph: A brief overview, IEEE Circuits Sst. Mag. 1 (2001) [5] J. Amigo, L. Kocarev, J. Szczepanski, Theor and practice of chaotic crptograph, Phs. Lett. A 366 (3) (2007) [6] G. Alvarez, S. Li, Breaking an encrption scheme based on chaotic baker map, Phs. Lett. A 352 (1-2) (2006) [7] S. Li, G. Chen, K.-W. Wong, X. Mou, Y. Cai, Baptista-tpe chaotic crptosstems: Problems and countermeasures, Phs. Lett. A 332 (5-6) (2004) [8] G. Alvarez, F. Montoa, M. Romera, G. Pastor, Crptanalsis of dnamic lookup table based chaotic crptosstems, Phs. Lett. A 326 (3-4) (2003) [9] G. Alvarez, F. Montoa, M. Romera, G. Pastor, Crptanalsis of a discrete chaotic crptosstem using eternal ke, Phs. Lett. A 319 (3-4) (2003) [10] G. Alvarez, F. Montoa, M. Romera, G. Pastor, Crptanalsis of an ergodic chaotic cipher, Phs. Lett. A 311 (2-3) (2003) [11] S. Li, X. Mou, Z. Ji, J. Zhang, Y. Cai, Performance analsis of jakimoski-kocarev attack on a class of chaotic crptosstems, Phs. Lett. A 307 (1) (2003) [12] G. Jakimoski, L. Kocarev, Analsis of some recentl proposed chaos-based encrption algorithms, Phs. Lett. A 291 (6) (2001) [13] S. Li, X. Mou, Y. Cai, Improving securit of a chaotic encrption approach, Phs. Lett. A 290 (3-4) (2001) [14] G. Alvarez, F. Montoa, M. Romera, G. Pastor, Crptanalsis of a chaotic encrption sstem, Phs. Lett. A 276 (1) (2000) [15] C. Y. Chee, D. Xu, Chaotic encrption using dicrete-time snchronous chaos, Phsics Letters A 348 (3-6) (2006) [16] G. Alvarez, S. Li, Some basic crptographic requirements for chaos-based crptosstems, International Journal of Bifurcation and Chaos 16 (8) (2006) [17] D. Stinson, Crptograph: Theor and Practice, CRC Press,