Numerical Solvers in Cryptanalysis

Transcription

1 Numerical Solvers in Cryptanalysis M. Lamberger, T. Nad, V. Rijmen Institute for Applied Information Processing and Communications (IAIK) Graz University of Technology Inffeldgasse 16a, A-8010 Graz, Austria 1

2 1 Motivation 2 Trivium (Bivium A) 3 Conversion Methods 4 Numerical Methods 2

3 Motivation Linear and differential cryptanalysis Successful techniques to break many existing ciphers New ciphers try to resist New techniques needed Numerical solvers Well researched Fast and efficient Working on real numbers 3

4 Basic Approach GF(2) equations solution GF(2) 4

5 Basic Approach GF(2) equations linear/ differential cryptanalysis solution GF(2) 4

6 Basic Approach GF(2) equations conversion R equations solution GF(2) 4

7 Basic Approach GF(2) equations conversion R equations numerical methods solution GF(2) solution R 4

8 Basic Approach GF(2) equations conversion R equations numerical methods solution GF(2) inverse conversion solution R 4

9 1 Motivation 2 Trivium (Bivium A) 3 Conversion Methods 4 Numerical Methods 5

10 Trivium and Bivium A Designed by Christophe De Cannière [1] Synchronous stream cipher estream finalist 6

11 Trivium and Bivium A Designed by Christophe De Cannière [1] Synchronous stream cipher estream finalist 288 bit internal state 6

12 Trivium and Bivium A Designed by Christophe De Cannière [1] Synchronous stream cipher estream finalist 288 bit internal state Reduced variant by Raddum [4] Bivium A 6

13 Trivium and Bivium A Designed by Christophe De Cannière [1] Synchronous stream cipher estream finalist 288 bit internal state Reduced variant by Raddum [4] Bivium A Attack Known plaintext attack Goal: state recovery 6

14 Keystream generation 7

15 Keystream generation: Bivium A 7

16 Keystream generation: Bivium A S 69 T 2 7

17 Keystream generation: Bivium A For i=1 to N do T 1 S 66 + S 93 T 2 S S 177 Z i T 2 T 1 T 1 + S 91 S 92 + S 171 T 2 T 2 + S 175 S S 69 (S 1, S 2,, S 93 ) (T 2, S 1, S 2,, S 92 ) (S 94, S 95,, S 177 ) (T 1, S 94, S 95,, S 176 ) end for 8

18 Keystream generation: Bivium A For i=1 to N do T 1 S 66 + S 93 T 2 S S 177 Z i T 2 T 1 T 1 + S 91 S 92 + S 171 T 2 T 2 + S 175 S S 69 (S 1, S 2,, S 93 ) (T 2, S 1, S 2,, S 92 ) (S 94, S 95,, S 177 ) (T 1, S 94, S 95,, S 176 ) end for 8

19 Keystream generation: Bivium A For i=1 to N do T 1 S 66 + S 93 T 2 S S 177 S 178 S 179 Z i T 2 T 1 T 1 + S 91 S 92 + S 171 T 2 T 2 + S 175 S S 69 (S 1, S 2,, S 93 ) (T 2, S 1, S 2,, S 92 ) (S 94, S 95,, S 177 ) (T 1, S 94, S 95,, S 176 ) end for 8

20 System of Equations First round S S Z 1 = 0 S S S 175 S S 69 + S 178 = 0 S 66 + S 93 + S 91 S 92 + S S 179 = keystream bits Z i needed for a fully determined system 327 equations and variables 177 linear equations 150 nonlinear equations 9

21 1 Motivation 2 Trivium (Bivium A) 3 Conversion Methods 4 Numerical Methods 10

22 Conversion: Requirements Convert from a normal form Algebraic Normal Form A solution for the Boolean system should be a solution for the real system A solution for the real system should be a solution for the Boolean system Low degrees Simple as possible 11

23 Conversion Methods Standard Conversion GF(2) = {0, 1} {0, 1} R X 1 X 2 = x 1 x 2 X 1 + X 2 = x 1 + x 2 2 x 1 x 2 Multiplication in GF(2) becomes mult. in R Increasing amount of monomials Increasing degree Multilinearity 12

24 Conversion Methods (cont d) Fourier Conversion GF(2) = {0, 1} {1, 1} R X 1 X 2 = 1 2 (1 + x 1 + x 2 x 1 x 2 ) X 1 + X 2 = x 1 x 2 Addition in GF(2) becomes mult. in R Variables can cancel out (x 2 = 1) Increasing amount of monomials Increasing degree 13

25 Adapted Standard Conversion (ASC) S S Z 1 = 0 Type I S S S 175 S S 69 + S 178 = 0 Type II S 66 + S 93 + S 91 S 92 + S S 179 = 0 Type II Convert each type of equation separately Do not change the structure of the equations Keep the degree low Evaluate over GF(2) and over the reals Introduce new variables for each possible real value 14

26 ASC (cont d) 15

27 ASC (cont d) 15

28 ASC (cont d) 777 equations and variables Fewer monomials More equations and variables Maximum degree is 3 New type of equations are linear 15

29 Other Conversion Tricks Convert each side separately S 66 + S 93 + S S 179 = S 91 S 92 16

30 Other Conversion Tricks Convert each side separately S 66 + S 93 + S S 179 = S 91 S 92 Split equations and Standard Conversion S 91 S 92 = R 1 S 66 + S 93 = R 1 + R 2 S S 179 = R 2 16

31 Other Conversion Tricks Convert each side separately S 66 + S 93 + S S 179 = S 91 S 92 Split equations and Standard Conversion S 91 S 92 = R 1 S 66 + S 93 = R 1 + R 2 S S 179 = R 2 s 91 s 92 r 1 = 0 s 66 + s 93 s 66 s 93 r 1 r 2 + 2r 1 r 2 = 0 s s 179 2s 171 s 179 r 2 = 0 16

32 Conversion Methods: Comparison S 66 + S 93 + S S S 91 S 92 = 0 Standard Conversion 17

33 Conversion Methods: Comparison S 66 + S 93 + S S S 91 S 92 = 0 Fourier Conversion 17

34 Conversion Methods: Comparison S 66 + S 93 + S S S 91 S 92 = 0 Adapted Standard Conversion 17

35 Conversion Methods: Comparison S 66 + S 93 + S S S 91 S 92 = 0 Splitting 17

36 Summary for Bivium A Standard Conversion 327 equations and variables Degree is 6 High amount of monomials with high degree Fourier Conversion 327 equations and variables Degree is 6 Less monomials No variables cancel out Adaptive Standard Conversion 777 equations and variables Degree is 3 Low amount of monomials Splitting 627 variables and equations Degree is 2 Low amount of monomials 18

37 1 Motivation 2 Trivium (Bivium A) 3 Conversion Methods 4 Numerical Methods 19

38 Converted System: Facts Large systems of polynomials Highly nonlinear, degrees between 2 and 6 Multilinear Coefficients are 1 Sparse Fully determined Possible over-determined 20

39 Converted System: Facts Large systems of polynomials Highly nonlinear, degrees between 2 and 6 Multilinear Coefficients are 1 Sparse Fully determined Possible over-determined Solution exists Solution is {0, 1} n or { 1, 1} n respectively Precomputed solution available Continuously differentiable Regular Jacobian in the solution Ill-conditioned Jacobian A lot of singular points 20

40 Optimization Problem min F (s)

41 Optimization Problem min F (s) 2 2 l i s i u i (i = 1,, n) Box-bounded optimization problem s, l, u R n F : R n R n Iterative algorithms Starting point needed Global and local convergence Global and local optimum 21

42 Interior Reflective Newton Method [2] [2] Box constrained problem Iterates are between upper and lower bounds Good global convergence Scales well with the system size 22

43 DIRECT Algorithm [3] Box constrained problem Global optimization, global search Good results on random systems Good results on systems with more than one global optimum [3] 23

44 Experiments Bivium A Standard Fourier ASC Splitting Starting point Random walk on the cube Random in (0, 1) or ( 1, 1) respectively Guessing bits (variables) 24

45 Results System Starting point Result Bivium A (F) a,b local optimum c (250) solution found Bivium A (S) a,b local optimum c (250) solution found Bivium A (ASC) a,b real-valued solution c (580) solution found Bivium A (Splitting) a,b local optimum c (470) solution found a Random in {0, 1} n or { 1, 1} n respectivley b Random in (0, 1) n or ( 1, 1) n respectivley c Guessing bits (variables) 25

46 Conclusions Hard problem Converted systems are difficult Large and highly nonlinear High influence on the system over the reals Many possibilities to model the problem over the reals Mixed Integer Linear Problem Mixed Integer Nonlinear Problem Adding constraints to the problem High amount of different solvers/algorithms/strategies Does a real-valued solution contain useful information? Does a local optimum contain useful information? 26

47 Thank you for your attention! 27

48 References [1] Christophe De Cannière. Trivium: A stream cipher construction inspired by block cipher design principles. In ISC, pages , [2] Thomas F. Coleman and Yuying Li. On the convergence of interior-reflective newton methods for nonlinear minimization subject to bounds. Math. Program., 67(2-17): , [3] D. R. Jones, C. D. Perttunen, and B. E. Stuckman. Lipschitzian optimization without the lipschitz constant. J. Optim. Theory Appl., 79(1): , [4] Havard Raddum. Cryptanalytic Result on Trivium. estream project