Count November 21st, 2017

Size: px

Start display at page:

Download "Count November 21st, 2017"

Bernadette Flynn
5 years ago
Views:

1 RUHR-UNIVERSITÄT BOCHUM XOR Count November 21st, 2017 FluxFingers Workgroup Symmetric Cryptography Ruhr University Bochum Friedrich Wiemer Friedrich Wiemer XOR Count November 21st,

2 Overview Joint Work Its not me alone [Kra+17] 1 Thorsten Kranz, Gregor Leander, Ko Stoffelen, Friedrich Wiemer Outline 1 Motivation 2 Preliminaries 3 State of the Art and Related Work 4 Future Work 1 available on eprint: Friedrich Wiemer XOR Count November 21st,

3 What is the XOR count, and why is it important? Some facts Lightweight Block Ciphers Efficient Linear Layers MDS matrices are optimal (regarding security) 2 2 Are they? Friedrich Wiemer XOR Count November 21st,

4 What is the XOR count, and why is it important? Some facts Lightweight Block Ciphers Efficient Linear Layers MDS matrices are optimal (regarding security) 2 What is the lightest implementable MDS matrix? What about additional features (Involutory)? 2 Are they? Friedrich Wiemer XOR Count November 21st,

5 What is the XOR count, and why is it important? Some facts Lightweight Block Ciphers Efficient Linear Layers MDS matrices are optimal (regarding security) 2 What is the lightest implementable MDS matrix? What about additional features (Involutory)? The XOR count Metric for needed hardware resources Smaller is better 2 Are they? Friedrich Wiemer XOR Count November 21st,

6 What is an MDS matrix? Definition: MDS A matrix M of dimension k over the field F is maximum distance separable (MDS), iff all possible submatrices of M are invertible (or nonsingular). Friedrich Wiemer XOR Count November 21st,

7 What is an MDS matrix? Definition: MDS A matrix M of dimension k over the field F is maximum distance separable (MDS), iff all possible submatrices of M are invertible (or nonsingular). Example The AES MIXCOLUMN matrix is defined over F 2 8 = F[x]/0x11b: 0x02 0x03 0x01 0x01 x x x01 0x02 0x03 0x01 0x01 0x01 0x02 0x03 = 1 x x x x + 1 0x03 0x01 0x01 0x02 x x This is a (right) circulant matrix: circ(x, x + 1, 1, 1). Friedrich Wiemer XOR Count November 21st,

8 What is an MDS matrix? Constructions Cauchy by construction MDS Vandermonde can be made involutory Circulant used in AES, GRØSTL, WHIRLPOOL, QARMA, MIDORI other Subfield used in WHIRLWIND Toeplitz Hadamard can be made involutory, used in ANUBIS, KHAZAD, JOLTIK Friedrich Wiemer XOR Count November 21st,

9 What is an MDS matrix? Constructions Cauchy by construction MDS Vandermonde can be made involutory Circulant used in AES, GRØSTL, WHIRLPOOL, QARMA, MIDORI other Subfield used in WHIRLWIND Toeplitz Hadamard can be made involutory, used in ANUBIS, KHAZAD, JOLTIK Friedrich Wiemer XOR Count November 21st,

10 What is an MDS matrix? Constructions Cauchy by construction MDS Vandermonde can be made involutory Circulant used in AES, GRØSTL, WHIRLPOOL, QARMA, MIDORI other Subfield used in WHIRLWIND Toeplitz Hadamard can be made involutory, used in ANUBIS, KHAZAD, JOLTIK Friedrich Wiemer XOR Count November 21st,

11 What is an MDS matrix? Representations How to implement this in hardware? This is about hardware implementations How do we implement a field multiplication in hardware? How do we implement a matrix multiplication in hardware? Friedrich Wiemer XOR Count November 21st,

12 What is an MDS matrix? Representations How to implement this in hardware? This is about hardware implementations How do we implement a field multiplication in hardware? How do we implement a matrix multiplication in hardware? Example α 1 β α x β α (x + 1) β Friedrich Wiemer XOR Count November 21st,

13 What is an MDS matrix? Representations How to implement this in hardware? This is about hardware implementations How do we implement a field multiplication in hardware? How do we implement a matrix multiplication in hardware? Example α (x + 1) β α 1 β α x β α x β 1 Friedrich Wiemer XOR Count November 21st,

14 Field Multiplication in Hardware From F 2 [x]/p(x) to F n 2 Implement α 1 β OK, this one is easy Example in F 2 [x]/0x13: Friedrich Wiemer XOR Count November 21st,

15 Field Multiplication in Hardware From F 2 [x]/p(x) to F n 2 Implement α 1 β OK, this one is easy Example in F 2 [x]/0x13: α = α 0 + α 1 x + α 2 x 2 + α 3 x 3 β = β 0 + β 1 x + β 2 x 2 + β 3 x 3 = α 0 + α 1 x + α 2 x 2 + α 3 x 3 Friedrich Wiemer XOR Count November 21st,

16 Field Multiplication in Hardware From F 2 [x]/p(x) to F n 2 Implement α x β Example in F 2 [x]/0x13: Friedrich Wiemer XOR Count November 21st,

17 Field Multiplication in Hardware From F 2 [x]/p(x) to F n 2 Implement α x β Example in F 2 [x]/0x13: α = α 0 + α 1 x + α 2 x 2 + α 3 x 3 x 4 x + 1 mod 0x13 β = β 0 + β 1 x + β 2 x 2 + β 3 x 3 = x (α 0 + α 1 x + α 2 x 2 + α 3 x 3 ) α 3 + (α 0 + α 3 )x + α 1 x 2 + α 2 x 3 ) Friedrich Wiemer XOR Count November 21st,

18 Field Multiplication in Hardware From F 2 [x]/p(x) to F n 2 In matrix notation for F 2 [x]/0x13: ) β = 1 α β = x α ( β0 β 1 β 2 β 3 ( β0 β 1 β 2 β 3 ) = = ( ) ) ( ( α0 α 1 α 2 α 3 ( α0 α 1 α 2 α 3 ) ) Friedrich Wiemer XOR Count November 21st,

19 Field Multiplication in Hardware From F 2 [x]/p(x) to F n 2 In matrix notation for F 2 [x]/0x13: ) β = 1 α β = x α ( β0 β 1 β 2 β 3 ( β0 β 1 β 2 β 3 ) = = ( ) ) ( ( α0 α 1 α 2 α 3 ( α0 α 1 α 2 α 3 ) ) Companion Matrix We call M p(x) = ( ) the companion matrix of the polynomial p(x) = 0x13. For any element γ F 2 [x]/p(x), we denote by M γ the matrix that implements the multiplication by this element in F n 2. Friedrich Wiemer XOR Count November 21st,

20 Counting XOR s Example We can rewrite the AES MIXCOLUMN matrix as: M AES = circ(x, x + 1, 1, 1) = circ(m x, M x+1, M 1, M 1 ). Starting in (F 2 [x]/0x11b) 4 4, we end up in ( F ) 4 4 = F Friedrich Wiemer XOR Count November 21st,

21 Counting XOR s Example We can rewrite the AES MIXCOLUMN matrix as: M AES = circ(x, x + 1, 1, 1) = circ(m x, M x+1, M 1, M 1 ). Starting in (F 2 [x]/0x11b) 4 4, we end up in ( F ) 4 4 = F A first XOR-count To implement multiplication by γ, we need hw(m γ ) dim(m γ ) many XOR s. Thus XOR-count(M AES ) = 4 (hw(m x ) + hw(m x+1 ) + 2 hw(m 1 )) 32 = 4 ( ) 32 = 152. Friedrich Wiemer XOR Count November 21st,

22 The General Linear Group Generalise a bit Instead of choosing elements from F 2 n = F2 [x]/p(x) we can extend our possible choices for multiplication matrices by exploiting the following. Friedrich Wiemer XOR Count November 21st,

23 The General Linear Group Generalise a bit Instead of choosing elements from F 2 n = F2 [x]/p(x) we can extend our possible choices for multiplication matrices by exploiting the following. Todo Maybe remove this? Friedrich Wiemer XOR Count November 21st,

24 RUHR-UNIVERSITÄT BOCHUM The Stupidity of recent XOR Count Papers November 21st, 2017 FluxFingers Workgroup Symmetric Cryptography Ruhr University Bochum Friedrich Wiemer Friedrich Wiemer The Stupidity of recent XOR Count Papers November 21st,

25 State of the Art Before our Paper You saw how to count XORs This count is split in the overhead and the XORs needed for the field multiplication Thus for AES we get = = 152 Finding a good matrix reduces now to find the cheapest elements for field multiplication There is a lot of work followng this line [BKL16; JPS17; LS16; LW16; LW17; Sim+15; SS16a; SS16b; SS17; ZWS17] Friedrich Wiemer The Stupidity of recent XOR Count Papers November 21st,

26 State of the Art Best known Results 4 4 matrices over GL(8, F 2 ) Matrix Naive Literature AES (Circulant) [Sim+15] (Subfield) [LS16] (Circulant) [LW16] [BKL16] (Circulant) [SS16b] (Toeplitz) [JPS17] (Subfield) Friedrich Wiemer The Stupidity of recent XOR Count Papers November 21st,

27 Related Work I Friedrich Wiemer The Stupidity of recent XOR Count Papers November 21st,

28 Related Work I Friedrich Wiemer The Stupidity of recent XOR Count Papers November 21st,

29 Related Work II Friedrich Wiemer The Stupidity of recent XOR Count Papers November 21st,

30 State of the Art Best known Results (After our Paper) 4 4 matrices over GL(8, F 2 ) Matrix Naive Literature AES (Circulant) [Sim+15] (Subfield) [LS16] (Circulant) [LW16] [BKL16] (Circulant) [SS16b] (Toeplitz) [JPS17] (Subfield) Friedrich Wiemer The Stupidity of recent XOR Count Papers November 21st,

31 State of the Art Best known Results (After our Paper) 4 4 matrices over GL(8, F 2 ) Our Results [Kra+17] Matrix Naive Literature PAAR1 PAAR2 BP AES (Circulant) [Sim+15] (Subfield) [LS16] (Circulant) [LW16] [BKL16] (Circulant) [SS16b] (Toeplitz) [JPS17] (Subfield) Friedrich Wiemer The Stupidity of recent XOR Count Papers November 21st,

32 State of the Art Finding better matrices? Type Previously Best Known XOR count GL(4, F 2 ) [JPS17; SS16b] 36 GL(8, F 2 ) [LW16] 72 (F 2 [x]/0x13) [Sim+15] 196 GL(8, F 2 ) [LS16] 392 (F 2 [x]/0x13) 4 4 * 63 [JPS17] 42 GL(8, F 2 ) [JPS17] 84 (F 2 [x]/0x13) [Sim+15] 212 GL(8, F 2 ) [JPS17] 424 Friedrich Wiemer The Stupidity of recent XOR Count Papers November 21st,

33 Future Work; Questions? Thank you for your attention! Do your work! Apply global optimization techniques that are known for years! (But thanks for the easy paper ) Mainboard & Questionmark Images: flickr Friedrich Wiemer The Stupidity of recent XOR Count Papers November 21st,

34 References I [BKL16] [JPS17] [Kra+17] C. Beierle, T. Kranz, and G. Leander. Lightweight Multiplication in GF(2 n ) with Applications to MDS Matrices. In: CRYPTO 2016, Part I. Ed. by M. Robshaw and J. Katz. Vol LNCS. Springer, Heidelberg, Aug. 2016, pp DOI: / _23. J. Jean, T. Peyrin, and S. M. Sim. Optimizing Implementations of Lightweight Building Blocks. Cryptology eprint Archive, Report 2017/ T. Kranz, G. Leander, K. Stoffelen, and F. Wiemer. Shorter Linear Straight-Line Programs for MDS Matrices. In: IACR Trans. Symm. Cryptol (2017). to appear. ISSN: X. [LS16] M. Liu and S. M. Sim. Lightweight MDS Generalized Circulant Matrices. In: FSE Ed. by T. Peyrin. Vol LNCS. Springer, Heidelberg, Mar. 2016, pp DOI: / _6. [LW16] Y. Li and M. Wang. On the Construction of Lightweight Circulant Involutory MDS Matrices. In: FSE Ed. by T. Peyrin. Vol LNCS. Springer, Heidelberg, Mar. 2016, pp DOI: / _7. Friedrich Wiemer The Stupidity of recent XOR Count Papers November 21st,

35 References II [LW17] [Sim+15] [SS16a] [SS16b] [SS17] C. Li and Q. Wang. Design of Lightweight Linear Diffusion Layers from Near-MDS Matrices. In: IACR Trans. Symm. Cryptol (2017), pp ISSN: X. DOI: /tosc.v2017.i S. M. Sim, K. Khoo, F. E. Oggier, and T. Peyrin. Lightweight MDS Involution Matrices. In: FSE Ed. by G. Leander. Vol LNCS. Springer, Heidelberg, Mar. 2015, pp DOI: / _23. S. Sarkar and S. M. Sim. A Deeper Understanding of the XOR Count Distribution in the Context of Lightweight Cryptography. In: AFRICACRYPT Ed. by D. Pointcheval, A. Nitaj, and T. Rachidi. Vol LNCS. Springer International Publishing, 2016, pp S. Sarkar and H. Syed. Lightweight Diffusion Layer: Importance of Toeplitz Matrices. In: IACR Trans. Symm. Cryptol (2016). pp ISSN: X. DOI: /tosc.v2016.i S. Sarkar and H. Syed. Analysis of Toeplitz MDS Matrices. In: ACISP 17, Part II. Ed. by J. Pieprzyk and S. Suriadi. Vol LNCS. Springer, Heidelberg, July 2017, pp Friedrich Wiemer The Stupidity of recent XOR Count Papers November 21st,

36 References III [ZWS17] L. Zhou, L. Wang, and Y. Sun. On the Construction of Lightweight Orthogonal MDS Matrices. Cryptology eprint Archive, Report 2017/ Friedrich Wiemer The Stupidity of recent XOR Count Papers November 21st,

The Invariant Set Attack 26th January 2017

The Invariant Set Attack 26th January 2017 Workgroup Symmetric Cryptography Ruhr University Bochum Friedrich Wiemer Friedrich Wiemer The Invariant Set Attack 26th January 2017 1 Nonlinear Invariant Attack