Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs

Transcription

1 Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs Alex Biryukov 1,2, Dmitry Khovratovich 2, Léo Perrin 2 1 CSC, University of Luxembourg 2 SnT, University of Luxembourg March 6, 2017 Fast Software Encryption 2017

2 Introduction m S S 0 S 1... S n/m 1 A L n bits Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 1 / 17

3 Introduction m S S 0 S 1... S n/m 1 A L n bits How many layers can we attack? Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 1 / 17

4 Introduction Generic Attacks Against SPNs... but why? Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 2 / 17

5 Introduction Generic Attacks Against SPNs... but why? For attacking actual block ciphers Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 2 / 17

6 Introduction Generic Attacks Against SPNs... but why? For attacking actual block ciphers For attacking White-box schemes ASASA AES white-box implementations SPNbox Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 2 / 17

7 Introduction Generic Attacks Against SPNs... but why? For attacking actual block ciphers For attacking White-box schemes ASASA AES white-box implementations SPNbox For decomposing S-Boxes Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 2 / 17

8 Outline Talk Outline 1 Introduction 2 Attacks Against 5 rounds 3 More Rounds! 4 Division Property 5 Conclusion Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 3 / 17

9 Plan 1 Introduction 2 Attacks Against 5 rounds Attack SASAS Attack ASASA 3 More Rounds! 4 Division Property 5 Conclusion Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 3 / 17

10 Core Lemma Lemma If F : {0, 1} n {0, 1} m has degree d, then F (x) = 0 x C for all cube C = {a + v, v V}, where V is a vector space of size 2 d+1. Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 4 / 17

11 Distinguisher for S-layer S S 0 S 1... S n/m 1 For all cube C of size 2 m : S (x) = 0. x C Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 5 / 17

12 Distinguisher for S-layer S S 0 S 1... S n/m 1 L 1 For all cube C of size 2 m : SA(x) = 0. x C Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 5 / 17

13 Distinguisher for S-layer L 0 S S 0 S 1... S n/m 1 L 1 For all cube C of size 2 m : ASA(x) = 0. x C Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 5 / 17

14 Free S-Layer Trick Observation If V consists in the input bits of some S-Boxes, then S(V) = V. Cubes based on V simply change their offsets. Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 6 / 17

15 Free S-Layer Trick Observation If V consists in the input bits of some S-Boxes, then S(V) = V. Cubes based on V simply change their offsets. S 0,0 S 0,1... S 0,n/m 1 L 0 S 1,0 S 1,1... S 1,n/m 1 L 1 Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 6 / 17

16 Free S-Layer Trick Observation If V consists in the input bits of some S-Boxes, then S(V) = V. Cubes based on V simply change their offsets. S 0,0 S 0,1... S 0,n/m 1 L 0 S 1,0 S 1,1... S 1,n/m 1 L 1 For the cubes C i of size 2 m corresponding to the inputs of S i, x C i SASA(x) = 0. Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 6 / 17

17 S-Box Recovery Against SASAS j 0 0 S 0,0 S 0,1... S 0,n/m 1 L 0 S 1,0 S 1,1... S 1,n/m 1 L 1 S 2,0 S 2,1... S 2,n/m 1 y j 0 y j 1 y j n/m 1 Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 7 / 17

18 S-Box Recovery Against SASAS j 0 0 S 0,0 S 0,1... S 0,n/m 1 L 0 S 1,0 S 1,1... S 1,n/m 1 Zero sums L 1 S 2,0 S 2,1... S 2,n/m 1 y j 0 y j 1 y j n/m 1 Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 7 / 17

19 S-Box Recovery Against SASAS j 0 0 S 0,0 S 0,1... S 0,n/m 1 L 0 S 1,0 S 1,1... S 1,n/m 1 Zero sums L 1 S 2,0 S 2,1... S 2,n/m 1 2 m 1 j=0 S 2,i (y j i ) = 0, for all i. y j 0 y j 1 y j n/m 1 Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 7 / 17

20 S-Box Recovery Against SASAS j 0 0 S 0,0 S 0,1... S 0,n/m 1 L 0 S 1,0 S 1,1... S 1,n/m 1 Zero sums L 1 S 2,0 S 2,1... S 2,n/m 1 2 m 1 y j 0 y j 1 y j n/m 1 j=0 S 2,i (y j i ) = 0, for all i. Repeat for different constant then solve system [Biryukov, Shamir, 2001] Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 7 / 17

21 Attack Against ASASA Observation [Minaud et. al, 2015] Consider S with two parallel S-Boxes S 0, S 1. The scalar product of two outputs of S 0 has degree at most m 1;... one output of S 0 and one of S 1 has degree at most 2(m 1) Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 8 / 17

22 Attack Against ASASA Observation [Minaud et. al, 2015] Consider S with two parallel S-Boxes S 0, S 1. The scalar product of two outputs of S 0 has degree at most m 1;... one output of S 0 and one of S 1 has degree at most 2(m 1) For SASAS and ASASA, algebraic degree bound is crucial! Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 8 / 17

23 Plan 1 Introduction 2 Attacks Against 5 rounds 3 More Rounds! Iterated Degree Bound How Many Rounds? Applications to Actual Block Ciphers 4 Division Property 5 Conclusion Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 8 / 17

24 Degree Bound of Boura et al Theorem ([Boura et al 2011]) Let P be an arbitrary function on F n 2. Let S be an S-Box layer of Fn 2 corresponding to the parallel application of m-bit bijective S-Boxes of degree m 1. Then n deg(p) deg(p S) n. m 1 Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 9 / 17

25 Example SPN Degree Number of rounds n = 128 ; m = 4 Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 10 / 17

26 How Many Rounds Can We Attack? l = log m 1 (n). Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 11 / 17

27 How Many Rounds Can We Attack? l = log m 1 (n). Theorem (greatly simplified) Basic Attack: if r 2l and n/(m 1) l > 1 then deg ((AS) r ) (n 2) Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 11 / 17

28 How Many Rounds Can We Attack? l = log m 1 (n). Theorem (greatly simplified) Basic Attack: if r 2l and n/(m 1) l > 1 then deg ((AS) r ) (n 2) Free-S-layer Attack: if r 2l and n/(m 1) l > 2 then deg ((AS) r ) (n m 1) Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 11 / 17

29 How Many Rounds Can We Attack? l = log m 1 (n). Theorem (greatly simplified) Basic Attack: if r 2l and n/(m 1) l > 1 then deg ((AS) r ) (n 2) Free-S-layer Attack: if r 2l and n/(m 1) l > 2 then deg ((AS) r ) (n m 1) Other similar results depend on the base-(m 1) expansion of n Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 11 / 17

30 What We Can Attack m n Key size ASASAS SASASAS ASASASAS SASASASAS Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 12 / 17

31 Kuznyechik Standardized in 2015 (GOST) 128-bit block ; 8-bit S-Box (remember π?) 9 rounds, 256-bit key Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 13 / 17

32 Kuznyechik Standardized in 2015 (GOST) 128-bit block ; 8-bit S-Box (remember π?) 9 rounds, 256-bit key MDS linear layer operating on 16 bytes Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 13 / 17

33 Kuznyechik Standardized in 2015 (GOST) 128-bit block ; 8-bit S-Box (remember π?) 9 rounds, 256-bit key MDS linear layer operating on 16 bytes 7-round Attack We use that deg(4-r Kuzn.) 126. Add 1-round at the top, 2 at the bottom. Time = , Memory = 2 140, Data = Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 13 / 17

34 Khazad Published in 2000 (NESSIE candidate) 64-bit block ; 8-bit S-Box 8 rounds, 128-bit key Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 14 / 17

35 Khazad Published in 2000 (NESSIE candidate) 64-bit block ; 8-bit S-Box 8 rounds, 128-bit key 6-round Attack We use that deg(3-r Khaz.) 62. Add 1-round at the top, 2 at the bottom. Time = 2 90, Memory = 2 72, Data = Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 14 / 17

36 Plan 1 Introduction 2 Attacks Against 5 rounds 3 More Rounds! 4 Division Property 5 Conclusion Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 14 / 17

37 Division Property Definition (Division Property (simplified)) A multiset X on F n 2 has division property Dn k if x u = 0 x X for all u in F n 2 such that hw(u) < k; where xu = n 1 i=0 xu i i. Example A cube of size 2 k has division property D n k If a multiset with D n k is mapped to one with Dn 2, it sums to 0. Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 15 / 17

38 Algebraic View I X (x) = 1 if and only if x X Theorem A multiset X has division property D n k if and only if deg(i X ) n k. Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 16 / 17

39 Algebraic View I X (x) = 1 if and only if x X Theorem A multiset X has division property D n k if and only if deg(i X ) n k. Division Property and Algebraic Degree The increase in the division property is the increase in the algebraic degree of the indicator function! Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 16 / 17

40 Plan 1 Introduction 2 Attacks Against 5 rounds 3 More Rounds! 4 Division Property 5 Conclusion Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 16 / 17

41 Conclusion Secure ASASA-like cryptosystems: Block Layers Structure S-layer BB mem. WB mem. Security 12 bits 7 SASASAS 2 (6 bits) 512 B 8 KB 64 bits 16 bits 7 SASASAS 2 (8 bits) 2 KB 132 KB 64 bits 24 bits 7 SASASAS 3 (8 bits) 3 KB 50 MB 128 bits 32 bits 7 SASASAS 4 (8 bits) 4 KB 18 GB 128 bits 64 bits 7 SASASAS 8 (8 bits) 8 KB 128 bits 128 bits 11 S(AS) 5 16 (8 bits) 24 KB 128 bits Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 17 / 17

42 Conclusion Secure ASASA-like cryptosystems: Block Layers Structure S-layer BB mem. WB mem. Security 12 bits 7 SASASAS 2 (6 bits) 512 B 8 KB 64 bits 16 bits 7 SASASAS 2 (8 bits) 2 KB 132 KB 64 bits 24 bits 7 SASASAS 3 (8 bits) 3 KB 50 MB 128 bits 32 bits 7 SASASAS 4 (8 bits) 4 KB 18 GB 128 bits 64 bits 7 SASASAS 8 (8 bits) 8 KB 128 bits 128 bits 11 S(AS) 5 16 (8 bits) 24 KB 128 bits Thank you! Biryukov, Khovratovich, Perrin Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs 17 / 17