SINCE the 1990s, chaotic cryptography has attracted more

Transcription

1 1 On the Securty of the Y-Tan-Sew Chaotc Cpher Shujun L, Guanrong Chen, Fellow, IEEE and Xuanqn Mou Abstract Ths paper presents a coprehensve analyss on the securty of the Y-Tan-Sew chaotc cpher proposed n [1]. A dfferental chosen-plantext attack and a dfferental chosencphertext attack are suggested to break the sub-key K, under the assupton that the te stap can be altered by the attacker, whch s reasonable n such attacks. Also, soe securty Probles about the sub-keys α and β are clarfed, fro both theoretcal and experental ponts of vew. Further analyss shows that the securty of ths cpher s ndependent of the use of the chaotc tent ap, once the sub-key K s reoved va the proposed suggested dfferental chosen-plantext attack. Index Ters chaotc cryptography, tent ap, dfferental cryptanalyss, chosen-plantext attack, chosen-cphertext attack. I. INTRODUCTION SINCE the 199s, chaotc cryptography has attracted ore and ore attenton as a prosng way to desgn novel cphers, and ths research has becoe ore ntensve n recent years [, Chap. ]. To evaluate the securty perforance of chaotc cphers and to clarfy soe desgn prncples, cryptanalyss plays an portant role. Ths paper analyzes the securty of the recently-proposed Y-Tan-Sew chaotc cpher [1] and ponts out soe defects exstng n ths cpher: 1 the sub-key K can be reoved by a dfferental chosenplantext attack and a dfferental chosen-cphertext attack, under the assupton that the te-stap t can be altered by the attacker; the sub-key β should not be contaned n the secret key due to ts poor contrbuton to the securty of the cpher; 3 the nose vectors U j } used n the encrypton/decrypton functons do not have a unfor dstrbuton, whch downgrades the securty of the cpher by ltng the value of the sub-key α; 4 when the aforeentoned dfferental chosen-plantext or chosen-cphertext attack s used, the securty of the cpher s ndependent of the chaotc ap, but depends on the xture of three operatons fro dfferent algebrac groups. The frst two defects ean that the claed key α, β, γ, K collapses to be α, γ. Note that the second and thrd defects Ths paper has been publshed n IEEE Transactons on Crcuts and Systes II: Express Brefs, vol. 51, no. 1, pp , 4, DOI: 119/TCSII Ths research was supported by the Appled R&D Center, Cty Unversty of Hong Kong, under Grants and 964. Shujun L and Guanrong Chen are wth the Departent of Electronc Engneerng, Cty Unversty of Hong Kong, Kowloon, Hong Kong, Chna. Xuanqn Mou s wth the School of Electroncs and Inforaton Engneerng, X an Jaotong Unversty, X an, Shaanx 7149, Chna. Shujun L s the correspondng author. Contact h va were plctly entoned n Sec. III-B of [1] wthout convncng explanatons. Ths paper wll gve a coprehensve analyss on all the four securty defects. The rest of ths paper s organzed as follows. The next secton gves a bref ntroducton to the Y-Tan-Sew chaotc cpher. Then, the frst two defects of the cpher are dscussed n Sec. III. The other two defects are analyzed n Secs. IV and V, respectvely. The last secton concludes the paper. II. YI-TAN-SIEW CHAOTIC CIPHER Ths proposed cpher s a te-varant block cpher based on the chaotc tent ap. Each block has 4n bts, and the encrypton functon changes as the teraton evolves. Gven a plantext P = P 1,, P j,, P r and the correspondng cphertext C = C 1, C j,, C r, where P j and C j are both 4n-bt blocks, the cpher s descrbed as follows. The eployed chaotc tent ap s an extended verson of the noral skew tent ap F α : F α x 1, f < x 1 < 1, G α,β : x = 1 β, otherwse, where F α : x = x 1 /α, x 1 α, 1 x 1 /1 α, α < x 1 1. The secret key was claed to be a 4-tuple key α, β, γ, K, where γ s used to generate a secret ntal condton x of G α,β as follows: x = F 4n γ 1 log 1 t t. 3 Here, t representes the current te-stap transtted over a publc channel. Snce γ s only used to generate x, the secret key can also be consdered as α, β, x, K. Based on the secret key, the followng secret functons are calculated for the encrypton/decrypton procedures: 1 A sequence of 4n-bt nose vectors U j = u 4jn, u 4jn+1,, u 4jn+4n 1 j =, 1,,, are generated fro the dgtal chaotc orbt 1 of the extended tent ap G α,β wth the followng rule:, x α, u = 4 1, α < x 1. A sequence of secret perutatons w j j =, 1,, ; = 1,, n are generated fro U j and the sub-key K, as follows: V j = v j1, v j,, v jn = U j K, where each v j 1 In ths paper, the ter dgtal chaotc orbt s used to denote the orbt of a chaotc ap realzed n a dgtal coputer [, Chap..5].

2 corresponds to a functon w j that represents a perutaton of four ntegers 1,, 3, 4} followng Table 1 of [1]. 3 A sequence of secret bt-perutaton functons f j = f jn f j1 j =, 1,, are generated as follows: f j X = f j M 1, M, M 3, M 4 = [w j M 1, M, M 3, M 4 ] 1, 5 where X = M 1 3n + M n + M 3 n + M 4 and 1 s the 1-bt crcular left-shft operaton. 4 Another sequence of perutaton functons j1 jn j are generated as follows: j = 1 X = fj M 1, M, M 3, M 4 = [w 1 j M 1, M, M 3, M 4 ] 1, 6 where j s the nverse functon of f j,.e., j f j X = X, and 1 s the 1-bt crcular rght-shft operaton. The ntalzaton procedure: C = U, P = U 1. The encrypton procedure: C j = f j 1 P j C j 1 U j+1 P j 1 U j+1, 7 where denotes XOR and a b := a + b od 4n. The decrypton procedure: P j = j 1 C j P j 1 U j+1 C j 1 U j+1. 8 III. REDUCTION OF KEY SPACE Ths secton dscusses the reducton of the key space of the Y-Tan-Sew cpher,.e., ts frst two securty defects. A. The Dfferental Chosen-Plantext Attack for Reducng K To break the Y-Tan-Sew cpher va a chosen-plantext attack, the attacker has to ake t fxed durng the attack,.e., to ake the sub-key x and the nose vector sequence U j } fxed. Ths can be done by ntentonally alterng the local clock of the encrypton achne, whch s generally avalable snce the attacker can access the encrypton achne n chosen-plantext attacks [3]. If t s generated fro a publc te servce, the attacker can sply alterng the te sgnal transtted over the publc channel to alter t. In the followng, therefore, assue that t s fxed for all chosen plantexts. Assue P 1,, P j 1, P j } and P 1,, P j 1, P j } are two plantexts. The dfference of the cphertexts s as follows: C j = C j C j = f j 1 P j C j 1 U j+1 f j 1 P j C j 1 U j+1.9 Assue CU j = C j 1 U j+1. Then, Eq. 9 s reduced to C j = f j 1 P j CU j f j 1 P j CU j. 1 Now, consder such a queston: what can one observe fro C j, f P j and P j have only one dfferent bt? Assue that P j = p 4jn,, p 4jn+,, p 4jn+4n 1, P j = p 4jn,, p 4jn+,, p 4jn+4n 1, and CU j = cu,, cu 4n 1. It s obvous that P j CU j and P j CU j also have only one dfferent bt at the sae poston. Thus, further assung that one has P j CU j = p 4jn,, p 4jn+,, p 4jn+4n 1, P j CU j = p 4jn,, p 4jn+,, p 4jn+4n 1, C j = f j 1 p 4jn,, p 4jn+,, p 4jn+4n 1 f j 1 p 4jn,, p 4jn+,, p 4jn+4n 1. Consderng f j 1 s a bt-perutaton functon, one has f j 1 P j CU j = p 4jn+I,, p 4jn+I l = p 4jn+,, p 4jn+I 4n 1, and f j 1 P j CU j = p 4jn+I,, p 4jn+I l = p 4jn+,, p 4jn+I 4n 1, where I I 4n 1, 1,, 4n 1} denote the peruted postons of the 4n bts p 4jn p 4jn+4n 1. As a result, 4n l l 1 }}}} C j =,,, 1,,, = l 1, 11 whch eans that the -th bt of P = P j P j s peruted to the l-th bt of C = C j C j by f j 1. Fro the above dscusson, one can edately conclude that gven the followng 4n+1 plantexts contanng j planblocks, the secret bt-perutaton functon f j 1 can be exactly reconstructed: P = P,, P, P, P 1 = P,, P, P 1, P l = P,, P, P l, P 4n = P,, P, P 4n, where P P l = l 1. To get all r secret perutaton functons f f r 1 for the decrypton of cphertexts whose szes are not larger than r, the nuber of requred plantexts s 4n + 1 r. Snce the sub-key K s used only to deterne f j } together wth U j, the reconstructon of f f r 1 eans the reducton of K fro the whole secret key α, β, γ, K. Note that t s generally dffcult to derve V j fro f j, due to the strong xng of v j and the bt-shftng operatons. That s, t s generally dffcult to derve K fro f j, even when U j s known to the attacker. B. The Dfferental Chosen-Cphertext Attack for Reducng K Due to the slarty of the encrypton and decrypton procedures, the above dfferental chosen-plantext attack can be easly generalzed to a dfferental chosen-cphertext attack. Here, the attacker can ake x fxed durng the attack by alterng t transtted over the publc channel, whch s possble snce generally the attacker has a full control of the publc channel. In the dfferental chosen-cphertext attack, one can replace the 4n + 1 r chosen plantexts n the above dfferental chosen-plantext attack wth 4n + 1 r

3 3 chosen cphertexts. As a result, one can get all r nverses perutaton functons, f 1 fr 1 1, whch s equvalent to the r perutaton functons, f f r 1. C. Reducton of β In Sec. III-B of [1], t was sad that ost lkely, β does not act n the encrypton and decrypton processes, wthout any explanaton. Here, we wll theoretcally verfy ths cla. In the extended tent ap G α,β, β wll have to ake nfluence on the cpher only after x = or 1. However, the possblty that x = or 1 s so tny that the pact of β on the encrypton/decrypton procedures s coputatonally neglgble fro the Probablstc pont of vew. Wthout loss of generalty, assue that the ap G α,β s realzed n n-bt coputng precson and that the dgtal chaotc orbt dstrbutes unforly n the dscretzed space, whch s reasonable due to the unfor nvarant densty functon of the skew tent ap [4]. So, the Probablty that x = or 1 s p = / n = 1/ n 1. As a result, fro the atheatcal expectaton of the geoetrc dstrbuton [5], the average poston of the frst occurrence of the above event x = or 1 s 1/p = n 1. For sngle-precson floatng-pont arthetc, n = 3 two sgn bts are excluded, averagely 9 = 51M teratons are needed to actvate the nfluence of β on the encrypton/decrypton procedures. Ths eans averagely 9 /8 = 64M leadng bytes of the cphertext can be successfully decrypted wthout any knowledge of β. Slarly, when the double-precson floatng-pont arthetc n = 6 s used, the condton wll becoe uch worse: averagely 61 /8 = GG leadng cpher-bytes can be decrypted wthout knowng β. Therefore, n ost f not all cases, β s not eanngful n the key. In fact, t s just a trval paraeter not part of the secret key to avod the dgtal chaotc orbt of the noral skew tent ap F α to fall nto the fxed pont x =. As a suary, under the above dfferental chosen-plantext attack, the orgnal key α, β, γ, K collapses to be α, γ. When the dfferental chosen-plantext attack s possble, the orgnal key α, β, γ, K collapses to be α, γ, K. IV. NON-UNIFORMITY OF NOISE VECTOR U j In the encrypton procedure of the Y-Tan-Sew cpher, the nose vector U j+1 s used to ask the plantext P j together wth the prevous plantext P j 1 and the prevous cphertext C j 1. To enhance the potental capablty of resstng statstcs-based attacks [3], t s desrable that U j dstrbutes unforly n the dscrete space,, 4n 1 }. However, as entoned n Sec. III-B of [1], U j does not dstrbutes unforly when α s close to or 1. As a suggeston, 9 < α < was suggested n [1]. However, nether theoretcal nor experental analyss s gven n [1] to support ths cla. In ths secton, we nvestgate the theory underlyng the non-unforty of U j over,, 4n 1 }. In addton, t s ponted out that the non-unforty of U j s also very sgnfcant when α =, whch was not notced n [1]. frequency U j Fg. 1. The occurrence frequency of U j = a,, 55}, when α, β, x =,.7, 1 saples. A. Non-Unforty of U j when α In ths subsecton, t s shown that when α, the closer the α s to or 1, the ore severe the non-unforty of U j wll becoe. Strctly speakng, α can never lead to a unfor dstrbuton. Slar to Sec. III-C, assue agan that the dgtal chaotc orbt of the ap G α,β dstrbutes unforly n the dscretzed space. It s then easy to deduce the followng two Probabltes: Probu = } = α, Probu = 1} = 1 α. 1 The above equatons ean that U j wll contan ore - bts than 1-bts when α >, and ore 1-bts than - bts when α <. That s, U j does not have a unfor dstrbuton over,, 4n 1 } f α. When α, β, x =,.7, and n =, for exaple, under double-precson floatng-pont arthetc, Fgure 1 gves an experental curve of the occurrence frequency of U j wth dfferent values between and 4n 1 = 8 1 = 55. It can be seen that the frequency of U j = 55 = s close to but any others are alost. Under the assupton that all bts n U j are ndependent each other, a,, 4n 1}, one can theoretcally deduce the Probablty of U j = a: ProbU j = a} = α Na 1 α 4n Na, where N a,, 4n} denotes the nuber of -bts n a. In total there are 4n + 1 dfferent values n all 4n Probabltes: Prob = α 4n, Prob1 = α 4n 1 α,, Prob = α 4n 1 α,, Prob4n = 1 α 4n. The non-unforty of each U j s useful for an attacker to get ts value ore quckly va a specally-desgned guess order. Snce the secret bt-perutaton functons f j 1 } can be reconstructed under chosen-plantext attack recall Sec. III- A, the attacker can successfully decrypt any cphertext once U j } are obtaned. That s, U j }, f j } can be consdered as an equvalent of the orgnal secret key α, β, γ, K. To fnd the rght value of each U j, the followng guess order of U j = a s suggested: a A A 4n,, a A A 4n,, a A n, where A = n denotes the set of all

4 4 Coα = n 1 Prob H + 4n 4 = = + Probn Hn + 4n n 1 n 4n 4n 4n Prob H + + Prob4n H + + = = = = = 4n n + Probn Hn + n 1 = Prob + Prob4n H + Coα = = n 1 = 4n 4n + 1 4n Prob + Prob4n H + + Prob4n. = 4n 4n n n Probn Hn + + Probn Hn + 4n n 4n + 1 n 13 + Prob4n H + 4n 4n + 4n 4n = 4n Prob4n 4n 13 log Coα Fg.. log Coα vs. α.1,,.1,,.99}. 4n-bt bnary ntegers that contan -bts. Wth such a guess order, the average nuber of searched ntegers.e., the guess coplexty Coα can be calculated wth Eq. 13, where H denotes the nuber of prevous searched ntegers: 1 H = l= 4n l 1 + l= α 4n 4n l 1 = l= 4n l. 14 When n = 16, for nstance, the relatonshp between the calculated coplexty and the value of α s shown n Fg.. Note that there exst calculaton errors that ake each log Coα a lttle less than the real value, but ths fact does not nfluence the followng qualtatve analyss. Fro the experental data gven n Fg., one can see that the coplexty s uch less than 4n 1 = 63 the coplexty of the brute-force guess of a unforly-dstrbuted 4n-bt nteger when α s close to or 1. Apparently, the closer the α s to or 1, the weaker the sub-key α wll be. As a result, to ensure the securty of the Y-Tan-Sew cpher, the sub-key α has to be constraned n [α, 1 α ], 1, where Coα should be cryptographcally large. Ths, however, wll further reduce the key space to soe extent. In [1], 9 < α < s suggested to avod ths securty defect. In ths case, 1-bt wll always occur wth a hgher The errors are natural results of the unavodable accuulaton of the nteredate quantzaton errors. Probablty than -bt, snce Probu = 1} = 1 α > Probu = } = α. So, one can guess the value of each U j wth a dfferent order: A A 4n. Although Probu = 1} Probu = } = 1 α,. s not so uch, the guess coplexty wll stll be less than the sple brute-force search. Fro such a pont of vew, 9 < α < should be replaced by ts balanced verson: α <.1. B. Non-Unforty of U j when α = Fro the dscusson gven above, α = sees to be the best paraeter to generate unforly dstrbuted U j } that should axze the value of Coα. Unfortunately, accordng to our prevous studes on the dgtal dynacs of pecewse-lnear chaotc aps PWLCM realzed n fxedpont arthetc [, Chap. 3], α = s the worst paraeter fro the vewpont of dynacal degradaton occurrng n the dscretzed space, whch destroys the unfor dstrbuton of the generated pseudo-rando nubers. Actually, as a specal case of the dgtal PWLCM, the dgtal chaotc orbt of G,β can be theoretcally analyzed, whch s slar to but a lttle ore coplex than the orbt of F. Wthout loss of generalty, assue that the least sgnfcant bt of x s the n x -th bt after the dot,.e., x =.a 1 a a nx, where a nx = 1. To facltate the followng dscusson, n x s called the bnary precson of x. Substtutng α = nto the equaton of F, one can get x 1, x 1, F : x = 15 1 x 1, < x 1 1. It s obvous that F x ust be n the for of.a 1a a n x 1, where a n x 1 = 1. Ths eans that the bnary precson of x s decreased by 1 after one teraton. Thus, the dgtal chaotc orbt of F wll always trend to the sae fxed pont x = after n x teratons. For G,β, the ntroducton of β akes thngs a lttle coplcated: assung that the bnary precson of β s n β, the orbt of G,β wll be n the followng for: n x teratons x β n β teratons β β n β teratons β That s, the dgtal chaotc orbt of G,β enters a perodc cycle deterned by β after a transent stage deterned by x. The perod of the fnal cycle s n β + 1.

5 5 5 x Fg. 53. The dgtal chaotc orbt of G, when x = 3. frequency The queston s: Can we unquely or partally solve Uj+1 As an exaple, when x = 3, fro the above the equatons? dgtal Or, howchaotc to use the above orbt equatons. to lessen the coplexty of exhaustve guess of Uj+1? of G 5, s shown n Fg. 3. Apparently, In an experent, the curves such of a b x a degraded and fj 1x are plotted and t s observed that at ost n solutons exsts. Of chaotc orbt wll generate badly course, non-unfor only a few ones are rght U solutons, j }. snce When ost others.5 are not nteger solutons. n =, experents show that the frequency of U Now we can see t leads to the well-known j = 17 dffcult Uj proble of nteger equatons. We beleve t wll be the s about.993, whch eans that the non-unforty s even sae dffcult as other atheatcal probles used n pure Fg. 3. The occurrence frequency of Uj = a,,55}, when α = cryptography. The coplexty s expected to be O n. It worse, β =.7, x than = 1 the saples one gven n Fg. 1. One ore exaple s also s obvous that such a coplexty only reles on the xng two operatons n two dfferent felds, and s ndependent tested by changng the value of αof the nuse Fg. of the chaotc 1 fro tent ap. Fro tosuch a pont but of vew, Gven two sequent plan-blocks satsfyng Cj 1 = Pj =, the chaotc tent ap can be reoved fro the Y-Tan-Sew the we can values get the followng ofequaton: β and x are keptcpher unchanged, and be replaced by any and other pseudo-rando t s found nuber Cj = fj 1Uj+1 Pj 1 Uj+1. generator PRNG. Rewrte t n another for: Cj Pj 1 Uj+1 = fj 1Uj+1. that the dstrbuton of U j has two pronent peaks at U j = 85 and 17 the frequences are 1 and 18, respectvely. The above analyss shows that α = s also a rather bad paraeter for the generaton of U j } toward a unfor dstrbuton. So, should be excluded fro the range of α. For exaple, the range α <.1 should be replaced by < α <.1. C. How to Mend Ths Defect? Snce the non-unforty of U j } s anly caused by the fact that Probu = } = Probu = 1}, t s easy to end t by changng Eq. 4 to the followng one:, x, u = 16 1, < x 1. It has been ponted out that dynacal degradaton of G,β n the dgtal doan wll nfluence the unforty of U j }. In fact, ths Proble also exsts for any α, whch has been clarfed n [, Sec..5.1]. Followng prevous studes, the average length of all dgtal orbt of the tent ap s O L/, when L s the bt nuber of the eployed fnte-precson arthetc. For double-fnte floatng-pont arthetc, L = 6, so the average length s about 31, whch s not suffcently large fro the cryptographcal pont of vew. To overcoe ths Proble and also the non-unforty caused by the dgtal dynacal degradaton, a sall pseudo-rando sgnal s suggested to be used to perturb the dgtal chaotc orbt tely, as dscussed n Secs..5. and of []. V. INCAPABILITY OF CHAOS FOR SECURITY In Sec. IV-A above, t was entoned that U j }, f j } s an equvalent of the orgnal key. By studyng the possblty of solvng for U j } fro chosen plantext-cphertext pars, t can be shown that the securty of the Y-Tan-Sew cpher s ndependent of the use of the chaotc ap G α,β. Gven a plantext P j and the correspondng cphertext C j, one can get Eq. 7 for U j+1. Under the condton that f j 1 has been reconstructed, t s possble to solve for U j+1 wth a nuber of such equatons. Apparently, the solvablty of U j+1 s ndependent of the chaotc ap G α,β. That s, the securty of the cpher s ndependent of G α,β. In fact, one can replace the chaotc ap wth any other PRNG to generate U j, wthout nfluencng the securty of the cpher. Therefore, fro ths pont of vew, the Y-Tan-Sew cpher cannot be consdered as a typcal chaotc cpher. Next, the solvablty of Eq. 7 s dscussed. Bascally, the xture of three dfferent operatons, XOR, odulo 4n addton, and f j 1, akes t rather dffcult to get U j+1 fro Eq. 7. Rewrte Eq. 7 as follows: C j P j 1 U j+1 = f j 1 P j C j 1 U j+1, 17 whch can be splfed as a b x = f j 1 c d x. 18 The task s to fnd a 4n-bt nteger soluton of x fro a nuber of such equatons. Consderng that f j 1 contans n crcular left-shft operatons, t should have at least n separate branches. Ths ples that at least n ponts of ntersecton between the graph of a b x and that of f j 1 c d x have to be checked to fnd the only rght nteger soluton of x. That s, a lower bound of the coplexty s O n. VI. CONCLUSION Ths paper has studed the securty of the recently-proposed Y-Tan-Sew chaotc cpher [1]. Soe defects of ths cpher have been ponted out and analyzed n detal. The securty analyses gven n ths paper should provde soe useful references for better desgn of varous chaotc cphers n the future. ACKNOWLEDGEMENTS The authors would lke to thank the anonyous revewers for ther valuable coents. REFERENCES [1] X. Y, C. H. Tan, and C. K. Sew, A new block cpher based on chaotc tent aps, IEEE Trans. Crcuts Syst. I, vol. 49, no. 1, pp , Deceber. [] S. L, Analyses and new desgns of dgtal chaotc cphers, Ph.D. dssertaton, School of Electroncs and Inforaton Engneerng, X an Jaotong Unversty, X an, Chna, June 3, fulltext s avalable onlne at [3] B. Schneer, Appled Cryptography Protocols, Algorths, and Souce Code n C, nd ed. New York: John Wley & Sons, Inc., [4] A. Baranovsky and D. Daes, Desgn of one-densonal chaotc aps wth prescrbed statstcal propertes, Int. J. Bfurcaton Chaos, vol. 5, no. 6, pp , [5] E. W. Wessten, Geoetrc dstrbuton, Fro MathWorld: athworld.wolfra.co/geoetrcdstrbuton.htl, 4.