SECURITY EVALUATION FOR SNOW 2.0-LIKE STREAM CIPHERS AGAINST CORRELATION ATTACKS OVER EXTENSION FIELDS

Transcription

1 SECURIY EVALUAION FOR SNOW.-LIKE SREAM CIPHERS AGAINS CORRELAION AACKS OVER EXENSION FIELDS A. N. Alekseychk * S. M. Koshok ** M. V. Poemsky *** Ise of Secal Commcao ad Ifomao Secy Naoal echcal Uvesy of Ukae «Igo Skosky Kyv Polyechc Ise» * ale-d@k.e ** 3ooh@szz.k.a *** demyclods@gmal.com Absac: We oose a geeal mehod fo secy evalao of SNOW.-lke ches agas coelao aacks ha ae bl smlaly o kow aacks o SNOW.. Ulke evosly kow mehods he mehod we oose s ageed a secy oof ad allows obag lowe bods fo effcecy of aacks fom he class de cosdeao decly sg aamees of seam che comoes smlaly o echqes fo secy oofs of block ches agas lea cyaalyss. he mehod oosed s based o aomaa-heoec aoach o evalao he mbalace of dscee fcos. I acla we oba a ma eeseao ad e bods fo mbalace of a abay dscee fco beg ealzed by a seqece of fe aomaa. hese esls geealze a mbe of evosly kow saemes o ma lea eeseaos fo mbalace of fcos havg secfed foms ad may be aled o secy oofs fo ohe seam ches agas coelao aacks. Alcao of hs mehod o SNOW. ad Smok ches shows ha ay of he cosdeed coelao aacks o hem ove he feld of he ode 56 has a aveage me comley o less ha ad esecvely ad eqes o less ha ad esecvely keyseam symbols. Key wods: symmec cyogahy seam che coelao aack sysem of osed lea eqaos dscee Foe asfom oof of secy SNOW. Smok. Iodco he seam che SNOW. [] was oosed as a aleave of a evos weake veso SNOW. A he mome hs che s sadadzed [] ad s oe of he fases sofwae oeed seam ches. he mos owefl of he kow aacks o SNOW. ae coelao aacks he essece of whch s o comle ad o solve sysems of osed lea eqaos acla sysems of eqaos ove he felds of ode lage ha [3 7]. Dese cea ogess hs deco hee ae some solved oblems elaed o develome of mehods fo secy evalao ad secy oof of SNOW.-lke

2 seam ches agas coelao aacks. A he mome hee ae o mehods ha wold allow ovg secy of he meoed ches agas kow coelao aacks decly sg aamees of he comoes. Besdes a aem o eed he kow mehods fo secy evalao of SNOW. agas coelao aacks fo some ohe seam ches e.g. Smok ha was oosed as a caddae fo a aoal sadad of seam ecyo [8] ecoeed dffcles elaed o he scale of oblems o be esolved o oba he bods. Ulke SNOW. ha s bl ove 3 64 he feld of he ode he Smok che s bl ove he feld of he ode ha esls mossbly of accal alcao of cea algohms [4 5 7] comley of whch ceases fom o b oeaos. I hs ae we ese mehods allowg accal evalao ad ovg secy of SNOW.-lke seam ches agas a wde class of coelao aacks. I Seco we addce he defo of SNOW.-lke seam ches ad of a mbe of elaed coces. Noe ha Seco cosdes ches of a moe geeal fom ha hose oosed [9]. I acla we defe bay ches ha dffe fom evosly defed modla ches [9] by elaceme he addo modlo owes of wh coodae-wse XOR oeao of bay vecos. Bay ches may be egaded as smlfed vesos of he esecve modla ches ha clde SNOW. ad Smok howeve he eseach s of deede ees. I acla as show Seco 3 hee es qe accal bay SNOW.-lke ches ha ae oved o be sece agas kow coelao aacks. I Seco based o [7] we descbe a class of aacks cosdeed he followg secos. Ulke [7] we se fo desco of hese aacks o ahe of he sysems of osed eqaos solvg of whch eses he essece of he meoed aacks he ace fco fom a fe feld o s sb-feld. ha eables obag a desco ha s moe sefl fo fhe aalyss acla o se a aalycal eesso fo he aamee ha deemes he effcecy of a coelao aack ems of Foe coeffces of ose dsbo he gh-had sdes of he eleva sysem of eqaos. he ma esl of Seco s heoem allowg o edce he oblem of obag lowe bods fo he me comley of a coelao aack fom he secfed class ad also fo he sze of he keyseam eeded fo s sccessfl mlemeao o cosco e bods fo he mamm modles of Foe coeffces of ose dsbo he gh-had sdes of eqaos a sysem o deedg o a secfc aack. We also sdy he elao bewee effcecy of aacks ove felds of ode whee ad oday bay aacks ha ae bl ove he feld of wo elemes. We show ha he aso fom bay coelao aacks o aacks ove felds of ode may cease effcecy of he fome o moe ha mes. I Seco 3 we oba lowe bods of he me ad daa comlees eeded fo sccessfl mlemeao of coelao aacks o oday bay SNOW.- lke seam ches. Eessos fo obaed bods deed o aamees ha ae adoally sed fo secy evalao of block ches agas lea cyaalyss:

3 he mamal elemes of lea aomaos ables of s-boes ad he bach mbe of he lea asfom sed he ecyo algohm. Alcao of hese bods o bay vesos of SNOW. ad Smok ches shows ha ay coelao aack fom he secfed class o hem ove he feld of he ode has aveage me comley o less ha ad esecvely ad eqes o less ha ad esecvely keyseam symbols. Resls eeso of Seco 3 fo modla SNOW.-lke ches ecoeed dffcles assocaed wh alcao sch ches he addo of bay eges modlo owe of wo. Mehods develoed o ovecome hese dffcles [4 5 7] eqe calclao of obably dsbos of ose he gh-had sdes of sysems of eqaos sed coelao aacks ad aea o be alcable whe 64 he ode of he feld ove whch he che s defed s o moe e.g. fo Smok. Besdes hese mehods ae focsed o he cosco of secfc aacks ad o o oof of secy of SNOW.-lke ches so he se fo he ose of oof of secy eve he case of SNOW. che leads o a lage amo of comaos. o ovecome hese dawbacks we oose Seco 4 a aomaa-heoec aoach o cosco e bods fo mbalace of dscee fcos beg ealzed by seqeces of fe aomaa. he soce of hs aoach s he ae [] whee a ma eeseao s obaed fo he emages mbe of he o seqece of a fe aomao; howeve he case dscssed below we deal o wh he dsbo of he mbe of emages b wh Foe coeffces of hs dsbo. he ma esls of Seco 4 ae heoems 5 6 ad 7 he fs of whch geealzes a sees of seaae esls o ma o lea eeseaos of he mbalace of mas ha ae mlemeed by aomaa of secal foms [4 ] ad he secod ad he hd ovde e bods of mbalace ha ca be sed acla fo oof he secy of oday modla SNOW.-lke ches agas coelao aacks. I Seco 5 by meas of heoem 7 we oba lowe bods fo he me comley ad he sze of he keyseam eeded fo sccessfl mlemeao coelao aacks o oday modla SNOW.-lke ches. Eessos fo he obaed bods deed o cea aamees of s-boes ha may be cosdeed as modfed elemes of he lea aomaos ables ad also o he bach mbe of he lea asfom sed he ecyo algohm. Alcao of he obaed bods o SNOW. ad Smok leads o he esls ha cocde wh he esls obaed fo he bay vesos: ay coelao aack o he meoed ches fom he secfed class of aacks ove he feld of he ode 56 has a aveage me comley o less ha ad esecvely ad eqes o less ha ad esecvely keyseam symbols. 3

4 Noe ha cea esls of hs ae acla hose Secos ad 4 ae alcable o oly o SNOW.-lke ches ad ca be sed o solve ohe oblems of he coelao cyaalyss of symmec ecyo schemes. SNOW.-lke seam ches Fo ay aal le s deoe by V he se of bay vecos of he legh. Le s slae o hs se he sce of he feld of he ode ageed wh he oeao of he coodae-wse Boolea addo of bay vecos. Le s defy he elemes of he se V wh -b eges assmg ha he mbe coesods o he veco... V ad le s deoe by he addo oeao of hese mbes modlo. By defo he al daa fo cosco of he keyseam geeao of a SNOW.-lke seam che ae he followg objecs Fge : a mve olyomal g z z c z... c ove he feld F ; a emao : V V ; a aal mbe ; a commave go oeao o he se V. he keyseam geeao s a fe aoomos aomao wh he se of saes V V he e sae fco ad he o fco F h... v... v f... v v whee... v V c... c. So he keyseam symbol a he me s deemed by he al sae... v of he geeao by meas of he ece elaos v v v vald fo all... Sag fom Seco 3 we cosde oly SNOW.-lke seam ches ha sasfy he codo { }. A che s called bay f ad modla f 4

5 whee. A SNOW.-lke che s called oday f hee es ege mbes sch ha a bass of he feld F ove he feld F emaos : F F ad a evesble -ma D ove he feld s F sch ha f elemes z ad z of he feld F ae defed wh he vecos of he coodaes he bass he followg eqaly holds: z s z... s z D z... z z F. 3 Usally he emaos che de cosdeao. s : F F ae called s-boes of he Fge. Scheme of he keyseam geeao fo a SNOW.-lke seam che Eamle. SNOW. [] s a oday modla che wh he aamees Hee 6 5 ad he s-boes s ad he ma D ae defed he same way as he od asfom of Rjdael []. Eamle. he seam che Smok [8] s a oday modla SNOW.- lke che wh he aamees Hee 6 3 ad he s-boes s ad he ma D ae defed he same way as fo Kalya block che [3 4]. 5

6 Coelao aacks o SNOW.-lke seam ches. Cosco of sysems of osed lea eqaos fo coelao aacks. Paccally all kow coelao aacks o SNOW. [3 7] ae based o he feae ha he sm of keyseam symbols ay sccessve mes s a esl of a symbol dsoo a lea ecg seqece ove he feld by whch oe ca decly ecove he al sae of he LFSR Fge. Fo a abay SNOW.- lke seam che we oba fom : F whee... 4 v v... 5 Assmg ha v 5 ae deede adom vaables wh fom dsbo o he se V ad eseg he symbols of he lea ecg seqece hogh he al sae of he LFSR Fge we oba he sysem 4 of osed lea eqaos ove he feld F whee dsoos.e. he osy symbols ae adom vaables 5. Le s descbe a mehod fo cosco of coseqeces fo sysem 4 ha ae sed fhe coelao aacks o SNOW.-lke seam ches. Le s we he fs N eqaos of he sysem 4 he fom b A a N 6 whee b A a of he legh ove he feld a... F ad A s a kow ow veco s he age solo of he sysem 4.e. he kow colm veco eqal o he al sae of he LFSR Fge. Le s f a abay osve dvso of he mbe ad le s deoe by z z z z he ace of he eleme z F he feld F whee. Le s ecall see e.g. [5] Defo.3 ha he bases { b... b } ad ˆ {ˆ b... bˆ } of he feld F ove he sb-feld F ae called dal f ˆ b b whe j ˆ b b f ohewse. I follows fom hs j j 6

7 defo ha he ace of he odc of abay elemes fom he feld cocdes wh he do odc of vecos of he coodaes ay dal bases. o cosc a coseqece of he sysem 6 le s f a eleme c \{} ad a a of dal bases ad ˆ of he feld F ove he sb-feld F F F. Obseve ha he eqales cb A ca c N follow fom eqales 6 ad ca s he do odc ove A ha ca be eceved by sbso of each coodae of he veco F of he vecos A ad a A esecvely of he veco ca wh s eeseao he bass esecvely he bass ˆ. Whece he veco a F cocdes wh he age solo of he followg sysem of he osed lea eqaos: A b Aa N 7 whee b cb c fo each N. hs o ecove he veco a fom he sysem of eqaos 4 s sffce o cosc fo he evosly chose ad c he sysem of eqaos 7 ove he feld ad o ecove s age solo a by oe of he kow mehods. Kowg he F veco a ad he bass ˆ s easy o fd he veco ca ad hs also he eqed veco a. Noe ha all kow coelao aacks o SNOW. ae based o solvg he sysems of osed eqaos havg he meoed fom howeve who elc lzao of he ace fco o coseqeces of sch sysems ha ae lea combaos of he seaae eqaos. I acla he aes [3 4 6] coa cosdeao of Boolea sysems of osed lea eqaos ha ae obaed fom 4 by cea lea asfoms ove he feld F ad he ae [7] coas 8 cosdeao of smla sysems of eqaos ove he feld of he ode 8. Besdes [5] ooses o se dec he sysem 4 ove he feld F 3 fo cosco a dsgshg aack o SNOW... A algohm fo solvg he obaed sysems of osed lea eqaos. A he mome hee ae a lo of fas sb-eoeal algohms fo solvg sysems of osed lea eqaos ove he feld of wo elemes see e.g. [7 6 8]. Some of hem allow aal geealzaos fo sysems ove fe felds o eve ove abay fe gs [9]. Sbseqely we wll assme ha whe cayg o a coelao aack o a SNOW.-lke che he algohm oosed [7] wll be sed o solve he sysem of eqaos 7. 7

8 he meoed algohm deeds o aamees k ha s a owe of wo ad l l whee l ad cosss of wo sages. A he fs sage Wage s k -ee algohm [] s sed o eclde he las l l kows fom he sysem 7. As a esl we oba a ew osed sysem of eqaos wh l kows ove he feld each eqao of whch s he sm of cea k eqaos of he sysem. A he secod sage he obaed sysem s solved by he mamm lkelhood mehod wh alcao of he fas Hadamad o Walsh asfom. hs he meoed algohm allows o ecove he fs l kows of he sysem of eqaos 7. Alyg l l mes o vaos ses of kows ha do o esec we ca fd he eqed veco a. Obseve ha he dsbo of dsoos he gh-had sdes of eqaos 7 has he followg fom: F F P { z} P{ } z F 8 : c z whee he adom vaable s defed by 5 N. Besdes he dsoo he gh-had sde of each eqao he sysem ha s obaed as a esl of he fs sage of he algohm s he sm of k deede adom vaables dsbed by 8. So he dsbo of dsoos he gh-had sdes of eqaos he sysem obaed afe he fs sage has he followg fom: z P { } z F. 9 c k k z Noe also ha hese dsoos ae deede adom vaables; howeve [7] he hesc assmo abo he deedece s sed mlcly. Based o hs assmo oe ca show [9 ] ha o ecove he age solo of he sysem 7 wh he eo obably o moe ha a he secod sage of he algohm s ecessay o have o less ha mc k l c k l h l eqaos whee h log log c k c k z zf. he followg hesc fomla s sed [7] o evalae he mbe of eqaos ecessay fo sccessfl solvg he sysem of eqaos a he secod sage of he algohm: 8

9 m c c k l k l l. Accodg o [7] he aveage me comley of he algohm ovded a deede e adom choce of he ows A N s eqal o c k l mc k l k ll l l c m k l l ad he sze of he keyseam eeded fo he sccessfl mlemeao of he algohm s eqal o N ll k l k l l c k Nc 3 whee log k ad m c k l has he fom. I s clea ha o move he effcecy of he algohm he aamees k ad l shold by chose fom he codo of he mmm vale..3 Eesso of he aamee ha chaacezes effcecy of coelao aacks o SNOW.-lke seam ches. Below he em coelao aack meas oe of he aacks descbed Secos... Le s ecall ha each sch aack s deemed by a dvso of he mbe ad by a o-zeo eleme c of he feld F ad cosss cosco of he sysem 7 ad s fhe solvg wh he algohm fom [7] ha deeds o he aamees k ha s a owe of wo ad l l whee l. he aveage me comley of he aack s deemed by he fomla ad he daa comley of he aack by he fomla 3. Boh fomlas coa he eesso of he aamee ha o he bass of 9 has he followg fom: c k c k { k z} zf P 4 whee c ad he adom vaables ae defed by 5 k. hs o evalae he effcecy of coelao aacks o SNOW.-lke seam ches o fo he oof of secy of hese ches agas he meoed aacks s ecessay o be able o calclae o o evalae vales of he aamee 4 decly by he che comoes. Le s oba a eesso of hs aamee ems of Foe coeffces fo he obably dsbos of adom vaables 5. 9

10 Le s ecall ha he Foe asfom of a abay dsbo z : z F m o he feld m s defed by he fomla F whee m ˆ z F m zf m m m z s he absole ace of F m. I follows fom he Paseval s dey see e.g. [] ha m zf m m F \{} m z ˆ. 5 Fhe accodg o he Covolo heoem [] he Foe asfom fo he dsbo of he sm of deede adom vaables s eqal o he odc of he Foe asfoms of he smmads dsbos. Whece o he bass of 4 5 wh m z P { z} z F we oba he eqaly k whee c c zf k 6 c F \{} k z P { z} F 7 s he Foe asfom of he obably dsbo of he adom vaable c. Le s ove ha whee ˆ c F 8 c F ˆ P { } F 9 s he Foe asfom of he obably dsbo of adom vaables 5. Ideed sg 7 he codo F ad asvy of he ace fco see e.g. [5] heoem.6 we oba ha

11 c zf z P { c z} P{ zf F : c z } z F c c } F P { } P{ F c P { } ˆ c. hs he eqaly 8 s e ad whece o he bass of 6 we oba he followg heoem. heoem. he aamee 4 sasfes he eqaly c k ˆ c F \{} whee he vale ˆ c s defed by 9 wh c. he obaed heoem allows s o evalae he effcecy of coelao aacks o SNOW.-lke seam ches decly by he Foe coeffces of he obably dsbo of adom vaables 5 ad foms he bass fo he esls se foh he followg Secos..4 Effcecy comaso of coelao aacks ove felds of vaos odes. heoem allows o ge a aswe o he qeso of how mch moe effce ems of he aveage me comley ad daa comley may be coelao aacks ove felds of he ode whee comaso wh adoal bay aacks o SNOW.-lke seam ches. he followg heoem holds. s heoem. Le whee N c \{} k whee s N l ad l l. Le s deoe by ˆ k F a o-zeo eleme of he feld ma F \{} F sch ha ˆ whee ˆ s deemed by 9. he fo he aamees ad 3 he followg eqales hold:

12 N c l k l k c l hs ay coelao aack ove he feld k l N k 3 F fom he class of aacks beg cosdeed s o moe ha mes moe effce boh wh esec o he me ad he daa comley comaso wh he bes coelao aack ove he feld F. Poof. O he bass of heoem ad fomla he followg elao holds: k ˆ c ˆ k. c F \{} Usg we oba ha k k c k l c k l l k l c k l l l k l l k ll l ll l l k l l l. Fhe g l l ad sg eqales l we oba he followg elaos: k c l k l l k l k l l l l l k l. So he eqaly s. he eqaly 3 may be oved smlaly. heoem s oved. Eamle 3. I [7] a coelao aack ove he feld F 8 o SNOW. s sggesed ha has he aveage me comley 64.5 eqes aomaely 63.59

13 keyseam symbols ad s sgfcaly fase ha he evosly kow bay.38 aack whch me comley s [6]. Alog wh ha o he bass of heoem hee ess a bay coelao aack o SNOW. ha has he aveage me comley o moe ha ad eqes o moe ha keyseam symbols ad he aamees of hs aack he veco ad he mbes k ad l ca be deemed decly by he aamees of he aack ove he feld F 8 see fomlas. he ovded eamle shows ha he ga ems of me comley of he aack fom [7] comaed o he aack descbed [6] s acheved o so mch by alcao of he feld of lage ode F 8 sead of F b o a lage ee as a esl of a sccessfl choce of he sysem of osed lea eqaos fo he aack ad also of alcao of a moe effce algohm fo solvg hs sysem. I geeal accodg o heoem aso fom bay coelao aacks o aacks ove felds of he ode ca cease he effcecy of he fome o moe ha mes. 3 Secy evalao fo bay SNOW.-lke ches agas coelao aacks Le s cosde a bay SNOW.-lke che ha s obaed by elaceme he oeao he scheme Fge by he oeao. I hs case he adom vaable 5 has he fom whee s a adom veco wh he fom dsbo o he se V... Le s eceve a codo ha gaaees he secy of hs che agas coelao aacks we o o ha he em coelao aack meas solely oe of he aacks descbed Secos... By defo fom [3] he emao : V V s called a ohomohsm f he ma V s also a emao. A well-kow eamle of a ohomohsm s he ma mlemeed by a -od Fesel ewok: Vm whee m ad s a emao o he se V m see e.g. [3]. Decly fom he addced defo we oba he followg esl. heoem 3. Le he scheme Fge ad s a ohomohsm. he he dsoos 5 he gh-had sde of he sysem of eqao 4 ae fomly dsbed o he se V ; so he esecve SNOW.-lke che s sece agas descbed above coelao aacks. 3

14 Now we ge a aalycal eesso ad a e bod of he aamee 4 fo a abay oday bay che see defo Seco. Le s assme ha whee N ad hee es a bass of he feld F ove he sb-feld F emaos s j : F F j ad a evesble -ma D ove he feld F sch ha wh defcao he elemes z ad z of he feld F wh he ses of he coodaes he bass he eqaly 3 s sasfed. Le s deoe by ˆ he bass dal o he bass. Smlaly o he above we wll defy a abay eleme z F wh he veco z... of s coodaes z he bass ad deoe hs veco wh he same symbol z z... z. he symbol z zˆ... zˆ wll deoe he veco of coodaes of he eleme z F ˆ he bassˆ. I wha follows we wll om he asoso symbol fomlas lke Dz sosg as sal ha he veco z s a colm f s we o he gh of a ma D. Fo ay... z z z F le s deoe s z { j : z } w z s z. Le s ecall see e.g. [4] ha he bach mbe of he ma by he fomla B D j F D s defed m{ w z w zd : z \{} 4 ad he elemes of he lea aomaos able of he s-bo s j by he fomlas [5] ls j a j b j jf ja j s j j b j a b F j. 5 j j Noe ha 5 he eesso a s b ca be elaced by he Boolea do odc j j j j j j j j a s b f we defy he elemes s wh he vecos of he coodaes some bass of he feld wh he vecos of he coodaes he esecve dal bass. j j j j j F ad he elemes a b j j 4

15 Le s ove a heoem ha gves a eesso ad a e bod of aamee 4 fo a oday bay SNOW.-lke che ems of aamees 4 5. heoem 4. We have l 6 c k ma B D k whee l ma{ l a b : a b F \{} j } ma s j j j j j. Besdes f s a dvso of he k k c k l s cˆ cˆ l ˆ ˆ s c c 7 F \{} whee c cˆ... cˆ s he veco of coodaes of he eleme c F he bass ˆ whee ˆ c... c ˆ ˆ cˆ D. Poof. Le s show ha aamee 9 sasfes he followg eqaly: ˆ l s ˆ ˆ ls ˆ ˆ 8 ˆ ˆ... ˆ ˆ... ˆ D. Ideed de o asvy of he ace fco ad daly of he bases ad ˆ fo ay F he followg eqales ae e: whee feld ˆ ˆ s he do odc of he vecos... ad ˆ... ˆ ove he F. So fom 9 ad he eqales... we oba ha ˆ F P { } ˆ Usg fomla 3 we ge: ˆ F F : F ˆ. 5

16 ˆ... F ˆ s... s D ˆ... F ˆ s... s Dˆ... F ˆ s... s ˆ j jf jˆ j s j j ˆ j. akg he sqae of hs eesso we oba 8. Le s ove he eqaly 6. Le be a o-zeo eleme of he feld F sch ha ˆ ma ˆ. I follows fom heoem ha c k k ˆ F \{} ad fom 5 8 we coclde ha ˆ f hee ess a leas oe j sch ha ˆ j ˆ j o ˆ j ˆ j. hs de codo ˆ he followg eqaly holds: s ˆ s D ˆ. Hece o he bass of 8 ad 4 we have c w ˆ k k l w ˆ B D ma So he eqaly 6 s oved. Now assme ha s a dvso of. Sbsg he eesso he ghhad sde of 8 o o he bass of he elao F F we oba he eqaly 7. hs comleeess he oof of heoem. he obaed heoem alog wh elaos 3 ovdes secy evalao of oday bay SNOW.-lke seam ches agas coelao aacks by aamees 4 ad 5 of he comoes. Noe ha hese aamees ae adoally sed fo secy evalao of block ches agas lea cyaalyss. Ulzao sead of he aamee of s e bod 6 c k 3 eables o oba lowe bods of he aveage me comley ad he 6

17 sze of he keyseam eeded fo ay of he above-meoed coelao aacks ove he feld of he ode see Algohm Fge. I also follows fom heoem 4 ha o cosc coelao aacks ove he feld o oday bay SNOW.-lke ches s ossble o se oly sch F elemes c \{} ha sasfy he codo F s cˆ s cd ˆ. 9 I a accally moa case B D whe D s a MDS ma; see e.g. B D [6] accodg o heoem 4 [7] fo each l hee es eacly l l j j l j l j of he meoed elemes c sch ha w cˆ l. Eamle 4. Le s cosde a bay veso of SNOW. ha dffes fom he ogal [] by sg of he oeao sead of 3 he scheme Fge. he aamees of hs che have he followg vales: he emao has he fom 3 whee he s-boes s j : F F j ad he ma D ae defed he same way as he od asfom of Rjdael see Eamle. I acla s kow ha l ma 6 B D 5 []. Usg Algohm we oba lowe bods of he aamees ha deeme he effcecy of coelao aacks ove he feld F F56 o he bay veso of SNOW. able. able : Resls obaed by Algohm fo he bay veso of SNOW. k l * log k l* log N k l* he obaed esls mea ha ay of he cosdeed above coelao aacks ove he feld of he ode 56 o he bay veso of he che has a aveage me comley o less ha ad eqes o less ha keyseam symbols. 7

18 Noe ha he bes of he kow coelao aacks o SNOW. eqes aod keyseam symbols ad has a aveage me comley [7]. Fhe cease of he vale of k Algohm leads o a cease of vales of he aamees k l* N k l*. I: ege mbes ; Algohm s-boes : F F j ; s j a evesble -ma D ove he feld F. a mbe k ha s a owe of wo; a dvso of he mbe. Pocessg:. Calclae k l ma B D k sg fomlas P l log k. 3. Fo each l... l calclae m k k l l k l m k k ll l l m k l. 4. Choose l * l sch ha k l* m{ k l : l l }. O: he mbe l * of -b wods of he al sae of LFSR ha ae ecoveed by he aack; he aveage me comley of he aack k l* ; he daa comley N ll* k l* k l * l k eeded fo sccessfl mlemeao of he aack. Fge. he algohm fo secy evalao of oday bay SNOW.-lke ches agas coelao aacks ove he feld of he ode 8

19 Eamle 5. Accodg o [8] he che Smok ses he followg aamees: he emao has he fom 3 whee he s-boes ad he ma D ae defed he same way as Kalya see Eamle. I acla s 8 kow ha l ma 9 B D 9 [4]. Usg Algohm we oba vales of he aamees ha deeme he effcecy of coelao aacks ove he feld F F56 o he bay veso of Smok able. able : Resls obaed by Algohm fo he bay veso of Smok k l * log k l* log N k l* Fhe cease of he vale of k Algohm esls cease of vales of he aamees k l* N k l* able. So ay of he cosdeed above coelao aacks ove he feld of he ode 56 o he bay veso of Smok has a aveage me comley o less ha ad eqes o less ha keyseam symbols. I geeal he obaed esls show ha he bay vesos of SNOW. ad Smok ae accal sece agas he cosdeed coelao aacks de he codo ha he keyseam legh fo ay fed a of key ad alzao veco 8 s lmed by e.g.. 4 Ue bods fo mbalace of dscee fcos ealzed by seqeces of fe aomaa Le U X be fe ses N se he fcos H : U X U ad F h H : U X U f : U X V.... Fo ay y y... y : U X V g F 3 whee he elemes... y y... ae calclaed sg ecece elaos h y f... If h h f f fo each... he F... s he o seqece geeaed accodace o he al sae ad he seqece... of he aomao X U V h f wh he alhabe X he se of 9

20 saes U ad he o alhabe V ad H... s he sae of hs aomao a me. By defo a fco F : X V s ealzed by a seqece of aomaa X U V h f f hee ess a eleme U sch ha F... F... fo each... X. Le... be a seqece of bay vecos V... Fo ay N le s deoe... ad se he fco F ha akes each o... o he Boolea do odc of he vecos... F ad. he mbalace of hs fco a a fed vale of U s deemed as follows: l F X... X ay Le s oba a ma eeseao ad e bods of he aamee 3. Fo U le s deoe l F X... X : H... Le s emeae abay ode he elemes of he se U g U... } whee M U ad ake M M -maces A wh elemes { M A f U 33 X X : h whee f deoes he Boolea do odc of he meoed bay vecos of he legh... heoem 5. Fo ay N he followg eqaly holds: l A A A U ; 34 ohe wods he aamee 3 cocdes wh he -h eleme of he odc of maces 33 ove all. Besdes he aamee 3 sasfes he followg eqaly:

21 e A A A l 35 whee... e.... Poof. Fomla 34 ca be oved by meas of dco by. Fo follows decly fom he above defos. Fo s sffce o check he coecess of sch eqaly: A l l U U. 36 Ideed o he bass of 3 33 ad he defos of he fcos F H he followg eqales hold: A l U h X f H X F U X :... : X F X H h X H f... :... H X X H f F X... : : l X H X F. So he eqaly 36 s oved. Fally he coecess of 35 follows fom 34 ad he eqaly l l U. hs heoem s comleely oved.

22 Noe ha heoem 5 geealzes a mbe of seaae esls o ma o lea eeseaos fo he aamees of he fom 3 fo fcos ealzed by fe aomaa of secal fom [4 ]. hs heoem allows s o oba e bods of he aamee 3 ha ca be sed acla fo secy oofs of oday modla SNOW.-lke ches agas coelao aacks. Le s odce some addoal oao. Fo ay veco... wh eal coodaes le s deoe ma{ : }. Le s se a sal way he s-om of a eal -ma A g A s{ A : } whee semm s ake ove all eal vecos... sch ha. I s o dffcl o check ha A ma{ A A... A } 37 whee A A... A ae ows of he ma A. Besdes fo ay eal -maces A ad B he followg eqaly holds: AB B. 38 A heoem 6. he aamee 3 sasfes he followg eqaly whee l A A A A 39 A f ma U X U X : h f ma. U X X A Besdes he followg eqaly holds: ma { l } ma ma A. 4 Poof. he eqaly 39 follows decly fom ad 38.

23 Le s ove he eqaly 4. Le s deoe by he lages ege fom o sch ha. As... he o he bass of 33 A A whece fom 35 we have l e A A A. hs l A A A A. heoem s oved. As a eamle of alcao of heoems 5 ad 6 le s cosde abay les of emaos s s... s ad vecos whee s : V V V ad oba a e bod of he aamee l s 4 yv y s y whee... y y... y y s y... s y ad y deoes he sm modlo y V s of bay eges coesod o vecos y heeafe ay veco... V s defed wh he ege whose leas sgfca b cocdes wh he lefmos coodae of he veco. Fo ay a bv le s defe a -ma A wh he elemes A y a b yv : msb y a b a a s y b {} 4 whee msb y s he mos sgfca.e. he -h b of he sm of eges coesods o he meoed bay vecos of he legh ad of hese mbes modlo. heoem 7. he aamee 4 sasfes he followg eqaly: y s he sm l s A A A 43 Besdes he followg eqaly holds: 3

24 whee l s s s s 44 s A ma{ A A A A }. 45 Poof. O he bass of heoems 5 ad 6 s sffce o check ha he fco F y y s y y V fom he se V V o self s ealzed by a seqece of fe aomaa X U V h f whee X V U {} ad he fcos h f ae defed as follows: h y msb y U y X f y y s y U y X. Ideed le s deoe z z... z y ad se h y z y. Usg dco by s o dffcl o check ha z z fo each. Whece he fco F cocdes wh 3 fo he meoed fcos h f fed vale ad. hs heoem s oved. 5 Alcao of he aomaa-heoec aoach o secy evalao of oday modla SNOW.-lke ches agas coelao aacks Le s cosde a oday modla SNOW.-lke che ha s obaed by elaceme of he oeao he scheme Fge wh he oeao of addo of bay eges modlo ad he emao s defed by 3. Fom 3 he secy of hs che agas coelao aacks ove he feld of he ode whee dvdes deeds o he aamee 4. he followg heoem ses a e bod of hs aamee. heoem 8. Fo ay oday modla SNOW.-lke che he aamee 4 sasfes he followg eqaly: 4

25 whee c k ma B D k 46 ma ma{ s : V V \{ } } s s defed by 45 ad B D s defed by 4. Poof. I follows fom heoem ha c k ma F \{} ˆ k 47 whee ˆ s he Foe asfom of he dsbo of 5: F ˆ P { } F \{}. Accodg o 5 he adom vaable s he sm of wo deede adom vaables: ad v v whee v ae deede adom vaables wh he fom dsbo o he se V. So o he bass of he Covolo heoem he Foe asfom of he dsbo ae odcs of Foe asfoms of he dsbos ad.e. ˆ ˆ whee ˆ z z ˆ P { } zf Whece we have z z { } zf ˆ P. 5

26 y y zf yf z ˆ z ˆ P{ }. Fhe sg he fomla 3 ad he a of he dal bases ˆ of he feld F ove he sb-feld F ha whee he elemes he same way as he oof of heoem 4 we oba y y y ˆ s y ˆ 48 y ad s y s y... s y of he feld defed wh he vecos of he coodaes he bass ˆ... ˆ s he veco of coodaes of he bass ˆ he do odc of he vecos ove he feld ˆ D ˆ F ˆ ae ad he symbol. deoes F. Fally he eesso he ghhad sde of he eqaly 48 cocdes wh he Boolea do odc y ˆ s y ˆ f we defy he coodaes of he vecos y ad s y ove he feld F wh he vecos of he coodaes a cea bass of hs feld ove he sb-feld F ad he coodaes of he vecos ˆ ad ˆ wh he vecos of he coodaes he esecve dal bass. hs he followg eqaly s e: y ˆ s yˆ ˆ 49 yf whee... F ˆ ˆ ˆ ˆ D ˆ ad y ˆ he Boolea do odcs of he meoed bay vecos. I follows fom he obaed eqaly ad fom heoem 7 ha ˆ ˆ ˆ ˆ ˆ ˆ ˆ ad s y ˆ deoes s s s ma whee l { : ˆ ˆ }. Fhe sg he eqaly ˆ D ˆ ad fomla 4 we oba l 6

27 ha B D w ˆ wˆ l l l. So fo ay F \{} he followg eqaly holds: ˆ ma whece sg 47 we oba 46. heoem s oved. hs heoem alog wh he eqales 3 ovdes secy evalao of oday modla SNOW.-lke seam ches agas coelao aacks decly by he aamees of he comoes see fomlas 4 4 ad 45. Ulzao sead of he aamee of s e bod 46 3 B D c k eables o oba lowe bods of he aveage me comley ad he sze of he keyseam eeded fo ay of he above-meoed coelao aacks ove he feld of he ode see Algohm Fge 3. Noe ha fo calclao of he aamee ma a Se of Algohm s ossble o se Algohm 3 see Fge 4 coecess of whch follows decly fom Alcao of he fas Hadamad asfom see e.g. [8]. 7 a Se of Algohm 3 allows o edce he me comley of calclao of he vale ma 3 o O oeaos sead of O oeaos sed val algohm based o 4. Eamle 6. We ge lowe bods of aamees ha deeme he effcecy of coelao aacks ove he feld F F 56 o SNOW.. Le s ecall see Eamle ha he aamees of hs che have he followg vales: he emao has he fom 3 whee he emaos s : F F ad he ma D ae defed he same way as fo he od asfom of Rjdae; acla B D 5. Usg Algohm 4 we oba ha. So ma lma whee he vale of l ma s gve Eamle 4. Whece he esls obaed by meas of Algohm fo he bay veso of he che see able cocde wh he esecve esls obaed by meas of Algohm fo he ogal SNOW.. hs accodg o able ay of he cosdeed above coelao aacks ove he feld of he ode 56 o SNOW. has he aveage me comley o less ha ad eqes o less ha keyseam symbols. Eamle 7. Le s cosde he che Smok Eamle whee he followg aamees ae sed: he emao has he fom 3 whee he s-boes ad he ma D ae defed he same way as fo Kalya block che. I acla Smok fo vaos emaos ae sed: 3 each of hem s sed wce; ad B D 9. ma 3 6 able 3 gves vales of he aamee ma 3 ad also of he vecos a b a whch he mamm he eesso of hs aamee s eached see Se 4 7

28 of Algohm 3. I accodace o able 3 ma 3 lma whee he vale of l ma was gve Eamle 5. So he esls obaed by meas of Algohm fo he bay veso of Smok see able cocde wh he esecve esls obaed by meas of Algohm fo he ogal ecyo algohm. 4 I: ege mbes ; Algohm s-boes : F F j ; s j a evesble -ma D ove he feld F. a mbe k ha s a owe of wo; a dvso of he mbe. Pocessg: B D k ma sg 4 4 ad 45.. Calclae k. Se l log k. 3. Fo each l... l calclae m k k l l k l m k k ll l l m k l. 4. Choose l * l sch ha k l* m{ k l : l l }. O: he mbe l * of -b wods of he al sae of LFSR ha ae ecoveed by he aack; he aveage me comley of he aack k l* ; he daa comley N ll* k l* k l * l k eeded fo sccessfl mlemeao of he aack. Fge 3. he algohm fo secy evalao of oday modla SNOW.-lke ches agas coelao aacks ove he feld of he ode 8

29 Algohm 3 I: s-boes s : V V. Pocessg: Fo each make he followg calclaos.. Fo each se a V {} calclae vales of he fco f a. Calclae he vales V : msb s s z z a a z z V. zb a b fa z b V zv A by fas Hadamad asfom. 3. Fo of each a a b V V \{ } calclae s ma{ A A A A }. a b 4. Calclae a b a b a b a b O: ma s a b ma{ s : a b V V \{ }} ma ma { ma s } Fge 4. Fas algohm fo calclao of he aamee ma able 3: Resls obaed by Algohm 4 fo he s-boes of Smok Pemaos ma sed Kalya 4 3 = = 6 = 44 = 5 5 = = = 9 = 9

30 hs ay of he cosdeed above coelao aacks ove he feld of he ode o Smok has he aveage me comley o less ha ad eqes o less ha keyseam symbols. I geeal he obaed esls show ha he ches SNOW. ad Smok ae accal sece agas he cosdeed coelao aacks o he codo ha he keyseam legh fo ay fed a of key ad alzao veco s lmed by e.g. 8. Smmay. he ae ooses mehods fo secy evalao fo SNOW.-lke seam ches agas coelao aacks cosced smlaly o he kow aacks o SNOW. [3 7]. Each sch aack s defed by a dvso of degee of he feld ove whch he LFSR Fge 3. s se ad by a o-zeo eleme c of hs feld ad cosss cosco of he sysem of eqaos 7 ad s fhe solvg by he algohm fom [7] ha deeds o he aamees k ha s a owes of wo ad l l whee l. he aveage me comley of a aack s deemed by fomla ad he sze of he keyseam eeded fo sccessfl mlemeao of he aack s deemed by fomla 3.. heoem edces he oblem of obag lowe bods fo he me comley of ay coelao aack fom he secfed class ad also fo he sze of he keyseam eeded fo sccessfl mlemeao of he aack o cosco of e bods fo he mamm modles of Foe coeffces of he ose dsbo he gh-had sdes of eqaos he sysem 4 o deedg o a secfc aack. hs he effcecy of coelao aacks o a SNOW.-lke seam che ca be evalaed decly fom Foe coeffces of he dsbo of adom vaable Ay coelao aack ove he feld F fom he class of aacks beg cosdeed s o moe ha mes effce boh wh esec o me ad he daa comley comaed o he bes coelao aack ove he feld F. So a aso fom bay coelao aacks o aacks ove felds of ode may cease effcecy of he fome o moe ha mes. 4. heoem 4 ovdes secy evalao of oday bay SNOW.-lke seam ches agas coelao aacks ove he feld of he ode decly by he aamees 4 ad 5 of he comoes. Ulzao sead of he aamee of s e bod 7 fomlas 3 eables o oba lowe c k bods of he aveage me comley ad he sze of he keyseam eeded fo sccessfl mlemeao of ay of he above-meoed coelao aacks. 5. Alcao of heoem 4 o bay vesos of SNOW. ad Smok shows ha ay coelao aack o hem fom he secfed class ove he feld of he 3

31 ode 56 has he aveage me comley o less ha ad esecvely ad eqes o less ha ad esecvely keyseam symbols ha shows accal secy of he meoed bay ches agas kow coelao aacks o codo ha he keyseam legh fo ay fed a of key 8 ad alzao veco s lmed by e.g.. 6. heoem 5 ovdes a ma eeseao ad e bods of mbalace fo a abay dscee fco ealzed by a seqece of fe aomaa ad geealze a mbe of evosly kow saemes o ma lea eeseaos fo he mbalace of mas ha ae ealzed by fe aomaa of he secal fom [4 ]. heoems 6 ad 7 gve e bods of mbalace ha may be sed acla fo he oof of secy of oday modla SNOW.-lke ches agas coelao aacks. 7. heoem 8 ses lowe bods of he me comley ad he sze of he keyseam eeded fo sccessfl mlemeao coelao aacks o oday modla SNOW.-lke ches. Alcao of he obaed bods o SNOW. ad Smok gves esls ha cocde wh he esls obaed fo he bay vesos: ay coelao aack o he meoed ches fom he secfed class of aacks ove he feld of he ode 56 has he aveage me comley o less ha ad esecvely ad eqes o less ha ad esecvely keyseam symbols. ha shows he accal secy of SNOW. ad Smok agas kow coelao aacks o codo ha he keyseam legh fo 8 ay a of key ad alzao veco s lmed by e.g.. Refeeces. P. Ekdahl ad. Johasso "A ew veso of he seam che SNOW" Seleced Aeas Cyogahy SAC LNCS Sge- Velag.. ISO/IEC 833-4: E. Ifomao echology Secy echqes Ecyo algohm Pa 4: Seam ches D. Waaabe A. Bykov ad C. de Caèe "A dsgshg aack of SNOW. wh lea maskg mehod" Seleced Aeas Cyogahy SAC 3 LNCS Sge-Velag K. Nybeg ad J. Wallé "Imoved lea dsgshes fo SNOW." Fas Sofwae Ecyo FSE 6 LNCS Sge-Velag A. Mamov ad h. Johasso "Fas comao fo lage dsbo ad ad s cyogahc alcao" Advaced Cyology ASIACRYP 5 LNCS Sge-Velag J.-K. Lee D.H. Lee ad S. Pak "Cyaalyss of SOSEMANUC ad SNOW. sg lea masks" Advaced Cyology ASIACRYP 8 LNCS Sge-Velag 8. 3

32 7. B. Zhag C. X ad W. Mee "Fas coelao aacks ove eeso felds lage- lea aomao ad cyaalyss of SNOW." Cyology ep Achve Reo 6/3 h://e.ac.og/6/3. 8. I. Gobeko A. Kzesov Y. Gobeko A. Alekseychk ad V. mcheko "Smok Keyseam Geeao" he 9 h IEEE Ieaoal Cofeece o Deedable Sysems Sevces ad echologes DESSER Kyv Ukae 4 7 May A.N. Alekseychk "Sffce codo fo SNOW-.-lke seam ches o be sece agas some elaed key aacks" Ukaa Ifomao Secy Reseach Joal 8 No [ Ukaa].. A.E. Zhkov ad V.P. Chsyakov "Ma aoach o he sdy of he mbe of emages of he o seqece of a fe aomao" Revew of aled ad dsal mahemacs Isse [ Rssa].. J. Wallé "Lea aomao of addo modlo " Fas Sofwae Ecyo FSE 3 LNCS Sge-Velag 3.. J. Daeme ad D. Rjme "AES oosal: Rjdael" h://csc.s.gov/eco/aes/jdael/ Rjdael.df. 3. R.V. Olyykov I.D. Gobeko O.V. Kazymyov e al. "A New Ecyo Sadad of Ukae: he Kalya Block Che" Cyology ep Achve Reo 5/65 h://e.ac.og/5/ A.N. Alekseychk L.V. Kovalchk A.S. Shevsov ad S.V. Yakovlev "Cyogahc Poees of a New Naoal Ecyo Sadad of Ukae" Cybeecs ad Sysems Aalyss 5 Isse R. Ldl ad H. Nedeee "Fe Felds" Cambdge U.K. Cambdge Uvesy Pess A. Blm A. Kala ad H. Wassema "Nose-olea leag he ay oblem ad he sascal qey model" J. ACM 5 No А.N. Аlekseychk "Sb-eoeal algohms fo solvg sysems of lea Boolea eqaos wh osed gh-had sde" Aled Rado Elecocs: Sc. Jo No [ Ukaa]. 8. S. Bogos F. ame ad S. Vadeay "O solvg LPN sg BKW ad vaas. Imlemeao ad aalyss" Cyology ep Achve Reo 5/49 h://e.ac.og/5/ A.N. Alekseychk S.M. Igaeko ad M.V. Poemsky "Sysems of lea eqaos coed by ose ove abay fe gs" Mahemacal ad come modellg. Sees: echcal sceces: scefc joal Isse [ Ukaa].. D. Wage "A geealzed bhday oblem" Advaces Cyology CRYPO Poceedgs LNCS Sge-Velag.. A.N. Alekseychk ad M.V. Poemsky "Love bods fo he daa comley of coelao aacks o seam ches ove felds of ode " Ukaa Ifomao Secy Reseach Joal 9 No [ Ukaa]. 3

33 . C. Cale "Boolea fcos fo cyogahy ad eo coecg codes" I "Boolea Mehods ad Models" Ed. by P. Hamme ad Y. Cama Cambdge U.K. Cambdge Uvesy Pess S. Vadeay "O he La-Massey scheme" Advaced Cyology ASIACRYP 999 LNCS Sge-Velag J. Daeme "Che ad hash fco desg saeges based o lea ad dffeeal cyaalyss" KU Leve Docoal Dsseao F. Chabad ad S. Vadeay "Lks bewee dffeeal ad lea cyaalyss" Advaces Cyology EUROCRYP 94 Poceedgs LNCS Sge-Velag F.J. MacWllams ad N.J.A. Sloae "he heoy of eo coecg codes" Amsedam New Yok Noh-Hollad Pblshg Comay M.M. Glhov "O mg lea asfoms fo block ches" Mahemacal Asecs of Cyogahy No [ Rssa]. 8. O.A. Logachev A.A. Salkov ad V.V. Yashcheko "Boolea Fcos Codg heoy ad Cyogahy" Ameca Mahemacal Soc