MATH 509 Differential Cryptanalysis on DES

Transcription

1 MATH 509 on DES Department of Mathematics, Boise State University Spring 2012 MATH 509 on DES

2 MATH 509 on DES

3 Feistel Round Function for DES MATH 509 on DES

4 1977: DES is approved as a standard. 1 1 Designers: H Feistel, W Tuchman, D Coppersmith, A Konheim, E Grossman, B Notz, L Smith and B Tuckerman from IBM MATH 509 on DES

5 1977: DES is approved as a standard : Biham and Shamir reported the differential cryptanalysis. 1 Designers: H Feistel, W Tuchman, D Coppersmith, A Konheim, E Grossman, B Notz, L Smith and B Tuckerman from IBM MATH 509 on DES

6 1977: DES is approved as a standard : Biham and Shamir reported the differential cryptanalysis. 1994: The first linear cryptanalysis of DES is performed by Matsui. 1 Designers: H Feistel, W Tuchman, D Coppersmith, A Konheim, E Grossman, B Notz, L Smith and B Tuckerman from IBM MATH 509 on DES

7 1977: DES is approved as a standard : Biham and Shamir reported the differential cryptanalysis. 1994: The first linear cryptanalysis of DES is performed by Matsui. 1999: DES was reaffirmed for the fourth time with the use of Triple DES. 1 Designers: H Feistel, W Tuchman, D Coppersmith, A Konheim, E Grossman, B Notz, L Smith and B Tuckerman from IBM MATH 509 on DES

8 1977: DES is approved as a standard : Biham and Shamir reported the differential cryptanalysis. 1994: The first linear cryptanalysis of DES is performed by Matsui. 1999: DES was reaffirmed for the fourth time with the use of Triple DES. 2002: The Advanced Encryption Standard (AES) become a standard. 1 Designers: H Feistel, W Tuchman, D Coppersmith, A Konheim, E Grossman, B Notz, L Smith and B Tuckerman from IBM MATH 509 on DES

9 2 2 Eli Biham and Adi Shamir, of the Data Encryption Standard, (1993) MATH 509 on DES

10 3 3 Eli Biham and Adi Shamir, of the Data Encryption Standard, (1993) MATH 509 on DES

11 S-Box Design Criteria 1 bit input difference produces 2 bits output difference. Minimize the difference between the numbers of 1 s and 0 s when any input bit remains the same. 2 input difference bits mapped to 3 by the expansion function. S(X ) S(X 11 00)... MATH 509 on DES

12 4 4 Eli Biham and Adi Shamir, of the Data Encryption Standard, (1993) MATH 509 on DES

13 4 Don was wrong!... Ali Biham 4 Eli Biham and Adi Shamir, of the Data Encryption Standard, (1993) MATH 509 on DES

14 on 3-round B-DES IN CLASS NOTES MATH 509 on DES

15 on 4-round B-DES Suppose we have an access to a 4-round B-DES device. We know all the inner workings of the encryption algorithm, its standards, S-boxes, but we don t know the key. MATH 509 on DES

16 on 4-round B-DES Suppose we have an access to a 4-round B-DES device. We know all the inner workings of the encryption algorithm, its standards, S-boxes, but we don t know the key. Using the analysis for 3-rounds and the knowledge that certain plaintext differences occurs with a higher probability than other differences, we can discover the key. MATH 509 on DES

17 on 4-round B-DES Suppose we have an access to a 4-round B-DES device. We know all the inner workings of the encryption algorithm, its standards, S-boxes, but we don t know the key. Using the analysis for 3-rounds and the knowledge that certain plaintext differences occurs with a higher probability than other differences, we can discover the key. Note that there are 16 2 input pairs (L, L ) in the S-boxes. There are 16 input pairs (L, L ) with fixed XOR. MATH 509 on DES

18 on 4-round B-DES The following is known about the difference distribution for the box S 1 in B-DES: MATH 509 on DES

19 on 4-round B-DES The following is known about the difference distribution for the box S 1 in B-DES: There are 12 input pairs (a, a ) such that MATH 509 on DES

20 on 4-round B-DES The following is known about the difference distribution for the box S 1 in B-DES: There are 12 input pairs (a, a ) such that a a = 0011 and S 1 (a) S 1 (a ) = 011 The following is known about the difference distribution for the box S 2 in B-DES: MATH 509 on DES

21 on 4-round B-DES The following is known about the difference distribution for the box S 1 in B-DES: There are 12 input pairs (a, a ) such that a a = 0011 and S 1 (a) S 1 (a ) = 011 The following is known about the difference distribution for the box S 2 in B-DES: There are 8 input pairs (a, a ) such that MATH 509 on DES

22 on 4-round B-DES The following is known about the difference distribution for the box S 1 in B-DES: There are 12 input pairs (a, a ) such that a a = 0011 and S 1 (a) S 1 (a ) = 011 The following is known about the difference distribution for the box S 2 in B-DES: There are 8 input pairs (a, a ) such that a a = 1100 and S 2 (a) S 2 (a ) = 010 MATH 509 on DES

23 on 4-round B-DES The following is known about the difference distribution for the box S 1 in B-DES: There are 12 input pairs (a, a ) such that a a = 0011 and S 1 (a) S 1 (a ) = 011 The following is known about the difference distribution for the box S 2 in B-DES: There are 8 input pairs (a, a ) such that a a = 1100 and S 2 (a) S 2 (a ) = 010 Therefore, if the S-boxes are independent we have that MATH 509 on DES

24 on 4-round B-DES The following is known about the difference distribution for the box S 1 in B-DES: There are 12 input pairs (a, a ) such that a a = 0011 and S 1 (a) S 1 (a ) = 011 The following is known about the difference distribution for the box S 2 in B-DES: There are 8 input pairs (a, a ) such that a a = 1100 and S 2 (a) S 2 (a ) = 010 Therefore, if the S-boxes are independent we have that p[s 1 (a) S 1 (a ) = 011, S 2 (a) S 2 (a ) = 010] = Question How can we use this weakness of the S-boxes? MATH 509 on DES

25 Step-by-Step on 4-round B-DES Step 1: Choose plaintext pairs L 0 R 0 and L 0 R 0 difference with an XOR R 0 = R 0 R 0 = and L 0 = L 0 L 0 = MATH 509 on DES

26 Step-by-Step on 4-round B-DES Step 1: Choose plaintext pairs L 0 R 0 and L 0 R 0 difference with an XOR R 0 = R 0 R 0 = and L 0 = L 0 L 0 = Step 2: Using the expansion function in B-DES compute E( R 0 ) = MATH 509 on DES

27 Step-by-Step on 4-round B-DES Step 1: Choose plaintext pairs L 0 R 0 and L 0 R 0 difference with an XOR R 0 = R 0 R 0 = and L 0 = L 0 L 0 = Step 2: Using the expansion function in B-DES compute E( R 0 ) = The input XOR for S 1 is R 1 0 R 0 1 = 0011 MATH 509 on DES

28 Step-by-Step on 4-round B-DES Step 1: Choose plaintext pairs L 0 R 0 and L 0 R 0 difference with an XOR R 0 = R 0 R 0 = and L 0 = L 0 L 0 = Step 2: Using the expansion function in B-DES compute E( R 0 ) = The input XOR for S 1 is and the input XOR for S 2 is R 1 0 R 0 1 = 0011 R 2 0 R 0 2 = 0011 MATH 509 on DES

29 Step-by-Step on 4-round B-DES Note that in that case we have that R 1 = R 1 R 1 = MATH 509 on DES

30 Step-by-Step on 4-round B-DES Note that in that case we have that R 1 = R 1 R 1 = L 0 f (R 0, K 1 ) L 0 f (R 0, K 1 ) = MATH 509 on DES

31 Step-by-Step on 4-round B-DES Note that in that case we have that R 1 = R 1 R 1 = L 0 f (R 0, K 1 ) L 0 f (R 0, K 1 ) = L 0 S 1 (R 0 ) S 1 (R 0 ) = = MATH 509 on DES

32 Step-by-Step on 4-round B-DES Note that in that case we have that R 1 = R 1 R 1 = L 0 f (R 0, K 1 ) L 0 f (R 0, K 1 ) = L 0 S 1 (R 0 ) S 1 (R 0 ) = = i.e. R 1 = R 1. Also, note that the probability p[ L 1 R 1 = L 0 R 0 = ] = 3 8. MATH 509 on DES

33 Step-by-Step on 4-round B-DES Note that in that case we have that R 1 = R 1 R 1 = L 0 f (R 0, K 1 ) L 0 f (R 0, K 1 ) = L 0 S 1 (R 0 ) S 1 (R 0 ) = = i.e. R 1 = R 1. Also, note that the probability p[ L 1 R 1 = L 0 R 0 = ] = 3 8. Step 2: Apply differential cryptanalysis on 3-round B-DES starting with the pair L 1 R 1 and L 1 R 1 where R 1 = R 1 and L 1 = MATH 509 on DES