observations on the simon block cipher family

Transcription

1 observations on the simon block cipher family Stefan Kölbl 1 Gregor Leander 2 Tyge Tiessen 1 August 17, DTU Compute, Technical University of Denmark, Denmark 2 Horst Görtz Institute for IT Security, Ruhr-Universität Bochum, Germany

2 lightweight cryptography

3 Lightweight Cryptography What is Lightweight Cryptography? Design primitives for resource-constraint environments like RFID tags. Lot of attention over the last few years. NIST started to investigate the possibility to standardize primitives. Design Criteria Chip-area Latency Code-size... 2

4 SIMON Simon is a family of block ciphers designed by NSA. Published in 2013 on the eprint archive. Lightweight design for hardware. block size key sizes , , , , 192, 256 3

5 SIMON Feistel Network Simple round function Between 32 and 72 rounds S 8 S 1 S 2 K i 4

6 SIMON Cryptanalysis of Simon No (public) cryptanalysis or security arguments from the designers. Many contributions by the cryptographic community. Attacks cover up to 74% of the rounds. 5

7 properties of simon

8 Differential and Linear Any cipher should have reasonable security margin against differential and linear cryptanalysis. For SPN designs easier to show bounds. Difficult for ARX, Simon. Best attacks on Simon are based on differential and linear cryptanalysis. 7

9 Differential Cryptanalysis Differential Cryptanalysis: Observe how difference propagate through the round function. Find correlations between input and output difference. x α = x x x f f y β = y y y 8

10 Differential Cryptanalysis We are interested in: Probability for one round: x α x Pr(α f β) Differential characteristics: Pr(α f β f γ) f f Differentials: Pr(α f x f γ) y β y x 9

11 Differential Cryptanalysis We are interested in: x α x Probability for one round: Pr(α f β) f f Differential characteristics: Pr(α f β f γ) y β y Differentials: Pr(α f x f γ) f f x z γ z 9

12 Differential Cryptanalysis We are interested in: x α x Probability for one round: Pr(α f β) f f Differential characteristics: Pr(α f β f γ) Differentials: Pr(α f x f γ) f f x z γ z 9

13 Differential and Linear For the analysis we use an equivalent representation for Simon S 8 S 1 S 2 K i 10

14 Differential and Linear For the analysis we use an equivalent representation for Simon S 1 K i 10

15 Differential and Linear We look at a message m = (m n 1,..., m 1, m 0 ) and an input difference d = (d n 1,..., d 1, d 0 ). The output difference f(m) f(m d) is then given by: 0, if d i = 0 and d i 1 = 0 D i (m, d) = 11

16 Differential and Linear We look at a message m = (m n 1,..., m 1, m 0 ) and an input difference d = (d n 1,..., d 1, d 0 ). The output difference f(m) f(m d) is then given by: 0, if d i = 0 and d i 1 = 0 m i, if d i = 0 and d i 1 = 1 D i (m, d) = 11

17 Differential and Linear We look at a message m = (m n 1,..., m 1, m 0 ) and an input difference d = (d n 1,..., d 1, d 0 ). The output difference f(m) f(m d) is then given by: 0, if d i = 0 and d i 1 = 0 m i, if d i = 0 and d i 1 = 1 D i (m, d) = m i 1, if d i = 1 and d i 1 = 0 11

18 Differential and Linear We look at a message m = (m n 1,..., m 1, m 0 ) and an input difference d = (d n 1,..., d 1, d 0 ). The output difference f(m) f(m d) is then given by: 0, if d i = 0 and d i 1 = 0 m i, if d i = 0 and d i 1 = 1 D i (m, d) = m i 1, if d i = 1 and d i 1 = 0 m i m i 1, if d i = 1 and d i 1 = 1. (1) 11

19 Differential and Linear Let us now look at a first example. Let n = 6, and d = We then calculate D(m, d) using the above bitwise definition of D: i d S 1 (d) (2) D(m, d) 12

20 Differential and Linear Let us now look at a first example. Let n = 6, and d = We then calculate D(m, d) using the above bitwise definition of D: i d S 1 (d) (2) D(m, d) 0 12

21 Differential and Linear Let us now look at a first example. Let n = 6, and d = We then calculate D(m, d) using the above bitwise definition of D: i d S 1 (d) (2) D(m, d) m

22 Differential and Linear Let us now look at a first example. Let n = 6, and d = We then calculate D(m, d) using the above bitwise definition of D: i d S 1 (d) (2) D(m, d) m 2 m

23 Differential and Linear Let us now look at a first example. Let n = 6, and d = We then calculate D(m, d) using the above bitwise definition of D: i d S 1 (d) (2) D(m, d) m 2 m 2 m

24 Differential and Linear Let us now look at a first example. Let n = 6, and d = We then calculate D(m, d) using the above bitwise definition of D: i d S 1 (d) (2) D(m, d) m 4 m 2 m 2 m

25 Differential and Linear Let us now look at a first example. Let n = 6, and d = We then calculate D(m, d) using the above bitwise definition of D: i d S 1 (d) (2) D(m, d) 0 m 4 m 2 m 2 m 0 0 Resulting difference only depends on m 0, m 2, m 4. Therefore we have 8 possible output differences. 12

26 Differential and Linear Can compute the differential probability with simple bit operations. The bits which can be non-zero at the output: varibits = α S 1 (α) (3) The bits which have to be equal to their right neighbour: doublebits = α S 1 (α) S 2 (α) (4) 13

27 Differential and Linear For our previous example: varibits = doublebits = Possible output differences:

28 Differential and Linear For our previous example: varibits = doublebits = Possible output differences:

29 Differential and Linear For our previous example: varibits = doublebits = Possible output differences:

30 Differential and Linear A valid differential (α β) has to satisfy: There can only be a difference at β i, if varibits i is equal to 1. If doublebits i is 1, then β i = β i 1. The probability is then given by: Pr(α β) = 2 wt(varibits doublebits) (5) 17

31 Differential and Linear A valid differential (α β) has to satisfy: There can only be a difference at β i, if varibits i is equal to 1. If doublebits i is 1, then β i = β i 1. The probability is then given by: Pr(α β) = 2 wt(varibits doublebits) (5) 17

32 Differential and Linear Apply affine transformation for Simon round function. Proofs in the paper. Similar approach for linear cryptanalysis. 18

33 finding optimal differential and linear characteristics

34 Optimal Characteristics We are interested in differential and linear characteristics with high probability. We use an approach based on SAT/SMT solvers, similar to results on Salsa20 [MP13] or NORX [AJN15]. Gives upper bounds on the probability. Estimate probability of the differentials. Open Source

35 Optimal Characteristics x i y i S 8 S 1 S 2 z i Constraints: Use our previous observations on varibits and doublebits. Probability for one round is w i = wt(varibits doublebits). x i+1 y i+1 21

36 Lower Bounds Use this to find characteristic with probability 2 w : Add constraints for each round. Check if w = r 1 w i. i=0 Increase w if no solution was found. We ran experiments for Simon32, Simon48 and Simon64. 22

37 Lower Bounds 2 50 Probability of best characteristic Simon Number of Rounds 23

38 Lower Bounds 2 50 Probability of best characteristic Simon32 Simon Number of Rounds 23

39 Lower Bounds 2 50 Probability of best characteristic Simon32 Simon48 Simon Number of Rounds 23

40 Differentials What about differentials? Often assumed that probability of the best characteristics can be used to estimate probability of the best differential. Only inaccurate estimate for Simon. We estimate the probability of a differential Add constraints for each round. Set (x 0, y 0 ) = in and (x r, y r ) = out. Find all solutions for increasing values of w. 24

41 Differentials We can determine the interval for the characteristics contributing to a differential [w min, w max ]. Covering the whole interval is computationally expensive. Gives better estimate than previous results. Cipher Rounds w min w max log 2 (p) Simon (91) Simon (68) Simon (89)

42 Differentials 2 20 #Characteristics Probability of one characteristic 26

43 Differentials Differential Probability Probability Probability of one characteristic 27

44 Differentials Differential Probability Probability Measured DP Probability of one characteristic 27

45 Differentials Differential Probability Seconds Probability Measured DP Probability of one characteristic 27

46 Differentials Differential Probability Seconds 3 Hours Probability Measured DP Probability of one characteristic 27

47 Differentials Differential Probability Seconds 3 Hours 1 Month Probability Measured DP Probability of one characteristic 27

48 rotation constants

49 Rotation Constants Possible Criteria: Simplicity Implementation costs Security? Are there parameters which are better with regard to some metrics? 29

50 Rotation Constants Basic test for diffusion: Block size Standard parameters Best possible Rank 2nd 2nd 2nd 3rd 4th 30

51 Rotation Constants Bounds for differential and linear characteristics give us some interesting candidates: The bounds are as good as the original parameters or slightly better. Simon[12, 5, 3] offers best diffusion. Simon[7, 0, 2] offers best diffusion, when b = 0. Simon[1, 0, 2] has bad diffusion, but good bounds. 31

52 Rotation Constants Bounds for differential and linear characteristics give us some interesting candidates: The bounds are as good as the original parameters or slightly better. Simon[12, 5, 3] offers best diffusion. Simon[7, 0, 2] offers best diffusion, when b = 0. Simon[1, 0, 2] has bad diffusion, but good bounds. What effect do the rotations constants have on differentials? 31

53 Rotation Constants Number of Characteristics Simon32[8, 1, 2] Probability of one characteristic 32

54 Rotation Constants Number of Characteristics Simon32[8, 1, 2] Simon32[7, 0, 2] Probability of one characteristic 32

55 Rotation Constants Number of Characteristics Simon32[8, 1, 2] Simon32[7, 0, 2] Simon32[1, 0, 2] Probability of one characteristic 32

56 Rotation Constants Number of Characteristics Simon32[8, 1, 2] Simon32[7, 0, 2] Simon32[1, 0, 2] Simon32[12, 5, 3] Probability of one characteristic 32

57 Conclusion Contributions: Constant time algorithm for differential probability. Bounds on the probability of differential/linear characteristics. Compared quality of rotation constants. Open Problems: More refined analysis of the parameter space. Find efficient method to determine differential effect for different constants. 33

58 questions? 34

59 References I Jean-Philippe Aumasson, Philipp Jovanovic, and Samuel Neves, Analysis of NORX: investigating differential and rotational properties, Progress in Cryptology - LATINCRYPT 2014 (Diego F. Aranha and Alfred Menezes, eds.), Lecture Notes in Computer Science, vol. 8895, Springer, 2015, pp Farzaneh Abed, Eik List, Stefan Lucks, and Jakob Wenzel, Differential cryptanalysis of round-reduced SIMON and SPECK, Fast Software Encryption, FSE 2014 (Carlos Cid and Christian Rechberger, eds.), Lecture Notes in Computer Science, vol. 8540, Springer, 2015, pp

60 References II Alex Biryukov, Arnab Roy, and Vesselin Velichkov, Differential analysis of block ciphers SIMON and SPECK, Fast Software Encryption, FSE 2014 (Carlos Cid and Christian Rechberger, eds.), Lecture Notes in Computer Science, vol. 8540, Springer, 2015, pp Ray Beaulieu, Douglas Shors, Jason Smith, Stefan Treatman-Clark, Bryan Weeks, and Louis Wingers, The SIMON and SPECK families of lightweight block ciphers, Cryptology eprint Archive, Report 2013/404, 2013, Nicky Mouha and Bart Preneel, Towards finding optimal differential characteristics for ARX: Application to Salsa20, Cryptology eprint Archive, Report 2013/328, 2013, 36