Links Between Theoretical and Effective Differential Probabilities: Experiments on PRESENT
|
|
- Cori Harrell
- 6 years ago
- Views:
Transcription
1 Links Between Theoretical and Effective Differential Probabilities: Experiments on PRESENT Céline Blondeau, Benoît Gérard SECRET-Project-Team, INRIA, France TOOLS for Cryptanalysis - 23th June 2010 C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 1 / 24
2 Outline 1 Introduction 2 Differential Trails 3 Differential 4 Success Probability C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 2 / 24
3 Outline 1 Introduction 2 Differential Trails 3 Differential 4 Success Probability C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 3 / 24
4 Notation We consider iterative block ciphers (especially PRESENT) operating on m-bit messages; using a master key K; with round function F using subkeys K i ; Y def = Enc K (X) def = F Kr F Kr 1 F K1 (X). We focus on the particular case of key alternating ciphers. C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 4 / 24
5 Differential A r-round differential of a cipher is a couple (δ 0, δ r ) F m 2 F m 2. The probability of a r-round differential is p def = Pr X,K [Enc K (X) Enc K (X δ 0 ) = δ r ]. If p > 2 m, then we can distinguish F r K from a random permutation. Statistical Cryptanalysis. C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 5 / 24
6 PRESENT A 64-bit block cipher presented in [Bogdanov et al., CHES 2007]. 80-bit or 128-bit key schedule. Substitution Permutation Network (SPN). A single 4-bit Sbox. S15 S14 S13 S12 S11 S10 S9 S8 S7 S6 S5 S4 S3 S2 S1 S0 C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 6 / 24
7 SMALLPRESENT-[s] Proposed by Leander in s is the number of Sboxes thus SMALLPRESENT-[s] is a 4s-bit cipher. The permutation is similar to the one of PRESENT. 80-bit key schedule. All of the experiments but one are done on SMALLPRESENT-[4]. One round of SMALLPRESENT-[4]. S3 S2 S1 S0 C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 7 / 24
8 Key schedules We introduced 2 other key schedules: a 16-bit key schedule (all subkeys are equal). a 20-bit key schedule (similar to the 80-bit one): Master key: K = k 19 k 18...k 0. Round keys: K i = k 19 k 18...k 4. Updated as follows: 1 [k 19k k 1k 0] = [k 6k 5... k 8k 7]; 2 [k 19k 18k 17k 16] = S[k 19k 18k 17k 16]; 3 [k 7k 6k 5k 4k 3] = [k 7k 6k 5k 4k 3] roundcounter. In this presentation, shown results are obtained using this last one. C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 8 / 24
9 Outline 1 Introduction 2 Differential Trails 3 Differential 4 Success Probability C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 9 / 24
10 Differential trails A differential trail of a cipher is a (r + 1)-tuple (β 0, β 1,, β r ) (F m 2 )r+1 of intermediate differences. The probability p β of a differential trail β = (β 0, β 1,, β r ) is: p β def = Pr X,K [ i F i K (X) F i K (X β 0) = β i ]. If the cipher is Markov and the round subkeys are independent, then, p t β def = r Pr X [F(X) F(X β i 1 ) = β i ]. i=1 C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 10 / 24
11 Key dependency (1/3) For a differential trail β: T K def = 1 2 # { X F i K (X) F i K (X β 0) = β i, 1 i r }, p β = 2 (m 1) E(T K ). S3 S2 S1 S0 S3 S2 S1 S0 S3 S2 S1 S0 T K # p β = 10 2 (16 1). p t β = 8 2 (16 1) C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 11 / 24
12 Key dependency (2/3) p t β = 2 17 p t β = 2 20 p t β = 2 23 p t β = log 2 (p β ) log 2 (p t β) C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 12 / 24
13 Key dependency (3/3) p t β = 2 17 p t β = 2 20 p t β = 2 23 p t β = log 2 (3/4) log 2 (p β ) log 2 (pβ) t log 2 (5/4) C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 13 / 24
14 Outline 1 Introduction 2 Differential Trails 3 Differential 4 Success Probability C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 14 / 24
15 Differential probability 0 log 2 ( p t β ) log 2(p ) The probability p of a r-round differential (δ 0, δ r ) is p = p β. β=(δ 0,β 1,...,β r 1,δ r) log 2 (number of trails) Algorithm used: adaptation of [Biryukov et al., CRYPTO 2004]. C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 15 / 24
16 Remarks on [Wang, AFRICACRYPT 2008] Attack: 14-round differentials with probability (lower bounded by) Obtained by iterating 3 times a 4-round differential trail. Remarks: 2 62 is the best probability for a 14-round differential trail. Considering the best trails of the difference (pβ t 2 73 ). -57 p t = log 2 ( p t β ) log 2 (number of trails) C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 16 / 24
17 Key dependency [Daemen, Rijmen 2005] In the Sampling Model for key-alternating ciphers, variable D K follows a binomial distribution. D K def = 1 2 #{X F r K (X) F r K (X δ 0) = δ r } Plots for 5-round differentials of SMALLPRESENT-[4] C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 17 / 24
18 Outline 1 Introduction 2 Differential Trails 3 Differential 4 Success Probability C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 18 / 24
19 Success Probability (1/2) p def = Pr X,K [Enc K (X) Enc K (X δ 0 ) = δ r ]. The function P S (p) is the success probability of an attack with a fixed-key differential probability p. The new formula for the Success Probability that takes into account the sampling model is: P success [ ( )] def DK = E DK P S 2 m 1 2 m 1 ( ) [ i = P S (p ) i (1 p ) 2m 1 i i=0 2 m 1 ( 2 m 1 i )].(1) C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 19 / 24
20 Success Probability (2/2) Experimental P S ( ) (1) Differential attack, SMALLPRESENT-[8], 11 rounds, 2 32 keys, 2 9 keys tried, 100 experiments log 2 (N) C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 20 / 24
21 Success Probability: choice of P S (1/2) [Selçuk, Journal of Cryptology 2007] P S Φ 1 (1 l n ) φ 0 (t) dt. [Blondeau, Gérard and Tillich, to appear in DCC] P S N i=f 1 (1 l 1 n 2) In the case of differential cryptanalysis, P[X 0 = i]. THE SECOND ONE IS TIGHTER!!! C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 21 / 24
22 Success Probability: choice of P S (2/2) PS Experimental [BGT10] [BGT10]+(1) log 2 (N) C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 22 / 24
23 Success Probability: choice of P S (2/2) PS Experimental [BGT10] [BGT10]+(1) [Sel07]+(1) log 2 (N) C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 22 / 24
24 Recommendations Use more than one trail when estimating a differential probability. For Wang s differential : p β : 10s. p β : 2m. p β : 1h. p β : 16h. Use the success probability formula given in this talk together with the one in [BGT10] PS Experimental [BGT10] [BGT10]+(1) [Sel07]+(1) log 2 (N) C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 23 / 24
25 Conclusion and further work For most of the trails p t β seems to be a good estimate for p β. Although p t β can be different from p β, it seems that p t β p. The Sampling Model seems to be well suited at least in the case of SMALLPRESENT-[4] and SMALLPRESENT-[8]. This leads to a new formula for the success probability of a differential attack. Results are obtained on SMALLPRESENT-[4] Trying to run experiments on SMALLPRESENT-[8] to extrapolate on the full PRESENT. Running experiments on other SPNs or Feistel networks. C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 24 / 24
26 Explanation on the 3-round trail S3 S2 S1 S0 S3 S2 S1 S0 S3 S2 S1 S0 0x1 0x3 implies red bits to 0. 0x3 0x6 implies green bit to 1. Two green key bits correspond to the same master key bit. Key bits Probability of 1 1/2 1/2 1/2 1 Key bits Probability of 1 1 1/2 1 0 C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 25 / 24
27 Finding differential trails Finding trails with probability > 10/2 6. 0x1 0x2 0x3 0x2 0x3 0x1 0x4 0x2 0x3 0x1 0x4 0x2 0x3 0x1 0x3 C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 26 / 24
28 Finding differential trails Finding trails with probability > 10/2 6. 0x1 1/2 2 3/2 2 2/2 4 2/2 4 3/2 4 9/2 4 4/2 6 4/2 6 2/2 6 6/2 6 1/2 6 9/2 6 18/2 6 18/2 6 C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 26 / 24
29 Finding differential trails Finding trails with probability > 10/2 6. 0x1 1/2 2 3/2 2 2/2 4 2/2 4 3/2 4 9/2 4 4/2 6 4/2 6 2/2 6 6/2 6 1/2 6 9/2 6 18/2 6 18/2 6 C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 26 / 24
30 Finding differential trails Finding trails with probability > 10/2 6. 0x1 1/2 2 3/2 2 2/2 4 2/2 4 3/2 4 9/2 4 4/2 6 4/2 6 2/2 6 6/2 6 1/2 6 9/2 6 18/2 6 18/2 6 C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 26 / 24
31 Finding differential trails Finding trails with probability > 10/2 6. 0x1 1/2 2 3/2 2 2/2 4 2/2 4 3/2 4 9/2 4 4/2 6 4/2 6 2/2 6 6/2 6 1/2 6 9/2 6 18/2 6 18/2 6 C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 26 / 24
32 Finding differential trails Finding trails with probability > 10/2 6. 0x1 1/2 2 3/2 2 2/2 4 2/2 4 3/2 4 9/2 4 4/2 6 4/2 6 2/2 6 6/2 6 1/2 6 9/2 6 18/2 6 18/2 6 C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 26 / 24
33 Finding differential trails Finding trails with probability > 10/2 6. 0x1 1/2 2 3/2 2 2/2 4 2/2 4 3/2 4 9/2 4 4/2 6 4/2 6 2/2 6 6/2 6 1/2 6 9/2 6 18/2 6 18/2 6 C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 26 / 24
34 Finding differential trails Finding trails with probability > 10/2 6. 0x1 1/2 2 3/2 2 2/2 4 2/2 4 3/2 4 9/2 4 4/2 6 4/2 6 2/2 6 6/2 6 1/2 6 9/2 6 18/2 6 18/2 6 C.Blondeau and B.Gérard. Links Between Theoretical and Effective Differential Probabilities 26 / 24
Multiple Differential Cryptanalysis: Theory and Practice
Multiple Differential Cryptanalysis: Theory and Practice Céline Blondeau, Benoît Gérard SECRET-Project-Team, INRIA, France aaa FSE, February 14th, 2011 C.Blondeau and B.Gérard. Multiple differential cryptanalysis
More informationData complexity and success probability of statisticals cryptanalysis
Data complexity and success probability of statisticals cryptanalysis Céline Blondeau SECRET-Project-Team, INRIA, France Joint work with Benoît Gérard and Jean-Pierre Tillich aaa C.Blondeau Data complexity
More informationLinear Cryptanalysis of Long-Key Iterated Cipher with Applications to Permutation-Based Ciphers
Linear Cryptanalysis of Long-Key Iterated Cipher with Applications to Permutation-Based Ciphers Kaisa Nyberg Aalto University School of Science kaisa.nyberg@aalto.fi Luxemburg January 2017 Outline Introduction
More informationData Complexity and Success Probability for Various Cryptanalyses
Data Complexity and Success Probability for Various Cryptanalyses Céline Blondeau, Benoît Gérard and Jean Pierre Tillich INRIA project-team SECRET, France Blondeau, Gérard and Tillich. Data Complexity
More informationand Céline Blondeau October 8, 2012 joint work with Benoît Gérard and Kaisa Nyberg Multiple differential cryptanalysis using LLR and October, 8 1/27
Multiple differential cryptanalysis using LLR and Céline Blondeau joint work with Benoît Gérard and Kaisa Nyberg October 8, 2012 1/27 Outline Introduction Block Ciphers Differential Cryptanalysis Last
More informationCryptanalysis of SP Networks with Partial Non-Linear Layers
Cryptanalysis of SP Networks with Partial Non-Linear Layers Achiya Bar-On 1, Itai Dinur 2, Orr Dunkelman 3, Nathan Keller 1, Virginie Lallemand 4, and Boaz Tsaban 1 1 Bar-Ilan University, Israel 2 École
More informationSimilarities between encryption and decryption: how far can we go?
Similarities between encryption and decryption: how far can we go? Anne Canteaut Inria, France and DTU, Denmark Anne.Canteaut@inria.fr http://www-rocq.inria.fr/secret/anne.canteaut/ SAC 2013 based on a
More informationAlgebraic Techniques in Differential Cryptanalysis
Algebraic Techniques in Differential Cryptanalysis Martin Albrecht and Carlos Cid Information Security Group, Royal Holloway, University of London FSE 2009, Leuven, 24.02.2009 Martin Albrecht and Carlos
More informationCryptanalysis of PRESENT-like ciphers with secret S-boxes
Cryptanalysis of PRESENT-like ciphers with secret S-boxes Julia Borghoff Lars Knudsen Gregor Leander Søren S. Thomsen DTU, Denmark FSE 2011 Cryptanalysis of Maya Julia Borghoff Lars Knudsen Gregor Leander
More informationDivision Property: a New Attack Against Block Ciphers
Division Property: a New Attack Against Block Ciphers Christina Boura (joint on-going work with Anne Canteaut) Séminaire du groupe Algèbre et Géometrie, LMV November 24, 2015 1 / 50 Symmetric-key encryption
More informationLinear Cryptanalysis: Key Schedules and Tweakable Block Ciphers
Linear Cryptanalysis: Key Schedules and Tweakable Block Ciphers Thorsten Kranz, Gregor Leander, Friedrich Wiemer Horst Görtz Institute for IT Security, Ruhr University Bochum Block Cipher Design k KS m
More informationSome attacks against block ciphers
Some attacks against block ciphers hristina Boura École de printemps en codage et cryptographie May 19, 2016 1 / 59 Last-round attacks Outline 1 Last-round attacks 2 Higher-order differential attacks 3
More informationStructural Evaluation of AES and Chosen-Key Distinguisher of 9-round AES-128
Structural Evaluation of AES and Chosen-Key Distinguisher of 9-round AES-128 Pierre-Alain Fouque 1 Jérémy Jean 2 Thomas Peyrin 3 1 Université de Rennes 1, France 2 École Normale Supérieure, France 3 Nanyang
More informationBlock Cipher Cryptanalysis: An Overview
0/52 Block Cipher Cryptanalysis: An Overview Subhabrata Samajder Indian Statistical Institute, Kolkata 17 th May, 2017 0/52 Outline Iterated Block Cipher 1 Iterated Block Cipher 2 S-Boxes 3 A Basic Substitution
More informationLinear Cryptanalysis of Reduced-Round PRESENT
Linear Cryptanalysis of Reduced-Round PRESENT Joo Yeon Cho 1 Helsinki University of Technology, Finland 2 Nokia A/S, Denmark joo.cho@tkk.fi Abstract. PRESENT is a hardware-oriented block cipher suitable
More informationLecture 12: Block ciphers
Lecture 12: Block ciphers Thomas Johansson T. Johansson (Lund University) 1 / 19 Block ciphers A block cipher encrypts a block of plaintext bits x to a block of ciphertext bits y. The transformation is
More informationLinks Between Truncated Differential and Multidimensional Linear Properties of Block Ciphers and Underlying Attack Complexities
Links Between Truncated Differential and Multidimensional Linear Properties of Block Ciphers and Underlying Attack Complexities Céline Blondeau and Kaisa Nyberg Department of Information and Computer Science,
More informationWieringa, Celine; Nyberg, Kaisa Improved Parameter Estimates for Correlation and Capacity Deviates in Linear Cryptanalysis
Powered by TCPDF (www.tcpdf.org) This is an electronic reprint of the original article. This reprint may differ from the original in pagination and typographic detail. Wieringa, Celine; Nyberg, Kaisa Improved
More informationDifferential Attacks: Using Alternative Operations
Differential Attacks: Using Alternative Operations Céline Blondeau 1, Roberto Civino 2, and Massimiliano Sala 2 1 Aalto University, School of Science, Finland celine.blondeau@aalto.fi 2 University of Trento,
More informationOn the Wrong Key Randomisation and Key Equivalence Hypotheses in Matsui s Algorithm 2
On the Wrong Key Randomisation and Key Equivalence Hypotheses in Matsui s Algorithm 2 Andrey Bogdanov 1 and Elmar Tischhauser 2 1 Technical University of Denmark anbog@dtu.dk 2 KU Leuven and iminds, Belgium
More informationOn related-key attacks and KASUMI: the case of A5/3
On related-key attacks and KASUMI: the case of A5/3 Phuong Ha Nguyen 1, M.J.B. Robshaw 2, Huaxiong Wang 1 1 Nanyang Technological University, Singapore 2 Applied Cryptography Group, Orange Labs, France
More informationExperimenting Linear Cryptanalysis
Experimenting Linear Cryptanalysis Baudoin Collard, François-Xavier Standaert UCL Crypto Group, Microelectronics Laboratory, Université catholique de Louvain. Place du Levant 3, B-1348, Louvain-la-Neuve,
More informationZero-Correlation Linear Cryptanalysis with Fast Fourier Transform and Applications to Camellia and CLEFIA
Zero-Correlation Linear Cryptanalysis with Fast Fourier Transform and Applications to Camellia and CLEFIA Andrey Bogdanov, Meiqin Wang Technical University of Denmark, Shandong University, China ESC 2013,
More informationCryptanalysis of a Generalized Unbalanced Feistel Network Structure
Cryptanalysis of a Generalized Unbalanced Feistel Network Structure Ruilin Li, Bing Sun, Chao Li, Longjiang Qu National University of Defense Technology, Changsha, China ACISP 2010, Sydney, Australia 5
More informationProduct Systems, Substitution-Permutation Networks, and Linear and Differential Analysis
Product Systems, Substitution-Permutation Networks, and Linear and Differential Analysis Cryptology, lecture 3 Stinson, Section 2.7 3.4 Tuesday, February 12th, 2008 1 Composition Product 2 Substitution-Permutation
More informationStream ciphers. Pawel Wocjan. Department of Electrical Engineering & Computer Science University of Central Florida
Stream ciphers Pawel Wocjan Department of Electrical Engineering & Computer Science University of Central Florida wocjan@eecs.ucf.edu Definition of block ciphers Block ciphers: crypto work horse n bits
More informationImprobable Differential Cryptanalysis and Undisturbed Bits
Improbable Differential Cryptanalysis and Undisturbed Bits Institute of Applied Mathematics Department of Cryptography Middle East Technical University September 5, 2013 Leuven, Belgium A (Very) Short
More informationTowards Provable Security of Substitution-Permutation Encryption Networks
Towards Provable Security of Substitution-Permutation Encryption Networks Zhi-Guo Chen and Stafford E. Tavares Department of Electrical and Computer Engineering Queen s University at Kingston, Ontario,
More informationImproved Linear (hull) Cryptanalysis of Round-reduced Versions of SIMON
Improved Linear (hull) Cryptanalysis of Round-reduced Versions of SIMON Danping Shi 1,2, Lei Hu 1,2, Siwei Sun 1,2, Ling Song 1,2, Kexin Qiao 1,2, Xiaoshuang Ma 1,2 1 State Key Laboratory of Information
More informationMasterMath Cryptology /2 - Cryptanalysis
MasterMath Cryptology 2015 2/2 Cryptanalysis Wednesday, 8 April, 2015 10:38 9. Differential cryptanalysis (v2) 9.1. Differential cryptanalysis In differential analysis we simultaneously consider two encryptions
More informationOn Distinct Known Plaintext Attacks
Céline Blondeau and Kaisa Nyberg Aalto University Wednesday 15th of April WCC 2015, Paris Outline Linear Attacks Data Complexity of Zero-Correlation Attacks Theory Experiments Improvement of Attacks Multidimensional
More informationLinear Cryptanalysis. Kaisa Nyberg. Department of Computer Science Aalto University School of Science. S3, Sackville, August 11, 2015
Kaisa Nyberg Department of Computer Science Aalto University School of Science s 2 r t S3, Sackville, August 11, 2015 Outline Linear characteristics and correlations Matsui s algorithms Traditional statistical
More informationLinear Hull Attack on Round-Reduced Simeck with Dynamic Key-guessing Techniques
Linear Hull Attack on Round-Reduced Simeck with Dynamic Key-guessing Techniques Lingyue Qin 1, Huaifeng Chen 3, Xiaoyun Wang 2,3 1 Department of Computer Science and Technology, Tsinghua University, Beijing
More informationExperiments on the Multiple Linear Cryptanalysis of Reduced Round Serpent
Experiments on the Multiple Linear Cryptanalysis of Reduced Round Serpent B. Collard, F.-X. Standaert, J.-J. Quisquater UCL Crypto Group Microelectronics Laboratory Catholic University of Louvain - UCL
More informationEnhancing the Signal to Noise Ratio
Enhancing the Signal to Noise Ratio in Differential Cryptanalysis, using Algebra Martin Albrecht, Carlos Cid, Thomas Dullien, Jean-Charles Faugère and Ludovic Perret ESC 2010, Remich, 10.01.2010 Outline
More informationNew Observations on Impossible Differential Cryptanalysis of Reduced-Round Camellia
New Observations on Impossible Differential Cryptanalysis of Reduced-Round Camellia Ya iu 1, eibo i 2,3, Dawu Gu 1, Xiaoyun Wang 2,3,4, Zhiqiang iu 1, Jiazhe Chen 2,3, Wei i 5,6 1 Department of Computer
More informationImproved Multiple Impossible Differential Cryptanalysis of Midori128
Improved Multiple Impossible Differential Cryptanalysis of Midori128 Mohamed Tolba, Ahmed Abdelkhalek, and Amr M. Youssef Concordia Institute for Information Systems Engineering, Concordia University,
More informationIntroduction on Block cipher Yoyo Game Application on AES Conclusion. Yoyo Game with AES. Navid Ghaedi Bardeh. University of Bergen.
Yoyo Game with AES Navid Ghaedi Bardeh University of Bergen May 8, 2018 1 / 33 Outline 1 Introduction on Block cipher 2 Yoyo Game 3 Application on AES 4 Conclusion 2 / 33 Classical Model of Symmetric Cryptography
More informationMultivariate Linear Cryptanalysis: The Past and Future of PRESENT
Multivariate Linear Cryptanalysis: The Past and Future of PRESENT Andrey Bogdanov, Elmar Tischhauser, and Philip S. Vejre Technical University of Denmark, Denmark {anbog,ewti,psve}@dtu.dk June 29, 2016
More informationSubspace Trail Cryptanalysis and its Applications to AES
Subspace Trail Cryptanalysis and its Applications to AES Lorenzo Grassi, Christian Rechberger and Sondre Rønjom March, 2017 1 / 28 Introduction In the case of AES, several alternative representations (algebraic
More informationImpossible Differential-Linear Cryptanalysis of Reduced-Round CLEFIA-128
Impossible Differential-Linear Cryptanalysis of Reduced-Round CLEFIA-8 Zheng Yuan,,, ian Li, Beijing Electronic Science & Technology Institute, Beijing 7, P.R. China zyuan@tsinghua.edu.cn, sharonlee95@6.com
More informationZero-Correlation Linear Cryptanalysis of Reduced-Round LBlock
Zero-Correlation Linear Cryptanalysis of Reduced-Round LBlock Hadi Soleimany and Kaisa Nyberg Department of Information and Computer Science, Aalto University School of Science, Finland WCC 2013 1/53 Outline
More informationDifferential Attack on Five Rounds of the SC2000 Block Cipher
Differential Attack on Five Rounds of the SC2 Block Cipher Jiqiang Lu Department of Mathematics and Computer Science, Eindhoven University of Technology, 56 MB Eindhoven, The Netherlands lvjiqiang@hotmail.com
More informationSieve-in-the-Middle: Improved MITM Attacks (Full Version )
Sieve-in-the-Middle: Improved MITM Attacks (Full Version ) Anne Canteaut 1, María Naya-Plasencia 1, and Bastien Vayssière 2 1 Inria Paris-Rocquencourt, project-team SECRET B.P. 105, 78153 Le Chesnay cedex,
More informationLow Probability Differentials and the Cryptanalysis of Full-Round CLEFIA-128
Low Probability Differentials and the Cryptanalysis of Full-Round CLEFIA-128 Sareh Emami 2, San Ling 1, Ivica Nikolić 1, Josef Pieprzyk 3 and Huaxiong Wang 1 1 Nanyang Technological University, Singapore
More informationType 1.x Generalized Feistel Structures
Noname manuscript No. (will be inserted by the editor) Type 1.x Generalized eistel Structures Shingo Yanagihara Tetsu Iwata Received: date / Accepted: date Abstract We formalize the Type 1.x Generalized
More informationProvable Security Against Differential and Linear Cryptanalysis
Provable Security Against Differential and Linear Cryptanalysis Kaisa Nyberg Department of Information and Computer Science Aalto University Introduction CRADIC Linear Hull SPN and Two Strategies Highly
More informationDD2448 Foundations of Cryptography Lecture 3
DD2448 Foundations of Cryptography Lecture 3 Douglas Wikström KTH Royal Institute of Technology dog@kth.se February 3, 2016 Linear Cryptanalysis of the SPN Basic Idea Linearize Find an expression of the
More informationImproved Differential-Linear Cryptanalysis of 7-round Chaskey with Partitioning
Improved Differential-Linear Cryptanalysis of 7-round Chaskey with Partitioning Gaëtan Leurent Inria, France Abstract. In this work we study the security of Chaskey, a recent lightweight MAC designed by
More informationChapter 1 - Linear cryptanalysis.
Chapter 1 - Linear cryptanalysis. James McLaughlin 1 Introduction. Linear cryptanalysis was first introduced by Mitsuru Matsui in [12]. The cryptanalyst attempts to find a linear equation x 1... x i =
More informationCryptanalysis of the Full DES and the Full 3DES Using a New Linear Property
Cryptanalysis of the ull DES and the ull 3DES Using a New Linear Property Tomer Ashur 1 and Raluca Posteuca 1 imec-cosic, KU Leuven, Leuven, Belgium [tomer.ashur, raluca.posteuca]@esat.kuleuven.be Abstract.
More informationSymmetric Crypto Systems
T H E U N I V E R S I T Y O F B R I T I S H C O L U M B I A Symmetric Crypto Systems EECE 412 Copyright 2004-2008 Konstantin Beznosov 09/16/08 Module Outline Stream ciphers under the hood Block ciphers
More informationAnalysis of cryptographic hash functions
Analysis of cryptographic hash functions Christina Boura SECRET Project-Team, INRIA Paris-Rocquencourt Gemalto, France Ph.D. Defense December 7, 2012 1 / 43 Symmetric key cryptography Alice and Bob share
More information7 Cryptanalysis. 7.1 Structural Attacks CA642: CRYPTOGRAPHY AND NUMBER THEORY 1
CA642: CRYPTOGRAPHY AND NUMBER THEORY 1 7 Cryptanalysis Cryptanalysis Attacks such as exhaustive key-search do not exploit any properties of the encryption algorithm or implementation. Structural attacks
More informationMILP-based Cube Attack on the Reduced-Round WG-5 Lightweight Stream Cipher
MILP-based Cube Attack on the Reduced-Round WG-5 Lightweight Stream Cipher Raghvendra Rohit, Riham AlTawy, & Guang Gong Department of Electrical and Computer Engineering, University of Waterloo Waterloo,
More informationThe Improbable Differential Attack. Cryptanalysis of Reduced Round CLEFIA
: Cryptanalysis of Reduced Round CLEFIA École Polytechnique Fédérale de Lausanne, Switzerland (This work was done at) Institute of Applied Mathematics Middle East Technical University, Ankara, Turkey INDOCRYPT
More informationS-box (Substitution box) is a basic component of symmetric
JOURNAL OF L A TEX CLASS FILES, VOL., NO., AUGUST 1 Characterizations of the Degraded Boolean Function and Cryptanalysis of the SAFER Family Wentan Yi and Shaozhen Chen Abstract This paper investigates
More informationCS 4770: Cryptography. CS 6750: Cryptography and Communication Security. Alina Oprea Associate Professor, CCIS Northeastern University
CS 4770: Cryptography CS 6750: Cryptography and Communication Security Alina Oprea Associate Professor, CCIS Northeastern University February 5 2018 Review Relation between PRF and PRG Construct PRF from
More information3-6 On Multi Rounds Elimination Method for Higher Order Differential Cryptanalysis
3-6 On Multi Rounds Elimination Method for Higher Order Differential Cryptanalysis TANAKA Hidema, TONOMURA Yuji, and KANEKO Toshinobu A multi rounds elimination method for higher order differential cryptanalysis
More informationBuilding Secure Block Ciphers on Generic Attacks Assumptions
Building Secure Block Ciphers on Generic Attacks Assumptions Jacques Patarin and Yannick Seurin University of Versailles and Orange Labs SAC 2008 August 14-15, 2008 the context security of symmetric primitives
More informationDistinguishing Attacks on a Kind of Generalized Unbalanced Feistel Network
Distinguishing Attacks on a Kind of Generalized Unbalanced Feistel Network Ruilin Li, Bing Sun, and Chao Li Department of Mathematics and System Science, Science College, National University of Defense
More informationFFT-Based Key Recovery for the Integral Attack
FFT-Based Key Recovery for the Integral Attack Yosuke Todo NTT Secure Platform Laboratories Abstract. The integral attack is one of the most powerful attack against block ciphers. In this paper, we propose
More informationRevisiting the Wrong-Key-Randomization Hypothesis
Revisiting the Wrong-Key-Randomization Hypothesis Tomer Ashur, Tim Beyne, and Vincent Rijmen ESAT/COSIC, KU Leuven and iminds, Leuven, Belgium [tomer.ashur,vincent.rijmen] @ esat.kuleuven.be [tim.beyne]
More informationDifferential Fault Analysis on DES Middle Rounds
Differential Fault Analysis on DES Middle Rounds Matthieu Rivain Speaker: Christophe Giraud Oberthur Technologies Agenda 1 Introduction Data Encryption Standard DFA on DES Last & Middle Rounds 2 Our Attack
More informationInvariant Subspace Attack Against Midori64 and The Resistance Criteria for S-box Designs
Invariant Subspace Attack Against Midori64 and The Resistance Criteria for S-box Designs Jian Guo 1, Jeremy Jean 2, Ivica Nikolić 1, Kexin Qiao 3, Yu Sasaki 4, and Siang Meng Sim 1 1. Nanyang Technological
More informationSome integral properties of Rijndael, Grøstl-512 and LANE-256
Some integral properties of Rijndael, Grøstl-512 and LANE-256 Marine Minier 1, Raphael C.-W. Phan 2, and Benjamin Pousse 3 1 Universit de Lyon, INRIA, INSA-Lyon, CITI, 2 Electronic & Electrical Engineering,
More informationComplementing Feistel Ciphers
Complementing Feistel Ciphers Alex Biryukov 1 and Ivica Nikolić 2 1 University of Luxembourg 2 Nanyang Technological University, Singapore alex.biryukov@uni.lu inikolic@ntu.edu.sg Abstract. In this paper,
More informationAlgebraic properties of SHA-3 and notable cryptanalysis results
Algebraic properties of SHA-3 and notable cryptanalysis results Christina Boura University of Versailles, France ICMC 2015, January 9, 2014 1 / 51 Cryptographic Hash Functions H : {0,1} {0,1} n m H h =
More informationBreaking Symmetric Cryptosystems Using Quantum Algorithms
Breaking Symmetric Cryptosystems Using Quantum Algorithms Gaëtan Leurent Joined work with: Marc Kaplan Anthony Leverrier María Naya-Plasencia Inria, France FOQUS Workshop Gaëtan Leurent (Inria) Breaking
More informationCryptanalysis of Patarin s 2-Round Public Key System with S Boxes (2R)
Cryptanalysis of Patarin s 2-Round Public Key System with S Boxes (2R) Eli Biham Computer Science Department Technion Israel Institute of Technology Haifa 32000, Israel biham@cs.technion.ac.il http://www.cs.technion.ac.il/~biham/
More informationQuantum Chosen-Ciphertext Attacks against Feistel Ciphers
SESSION ID: CRYP-R09 Quantum Chosen-Ciphertext Attacks against Feistel Ciphers Gembu Ito Nagoya University Joint work with Akinori Hosoyamada, Ryutaroh Matsumoto, Yu Sasaki and Tetsu Iwata Overview 3-round
More informationKnown and Chosen Key Differential Distinguishers for Block Ciphers
1/19 Known and Chosen Key Differential Distinguishers for Block Ciphers Josef Pieprzyk joint work with Ivica Nikolić, Przemys law Soko lowski, and Ron Steinfeld ASK 2011, August 29-31, 2011 2/19 Outline
More informationZero-Sum Partitions of PHOTON Permutations
Zero-Sum Partitions of PHOTON Permutations Qingju Wang 1, Lorenzo Grassi 2, Christian Rechberger 1,2 1 Technical University of Denmark, Denmark, 2 IAIK, Graz University of Technology, Austria quwg@dtu.dk,
More informationBlock ciphers. Block ciphers. Data Encryption Standard (DES) DES: encryption circuit
Block ciphers Block ciphers Myrto Arapinis School o Inormatics University o Edinburgh January 22, 2015 A block cipher with parameters k and l is a pair o deterministic algorithms (E, D) such that Encryption
More informationBlock Ciphers and Side Channel Protection
Block Ciphers and Side Channel Protection Gregor Leander ECRYPT-CSA@CHANIA-2017 Main Idea Side-Channel Resistance Without protection having a strong cipher is useless Therefore: Masking necessary Usual
More informationThe Hash Function JH 1
The Hash Function JH 1 16 January, 2011 Hongjun Wu 2,3 wuhongjun@gmail.com 1 The design of JH is tweaked in this report. The round number of JH is changed from 35.5 to 42. This new version may be referred
More informationMultiplicative complexity in block cipher design and analysis
Multiplicative complexity in block cipher design and analysis Pavol Zajac Institute of Computer Science and Mathematics Slovak University of Technology pavol.zajac@stuba.sk Fewer Multiplications in Cryptography
More informationConstruction of Lightweight S-Boxes using Feistel and MISTY structures
Construction of Lightweight S-Boxes using Feistel and MISTY structures Anne Canteaut Sébastien Duval Gaëtan Leurent Inria, France SAC 2015 A. Canteaut, S. Duval, G. Leurent (Inria) Lightweight S-Boxes
More informationImproved Slender-set Linear Cryptanalysis
1 / 37 Improved Slender-set Linear Cryptanalysis Guo-Qiang Liu 1 Chen-Hui Jin 1 Chuan-Da Qi 2 1 Information Science Technology Institute Zhengzhou, Henan, China 2 Xinyang Normal University Xinyang, Henan,
More informationMILP-Aided Bit-Based Division Property for Primitives with Non-Bit-Permutation Linear Layers
MILP-Aided Bit-Based Division Property for Primitives with Non-Bit-Permutation Linear Layers Ling Sun 1, Wei Wang 1, Meiqin Wang 1,2 1 Key Laboratory of Cryptologic Technology and Information Security,
More informationHigher-order differential properties of Keccak and Luffa
Higher-order differential properties of Keccak and Luffa Christina Boura 1,2, Anne Canteaut 1 and Christophe De Cannière 3 1 SECRET Project-Team - INRIA Paris-Rocquencourt - B.P. 105-78153 Le Chesnay Cedex
More informationImpossible differential and square attacks: Cryptanalytic link and application to Skipjack
UCL Crypto Group Technical Report Series Impossible differential and square attacks: Cryptanalytic link and application to Skipjack Gilles Piret Jean-Jacques Quisquater REGARDS GROUPE http://www.dice.ucl.ac.be/crypto/
More informationMultiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs
Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs Alex Biryukov 1,2, Dmitry Khovratovich 2, Léo Perrin 2 1 CSC, University of Luxembourg 2 SnT, University of Luxembourg https://www.cryptolux.org
More informationBISON Instantiating the Whitened Swap-Or-Not Construction November 14th, 2018
BION Instantiating the Whitened wap-or-not Construction November 14th, 2018 FluxFingers Workgroup ymmetric Cryptography, Ruhr University Bochum Virginie Lallemand, Gregor Leander, Patrick Neumann, and
More informationA New Algorithm to Construct. Secure Keys for AES
Int. J. Contemp. Math. Sciences, Vol. 5, 2010, no. 26, 1263-1270 A New Algorithm to Construct Secure Keys for AES Iqtadar Hussain Department of Mathematics Quaid-i-Azam University, Islamabad, Pakistan
More informationKey Difference Invariant Bias in Block Ciphers
Key Difference Invariant Bias in Block Ciphers Andrey Bogdanov, Christina Boura, Vincent Rijmen 2, Meiqin Wang 3, Long Wen 3, Jingyuan Zhao 3 Technical University of Denmark, Denmark 2 KU Leuven ESAT/SCD/COSIC
More informationProvable Security Against Differential and Linear Cryptanalysis
Provable Security Against Differential and Linear Cryptanalysis Kaisa Nyberg Aalto University School of Science and Nokia, Finland kaisa.nyberg@aalto.fi Abstract. In this invited talk, a brief survey on
More informationFull Key-Recovery Attacks on HMAC/NMAC-MD4 and NMAC-MD5
Full Attacks on HMAC/NMAC- and NMAC-MD5 Pierre-Alain Fouque, Gaëtan Leurent, Phong Nguyen Laboratoire d Informatique de l École Normale Supérieure CRYPTO 2007 1/26 WhatisaMACalgorithm? M Alice wants to
More informationSymmetric Crypto Systems
T H E U N I V E R S I T Y O F B R I T I S H C O L U M B I A Symmetric Crypto Systems EECE 412 Copyright 2004-2012 Konstantin Beznosov 1 Module Outline! Stream ciphers under the hood Block ciphers under
More informationLinear Cryptanalysis
Linear Cryptanalysis Linear cryptanalysis is a powerful method of cryptanalysis introduced by Matsui in 1993 [11]. It is a known plaintext attack in which the attacker studies the linear approximations
More informationA Brief Comparison of Simon and Simeck
A Brief Comparison of Simon and Simeck Stefan Kölbl, Arnab Roy {stek,arroy}@dtu.dk DTU Compute, Technical University of Denmark, Denmark Abstract. Simeck is a new lightweight block cipher design based
More informationStructural Evaluation of AES and Chosen-Key Distinguisher of 9-round AES-128
Structural Evaluation of AES and Chosen-Key Distinguisher of 9-round AES-18 Pierre-Alain Fouque 1, Jérémy Jean,, and Thomas Peyrin 3 1 Université de Rennes 1, France École Normale Supérieure, France 3
More informationTowards Understanding the Known-Key Security of Block Ciphers
Towards Understanding the Known-Key Security of Block Ciphers Elena Andreeva 1, Andrey Bogdanov 2 and Bart Mennink 1 1 Dept Electrical Engineering, ESAT/COSIC, KU Leuven, and iminds, Belgium {elenaandreeva,
More informationQuantum Differential and Linear Cryptanalysis
Quantum Differential and Linear Cryptanalysis Marc Kaplan 1,2 Gaëtan Leurent 3 Anthony Leverrier 3 María Naya-Plasencia 3 1 LTCI, Télécom ParisTech 2 School of Informatics, University of Edinburgh 3 Inria
More informationLinear and Statistical Independence of Linear Approximations and their Correlations
Linear and Statistical Independence of Linear Approximations and their Correlations Kaisa Nyberg Aalto University School of Science kaisa.nyberg@aalto.fi Boolean Functions and their Applications Os, Norway,
More informationLS-Designs. Bitslice Encryption for Efficient Masked Software Implementations
Bitslice Encryption for Efficient Masked Software Implementations Vincent Grosso 1 Gaëtan Leurent 1,2 François Xavier Standert 1 Kerem Varici 1 1 UCL, Belgium 2 Inria, France FSE 2014 G Leurent (UCL,Inria)
More informationOn Multiple Linear Approximations
On Multiple Linear Approximations Alex Biryukov, Christophe De Cannière, and Michael Quisquater Katholieke Universiteit Leuven, Dept. ESAT/SCD-COSIC, Kasteelpark Arenberg 10, B 3001 Leuven-Heverlee, Belgium
More informationImproved Meet-in-the-Middle Attacks on Reduced-Round Camellia-192/256
Improved Meet-in-the-Middle Attacks on Reduced-Round Camellia-192/256 Leibo Li 1 and Keting Jia 2 1 Key Laboratory of Cryptologic Technology and Information Security, Ministry of Education, School of Mathematics,
More informationA Five-Round Algebraic Property of the Advanced Encryption Standard
A Five-Round Algebraic Property of the Advanced Encryption Standard Jianyong Huang, Jennifer Seberry and Willy Susilo Centre for Computer and Information Security Research (CCI) School of Computer Science
More informationAnother view of the division property
Another view of the division property Christina Boura and Anne Canteaut Université de Versailles-St Quentin, France Inria Paris, France Dagstuhl seminar, January 2016 Motivation E K : block cipher with
More information