On Distinct Known Plaintext Attacks

Transcription

1 Céline Blondeau and Kaisa Nyberg Aalto University Wednesday 15th of April WCC 2015, Paris

2 Outline Linear Attacks Data Complexity of Zero-Correlation Attacks Theory Experiments Improvement of Attacks Multidimensional Linear Attacks Distribution of the Random Variables Experiments Discussion 2/23

3 Outline Linear Attacks Data Complexity of Zero-Correlation Attacks Theory Experiments Improvement of Attacks Multidimensional Linear Attacks Distribution of the Random Variables Experiments Discussion 3/23

4 Linear Cryptanalysis E: permutation over {0, 1} n Linear cryptanalysis: [Matsui 93] Relation between plaintext and ciphertext bits The correlation at point (u, v) F n 2 Fn 2 : cor(u, v) = 2 n[ # { x F n 2 u x v E(x) = 0} # { ] x F n 2 u x v E(x) = 1} Capacity: U, V subsets of F n 2 Fn 2 C = C(U, V ) = (u, v) (U, V ) (u, v) (0, 0) cor 2 (u, v) 4/23

5 Generalizations Multidimensional Linear Cryptanalysis [Hermelin et al 08] (U, V ) F n 2 Fn 2 : Vector spaces spanned by different masks Multiple/Multidimensional Zero Correlation (ZC) Linear Cryptanalysis [Bogdanov et al 12, 13] The distinguisher takes advantage of linear approximation(s) with correlation equal to zero: cor(u, v) = 0 or C = 0 Multiple ZC: U and V without structure Multidimensional ZC: U and V linear (affine) spaces 5/23

6 Random Variables N: Data complexity l: Number of linear approximations For each key-candidate, we compute T = N ( cor ˆ i ) 2, 1 i l where cor ˆ i is the empirical correlation of the i-th linear approximation Another equivalent formula exists for multidimensional (ZC) linear attacks Associated random variables: T R for the right key and T W for the wrong keys 6/23

7 Notation [Selçuk 08] TR N (µ R, σ 2 R ) and T W N (µ W, σ 2 W ) Φ: CDF of the central normal distribution a: advantage of the attack P S Φ µ R µ a σa 2 + σr 2 where µ a = µ W + σ W Φ 1 (1 2 a ) and σ a is often negligible, ϕ a = Φ 1 (1 2 a ) and ϕ PS = Φ 1 (P S ) 7/23

8 Outline Linear Attacks Data Complexity of Zero-Correlation Attacks Theory Experiments Improvement of Attacks Multidimensional Linear Attacks Distribution of the Random Variables Experiments Discussion 8/23

9 Data Complexity of Multiple/Multidimensional ZC Attacks [Bogdanov et al 13] Multiple ZC Attack (m) N m 2n (ϕ PS + ϕ a ) l/2 ϕa Multidimensional ZC Attack (M) N M 2n (ϕ PS + ϕ a ) l/2+ϕps In [Soleimany, Nyberg 13] experiments have been conducted: The general behavior: N = O( ) is correct l/2 2 n 9/23

10 (Distinct) Known Plaintext Attacks Are these formulas correct for a key-recovery attack? Why is there a difference? (In particular, when the set of masks is close to a linear space) 10/23

11 (Distinct) Known Plaintext Attacks Are these formulas correct for a key-recovery attack? Why is there a difference? (In particular, when the set of masks is close to a linear space) Results: N M is accurate for multiple and multidimensional ZC attacks when the involved plaintexts are distinct and the number of approximations is large N m is accurate for multiple and multidimensional ZC attacks when the involved plaintexts are non-distinct and the number of approximations is large 10/23

12 Success Probability For the experiments, we observe the evolution of the success probability when the data complexity increases ( ) N PS m m Φ l/2 ϕa 2 n ( Nm 2 n + 1) ( PS M N M ) (l 1)/2 Φ (2 n 1) N M ϕ 2 n 1 a (2 n 1) N M (m) (M) 11/23

13 Setting for the Experiments 16-bit cipher Type-II GFN with 4 branches Zero-correlation approximations: (u, 0, 0, 0) (0, v, 0, 0) over 7 rounds (u, v) (0, 0) Key-recovery: 1 round before, 2 rounds after Maximal advantage: 12 bits Similar structure as for instance CLEFIA X 1 X 2 X 11 X 12 X 13 K 1 1 F F u ZC on 7 rounds 0 v 0 0 K 1 11 F F K F 2 12 F 12/23

14 Multidimensional ZC Attacks distinct non-distinct (M) (m) a = PS log 2 (N) 13/23

15 Multidimensional ZC Attacks distinct non-distinct (M) (m) a = PS log 2 (N) 13/23

16 Multidimensional ZC Attacks distinct non-distinct (M) (m) a = PS log 2 (N) 13/23

17 Multiple ZC Attacks approximations and a = 6 distinct non-distinct (M) (m) 0.6 PS log 2 (N) 14/23

18 Multiple ZC Attacks approximations and a = 6 distinct non-distinct (M) (m) 0.6 PS log 2 (N) 14/23

19 Multiple ZC Attacks approximations and a = 6 Distinct Random (M) (m) 0.6 PS log 2 (N) 14/23

20 In Practice If we consider distinct known plaintexts we can improve the data complexity of some ZC attacks Complexity computed with same advantage than in the original publications on CAST-256 presented at INDOCRYPT 2014 from KP ( ?) to DKP (29 rounds) on Camellia presented at SAC 2013 Camellia-128 : from KP to DKP (11 rounds) Camellia-192 : from KP to DKP (12 rounds) 15/23

21 Key-Invariant Bias Attacks Related-key attack introduced at ASIACRYPT 2013 We can make the same observation on the data complexity Improvement of the attack on LBlock (Twine) considering distinct plaintexts: #R Type #Keys l a P S N Time Mem. Ref. 23 Imp. Diff 4-100% RKCP [Wen et al 14] 24 Key Inv Bias % RKKP [Bogdanov et al 13] 24 Key Inv Bias % RKKP [Bogdanov et al 13] 24 Key Inv Bias % RKDKP This paper 24 Key Inv Bias % RKDKP This paper 16/23

22 Outline Linear Attacks Data Complexity of Zero-Correlation Attacks Theory Experiments Improvement of Attacks Multidimensional Linear Attacks Distribution of the Random Variables Experiments Discussion 17/23

23 The Framework of [Hermelin et al 2009] In the known-plaintext model, the random variable T R involved in a multiple/multidimensional linear attack follows a normal distribution with parameters: µ R l + N C, and σ 2 R 2(l + 2 N C) The random variable T W follows a normal distribution with parameters µ W = l, σ 2 W = 2l The data complexity of a known-plaintext ML attack is computed: N 4al + 4Φ 1 (2P S 1) 2 C 18/23

24 Distinct-Known-Plaintext ML Attacks Assuming distinct-known plaintexts the random variable T R involved in a multiple/multidimensional linear attack follows a normal distribution with parameters: µ R l(1 N ) + N C, and 2n σr 2 2l(1 N/2n ) 2 + 4N C(1 N/2 n ) The random variable T W follows a normal distribution with parameters µ W = l, σ 2 W = 2l The fact that the messages are repeated (or not) does not influence µ W and σ 2 W 19/23

25 Settings 32-bit reduced-version of PRESENT Multidimensional linear approximation l = S 7 S 6 S 5 S 4 S 3 S 2 S 1 S 0 Experiments when C > l/2 n (2 24 ) and when C < l/2 n 20/23

26 µ R in Practice C = log2(µr) Th. distinct Exp. distinct Th. non-distinct Exp. non-distinct log 2 (N) 21/23

27 µ R in Practice 8.8 C = log2(µr) Th. distinct Exp. distinct Th. non-distinct Exp. non-distinct µ W log 2 (N) 21/23

28 Distinct Known Plaintexts ML Attacks When C > l/2 n distinct-known-plaintext ML attacks can be performed. The advantage over a known-plaintext ML attack depends of the parameters. In the other cases, we have to be careful if we have an underestimate of the capacity: We denote by µ T R the theoretical mean and by µe R the estimated one We have µ T R µ W µ E R µ w Leading in most cases to an underestimate of the data complexity 22/23

29 Conclusion We made the distinction between the known-plaintext and the distinct-known plaintext models We improved the complexity of some ZC attacks We improved the complexity of the key-invariant-bias attacks The same reasoning does not generalized easily to other known-plaintext attacks such as for instance ML attacks 23/23