Linear Cryptanalysis

Transcription

1 Linear Crypanalysis T Crypology Lecure 5 February 6, 008 Kaisa Nyberg Linear Crypanalysis /36

2 SPN A Small Example Linear Crypanalysis /36

3 Linear Approximaion of S-boxes Linear Crypanalysis 3/36

4 S-boxes S-box is a funcion f : 0 inegers. Example. The S-box S 4 of he DES n 0 m, where m and n are (small) Linear Crypanalysis 4/36

5 DES S-box S 4 Firs Row x y x y 3 x y x y Linear Crypanalysis 5/36

6 The S-box π S π S z z A B C D E F E 4 D F B 8 3 A 6 C Linear Crypanalysis 6/36

7 X b Lineariy of S-box Definiion Suppose f : 0 a a an 0 a b use N L f x y and n n and b 0 b o denoe he number of x m is an S-box and bn 0 0 m. We n such ha a x a x anxn by by b n y n or using he shor noaion a x b y 0 Remark. Then he bias of he random variable a equal o a b (o be defined soon). n N L Y is Linear Crypanalysis 7/36

8 The Linear Approximaion Table N L a b Linear Crypanalysis 8/36

9 Piling-Up Lemma Linear Crypanalysis 9/36

10 Piling-Up Lemma Definiion Suppose ha T is a discree random variable ha akes values from 0. Then he quaniy ε Pr T 0 is called he bias of T. Lemma 3. Suppose T j are independen discree random variables wih biases ε j, j T T T Tk can be calculaed as k. Then he bias ε of ε k ε ε ε k Linear Crypanalysis 0/36

11 Proof of Piling-Up Lemma Proof. We will give he proof for k by inducion. By independency. The general case follows Pr T 0 Pr T 0 Pr T 0 From his we ge Pr T 0 Pr T 0 Pr T 0 Pr T 0 Pr T 0 Pr T 0 Pr T Pr T 0 Pr T Pr T 0 ε Pr T 0 Pr T 0 Pr T 0 Pr T 0 Pr T 0 Pr T 0 ε ε Pr T 0 4 Linear Crypanalysis /36

12 Piling-Up Lemma and Independence Example Le T, T and T 3 be independen random variables wih biases ε ε ε 3 4. Denoe T T T wih bias ε ε ε 8 T 3 T T 3 wih bias ε 3 ε ε 3 8 T 3 T T 3 wih bias ε 3 ε ε 3 8 Then T and T 3 canno be independen. If hey were independen, hen by he Piling-Up Lemma he bias of T 3 T T 3 would be equal o he case which is no Linear Crypanalysis /36

13 Converse of he Piling-Up Lemma I can be shown ha he converse of he Piling-Up Lemma also holds. We sae i here for wo random variables. Converse of he Piling-Up Lemma. Suppose T and T are discree random variables wih biases ε and ε. If he bias ε of T T T saisfies ε ε ε hen T and T are independen. To give he proof we inroduce firs he Walsh-Hadamard ransform. Linear Crypanalysis 3/36

14 Walsh-Hadamard Transform Definiion Suppose f : 0 n Z is any ineger-valued funcion of bi srings of lengh n. The Walsh-Hadamard ransform ransforms f o a funcion F : 0 n Z defined as F w x 0 n f x w x w 0 n where he sum is aken over inegers. The Walsh-Hadamard Transform can also be invered. Acually, i is is own inverse upo a consan muliplier (see exercises): f x n w 0 n F w w x, for all x 0 n Linear Crypanalysis 4/36

15 Probabiliy Disribuion and Bias of T T Suppose Z a a Z a a Lemma T T is a pair of binary random variables, be a pair of bis and ε a be he bias of a T a T. ε a Pr Z a a Proof. Denoe and a a a. Then ε a Pr a Z 0 Pr a Z 0 Pr a Z a 0 Pr Z a Pr Z Pr Z a Linear Crypanalysis 5/36

16 Probabiliy Disribuion and Bias of T T Indeed, ε a f Pr Z F a. is he Walsh-Hadamard ransform of Using he inverse Walsh-Hadamard ransform we ge he following Pr Z a a ε a a a Linear Crypanalysis 6/36

17 Proof of he Converse of he Piling-Up Lemma, k Claim. If he bias of T T is equal o ε ε hen T and T are independen. Proof. For a of a Z a T a a 0 a T. Then, we use ε a o denoe he bias Pr T ε 0 0 ε ε ε T 0 Pr T ε a ε Pr T ε ε a 0 a ε ε a ε Linear Crypanalysis 7/36

18 Linear Aack on he SPN Linear Crypanalysis 8/36

19 Relaed Random Variables T U 5 U 7 U 8 V 6 has bias 4, as N L T U 6 V 6 V 8 T 3 U 3 6 V 3 6 V 3 8 T 4 U 3 4 V 3 4 V 3 6 has bias has bias has bias B 4 4, as N L 4 5 4, as N L 4 5 4, as N L 4 5 The four random variables have biases ha are high in absolue value. By he Piling-Up Lemma we ge he linear approximaion T X 5 X 7 X 8 U 4 6 U 4 8 U 4 4 U wih bias in absolue value. Linear Crypanalysis 9/36

20 The Las-Round Trick Masui s Algorihm is based on he following assumpion: Wrong Key Assumpion. If on he las round a wrong key is used o decryp he cipherex hen he random variable of he linear approximaion is much more uniformly disribued as indicaed by he bias. In he example of he exbook, if wrong parial keys K 5 i, i are used o compue he values of U46 4 and U 4 6, hen he disribuion of T is almos uniform. U4 8 U4 4 In his manner, par of he las round key bis can be found. The res can be found by repeaing he aack wih a differen approximaion, or by exhausive search. The required number of plainex-cipherex pairs is proporional o he inverse of he squared bias of he linear approximaion. In he case of he example he daa requiremen is abou 8000 plainex-cipherex pairs obained using he same key. Linear Crypanalysis 0/36