Linear Cryptanalysis: Key Schedules and Tweakable Block Ciphers

Transcription

1 Linear Cryptanalysis: Key Schedules and Tweakable Block Ciphers Thorsten Kranz, Gregor Leander, Friedrich Wiemer Horst Görtz Institute for IT Security, Ruhr University Bochum

2 Block Cipher Design k KS m E c

3 Block Cipher Design k Key Schedule KS m H 0... H r 1 c

4 Block Cipher Design k Key Schedule KS m H 0... H r 1 c How does the key schedule influence statistical attacks?

5 Linear Cryptanalysis For E k : F n 2 Fn 2 and α, γ Fn 2 Bias of a linear approximation Pr x [ γ, E k (x) = α, x ] = ɛ E k (α, γ) Goal: Find (α, γ) such that ɛ Ek (α, γ) is large.

6 Linear Cryptanalysis For E k : F n 2 Fn 2 and α, γ Fn 2 Bias of a linear approximation Pr x [ γ, E k (x) = α, x ] = ɛ E k (α, γ) Goal: Find (α, γ) such that ɛ Ek (α, γ) is large. Fourier Coefficient Ê k (α, γ) = 2 n+1 ɛ Ek (α, γ)

7 Linear Cryptanalysis For E k : F n 2 Fn 2 and α, γ Fn 2 Bias of a linear approximation Pr x [ γ, E k (x) = α, x ] = ɛ E k (α, γ) Goal: Find (α, γ) such that ɛ Ek (α, γ) is large. Fourier Coefficient Ê k (α, γ) = 2 n+1 ɛ Ek (α, γ) How does the key schedule influence the Fourier coefficient?

8 Outline 1 Strange Distribution 2 Linear Key Schedules and Round Constants 3 Linear Hulls and Tweakable Block Ciphers

9 Outline 1 Strange Distribution 2 Linear Key Schedules and Round Constants 3 Linear Hulls and Tweakable Block Ciphers

10 Experiments with one bit trails We cannot compute the exact Fourier coefficient [1] Ohkuma. Weak Keys of Reduced-Round PRESENT for Linear Cryptanalysis, SAC 2008.

11 Experiments with one bit trails We cannot compute the exact Fourier coefficient For round-reduced PRESENT, it is enough to look at the one bit trails [1] [1] Ohkuma. Weak Keys of Reduced-Round PRESENT for Linear Cryptanalysis, SAC 2008.

12 Round-reduced PRESENT: Identical round keys cause greater variance [2] #Keys ident indp N ident N indp Fourier coefficient [2] Abdelraheem et al. On the Distribution of Linear Biases: Three Instructive Examples, CRYPTO 2012.

13 Round-reduced PRESENT: Identical round keys cause greater variance [2] #Keys ident indp N ident N indp Fourier coefficient Greater variance, but still a normal distribution. [2] Abdelraheem et al. On the Distribution of Linear Biases: Three Instructive Examples, CRYPTO 2012.

14 Round-reduced PRESENT with Serpent-type S-box #Keys 8,000 6,000 4,000 ident indp N ident N indp 2, Fourier coefficient 10 14

15 Round-reduced PRESENT with Serpent-type S-box #Keys 8,000 6,000 4,000 ident indp N ident N indp 2, Fourier coefficient Not a normal distribution any more!

16 Number of weak keys is substantially increased 3% outliers with x µ > 3σ Factor of 10 higher than what we expect from normal distribution Factor of 2 20 higher than what we expect from independent round keys

17 Increasing the number of rounds Sbox R 1 and 7 Rounds Constant ND Independent ND Constant k σ 1

18 Increasing the number of rounds Sbox R 1 and 11 Rounds Constant ND Independent ND Constant k σ 1

19 Increasing the number of rounds Sbox R 1 and 19 Rounds Constant ND Independent ND Constant k σ 1

20 Increasing the number of rounds Sbox R 1 and 23 Rounds Constant ND Independent ND Constant k σ 1

21 Increasing the number of rounds Sbox R 1 and 31 Rounds Constant ND Independent ND Constant k σ 1

22 Increasing the number of rounds Sbox R 1 and 35 Rounds Constant ND Independent ND Constant k σ 1

23 Increasing the number of rounds Sbox R 1 and 43 Rounds Constant ND Independent ND Constant k σ 1

24 Increasing the number of rounds Sbox R 1 and 47 Rounds Constant ND Independent ND Constant k σ 1

25 Increasing the number of rounds Sbox R 1 and 55 Rounds Constant ND Independent ND Constant k σ 1

26 Increasing the number of rounds Sbox R 1 and 59 Rounds Constant ND Independent ND Constant k σ 1

27 Increasing the number of rounds Sbox R 1 and 67 Rounds Constant ND Independent ND Constant k σ 1

28 Increasing the number of rounds Sbox R 1 and 71 Rounds Constant ND Independent ND Constant k σ 1

29 Increasing the number of rounds Sbox R 1 and 79 Rounds Constant ND Independent ND Constant k σ 1

30 Increasing the number of rounds Sbox R 1 and 83 Rounds Constant ND Independent ND Constant k σ 1

31 Increasing the number of rounds Sbox R 1 and 91 Rounds Constant ND Independent ND Constant k σ 1

32 Increasing the number of rounds Sbox R 1 and 95 Rounds Constant ND Independent ND Constant k σ 1

33 Worst case for increasing number of rounds For increasing number of rounds, the distribution of 1 bit trails converges to 4σ with probability 1 32 Ê k (α, γ) 0 with probability σ with probability 1 32 This distribution fulfills Tchebysheff s bound with equality: [ ] ( 1 Pr Êk (α, γ) 4 σ = ) =

34 Outline 1 Strange Distribution 2 Linear Key Schedules and Round Constants 3 Linear Hulls and Tweakable Block Ciphers

35 Key Schedule Design Hypothesis of Independent Round Keys wrong. Instead: Key Schedule Often a linear function. Using round constants.

36 Sound Design: Linear Key Schedule with Random Constants Variance of Fourier Coefficients (over the keys) For a linear key schedule, the average variance over all constants is equal to the variance for independent round keys. Choosing Random Constants Choosing any linear key schedule and random round constants is on average as good as having independent round keys (in terms of the variance of the distribution).

37 Experiments: Linear Key Schedule with Random Constants

38 Outline 1 Strange Distribution 2 Linear Key Schedules and Round Constants 3 Linear Hulls and Tweakable Block Ciphers

39 Tweakable Block Ciphers t TS m E k c New attack vector: also consider tweak input for linear cryptanalysis. Input mask is (α, β) F n 2 Fm 2.

40 Tweaks do not introduce new linear trails Observation Tweaking a block cipher with a linear key schedule does not introduce any new linear trails. Design Consequences Protecting a tweakable block cipher against linear cryptanalysis can be done in the same way as in the non-tweakable case.

41 Application: Design of SKINNY Table: Lower bounds on the number of active Sboxes in SKINNY. Model SK (114) (116) (124) (132) (138) (136) (148) (158) TK (108) (112) (120) TK TK SK Lin (110) (118) (122) (128) (136) (141) (143)

42 Any Questions? Any Questions?

43 Round-reduced PRESENT with Serpent-type S-box 8,000 6,000 1 bit ident 1 bit indp 1 bit N ident 1 bit N indp 2 bit ident 1,500 1,000 #Keys 4,000 #Keys 2, Fourier coefficient 10 14

44 Fourier coefficient of E k (x) = F(x, k) k E k m F c 2 m Ê k (α, γ) = ( 1) β,k F((α, β), γ) β F m 2 F((α, β), γ) = ( 1) β,k Ê k (α, γ) k F m 2

45 Fourier coefficient of E k (x) = F(x, k) k E k m F c 2 m Ê k (α, γ) = ( 1) β,k F((α, β), γ) β F m 2 F((α, β), γ) = ( 1) β,k Ê k (α, γ) k F m 2

46 Fourier coefficient of E t (x) = F (x, t) t E t m F k c 2 m Ê t (α, γ) = ( 1) β,t Fk ((α, β), γ) β F m 2 F k ((α, β), γ) = ( 1) β,t Ê t (α, γ) t F m 2

47 Linear Hull for key-alternating cipher r-keyalt k k 0 k 1 k r 1 k r m H 0... H r 1 c Linear Hull Theorem r-keyalt k (α, γ) = 2 n θ θ 0 =α,θ r =γ ( 1) θ,k C θ where θ F (r+1)n 2 and C θ = 2 n r 1 i=0 Ĥi(θ i, θ i+1 )

48 Tweaks do not introduce new linear trails Let r-tweakalt L be a tweak-alternating and key-alternating block cipher with linear key-schedule L r-tweakalt L ((α, β), γ) = 2 (r+2)n ( 1) θ,k C θ Design Consequences θ L T (θ)=β θ 0 =α,θ r =γ Protecting a tweakable block cipher against linear cryptanalysis can be done in the same way as in the non-tweakable case.

49 Round-reduced PRESENT with S-box R 0 #Keys ident indp N ident N indp Fourier coefficient 10 15

50 Round-reduced PRESENT with S-box R 2 #Keys 1, ident indp N ident N indp Fourier coefficient 10 15

51 Round-reduced PRESENT with S-box R 3 #Keys 2,000 1,000 ident indp N ident N indp Fourier coefficient 10 14

52 Round-reduced PRESENT with S-box R 5 #Keys 4,000 2,000 ident indp N ident N indp Fourier coefficient 10 14