Provable Security Against a Dierential Attack? Aarhus University, DK-8000 Aarhus C.

Transcription

1 Provable Security Against a Dierential Attack Kaisa Nyberg and Lars Ramkilde Knudsen Aarus University, DK-8000 Aarus C. Abstract. Te purpose of tis paper is to sow tat tere exist DESlike iterated cipers, wic are provably resistant against dierential attacks. Te main result on te security of a DES-like ciper wit independent round keys is Teorem 1, wic gives an upper bound to te probability of s-round dierentials, as dened in [4] and tis upper bound depends only on te round function of te iterated ciper. Moreover, it is sown tat tere exist functions suc tat te probabilities of differentials are less tan or equal to 2 3,n, were n is te lengt of te plaintext block. We also sow a prototype of an iterated block ciper, wic is compatible wit DES and as proven security against dierential attacks. Key words. DES-like cipers, Dierential cryptanalysis, Almost perfect nonlinear permutations, Markov Cipers. 1 Introduction A DES-like ciper is a block ciper based on iterating a function, called F, several times. Eac iteration is called a round. Te input to eac round is divided into two alves. Te rigt alf is fed into F togeter wit a round key derived from akey scedule algoritm. Te output of F is added (modulo 2) to te left alf of te input and te two alves are swapped except for te last round. Te plaintext is te input to te rst round and te cipertext is te output of te last round. In [1] E. Biam and A. Samir introduced dierential cryptanalysis of DESlike cipers. In teir attacks tey make use of caracteristics, wic describe te beaviour of input and output dierences for some number of consecutive rounds. Te probability of a one-round caracteristic is te conditional probability tat given a certain dierence in te inputs to te round we get a certain dierence in te outputs of te round. Lai and Massey [4] observed tat for te success of dierential cryptanalysis it may not be necessary to x te values of input and output dierences for te intermediate rounds in a caracteristic. Tey introduced te notion of dierentials. Te probability of an s-round dierential is te conditional probability tat given an input dierence at te rst round, te output dierence at te s't round will be some xed value. Note tat A preliminary version of tis paper was presented in te rump session at Crypto '92 and will appear in te proceedings. Te work of te autor on tis project is supported by MATINE Board, Finland.

2 te probability of an s-round dierential wit input dierence A and output dierence B is te sum of te probabilities of all s-round caracteristics wit input dierence A and output dierence B. For s 2 te probabilities for a dierential and for te corresponding caracteristic are equal, but in general te probabilities for dierentials will be iger. In order to make a successful attack on a DES-like iterated ciper by dierential cryptanalysis te existence of good caracteristics is sucient. On te oter and to prove security against dierential attacks for DES-like iterated cipers we must ensure tat tere is no dierential wit a probability ig enoug to enable successful attacks. 2 Resistance against dierential attacks A DES-like iterated ciper wit block size 2n and wit r rounds is dened as follows. Let f : GF (2) m! GF (2) n ; m n E : GF (2) n! GF (2) m ; an ane expansion mapping and let K =(K 1 ;K 2 ; :::; K r ), were K i 2 GF (2) m, be te r round keys. Te round function (in te i't round) F : GF (2) n GF (2) m! GF (2) n is ten dened F (X; K i )=f(e(x) +K i ), were '+' is te bitwise addition modulo 2. Given a plaintext X =(X L ;X R ) and a key K =(K 1 ;K 2 ;:::;K r ) te cipertext Y =(Y L ;Y R ) is computed in r rounds. Set X L (0) = X L and X R (0) = X R and compute for i =1; 2; :::; r X L (i) =X R (i, 1) X R (i) =F ((X R (i, 1);K i )+X L (i, 1) X(i) =(X L (i);x R (i)) Set Y L = X R (r) andy R = X L (r). Te dierence between two n-bit blocks is dened as X = X + X An s-round caracteristic is an (s+1)-tuple ((0); (1); :::; (s)) considered as te possible values of (X(0); X(1);:::; X(s)); wereas an s-round dierential is a pair((0);(s)) considered as te possible values of (X(0);X(s)) [1, 4]. To prove resistance against dierential cryptanalysis we need to nd te best dierentials, so for te remainder of tis paper we consider only dierentials. Dierential attacks use s-round dierentials to pus forward te information of a xed input dierence at te rst round to te s't round independently of te used key. In tis paper we will sow tatitispossibletocoose te

3 round function so tat no single dierential is useful. Given a plaintext pair X; X,cosen by te cryptanalyst and r independent uniformly random round keys K 1 ;K 2 ; :::; K r, unknown to te cryptanalyst, te dierential may ormay not old. It is natural to measure te rate of success for te cryptanalyst by te probability of te dierential taken over te distributions of X and K. Te probability of a one-round dierential (X(0) = ; X(1) = ) is P (X(1) = j X(0) = ) wic by te property of Markov cipers, as dened in [4], is equal to P (X(1) = j X(0) = ; X = ) for all values of X, if te round key K is uniformly distributed. Hence te probability of a one round dierential is independent of te distribution of X and is taken over te distribution of K. Assuming tat te round keys K 1 ;K 2 ; :::; K r are mutually independent it follows tat te probability of an s-round caracteristic is te product of te probabilities of te individual rounds. Ten te probability of an s-round dierential equals (see also [4]) P (X(s) =(s) j X(0) = (0)) = X X (1) (2) :::: X sy (s,1) i=1 P (X(i) =(i) j X(i, 1) = (i, 1)) We denote by p max te igest probability for a non-trivial one-round dierential acievable by te cryptanalyst, i.e. p max = max max R6=0P (X(1) = j X(0) = ) were R is te rigt alfof. We sall sow in Sect. 3 tat te round function of a DES-like ciper can be cosen in suc away tat p max is small. Teorem 1 It is assumed tat in a DES-like ciper wit f : GF (2) m! GF (2) n te round keys are independent and uniformly random. Ten te probability of an s-round dierential, s 4, is less tan or equal to 2p 2 max. Proof: We sall rst give te proof for s = 4, i.e. P (X(4) = j X(0) = ) 2p 2 max for any ; (6= 0).Let L, R and L, R be te left and rigt alves of and. We denote by X R (i) te rigt input dierences at te i't round, see Figure 1. Let! denote tat, in order for te s-round dierential (; ) tooccur,itis necessary tat inputs to F wit dierence lead to outputs wit dierence. We split te proof into cases were L = 0 and L 6=0. Note tat wen L = 0 ten R 6= 0, oterwise L = R = L = R = 0, wic is of no use in dierential cryptanalysis. Similarly if L = 0 ten R 6=0.

4 X L(0) = L X R(0) = R F ( (( ( (((( ( (((( ( ( ((( F X R(1) ( (( ( (((( ( (((( ( ( ((( F X R(2) ( (( ( (((( ( (((( ( ( ((( F X R(3) = L ( (( ( (((( ( (((( ( ( ((( X L(4) = L X R(4) = R Fig. 1. Te four round dierential 1. L =0.Ten clearly X R (2) = R 6=0.IfX R (1) = 0 ten X R (2) = R = R 6= 0. It ten follows tat R = R! L in te rst round and X R (2) = R! 0 in te tird round, bot combinations wit probability at most p max.ifx R (1) 6= 0 ten it follows tat for any given X R (1) te second round must be X R (1)! R + R and te tird round must be X R (2) = R! X R (1), bot combinations wit probability atmostp max.we obtain P (X(4) X = j X(0) = ) = P (X R (1) j X(0) = ) P (X(4) = j X(0) = ; X R (1)) X R(1) = P (X X R (1) = 0 j X(0) = ) P (X(4) = j X(0) = ; X R (1) = 0) + P (X R (1) j X(0) = ) P (X(4) = j X(0) = ; X R (1)) X R(1)6=0 p 2 max + X X R(1)6=0 P (X R (1) j X(0) = ) p 2 max

5 2p 2 max since P X R(1)6=0 P (X R(1) j X(0) = ) L 6=0.We consider rst te 3-round dierential obtained by xing X R (1). We obtain P (X(4) X = j X(0) = ; X R (1)) = P (X R (2) j X(0) = ; X R (1)) X R(2) P (X(4) = j X(0) = ; X R (1);X R (2)) = P (X R (2) = 0 j X(0) = ; X R (1)) P (X(4) X = j X(0) = ; X R (1);X R (2) = 0) + P (X R (2) j X(0) = ; X R (1)) X R(2)6=0 p max p max + 2p 2 max P (X(4) = j X(0) = ; X R (1);X R (2)) X X R(2)6=0 P (X R (2) j X(0) = ; X R (1)) p 2 max Te above sows tat Teorem 1 olds for s-round dierentials for s 3if L 6= 0. In te rst inequality we used tat if X R (2) = 0 ten X R (1) 6= 0, since oterwise L = R =0.Now P (X(4) X = j X(0) = ) = P (X R (1) j X(0) = ) P (X(4) = j X(0) = ; X R (1)) X X R(1) X R(1) 2p 2 max Let now s>4. Ten P (X R (1) j X(0) = ) 2p 2 max P (X(s) X =jx(0) = ) = P (X(s, 4) j X(0) = ) P (X(s) =jx(0) = ; X(s, 4)) X(s,4) Since we assumed tat te round keys are independent and uniformly random it follows from te proof for s = 4 tat P (X(s) = j X(0) = ; X(s, 4)) = P (X(s) = j X(s, 4)) 2p 2 max Tus P (X(s) = j X(0) = ) 2p 2 max. 2 If f is a permutation, Teorem 1 can be proved for s 3. It comes from te fact tat to ave equal outputs of one round we must ave equal inputs.

6 Teorem 2 It is assumed tat te function f in a DES-like ciper is a permutation and tat te round keys are independent and uniformly random. Ten te probability of an s-round dierential for s 3 is less tan or equal to 2p 2 max. Proof: We give te proof for s = 3. Te general case can ten be proved like in te preceding teorem. Again we separate between two cases and use te same notation as before. 1. L =0.Ten X R (0) = R 6= 0, oterwise dierent inputs would ave to yield equal outputs in te second round, but tat is not possible, since f is a permutation. Te dierence in te inputs at te rst round is R 6=0andte dierence in te inputs at te second round is R 6=0,tus P (X(3) = j X(0) = ) p 2 max. 2. L 6=0.Like in te proof of Teorem 1 we split into cases were X R (1) is zero or not. Note tat if X R (1)=0) L 6= 0 oterwise R! L =0) R =0.We obtain P (X(3) X = j X(0) = ) = P (X R (1) j X(0) = ) P (X(3) = j X(0) = ; X R (1)) X R(1) = P (X X R (1) = 0 j X(0) = ) P (X(3) = j X(0) = ; X R (1) = 0) + P (X R (1) j X(0) = ) P (X(3) = j X(0) = ; X R (1)) X R(1)6=0 p 2 max + X X R(1)6=0 P (X R (1) j X(0) = ) p 2 max 2p 2 max 2 3 Almost perfect nonlinear permutations First we sow tat te maximum probability p max of a one-round dierential as an upperbound tat can be expressed in terms of te function f. Let Ten p f = max bmax a6=0 P (f(y + a)+f(y )=b): p max = max max R6=0P (X(1) = j X(0) = ) = max max R6=0P ( L + f(e(x + R )+K)+f(E(X)+K) = R ) p f ; were we ave assumed tat E is ane and denoted K + E(X) by Y.IfK is uniformly distributed ten so is Y. For a mapping f : GF (2) m! GF (2) n te lower bound for p f is 2,n. Mappings attaining tis lower bound were investigated in [7], were tey are called

7 perfect nonlinear generalizing te denition of perfect nonlinearity given for Boolean functions in [6]. It was sown in [7] tat perfect nonlinear mappings from GF (2) m! GF (2) n only exist for m even and m 2n. Hence tey can be adapted for use in DES-like cipers only wit expansion mappings tat double te block lengt. If te round function of a DES-like ciper does not involve any expansion, i.e. in te case wen f : GF (2) m! GF (2) n is a permutation, te trivial lower bound for p f is 2 1,n, since ten te dierence f(x + w)+f(x) obtains alf of te values in GF (2) n twice and never te oter alf of te values. We sall call te permutations wit p f =2 1,n almost perfect nonlinear. Te purpose of tis section is to sow tat suc permutations exist. For unexplained terminology we refer to [5]. Let m = nd, were n is odd. In [8] permutations f of GF (2 m )=GF (2 d ) n were constructed to satisfy te following property: (P) Every nonzero linear combination of te components of f is a nondegenerate quadratic form x t Cx in n indeterminates over GF (2 d ) wit rank(c+c t )= n, 1: It follows immediately from te denition tat te coordinate functions of a permutation wit (P) are complete, tat is, depend on all input variables. Te main result of tis section is te following teorem. Teorem 3 Let f : GF (2 d ) n! GF (2 d ) n, n odd, be apermutation satisfying (P). Ten p f =2d(1,n). Our proof of te teorem is based on te following tree lemmata concerning properties of linear structures of quadratic forms. Recall tat a linear structure w of f : F n! F, F a eld, is a vector in F n suc tat f(x + w) +f(x) is constant asx varies. Te linear structures of a quadratic form f(x) =x t Ax in n indeterminates over GF (2 d ) wit rank(a+a t )=n,1 form a one-dimensional linear subspace of GF (2 d ) n (see [8], Prop. 3). For a quadratic form f and every xed w te function f(x + w)+f(x) ofx is ane or constant. From tis we get te rst lemma. Lemma 1 Let w 2 GF (2 d ) n be not a linear structure of f : GF (2 d ) n! GF (2 d );f(x) =x t Ax. Ten te function f(x + w) +f(x) of x is balanced, i.e. obtains eac value in GF (2 d ) equally many times. Lemma 2 Let f(x) = x t Ax be a quadratic form in n indeterminates over GF (2) suc tat rank(a + A t )=n, 1. Ten f is nondegenerate if and only if f(w) 6= 0 for te nonzero linear structures w of f (see also Lemma 4.1. in [3]). Proof: Let '(x 1 ;:::;x n )=x 1 x 2 + :::+ x n,2 x n,1 + x 2 n

8 = 0 or 1, be te quadratic forms to wic all quadratic forms f(x) =x t Ax wit rank(a + A t )=n, 1 are equivalent (see [5], C.6.2). It means tat tere is a linear transformation T of coordinates suc tat f(x) ='(Tx). Ten w is a linear structure of f if and only if Tw =(0; 0;:::;0;a), were a 2 GF (2 d ). Ten f is nondegenerate if and only if ' is nondegenerate wic is true if and only if =1.But = 1 if and only if f(w) ='(Tw) ='(0;:::;0;a)=a 2 6=0 for a 6= 0: 2 Lemma 3 Let f : GF (2 d ) n! GF (2 d ) n beapermutation wit property (P). Ten every nonzero w 2 GF (2 d ) n is a linear structure of a nonzero linear combination of te components of f. Proof: Let u be a nonzero vector in GF (2 d ) n and let w 2 GF (2 d ) n be a nonzero linear structure of u f. Ten w, 2 GF (2 d ) are te linear structures of cu f, c 2 GF (2 d ). Hence it suces to sow tat if u 1 f and u 2 f sare a nonzero linear structure ten tere is c 2 GF (2 d ) suc tat u 1 = cu 2. Let w be a nonzero linear structure of u 1 f and u 2 f. Ten w is also te linear structure of (c 1 u 1 + c 2 u 2 ) f ; for all c 1 ;c 2 2 GF (2 d ): Since u 1 f and u 2 f are nondegenerate it follows from Lemma 2 tat u 1 f(w) 6= 0 and u 2 f(w) 6= 0: Hence tere exists c 6= 0 suc tat cu 1 f(w) =u 2 f(w) or, wat is te same, (cu 1 + u 2 ) f(w) =0: If cu 1 6= u 2,ten(cu 1 + u 2 ) f is nondegenerate wic cannot be true by Lemma 2. Consequently cu 1 = u 2. 2 Now Teorem 3 is a consequence of te following Teorem 4 Let f =(f 1 ;f 2 ;:::;f n ): GF (2 d ) n! GF (2 d ) n beapermutation tat satises (P). Ten for every xed nonzero dierence w 2 GF (2 d ) n of te inputs to f, te dierences of te outputs lie in an ane yperplane of GF (2 d ) n and are uniformly distributed tere. Proof: Let w be a nonzero input dierence for f. Ten by Lemma 3 tere is v 2 GF (2 d ) n, v 6= 0, suc tat w is te linear structure of vf and by Lemma 2 v f(x + w)+v f(x) =v f(w) 6= 0 for all x 2 GF (2 d ) n.we denote b 0 = v f(w): Let u 1 ;:::;u n,1 be linearly independent vectors in GF (2 d ) n suc tat v 62 spanfu 1 ;:::;u n,1 g: Ten by Lemma 1 for every u 2 spanfu 1 ;:::;u n,1 g te function x 7! u f(x + w)+u f(x)

9 obtains eac value in GF (2 d ) equally many times. Consequently (see [5]), for every (b 1 ;:::;b n,1 ) 2 GF (2 d ) n,1, te system of equations u i f(x + w)+u i f(x) =b i ;i=1;:::;n, 1; as 2 d solutions x 2 GF (2 d ) n. Hence te system of n equations: (2) u i f(x + w)+u i f(x) =b i ;i=1;:::;n, 1; v f(x + w)+v f(x) =b as 2 d solutions if b = b 0 and no solutions if b 6= b 0 : Every system of n equations f i (x + w)+f i (x) =a i ;i=1; 2;:::;n is a linear transformation of (2), from wic te claim follows. 2 By a similar argumentation one can prove te following generalization of Teorem 3. Teorem 5 Let f be apermutation in GF (2 d ) n, n odd, wit property (P ) and let f 1 ;:::;f n be te components of f wit respect to some arbitrary xed basis over GF (2 d ).Let l n and set =(f 1 ;f 2 ;:::;f l ). Ten p =2d(1,l). From te results of Section 2 we now obtain Teorem 6 Assume tat in a DES-like ciper te function f is a mapping from GF (2) nd to GF (2) ld, n l, obtained fromapermutation in GF (2 d ) n wit (P) by discarding n, l output coordinates. Ten p f =2d(1,l). Moreover, if n>l, ten te probability of every r-round dierential, r 4, is less tan or equal to 2 2d(1,l)+1, assuming tat te round keys are uniformly random and independent. If n = l, te probability of every r-round dierential, r 3, is less tan or equal to 2 2d(1,l)+1. 4 Class of permutations wit property (P) In tis section we sow tat te permutations f(x) =x 2k +1 in GF (2 nd ) wit k =0modd, gcd(k; n) = 1, and n odd, ave property (P), wen considered as permutations of GF (2 d ) n. Let 1 ; :::; P n be a basis in GF (2 nd )over GF (2 d )and 1 ; :::; n be its dual basis. n Let x = i=1 x i i ;x i 2 GF (2 d ). Ten te i't component f i (x) off(x) wit respect to te basis 1 ;:::; n is f i (x) =Tr( i x 2k +1 ) = Tr( i ( = = j=1 l=1 j=1 l=1 j=1 x j j )( l=1 x l l ) 2k ) Tr( i j 2k l )x j x l Tr( i j ( i l ) 2k )x j x l

10 were i 2 GF (2 nd )issuc tat 2k +1 i = i ;i=1; 2; :::; n: Now it is straigtforward to ceck tat Tr( i j ( i l ) 2k ) 2 GF (2 d )isteentry on te j't row and l't column in te matrix A i = B t i Rk B i were B i = 0 B i 1 i 2 i n ( i 1 ) 2 ( i 2 ) 2 ( i n ) ( i 1 ) 2n,1 ( i 2 ) 2n,1 ( i n ) 2n,1 is a n n regular matrix over GF (2 nd ) and R = 0 B is te cyclic sift for wic rank(r k +(R k ) t )=n, 1ifgcd(k; n) = 1. Ten also x t Rx is nondegenerate. Consequently, and f i (x) =x t A i x 1 C C A 1 C C A rank(a i + A t i)=rank(b t i(r k +(R k ) t )B i )=rank(r k +(R k ) t )=n, 1 over GF (2 nd ). Tus rank(a i + A t i )=n, 1alsoover GF (2d ), since te rank does not decrease wen going to a subeld and it cannot be n. By te linearity of te trace function te same olds for every nonzero linear combination of te components f i of f : Tis completes te proof of property (P) for f. 5 A prototype of a DES-like ciper for encryption Let g(x) = x 3 in GF (2 33 ). Tere are several ecient ways of implementing tis power polynomial and eac of tem suggest a coice of a basis in GF (2 33 ). Let us x a basis and discard one output coordinate. Ten we ave a function f : GF (2) 33! GF (2) 32 : Te 64-bit plaintext block is divided into two 32-bit alves L and R. Te plaintext expansion is an ane mapping E : GF (2) 32! GF (2) 33 : Eac round take a 32 bit input and a 33 bit key. Te round function is LkR 7! R k L + f(e(r)+k): In [2] E. Biam and A. Samir introduced an improved dierential attack on 16-round DES. Tis means, tat in general for an r-round DES-like ciper te existence of an (r, 2)-round dierential wit a suciently ig probability may enable a successful dierential attack. From Teorem 6 we ave tat every four and ve round dierential of tis block ciper as probability less tan or equal to 2,61. Terefore we suggest at least six rounds for te block ciper. All round

11 keys sould be independent, terefore we need at least 198 key bits. More examples of permutations f for wic p max is low can be found in [9]. Te examples include te inverses of x 7! x 2k +1 and te mappings x 7! x,1, wose coordinate functions are of iger nonlinear order tan quadratic. 6 Acknowledgements We would like to tank D. Coppersmit and an anonymous referee for comments tat improved te paper. References 1. E. Biam, A. Samir. Dierential Cryptanalysis of DES-like Cryptosystems. Journal of Cryptology, Vol. 4 No E. Biam, A. Samir. Dierential Cryptanalysis of te full 16-round DES. Tecnical Report # 708, Tecnion - Israel Institute of Tecnology. 3. P. Camion, C. Carlet, P. Carpin, N. Sendrier. On Correlation-immune functions. Advances in Cryptology - Crypto '91. Lecture Notes in Computer Science 576, Springer-Verlag, 1992, pp X. Lai, J. L. Massey, S. Murpy. Markov Cipers and Dierential Cryptanalysis. Advances in Cryptology - Eurocrypt '91. Lecture Notes in Computer Science 547, Springer-Verlag, 1992, pp R. Lidl, H. Niederreiter. Finite Fields. Encyclopedia of Matematics and its applications, Vol. 20. Addison-Wesley, Reading, Massacusetts, W. Meier, O. Staelbac. Nonlinearity criteria for cryptograpic functions. Advances in Cryptology - Eurocrypt '89. Lecture Notes in Computer Science, 434, Springer-Verlag, 1990, pp K. Nyberg. Perfect nonlinear S-boxes. Advances in Cryptology - Proceedings of Eurocrypt '91. Lecture Notes in Computer Science 547, Springer Verlag, 1991, pp K. Nyberg. On te construction of igly nonlinear permutations. Advances in Cryptology - Eurocrypt '92. Lecture Notes in Computer Science, 658, Springer- Verlag, 1993, pp K. Nyberg. Dierentially uniform mappings for cryptograpy. Proceedings of Eurocrypt '93 (to appear). Tis article was processed using te LaT E X macro package wit LLNCS style