Differential Analaysis of Block Ciphers SIMON and SPECK

Transcription

1 1 / 36 Differential Analaysis of Block Ciphers SIMON and SPECK Alex Biryukov, Arnab Roy, Vesselin Velichkov

2 2 / 36 Outline Introduction Light-Weight Block Ciphers: SIMON and SPECK Differential Anlaysis SIMON: Round Function Search for Differential Trail Search for Differential Differential Effect in SIMON Embedded Bipartite Graphs Key Recovery Attacks Practical Attack: 19-round SIMON32 Attacking 11-round SPECK Attack Summary Conclusion

3 3 / 36 Outline Introduction Light-Weight Block Ciphers: SIMON and SPECK Differential Anlaysis SIMON: Round Function Search for Differential Trail Search for Differential Differential Effect in SIMON Embedded Bipartite Graphs Key Recovery Attacks Practical Attack: 19-round SIMON32 Attacking 11-round SPECK Attack Summary Conclusion

4 4 / 36 SIMON AND SPECK SIMON, SPECK - proposed in 2013, by a group of researchers from the NSA Competitive designs Simplicity, Efficiency Both are constructed on ARX principle SIMON Feistel design with ARX based function SPECK ARX, Resemblance with Threefish

5 SIMON Feistel design with very simple F-function (1) (8) & (2) k r Block Size 32, 48, 64 with key size 64, 72 or 96, 96 or 128 respectively.

6 6 / 36 SPECK Round function is similar to Threefish XOR round-key instead of (modular)adding the round-key (7/8) k r (2/3) Block Size 32, 48, 64 with key size 64, 72 or 96, 96 or 128 respectively.

7 7 / 36 Outline Introduction Light-Weight Block Ciphers: SIMON and SPECK Differential Anlaysis SIMON: Round Function Search for Differential Trail Search for Differential Differential Effect in SIMON Embedded Bipartite Graphs Key Recovery Attacks Practical Attack: 19-round SIMON32 Attacking 11-round SPECK Attack Summary Conclusion

8 8 / 36 Outline Introduction Light-Weight Block Ciphers: SIMON and SPECK Differential Anlaysis SIMON: Round Function Search for Differential Trail Search for Differential Differential Effect in SIMON Embedded Bipartite Graphs Key Recovery Attacks Practical Attack: 19-round SIMON32 Attacking 11-round SPECK Attack Summary Conclusion

9 9 / 36 SIMON: DP of A(nd)RX round function Pr(α γ) = {x : ( x (x r) ) ( (x α) ((x α) r) ) = γ} 2 n (1) (7) & (2) k r

10 10 / 36 DP: Path counting in DAG Find DP Count paths in a DAG

11 10 / 36 DP: Path counting in DAG Find DP Count paths in a DAG (Example: n=5, r=2)

12 10 / 36 DP: Path counting in DAG Find DP Count paths in a DAG (Example: n=5, r=2) α 0 α 3 γ 0 α 2 α 0 γ 2 α 4 α 2 γ 4 α 1 α 4 γ 1 α 3 α 1 γ

13 10 / 36 DP: Path counting in DAG Find DP Count paths in a DAG (Example: α 4 α 3 n=5, α 2 α 1 r=2) α 0 α 2 α 1 α 0 α 4 α 3 α 0 α 3 γ 0 α 2 α 0 γ 2 α 4 α 2 γ 4 α 1 α 4 γ 1 α 3 α 1 γ

14 10 / 36 DP: Path counting in DAG Find DP Count paths in a DAG (Example: n=5, r=2) α 0 α 3 γ 0 α 2 α 0 γ 2 α 4 α 2 γ 4 α 1 α 4 γ 1 α 3 α 1 γ x 0 x 3 x 2 x 0 x 4 x 2 x 1 x 4 x 3 x

15 10 / 36 DP: Path counting in DAG Find DP Count paths in a DAG (Example: n=5, r=2) α 0 α 3 γ 0 α 2 α 0 γ 2 α 4 α 2 γ 4 α 1 α 4 γ 1 α 3 α 1 γ x 0 x 3 x 2 x 0 x 4 x 2 x 1 x 4 x 3 x

16 11 / 36 Example: Impossible I/O Difference α 0 α 3 γ α 2 α 0 γ α 4 α 2 γ α 1 α 4 γ α 3 α 1 γ x 0 x 3 x 2 x 0 x 4 x 2 x 1 x 4 x 3 x

17 12 / 36 Outline Introduction Light-Weight Block Ciphers: SIMON and SPECK Differential Anlaysis SIMON: Round Function Search for Differential Trail Search for Differential Differential Effect in SIMON Embedded Bipartite Graphs Key Recovery Attacks Practical Attack: 19-round SIMON32 Attacking 11-round SPECK Attack Summary Conclusion

18 13 / 36 About Extending Matsui s Search for ARX Matsui[EuroCrypt 94] : while selecting DP of round l check p = p 1 p 2... p l B n l B n, if p B n update the bound Problem: DDT requires exponential memory for ARX designs

19 13 / 36 About Extending Matsui s Search for ARX Matsui[EuroCrypt 94] : while selecting DP of round l check p = p 1 p 2... p l B n l B n, if p B n update the bound Problem: DDT requires exponential memory for ARX designs Biryukov-Velichkov [CT-RSA 14]: Use partial DDT table for ARX (Threshold Search) The pddt - D contains α β iff p(α β) p τ

20 13 / 36 About Extending Matsui s Search for ARX Matsui[EuroCrypt 94] : while selecting DP of round l check p = p 1 p 2... p l B n l B n, if p B n update the bound Problem: DDT requires exponential memory for ARX designs Biryukov-Velichkov [CT-RSA 14]: Use partial DDT table for ARX (Threshold Search) The pddt - D contains α β iff p(α β) p τ While searching, if some (α β) / D, then it is possible to take several options e.g. Choose greedily, Search all possible, Highway-Country Road approach

21 14 / 36 Using the Threshold Search for ARX Parameters in Threshold Search: Size of pddt (and p τ ), precomputaion time for pddt Lower p τ can intuitively lead to better result; But increases the search complexity and size of the pddt table

22 14 / 36 Using the Threshold Search for ARX Parameters in Threshold Search: Size of pddt (and p τ ), precomputaion time for pddt Lower p τ can intuitively lead to better result; But increases the search complexity and size of the pddt table Including New Entries: The new transitions (α β) / D are added to a secondary table D

23 14 / 36 Using the Threshold Search for ARX Parameters in Threshold Search: Size of pddt (and p τ ), precomputaion time for pddt Lower p τ can intuitively lead to better result; But increases the search complexity and size of the pddt table Including New Entries: The new transitions (α β) / D are added to a secondary table D Restrict size of D By Hamming weight of the differences; Used for SPECK Another way select (α β) at round l such that at round l + 1 there is at least one transition D; Used for SIMON together with Hamming weight

24 15 / 36 Highway-Country Road Analogy Route: Luxembourg to Frankfurt The Highway only route 2hr 46min Highway-Country Road 2hr 31min

25 16 / 36 Outline Introduction Light-Weight Block Ciphers: SIMON and SPECK Differential Anlaysis SIMON: Round Function Search for Differential Trail Search for Differential Differential Effect in SIMON Embedded Bipartite Graphs Key Recovery Attacks Practical Attack: 19-round SIMON32 Attacking 11-round SPECK Attack Summary Conclusion

26 Extension for Differential: Clustering Trails We extend the Threshold Search for clustering trails. Main Idea: for round l select transition with p l : (p 1 p 2... p l 1 p l B n l ) ɛ B n Input: Best trail found by threshold Search, pddt table, ɛ 17 / 36

27 Extension for Differential: Clustering Trails We extend the Threshold Search for clustering trails. Main Idea: for round l select transition with p l : (p 1 p 2... p l 1 p l B n l ) ɛ B n Input: Best trail found by threshold Search, pddt table, ɛ Efficiency: Hamming weight and probability constraints can be applied Difference with branch-and-bound We prune the search tree by limiting the search to ɛ region of the best known probability 17 / 36

28 Extension for Differential: Clustering Trails We extend the Threshold Search for clustering trails. Main Idea: for round l select transition with p l : (p 1 p 2... p l 1 p l B n l ) ɛ B n Input: Best trail found by threshold Search, pddt table, ɛ Efficiency: Hamming weight and probability constraints can be applied Difference with branch-and-bound We prune the search tree by limiting the search to ɛ region of the best known probability We apply this technique to both SIMON and SPECK 17 / 36

29 An overview: Differential Search in out 18 / 36

30 An overview: Differential Search in p 1 p 2... p l 1 out 18 / 36

31 An overview: Differential Search in p 1 p 2... p l 1 ɛb n B n l out 18 / 36

32 19 / 36 Search Results Cipher # rounds log 2 p, trail log 2 p, diff. # trails SIMON full search full search SIMON SIMON SPECK SPECK SPECK

33 20 / 36 Outline Introduction Light-Weight Block Ciphers: SIMON and SPECK Differential Anlaysis SIMON: Round Function Search for Differential Trail Search for Differential Differential Effect in SIMON Embedded Bipartite Graphs Key Recovery Attacks Practical Attack: 19-round SIMON32 Attacking 11-round SPECK Attack Summary Conclusion

34 21 / 36 Outline Introduction Light-Weight Block Ciphers: SIMON and SPECK Differential Anlaysis SIMON: Round Function Search for Differential Trail Search for Differential Differential Effect in SIMON Embedded Bipartite Graphs Key Recovery Attacks Practical Attack: 19-round SIMON32 Attacking 11-round SPECK Attack Summary Conclusion

35 The differential graph for S IMON trails 22 / 36

36 The differential graph for S IMON trails trails 22 / 36

37 The differential graph for S IMON trails trails 22 / 36

38 The differential graph for S IMON trails trails 22 / 36

39 23 / 36 Bipartite Subgraph of Trails Feistel: i L = 11 = i+1 R = 11 f = {000* 000* 00*0 00*0} i L i R = 106 i R = 104 i R = 1006 i+1 L = 4 i+1 L = 26 i+1 L = 6 ( i L 2) i R ) = i+1 L 120 (22) 106 = (22) 104 = 4

40 24 / 36 Outline Introduction Light-Weight Block Ciphers: SIMON and SPECK Differential Anlaysis SIMON: Round Function Search for Differential Trail Search for Differential Differential Effect in SIMON Embedded Bipartite Graphs Key Recovery Attacks Practical Attack: 19-round SIMON32 Attacking 11-round SPECK Attack Summary Conclusion

41 25 / 36 Outline Introduction Light-Weight Block Ciphers: SIMON and SPECK Differential Anlaysis SIMON: Round Function Search for Differential Trail Search for Differential Differential Effect in SIMON Embedded Bipartite Graphs Key Recovery Attacks Practical Attack: 19-round SIMON32 Attacking 11-round SPECK Attack Summary Conclusion

42 Guess 25 bits(and linear combinations) from K 18, K 17, K / Round SIMON32: Practical Attack Use 13 round differential with probability , Add 2 rounds on top, 4 rounds at the end (1) (8) & * * (2) K r * * (1) (8) & *00 000* *000 00** (2) K r+1 0*00 000* *000 01** (1) (8) & * * *000 0*** 0*00 **** (2) K r+2 *000 0*** 0*01 **** (1) (8) & 0*00 000* *000 01** (2) K r+3

43 27 / 36 Attack on SIMON32 Identify pairs satisfying top 2 rounds truncated difference guess 2 bits of K * *0 (1) (8) & *000 0**0 0*01 **0* (2) K r (1) (8) & * *0 (2) K r

44 28 / 36 Attack on SIMON32 We use four differentials D 1 : (2000, 8000) (2000, 0) D 2 : (4000, 0001) (4000, 0) D 3 : (0004, 0010) (0004, 0) D 4 : (0008, 0020) (0008, 0) Truncated diffrence for top 2 round ( * *, **00 00** 00*0 1**0) ( * *0, *000 0**0 0*01 **0*) (000* *0 0100, 0**0 0*01 **0* *000) (00* * , **00 *01* *0** 0000)

45 29 / 36 Attack on SIMON32 Data Collection: Encrypt structure of size 2 30 Filtering: = 2 12 pairs remain for any D i Counting : For each D i 2 12 pairs, 25 bit guessing 2 17 candidates for 25 bits Intersection of Counters: D1, D 2 19 common bits (guessed) = 2 15 for 35 bits Intersection: D3, D 1, D 2 20 bits common 2 12 candidates for 42 bits Intersection with D 4 = 2 7 candidates for 47 bits But 39 from last 4 rounds By brute-forcing rest total = 2 32 key guesses

46 29 / 36 Attack on SIMON32 Data Collection: Encrypt structure of size 2 30 Filtering: = 2 12 pairs remain for any D i Counting : For each D i 2 12 pairs, 25 bit guessing 2 17 candidates for 25 bits Intersection of Counters: D1, D 2 19 common bits (guessed) = 2 15 for 35 bits Intersection: D3, D 1, D 2 20 bits common 2 12 candidates for 42 bits Intersection with D 4 = 2 7 candidates for 47 bits But 39 from last 4 rounds By brute-forcing rest total = 2 32 key guesses

47 29 / 36 Attack on SIMON32 Data Collection: Encrypt structure of size 2 30 Filtering: = 2 12 pairs remain for any D i Counting : For each D i 2 12 pairs, 25 bit guessing 2 17 candidates for 25 bits Intersection of Counters: D1, D 2 19 common bits (guessed) = 2 15 for 35 bits Intersection: D3, D 1, D 2 20 bits common 2 12 candidates for 42 bits Intersection with D 4 = 2 7 candidates for 47 bits But 39 from last 4 rounds By brute-forcing rest total = 2 32 key guesses

48 29 / 36 Attack on SIMON32 Data Collection: Encrypt structure of size 2 30 Filtering: = 2 12 pairs remain for any D i Counting : For each D i 2 12 pairs, 25 bit guessing 2 17 candidates for 25 bits Intersection of Counters: D1, D 2 19 common bits (guessed) = 2 15 for 35 bits Intersection: D3, D 1, D 2 20 bits common 2 12 candidates for 42 bits Intersection with D 4 = 2 7 candidates for 47 bits But 39 from last 4 rounds By brute-forcing rest total = 2 32 key guesses

49 29 / 36 Attack on SIMON32 Data Collection: Encrypt structure of size 2 30 Filtering: = 2 12 pairs remain for any D i Counting : For each D i 2 12 pairs, 25 bit guessing 2 17 candidates for 25 bits Intersection of Counters: D1, D 2 19 common bits (guessed) = 2 15 for 35 bits Intersection: D3, D 1, D 2 20 bits common 2 12 candidates for 42 bits Intersection with D 4 = 2 7 candidates for 47 bits But 39 from last 4 rounds By brute-forcing rest total = 2 32 key guesses

50 29 / 36 Attack on SIMON32 Data Collection: Encrypt structure of size 2 30 Filtering: = 2 12 pairs remain for any D i Counting : For each D i 2 12 pairs, 25 bit guessing 2 17 candidates for 25 bits Intersection of Counters: D1, D 2 19 common bits (guessed) = 2 15 for 35 bits Intersection: D3, D 1, D 2 20 bits common 2 12 candidates for 42 bits Intersection with D 4 = 2 7 candidates for 47 bits But 39 from last 4 rounds By brute-forcing rest total = 2 32 key guesses

51 30 / 36 Outline Introduction Light-Weight Block Ciphers: SIMON and SPECK Differential Anlaysis SIMON: Round Function Search for Differential Trail Search for Differential Differential Effect in SIMON Embedded Bipartite Graphs Key Recovery Attacks Practical Attack: 19-round SIMON32 Attacking 11-round SPECK Attack Summary Conclusion

52 31 / 36 Attack on SPECK32 Use 9 round differential with p = 2 30 ; Add one round each on top and at the end (7) K Pr = 2 2 (Round-10) (2) (7) K 10 (2) Guess 16 bits from K 10, 11 bits from K 9, 1 carry bit

53 32 / 36 Attack on SPECK32 Verify the difference at the end of round 9 Keep a counter of size 2 28 Expect 2 18 counters with 4 increments Bruteforce rest of the = 37 bits of last 4 round-keys Total number of key guessing = 2 55

54 33 / 36 Outline Introduction Light-Weight Block Ciphers: SIMON and SPECK Differential Anlaysis SIMON: Round Function Search for Differential Trail Search for Differential Differential Effect in SIMON Embedded Bipartite Graphs Key Recovery Attacks Practical Attack: 19-round SIMON32 Attacking 11-round SPECK Attack Summary Conclusion

55 34 / 36 Summary of Attacks Cipher Key Rounds Rounds Our Results Known Result Size Total Attacked Time Data Time Data SIMON SIMON SIMON * * SPECK SPECK48 72/ SPECK

56 35 / 36 Outline Introduction Light-Weight Block Ciphers: SIMON and SPECK Differential Anlaysis SIMON: Round Function Search for Differential Trail Search for Differential Differential Effect in SIMON Embedded Bipartite Graphs Key Recovery Attacks Practical Attack: 19-round SIMON32 Attacking 11-round SPECK Attack Summary Conclusion

57 36 / 36 Summary Analysis and Linear time (in word size) Algorithm to find DP of SIMON round function Threshold Search with Highway-Country road approach for analysing SIMON and SPECK Extend the Threshold Search technique for Differential Search Improved differentials for SIMON and SPECK All these methods are generic and can be used to analyse ARX designs Additionally, use the differentials for key recovery attack on reduced round SIMON and SPECK