Zero-Correlation Linear Cryptanalysis with Fast Fourier Transform and Applications to Camellia and CLEFIA

Size: px

Start display at page:

Download "Zero-Correlation Linear Cryptanalysis with Fast Fourier Transform and Applications to Camellia and CLEFIA"

Oswald Sutton
6 years ago
Views:

1 Zero-Correlation Linear Cryptanalysis with Fast Fourier Transform and Applications to Camellia and CLEFIA Andrey Bogdanov, Meiqin Wang Technical University of Denmark, Shandong University, China ESC 2013, January 15, 2013

2 Background and Motivation Outline Background and Motivation Fast Fourier Transform in Linear Cryptanalysis Multidimensional Zero-Correlation Cryptanalysis of CLEFIA Conclusions 2 / 34

3 Background and Motivation Background on zero correlation linear cryptanalysis Proposed by Andrey Bogdanov and Vincent Rijmen (IACR Eprint Report:2011/123, to appear in DCC) Uses linear approximations with probability p=1/2, or correlation c = 0 Counterpart of impossible differential cryptanalysis in the domain of linear cryptanalysis Reduce the data complexity from 2 n to 2 n / l and attack TEA and XTEA [BW 12] Reveal strong links between zero-correlation distinguisher and integral and multidimensional linear distinguishers and attack a Skipjack variant and CAST-256 [BLNW 12] Motivation: find more applications for zero-correlation linear cryptanalysis 3 / 34

4 Fast Fourier Transform in Linear Cryptanalysis Outline Background and Motivation Fast Fourier Transform in Linear Cryptanalysis Multidimensional Zero-Correlation Cryptanalysis of CLEFIA Conclusions 4 / 34

5 Fast Fourier Transform in Linear Cryptanalysis For a linear approximation χ P χ D for R 1 rounds of R-round block cipher, there are q active S-boxes and k subkey bits κ, N text pairs needed Algorithm 2 [Matsui 93]: decrypt one round for every ciphertext by guessing κ, O(N 2 k ) Improved Algorithm 2 [Matsui 94]: O(2 k 2 k ), N 2 k Data counting phase 1. Initialize an array counter V [x ] for 2 k possible values of x 2. For N texts, extract the k-bit ciphertext value x corresponding to the q active S-boxes and evaluate χ T P P 3. Compute V [x ]+ = ( 1) χt P P Key counting phase 1. Guess k-bit subkey κ, decrypt 2 k x to get χ D D, M [κ, x ] = χ D D 2. For each κ, T κ = 2 k 1 x =0 M [κ, x ]V [x ], use T to compute bias ɛ κ 5 / 34

6 Fast Fourier Transform in Linear Cryptanalysis Fast partial decryption algorithm with FFT [CSQ 07] The vector bias can be computed with matrix-vector product M V The structure of matrix M M (i, j ) = parity(s 1 (i j )) f (i j ) As M has a level-circulant structure, the matrix-vector product can be computed using the Fast Walsh-Hadamard Transform with O(3k 2 k ) time complexity If the matrix can be expressed as a function of C K or P K, the matrix-vector product can be computed using the Fast Walsh-Hadamard Transform 6 / 34

7 Outline Background and Motivation Fast Fourier Transform in Linear Cryptanalysis Multidimensional Zero-Correlation Cryptanalysis of CLEFIA Conclusions 7 / 34

8 Description of Camellia The Camellia Algorithm ISO/IEC international standard, proposed by NTT and Mitsubishi Block size: 128-bit Key sizes: 128, 192 or 256 bits Round number: 18, 24, 24 Feistel structure with keyed functions FL/FL 1 Put key whitening at the beginning and ending of the cipher 8 / 34

9 Description of Camellia Encryption procedure of Camellia k w1 k w2 6 rounds FL FL -1 6 rounds KS P KS P KS P kl <<<1 FL-function kr FL FL -1 6 rounds FL FL -1 6 rounds KS P KS P KS P <<<1 FL -1 -function kr kl k w3 k w4 9 / 34

10 Zero-Correlation Linear Approximations of Camellia Property of FL Property 1 If the input mask of FL function is IM = ( i), the output mask of FL function OM = (? 0 0?? 0 0?), where "?" is an unknown value. IM L 0000?00??00??00? OM L k L?00? <<<1 k R? 00??00? FL function property IM R 000i 000i 000i?00? OMR 10 / 34

11 Zero-Correlation Linear Approximations of Camellia Property of FL 1 Property 2 If the output mask of FL 1 function is OM = ( i), the input mask of FL 1 function IM = (? 0 0?? 0 0?), where "?" is an unknown value. IM? 00? L?00??00??00? k L?00? <<<1 IM R?00? k R?00? 000i 000i 0000 OM L FL -1 function property 000i OM R 11 / 34

12 Zero-Correlation Linear Approximations of Camellia Permutation of input and output mask LP Permutation P, Y = P X, Permutation of input and output mask LP, MX = LP Y X8 Y8 Input Mask MX8 Output Mask MY8 X 7 Y7 MX7 MY7 X 6 Y6 MX6 MY6 X 5 Y5 MX5 MY5 X 4 Y4 MX4 MY4 X3 Y3 MX3 MY3 X 2 Y2 MX2 MY2 X1 Y1 MX1 MY1 12 / 34

13 Zero-Correlation Linear Approximations of Camellia Zero-correlation linear approximations for 7-round(3R+FL+4R) Camellia (b 0 0 b 0 b b b) ( ) KS P ( a) (c1 0 0 c4 c5 c6 c7 0) ( a) FL (f1 f2 f3 f4 f5 f6 f7 f8i) (f1 f2 f3 f4 f5 f6 f7 f8), f2=f7=0 (g1 0 0 g4 g5 g6 g7 0) ( i) KS P (b 0 0 b 0 b b b) ( b) KS P ( a) (a 0 0 a a a a 0) (c1b 0 0 c4b c5 c6b c7b b) FL -1 f 2=f 7=0=>LP( h g1 0 0 h g4 KS P g5 h g6 h g7 h) = 0 => 2,7 g g g = g g g g = => g1 = 0. Contradiction! KS P ( i) (i 0 0 i i i i 0) KS P (h 0 0 h 0 h h h) ( h) ( ) KS P ( ) (h 0 0 h 0 h h h) 13 / 34

14 Zero-Correlation Linear Approximations of Camellia Zero-correlation linear approximations for 7-round(4R+FL+3R) Camellia (b 0 0 b 0 b b b) ( ) KS P ( a) (c1 0 0 c4 c5 c6 c7 0) (f1 f2 f3 f4 f5 f6 f7 f8) (c1b 0 0 c4b c 5 c6b c7b b) FL (g1 0 0 g4 g5 g6 g7 0) ( i) KS P (b 0 0 b 0 b b b) ( b) KS P ( a) (a 0 0 a a a a 0) f = f = 0 => LP( c b c4 b c5 c6 b c7 (c1b 0 0 c4b c5 KS P b b) 2,7 = 0 => c4 c5 c6 = c6b c7b b) c c c c = 0 => c = Contradiction! (f1 f2 f3 f4 f5 f6 f7 f8a),f2=f7=0 FL -1 KS P ( i) (i 0 0 i i i i 0) KS P (h 0 0 h 0 h h h) ( h) ( ) KS P ( ) (h 0 0 h 0 h h h) 14 / 34

15 Key Recovery Attack on 11-Round Camellia-128 Attack on 11-round Camellia-128 with FFT (*,0,0,*,*,*,*,0) 1 X L P L 1 K0 = k w k1 P R KS P X 1 R (0,0,0,0,0,0,0,*) (*,0,0,*,*,*,*,0) (0,0,0,0,0,0,0,*) 2 X L 2 K1 = k w k2 KS P 2 X R (b,0,0,b,0,b,b,b) (b,0,0,b,0,b,b,b) (0,0,0,0,0,0,0,0) 3 X L 10 X L 7-round zero-correlation linear approximaitons K 3 2 = k w k 10 KS P 3 X R 10 X R (0,0,0,0,0,0,0,b) (0,0,0,0,0,0,0,0) (h,0,0,h,0,h,h,h) (0,0,0,0,0,0,0,h) (*,0,0,*,*,*,*,0) 11 X L 4 K3 = k w k11 KS P 11 X R (0,0,0,0,0,0,0,*) (*,0,0,*,*,*,*,0) 12 (0,0,0,0,0,0,0,*) X 12 L (*,0,0,*,*,*,*,0) X R C L C R 15 / 34

16 Key Recovery Attack on 11-Round Camellia-128 Attack on 11-round Camellia-128 with FFT Attack is to evaluate the linear approximation: f = b PL 8 h C R 8 αt PL 1,4,6,7 β T CR 1,4,6,7 b T S 8 [PR 8 K 1 8 F )] h T S 8 [C 8 L K 8 2 F 8 4 (P 1,4,5,6,7 L K 1,4,5,6,7 (C 1,4,5,6,7 R K 1,4,5,6,7 3 )] = 0, α T = (b, b, b, b), β T = (h, h, h, h), b F 2 8, b 0, h F 2 8, h 0. It is equivalent to evaluate the linear approximation: g = b PL 8 h C R 8 α T (PL 1,4,6,7 K0 1,4,6,7 ) β T (CR 1,4,6,7 K3 1,4,6,7 ) b T S 8 [PR 8 K 1 8 F 1 8 (P 1,4,5,6,7 L K0 1,4,5,6,7 )] h T S 8 [CL 8 K 2 8 F 4 8 (C 1,4,5,6,7 R K3 1,4,5,6,7 )] = 0, Get the following circulant matrix: M (PL 1,4,5,6,7 PR 8 C L 8 C 1,4,5,6,7 R, K0 1,4,5,6,7 K1 8 K 2 8 K 1,4,5,6,7 3 ) = g 16 / 34

17 Key Recovery Attack on 11-Round Camellia-128 Procedure to attack 11-Round Camellia Allocate counter C κ for 96-bit κ = (K0 1,4,5,6,7 K1 8 K 2 8 1,4,5,6,7 K3 ) 2. h, b F 2 8, b 0, h 0 3. Data counting phase: for N text pairs, extract i = (PL 1,4,5,6,7 PR 8 C L 8 1,4,5,6,7 CR ) and increment or decrement the counter x i according to the parity of b PL 8 h C R 8 4. Key counting phase 4.1 Use x to compute the first column of M which can define the whole M 4.2 Evaluate the vector ɛ = M x, 4.3 Let C = C + (ɛ/n ) If C κ < τ, the guessed κ is a possible subkey candidate and all master keys are tested exhaustively 17 / 34

18 Key Recovery Attack on 11-Round Camellia-128 Attack complexity for 11-Round Camellia-128 From Theorem 1 in [BW 12], data complexity N satisfies N 2n+0.5 l (z 1 β N 2 n + z 1 β 0 ), N = where β 0 = and β 1 = , z 1 β0 = 2, z 1 β1 = 2, l = , τ = 2l z N 1 β 0 + l N Data Complexity: known plaintexts Memory Complexity: bytes Time Complexity: round encryptions 18 / 34

19 Key Recovery Attack on 12-Round Camellia-192 Procedure to attack 12-round Camellia-192 P L (*,*,*,*,*,*,*,*) X 1 L 1 K0 = k w k1 P R 1 X R KS P (*,0,0,*,*,*,*,0) (*,0,0,*,*,*,*,0) 2 X L w 2 K1 = k k2 KS P 2 X R (0,0,0,0,0,0,0,*) (0,0,0,0,0,0,0,*) 3 X L K 1 2 = k w k 3 KS P 3 X R (*,0,0,*,*,*,*,0) (b,0,0,b,0,b,b,b) (0,0,0,0,0,0,0,b) 4 4 (b,0,0,b,0,b,b,b) X L X R (0,0,0,0,0,0,0,0) 7-round zero-correlation linear approximations 3 (0,0,0,0,0,0,0,0) K3 = k w 11 k11 11 X L X R (h 0 0 h 0 h h h) KS P w 4 (0,0,0,0,0,0,0,h) K3 = k k (*,0,0,*,*,*,*,0) X L X R (0,0,0,0,0,0,0,*) KS P (*,0,0,*,*,*,*,0) (0,0,0,0,0,0,0,*) X L X R (*,0,0,*,*,*,*,0) C L C R 19 / 34

20 Key Recovery Attack on 12-Round Camellia-192 Procedure to attack on 12-round Camellia-192 For each possible values of 64-bit K 0, compute the output value of X 2 L and X 2 R for N (P, C ) texts Proceed the attack steps similar as those of attack on 11-round Camellia-128 Data Complexity: known plaintexts Memory Complexity: bytes Time Complexity: round encryptions 20 / 34

21 Key Recovery Attack on 12-Round Camellia-192 Table: Summary of attacks on Camellia starting from 1st round Key R Attack Data Time Memory Ref Size Type (Ens) (Bytes) Imp. Diff CPs [LLGWLCL 12] 11 ZCLC-FFT KPs Here Imp. Diff CPs [CJYW 11] 10 Imp. Diff CPs [LCW 11] 11 Imp. Diff CPs [LLGWLCL 12] 12 ZCLC-FFT KPs Here 21 / 34

22 Multidimensional Zero-Correlation Cryptanalysis of CLEFIA Outline Background and Motivation Fast Fourier Transform in Linear Cryptanalysis Multidimensional Zero-Correlation Cryptanalysis of CLEFIA Conclusions 22 / 34

23 Multidimensional Zero-Correlation Cryptanalysis of CLEFIA Description of CLEFIA The CLEFIA Algorithm Lightweight ISO/IEC Standard, proposed by Sony Block size: 128 bits Key sizes: 128, 192 or 256 bits Round number: 18, 22, 26 4-Branch Generalized Feistel Structure With key whitening at the beginning and end of the cipher 23 / 34

24 Multidimensional Zero-Correlation Cryptanalysis of CLEFIA Description of CLEFIA Encryption procedure of CLEFIA 24 / 34

25 Multidimensional Zero-Correlation Cryptanalysis of CLEFIA Zero-Correlation Linear Approximations of CLEFIA Zero-correlation linear approximations of 9-round CLEFIA [BR 11] 9-round linear approximations: (a, 0, 0, 0) 9r (0, 0, 0, a), a F 32 2, a 0 25 / 34

26 Multidimensional Zero-Correlation Cryptanalysis of CLEFIA Key Recovery Attack on 14-Round CLEFIA-192 Multidimensional zero-correlation cryptanalysis of 14-round CLEFIA-192 To reduce the number of guessed subkey bits, use the linear 9r approximations (a, 0, 0, 0) (0, 0, 0, a) with the following property (x, 0, 0, 0) M 1 a, x F 8 2, x 0, a 0 (y 0, y 1, y 2, y 3 ) M 0 a, y i F 8 2, 0 i 3, y i 0 There are 255 such linear approximations 26 / 34

27 Multidimensional Zero-Correlation Cryptanalysis of CLEFIA Key Recovery Attack on 14-Round CLEFIA-192 P0 P1 P2 P3 K0 K1 α S M0 S M1 α K2 S M0 x 1 0 x 1 1 x 1 2 x 1 3 α S M1 0 0 x 2 0 K3 S M0 y x 2 1 α x 2 2 S M1 x 2 3 x 3 0 x 3 1 x 3 2 x 3 3 α round zero-correlation linear approximations α x 12 0 x 12 1 x 12 2 K4 x 12 3 S S M0 M1 x 13 0 x 13 1 x 13 2 x 13 3 K5 S M0 S M1 C0 C1 C2 C3 27 / 34

28 Multidimensional Zero-Correlation Cryptanalysis of CLEFIA Key Recovery Attack on 14-Round CLEFIA-192 Attack procedure on 14-round CLEFIA-192 Step Guessed Subkey Complexity Computed States Counter-Size 1 K 5 N 2 32 x 1 = (P 0 P 1 P 2 (M 1 (P 1 3 C 2 ))[0] X1 13 V K 4 [0] x 2 = (P 0 P 1 P 2 (M 1 (P 1 3 X3 13 V K x 3 = (X0 1 P 2 (M 1 (P 1 3 X3 13 V K x 4 = (X0 2 P 2[0] (M 1 (P 3 X3 13 V K 1 [0] x 5 = (X0 2 1 (M (X X 3 13 V K x 6 = ((Y M 1 (X X 3 13 V 6 8 Then proceed the following steps, 1. Allocate a 128-bit counter V [z ] for 8-bit z. The vector z is the concatenation of evaluations of 8 basis zero-correlation masks. 2. For 2 8 values of x 6 : 2.1 Evaluate all 8 basis zero-correlation masks on x 6 and get z. 2.2 V [z ]+ = V 6 [x 6 ]. 3. T = N 2 8 ( ) V [z ] 2 z =0 N If T < τ, the guessed subkey is a possible subkey candidate 28 / 34

29 Multidimensional Zero-Correlation Cryptanalysis of CLEFIA Key Recovery Attack on 14-Round CLEFIA-192 Attack complexity From Corollary 2 in [BLNW 12], data complexity N satisfies N = 2n (q 1 α0 + q 1 α1 ) l/2 q 1 α1 = , where q 1 α0 = 1, q 1 α1 = 2.9, α 0 = 2 2.7, α 1 = Data Complexity: known plaintexts Memory Complexity: bytes Time Complexity: round encryptions 29 / 34

30 Multidimensional Zero-Correlation Cryptanalysis of CLEFIA Key Recovery Attack on 15-Round CLEFIA-256 Procedure of attack on 15-round CLEFIA-256 P0 P1 P2 P3 K0 K1 α α x 1 0 x 1 1 x 1 2 x 1 3 K2 S M0 S M1 α 0 0 x 2 0 x 3 0 K3 S S M0 M0 y α α round zero-correlation linear approximations α x 12 0 x 12 1 x 12 2 K4 x 12 3 S M0 S M1 x 13 0 x 13 1 x 13 2 x 13 3 K5 S M0 x 2 1 x 3 1 x 14 0 x 14 1 x 14 x K6 K7 S M0 S M1 C0 C1 C2 C3 x 2 2 x 3 2 S S S M1 M1 M1 x 2 3 x 3 3 Guess 32-bit K 6 and K 7, decrypt N pairs of texts to get (X0 14, X 1 14, X 2 14, X 3 14) Proceed the attacking steps similar as those of attack on CLEFIA-192 Complexity: Data Complexity: known plaintexts Memory Complexity: bytes Time Complexity: round encryptions 30 / 34

31 Multidimensional Zero-Correlation Cryptanalysis of CLEFIA Key Recovery Attack on 15-Round CLEFIA-256 Table: Summary of attacks on CLEFIA Key Attack R Data Time Memory Source size (Ens) (Bytes) 192 Integral CPs N-A [LWYD 11] Impossible CPs [YEMTTH 08] Improbable CPs [Tezcan 10] Multidim. ZC KPs Here 256 Integral CPs N-A [LWYD 11] Impossible CPs [YEMTTH 08] Improbable CPs [Tezcan 10] Multidim. ZC KPs Here 31 / 34

32 Conclusions Outline Background and Motivation Fast Fourier Transform in Linear Cryptanalysis Multidimensional Zero-Correlation Cryptanalysis of CLEFIA Conclusions 32 / 34

33 Conclusions Conclusions FFT technique to reduce the time complexity for zero correlation linear cryptanalysis and attack 11-round Camellia-128 and 12-round Camellia-192 Best attacks for Camellia-128 and Camellia-192 starting from the first round according to round number Multidimensional zero correlation linear cryptanalysis of 14-round CLEFIA-192 and 15-round CLEFIA-256, improving the previous attacks 33 / 34

34 Thanks!

Impossible Differential-Linear Cryptanalysis of Reduced-Round CLEFIA-128

Impossible Differential-Linear Cryptanalysis of Reduced-Round CLEFIA-8 Zheng Yuan,,, ian Li, Beijing Electronic Science & Technology Institute, Beijing 7, P.R. China zyuan@tsinghua.edu.cn, sharonlee95@6.com