Studies on Disk Encryption

Transcription

1 Studies on Disk Encryption Cuauhtemoc Mancillas López Advisor: Debrup Chakraborty Nov 14, 2011 Cuauhtemoc Mancillas López Advisor: Debrup Chakraborty Studies () on Disk Encryption Nov 14, / 74

2 Disk Encryption Problem The problem of disk encryption is to encrypt bulk information stored in a storage media like hard disk, flash memory, CD or DVD. The nature of storage media dictates the type of encryption required. We are primarily interested in hard disks. A well accepted proposal for encrypting hard disks is to encrypt individual sectors. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 2 / 74

3 Low Level Disk Encryption Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 3 / 74

4 Requirements for disk ciphers: Privacy. Length preserving. Authentication (data integrity). Efficiency. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 4 / 74

5 Requirements for disk ciphers: Privacy. Length preserving. Authentication (data integrity). Efficiency. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 4 / 74

6 Requirements for disk ciphers: Privacy. Length preserving. Authentication (data integrity). Efficiency. Tweakable enciphering schemes satisfy all these requirements Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 4 / 74

7 Table of contents 1 Preliminaries Finite Field Representation Cryptographic Primitives Adversaries Tweakable Enciphering Schemes 2 Implementations 3 BRW Polynomials 4 Side Channel Attacks 5 New Model for Disk Encryption 6 Secure Backup 7 Work Left to be Done Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 5 / 74

8 Contents 1 Preliminaries Finite Field Representation Cryptographic Primitives Adversaries Tweakable Enciphering Schemes 2 Implementations 3 BRW Polynomials 4 Side Channel Attacks 5 New Model for Disk Encryption 6 Secure Backup 7 Work Left to be Done Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 6 / 74

9 Finite Field Representation 1/2 We shall view n-bit strings as elements of GF (2 n ). n-bit strings can be considered as polynomials of degree at most n 1 over GF (2). This forms a field of 2 n elements. For example the 5-bit string can be represented as the polynomial x 4 + x + 1. Addition is defined as bitwise-xor A B. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 7 / 74

10 Finite Field Representation 2/2 Multiplication is defined as a(x)b(x) mod p(x) where p(x) is a n-degree irreducible polynomial. Given a string A, by xa we shall mean the multiplication of the polynomial a(x) with the polynomial x. This can be realized very efficiently by a shift and a conditional XOR. This operation is called xtimes. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 8 / 74

11 Polynomial Hash Informally a hash function maps a big string into a small one. We shall use a specific type of hash called the polynomial hash defined as H : {0, 1} n {0, 1} nm {0, 1} n H h (P 1... P m ) = P 1 h m P 2 h m 1... P m h All operations are in GF (2 n ),h, P i {0, 1} n This type of functions are AXU (almost xor universal hash), because for any G {0, 1} n, and P P. Pr[h $ {0, 1} n : H h (P) H h (P ) = G] maxdegree(p, P ) 2 n Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 9 / 74

12 Block-Ciphers Definition Let n be the block length then the block cipher can be seen as a function E : {0, 1} n K {0, 1} n Denoted by E(K, M) = E K (M). For each K, E K must be a permutation. So, each E K () has an inverse such that D K (E K (M)) = M A secure block cipher is considered to be a Strong Pseudo Random Permutation (SPRP). Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 10 / 74

13 Adversary Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 11 / 74

14 Adversary Adversarial Goals Key Recovery Plaintext Recovery Create Ciphertext Distinguishing Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 11 / 74

15 Adversary Adversarial Goals Key Recovery Plaintext Recovery Create Ciphertext Distinguishing Adversarial Resources Ciphertext only Known Plaintext Chosen Plaintext Chosen Ciphertext Adaptive Chosen Plaintext Adaptive Chosen Ciphertext Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 11 / 74

16 The Adversary The adversary is considered to be a probabilistic algorithm. It has oracle access to the functions and can output either a 0 or 1. It can interact with the function through valid queries. An adversary A interacting with an oracle O outputing 1 will be denoted by A O 1 Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 12 / 74

17 Strong Pseudorandom Permutations -1 E K E K A π π -1 Adv ±prp E (A) = K Pr[K $ K : A E K,D K = 1] Pr[π $ Perm(n) : A π,π 1 = 1] Perm(n) is the set of all permutations from n bits to n bits. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 13 / 74

18 Tweakable Enciphering Schemes They are length preserving encryption schemes. These schemes takes in an extra public quantity called the tweak. They can provide partial authentication. A potential application area of such schemes is in-place disk encryption. Security of such schemes are that of a strong pseudorandom permutation. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 14 / 74

19 Tweakable Enciphering schemes Definition A TES is a function E : M K T M Where M, K and T are the message space, key space and tweak space respectively. M = i>0 {0, 1} i. E K (X, T ) E K (X, T ). E should be a tweakable strong pseudorandom permutation. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 15 / 74

20 Security of TES A TES is secure if both the algorithm and its inverse are indistinguishable from an algorithm which outputs random strings. Adv ±rnd E (A) = ] [ Pr [K $ K : A E K (.,.),E 1 K (.,.) 1 Pr A $(.,.),$(.,.) 1] Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 16 / 74

21 Existing TES Depending of their structure TES are classified as follows ECB-Mask-ECB. Hash-Counter-Hash. Hash-ECB-Hash. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 17 / 74

22 ECB-mask-ECB m m-1 m EME (Halevi and Rogaway,2003). MP m m-1 MC m m m-1 m uauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 18 / 74

23 ECB-mask-ECB m m-1 m EME (Halevi and Rogaway,2003). CMC (Halevi and Rogaway,2003). MP MC m-1 m EME* (Halevi,2004). m EME2 (Halevi,2007). m m-1 m uauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 18 / 74

24 Hash-Counter-Hash P P P 1 2 m HCTR (Wang,et. al,2005). H h T E K Ctr K T H h C 1 C 2 C m Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 19 / 74

25 Hash-Counter-Hash P P P 1 2 m HCTR (Wang,et. al,2005). H h T ABL (McGrew and Viega,2004). E K Ctr K XCB (McGrew and Flurer,2004). H h T HCH (Chakraborty and Sarkar,2006). C 1 C 2 C m Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 19 / 74

26 Hash-ECB-Hash TET (Halevi,2007). Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 20 / 74

27 Hash-ECB-Hash TET (Halevi,2007). HEH (Sarkar,2007). PEP (Chakraborty and Sarkar,2006). Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 20 / 74

28 Standardization Process NIST have been running a standarization effort for different types of modes, and currently there are more than twenty different modes which provides various functionalities. Tweakable enciphering schemes are not covered under this effort. A recent standarization effort by the IEEE working group on storage security is currently considering standardization of tweakable enciphering schemes for the disk encryption application. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 21 / 74

29 Outline of our work Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 22 / 74

30 Contents 1 Preliminaries Finite Field Representation Cryptographic Primitives Adversaries Tweakable Enciphering Schemes 2 Implementations 3 BRW Polynomials 4 Side Channel Attacks 5 New Model for Disk Encryption 6 Secure Backup 7 Work Left to be Done Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 23 / 74

31 Efficient Implementations Some TES were implemented using a 128 bits pipelined AES and fully parallel Karatsuba Ofman multiplier, on Virtex 2 pro, Virtex 4 and Virtex 5 FPGAs. EME. HCTR,HCH,XCB. TET,HEH. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 24 / 74

32 Efficient Implementations Algorithm HCH.Encrypt T K (P 1,..., P m) 1. R E K (T ); Q E K (R bin n(mn)); 2. M 1 P 1 H R,Q (P 2,..., P m 1, P m); 3. U 1 E K (M 1 ); I M 1 U 1 ; S E K (I ); 4. (C 2,..., C m 1, C m) Ctr K,S (P 2,..., P m 1, P m); 5. C 1 U 1 H R,xQ (C 2,..., C m 1, C m); 6. return (C 1,..., C m); R l Q M 1 Key Schedule R U1 I S C,...,Cm Clock cycles C 1 H R,Q (P 2,..., P m 1, P m) = P 2 R m 1 P 2 R m 2... P mr Q Ctr K,S (P 2,..., P m 1, P m) = (P 2 E K (S bin n(1)),..., P m E K (S bin n(m 1))) uauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 25 / 74

33 Architecture for HCH Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 26 / 74

34 Experimental Results Table: Hardware costs of the modes with an underlying full 10-stage pipelined 128-bit AES core when processing one sector of 32 AES blocks: Virtex 4 Implementation Mode Slices B-RAM Frequency Clock Time Latency Throughput (MHz) Cycles (µs) (µs) GBits/Sec HCTR HCH HCHfp XCB EME TET HEH Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 27 / 74

35 HMCH Sarkar at 2009 proposed to use BRW as hash function to construct efficient tweakable enciphering schemes. Algorithm Encrypt τ K,β 1,β 2,(P 1,...P m) 2. M 1 H τ,β1 (P 1,..., P m) 3. U 1 E K (M 1);S M 1 U 1 (β 1 β 2) 4. (C 2,..., C m) Ctr K,β1,S(P 2,...P m) 5. C 1 H τ,β2 (C 1,..., C m) M1 U H R,β1 (P 2,..., P m 1, P m) = P 2 τ m 1 P 2 τ m 2... P mτ P 1 β 1 Ctr K,S (P 2,..., P m 1, P m) = (P 2 E K (S β 1 ), E K (S xβ 1 ),..., P m E K (S x m 1 β 1 )) Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 28 / 74

36 Contents 1 Preliminaries Finite Field Representation Cryptographic Primitives Adversaries Tweakable Enciphering Schemes 2 Implementations 3 BRW Polynomials 4 Side Channel Attacks 5 New Model for Disk Encryption 6 Secure Backup 7 Work Left to be Done Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 29 / 74

37 Efficient Implementations The BRW polynomial BRW is defined recursively as follows: BRW h () = 0 BRW h (P 1 ) = P 1 BRW h (P 1, P 2 ) = P 1 + P 2 h BRW h (P 1, P 2, P 3 ) = (h + P 1 )(h 2 + P 2 ) + P 3 BRW h (P 1, P 2,..., P m ) = BRW h (P 1, P 2,..., P t 1 )(h t + P t ) + BRW h (P t+1,..., P m ) where t {4, 8, 16,...} and t m < 2t The number of multiplications is given by m 2. Additions: m + m 3 2. Squarings: lgm. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 30 / 74

38 BRW-Polynomials We propose a framework to construct an efficient circuit to compute BRW polynomials using a pipelined multiplier. To achieve a good performance in the implementations of BRW polynomial, there are two important aspects: Scheduling of the blocks of information, trying to have the pipeline always full. The number of accumulators or registers required. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 31 / 74

39 BRW-Polynomials Representation Let s see the BRW-Polynomial with 16 coefficients BRW h (P 1,..., P 16 ) = ((((h + P 1 )(h 2 + P 2 ) + P 3 )(h 4 + P 4 ) +(h + P 5 )(h 2 + P 6 ) + P 7 )(h 8 + P 8 ) +((h + P 9 )(h 2 + P 10 ) + P 11 )(h 4 + P 12 ) +(h + P 13 )(h 2 + P 14 ) + P 15 )(h 16 + P 16 ) The total number of operations are 8 multiplications, 4 squarings and 19 additions. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 32 / 74

40 BRW-Polynomials Representation It can be represented as a tree T m. BRW h (P 1,..., P 16 ) = ((((h + P 1 )(h 2 + P 2 ) + P 3 )(h 4 + P 4 ) + (h + P 5 )(h 2 + P 6 ) + P 7 )(h 8 + P 8 ) +((h + P 9 )(h 2 + P 10 ) + P 11 )(h 4 + P 12 ) + (h + P 13 )(h 2 + P 14 ) + P 15 )(h 16 + P 16 ) Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 33 / 74

41 BRW-Polynomials Representation It can be represented as a tree T m. BRW h (P 1,..., P 16 ) = ((((h + P 1 )(h 2 + P 2 ) + P 3 )(h 4 + P 4 ) + (h + P 5 )(h 2 + P 6 ) + P 7 )(h 8 + P 8 ) +((h + P 9 )(h 2 + P 10 ) + P 11 )(h 4 + P 12 ) + (h + P 13 )(h 2 + P 14 ) + P 15 )(h 16 + P 16 ) Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 33 / 74

42 Some Properties of the Tree Let p = m and x is a label of a node. 2 Number of nodes in T m is p. The number of connected components is given by hamming weight of p. If the bit i of p is 1, T m contains a tree of size 2 i. If x 2mod 4, then x is an independent node. If x 0mod 8, x has at least x 2 and x 4 as its children. If x 4mod 8, x 2 is the only child of x. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 34 / 74

43 Scheduling of the blocks Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 35 / 74

44 Scheduling of the blocks Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 35 / 74

45 Scheduling of the blocks Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 35 / 74

46 Scheduling of the blocks Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 35 / 74

47 Scheduling of the blocks Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 35 / 74

48 Algorithm Schedule(H h (X 1,..., X m),ns) 1. Construct the collapsed tree T m corresponding to H h (X 1,..., X m); 2. for each node x in T m 3. x.nc number of children of x; 4. x.st undefined; 5. end for 6. Insert in L 1 all nodes in T m with level 0; 7. L 2 Empty; 8. clock 1; 9. while (L 1 and L 2 are both not empty) 10. if (L 2 is not empty) 11. x Pop(L 2 ); 12. if (clock x.st > NS); 13. Process(x, L 2, clock); 14. else if (L 1 is not empty) 15. x Pop(L 1 ); 16. Process(x, L 1, clock); 17. end if; 18. else if (L 1 is not empty) 19. x Pop(L 1 ); 20. Process(x, L 1, clock); 21. end if 22. clock clock + 1; 23. end while Figure: The algorithm Schedule Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 36 / 74

49 Optimal Scheduling Theorem Let H h (X 1, X 2,..., X m ) be a BRW polynomial and let p = m/2 be the number of nodes in the corresponding collapsed tree. Let clks be the number of clock cycles taken by Schedule to schedule all nodes, then, 1 If NS = 2, and p 3, clks = p + 1 if p 0 mod 4; and clks = p otherwise. 2 If NS = 3 and p 7, then p + 2 if p 0 mod 4 p + 1 if p 1 mod 4 clks = p + 1 if p 2 mod 4 p if p 3 mod 4 Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 37 / 74

50 Karatsuba-Ofman Multiplier To multiply C = A B, we can write it as follows C = (A L + x m 2 A H ) (B L + x m 2 B H ) C = x m A H B H + (A H B L + A L B H )x m 2 + A L B L C = x m A H B H + A L B L + (A H B H + A L B L + (A H + A L )(B L + B H ))x m 2 = x m C H + C L The last equation has three multiplications with half of the initial bits. We can construct a multiplier recursively. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 38 / 74

51 3 Stages Pipelined Karatusuba-Ofman Multiplier Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 39 / 74

52 Architecture to BRW Polynomial Evaluation ina inb stages pipelined KOM 1 output Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 40 / 74

53 HMCH and HEH 1 M1 1 1 U uauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 41 / 74

54 Experimental Results Table: Modes of operation on Virtex-5 device. AES-PEC: AES pipelined encryption core, AES-PDC: AES pipelined decryption core, AES-SDC: AES sequential decryption core, SOF : squares computed on the fly, SPC: squares pre-computed Mode Implementation Slices Frequency Clock Time Throughput 1 Details (MHz) Cycles (ns) (Gbits/Sec) (Slice Time) HMCH[BRW]-1 2 AES-PEC, AES-SDC, SOF HMCH[BRW]-2 2 AES-PEC, AES-SDC, SPC HMCH[BRW]-3 1 AES-PEC, AES-SDC, SOF HEH[BRW]-1 2 AES-PEC, AES-PDC, SOF HEH[BRW]-2 2 AES-PEC, AES-PDC, SPC HEH[BRW]-3 1 AES-PEC, AES-PDC, SOF HMCH[Poly] 1 AES-PEC, 1 AES-SDC HEH[Poly] 1 AES-PEC, 1 AES-PDC Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 42 / 74

55 Contents 1 Preliminaries Finite Field Representation Cryptographic Primitives Adversaries Tweakable Enciphering Schemes 2 Implementations 3 BRW Polynomials 4 Side Channel Attacks 5 New Model for Disk Encryption 6 Secure Backup 7 Work Left to be Done Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 43 / 74

56 Side Channel Attacks Physical attacks on cryptographic devices take advantage of specific implementation characteristics to recover the secret parameters involved in the computation. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 44 / 74

57 Side channel attacks Adversary tries to exploit physical information leakages such that: Timing information (Kocher, 1996). Power consumption (Kocher, 1999). Electromagnetic radiation (Quisquater, et al, 2002). Acoustic side channel (Shamir,2004). Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 45 / 74

58 Leakages in Xtimes Operation Xtimes(L) m-1 m We assume if xtimes operation is implemented as follows: 1. b msb(l) 2. L L << 1 3. if b = 1 4. L L Q 5. return L MP MC m-1 m m m m m-1 m L = xe K (0) MP = (PPP 1 PPP 2... PPP m) T MC = E K (MP), M = MP MC C 1 = MC (CCC 2 CCC 3 CCC m) T Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 46 / 74

59 Leakages in Xtimes Operation Xtimes(L) m-1 m We assume if xtimes operation is implemented as follows: 1. b msb(l) 2. L L << 1 3. if b = 1 4. L L Q 5. return L MP MC m-1 m m Xtimes(L) leaks information about power consumption. Since that L = E K (0) we can recover m bits of E K (0 n ) (L-side-channel) and m 1 bits of M (M-side-channel) from EME. L = xe K (0) MP = (PPP 1 PPP 2... PPP m) T MC = E K (MP), M = MP MC C 1 = MC (CCC 2 CCC 3 CCC m) T m-1 m m m Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 46 / 74

60 Distinguishing attack against EME First we note down the basic steps followed by the adversary: 1 Apply an arbitrary encryption query of n blocks with an arbitrary tweak. Obtain the n bits of E K (0 n ) from the L-side-channel. Compute L = xe K (0 n ). 2 Apply an encryption query with plaintext L and tweak x 1 L. Let C be the response of this query. 3 If C is equal to (1 x)x 1 L output EME otherwise output random. MP MC L = xe K (0) MP = E K (0) x 1 xe K (0) = 0 MC = E K (0) C 1 = E K (0) L = (1 x)x 1 L m-1 m-1 m-1 m m m m m m Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 47 / 74

61 Distinguishing attack against EME First we note down the basic steps followed by the adversary: 1 Apply an arbitrary encryption query of n blocks with an arbitrary tweak. Obtain the n bits of E K (0 n ) from the L-side-channel. Compute L = xe K (0 n ). 2 Apply an encryption query with plaintext L and tweak x 1 L. Let C be the response of this query. 3 If C is equal to (1 x)x 1 L output EME otherwise output random. MP MC L = xe K (0) MP = E K (0) x 1 xe K (0) = 0 MC = E K (0) C 1 = E K (0) L = (1 x)x 1 L m-1 m-1 m-1 m m m m m m Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 47 / 74

62 Stronger attack against EME Property An oracle access to the blockcipher E K is enough to encrypt any plaintext P 1 P 2... P m with arbitrary tweak T using the EME mode of operation which uses the key K. Similarly, with an oracle access to both E 1 K and E K one can decrypt any arbitrary ciphertext C 1, C 2,..., C m with an arbitrary tweak T which has been produced by the EME mode of operation with key K. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 48 / 74

63 Stronger attack against EME AdvSCA EME K (.,.) (X ) 1 Apply an arbitrary encryption query of n blocks with an arbitrary tweak. Obtain the n bits of L using the L-side-channel. 2 Apply an encryption query with tweak X and the following plaintext: Y L, Y xl,..., Y x n 1 L. }{{} n blocks where Y {0, 1} n is chosen arbitrarily. Obtain (n 1) significant bits of M using the M-side-channel, call this as M 1. 3 Output M 1 take n 1 (X ) The procedure AdvSCA EME K (.,.) (X ) outputs take n 1 (E K (X )). Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 49 / 74

64 Stronger attack against EME AdvSCB EME K (.,.) (X, take n 1 (E K (X ))) 1 Apply an arbitrary encryption query of n blocks with an arbitrary tweak. Obtain the n bits of L using the L-side-channel. 2 Z take n 1 (E K (X )) 3 S AdvSCA EME K (.,.) (Z 1 x 1 L) 4 Apply a query with tweak Z 1 and plaintext X L Get the output as C 5 If take n 1 (C L) = S output Z 1 else output Z 0 Pr[AdvSCB EME K (.,.) (X, take n 1 (E K (X )) = E K (X )] n 1 Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 50 / 74

65 Stronger attack against EME Using AdvSCB we construct a real block cipher oracle without having any knowledge about secret key K. Having this oracle we can encrypt or decrypt any plaintext or any ciphertext using EME. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 51 / 74

66 Attacks against EME2 Algorithm EME2.Encrypt T K 1,K 2,K 3 (P) 1. Partition P into P 1, P 2,..., P m 2. if len(t)= 0 then T = E K1 (K 3 ) 3. else 4. Partition the tweak T to T 1, T 2,..., T r 5. for i = 1 to r 6. K 3 xk 3 7. TT i E K1 (K 3 T i ) K 3 8. T = TT 1 TT 2 TT r 9. endif 10. L K for i = 1 to m 12. PPP i E K1 (L P i ) 13. L xl 14. end for 15. MP PPP 1 PPP 2 PPP m T 16. MC E K1 (MP) 17. M MP MC 18. for i 2 to m 19. M xm 20. CCC i PPP i M 21. end for 22. CCC 1 MC CCC 2 CCC m T 23 L K for i 1 to m 25. C i E K1 (CCC i ) L 26. L xl 27. end for 28. return C 1, C 2,..., C m We implement distinguishing attack. Due to some improvements in EME2 the stronger attack does not work. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 52 / 74

67 Contents 1 Preliminaries Finite Field Representation Cryptographic Primitives Adversaries Tweakable Enciphering Schemes 2 Implementations 3 BRW Polynomials 4 Side Channel Attacks 5 New Model for Disk Encryption 6 Secure Backup 7 Work Left to be Done Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 53 / 74

68 New Model for Disk Encryption Till now the accepted proposal for disk encryption are TES. Why? Mainly because of the length preserving requirement. We ask the question: Is length preserving that important?. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 54 / 74

69 A real sector: A sector storing 512 bytes user data is not 512 bytes long. Table: Extra format overhead Sector size Tag size (in bits) (in bytes) % 2.34% 3.13% % 0.29% 0.39% % 0.14% 0.19 % uauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 55 / 74

70 Which Encryption Scheme? Authenticated Encryption AE(N, H, M) = N, τ, C AEs need extra space to store N and τ. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 56 / 74

71 Which Encryption Scheme? Authenticated Encryption AE(N, H, M) = N, τ, C AEs need extra space to store N and τ. Deterministic Authenticated Encryption DAE(H, M) = τ, C DAEs need extra space to store only τ. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 56 / 74

72 Which Encryption Scheme? We propose to use Deterministic Authenticated Encryption modes (DAEs). Definition A DAE is a tuple Ψ = (K, E, D) They provide authentication and privacy. Authentication is on message and associated data. A pseudorandom function and an IV based encryption scheme are required in order to construct a DAE. DAEs are not length preserving. Ciphertext is a pair τ, C where τ is a tag for authentication. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 57 / 74

73 Security of DAEs Let s Ψ be a DAE, it offers privacy: [ ] [ Adv DAE priv Ψ (A) = Pr K $ K : A E K (.,.) 1 Pr A $(.,.) 1] DAE is secure when Adv DAE priv Ψ (A) is small for all efficient adversaries. It offers authentication: Adv DAE auth Ψ (A) = Pr[A E K (.,.,.) forges ] If Adv DAE auth Ψ (A) is small, this signify that it must hard for an adversary to create a valid ciphertext. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 58 / 74

74 BCTR: A Novel Disk Cipher Encrypt.BCTR T K,h (P 1 P 2... P m) 1. α = E K (0); β = E K (1); 2. γ h BRW h (P 1 P 2... P m T ) 3. τ E K (γ α) ; 4. for j = 1 to m 5. R j E K (τ x j β) 6. C j R j P j 7. endfor 8. return (C 1 C 2... C m τ) Computational Cost: m + 3 Block Cipher Calls and 1 + (m + 1)/2 Multiplications. It increases the ciphertext in 128 bits. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 59 / 74

75 Efficiency of BCTR Mode [BC] [M] [BCK] [OK] CMC 2m EME 2m XCB m + 1 2(m + 3) 3 2 HCTR m (2m + 1) 1 1 HCHfp m + 2 2(m 1) 1 1 TET m + 1 2m 2 3 Constructions Sarkar s proposals using m + 1 2(m 1) 1 1 normal polynomials Constructions Sarkar s proposals using m (m 1)/2 1 BRW polynomials BCTR m (m + 1)/2 1 1 [BC]: Number of block-cipher calls; [M]: Number of multiplications, [BCK]: Number of blockcipher keys, [OK]: Other keys, including hash keys. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 60 / 74

76 Efficiency of BCTR Mode [BC] [M] [BCK] [OK] SIV [Rogaway and Srimptom] 2m HBS [Iwata and Yasuda] m + 2 m BTM [Iwata and Yasuda] m + 3 m 1 BCTR m (m + 1)/2 1 1 [BC]: Number of block-cipher calls; [M]: Number of multiplications, [BCK]: Number of blockcipher keys, [OK]: Other keys, including hash keys. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 61 / 74

77 Security of BCTR Theorem Let E : K {0, 1} n {0, 1} n be a block-cipher secure in the PRP sense. Let A be an adversary attacking BCTR[E] who asks q queries, then there exist an adversary A such that Adv DAE priv (A) 14m2 q 2 + Adv prp BCTR[E] 2 n E (A ) (1) Adv DAE auth (A) 1 BCTR[E] m2 q 2 + 2Adv prp n 2 n E (A ) (2) where A asks O(q) queries and run for time t + O(q) where t is the running time of A. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 62 / 74

78 Contents 1 Preliminaries Finite Field Representation Cryptographic Primitives Adversaries Tweakable Enciphering Schemes 2 Implementations 3 BRW Polynomials 4 Side Channel Attacks 5 New Model for Disk Encryption 6 Secure Backup 7 Work Left to be Done Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 63 / 74

79 Secure Backup We propose DCM, a new mode of operation that given a message M produces two ciphertext called C L and C S. The message space M is {0, 1} mn. The tweak space T is {0, 1} n. The ciphertext space C is {0, 1} mn+n. There are two types of ciphertexts C L and C R. The function g(c L, C S ) = M is easier to compute than the decryption algorithm. Using the decryption algorithm is possible to recover the message from C L or C S. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 64 / 74

80 DCMG: Generic Construction Let F : K 1 {0, 1} mn+n {0, 1} n be a psudorandom function and E : K 2 {0, 1} n {0, 1} n be a secure block cipher in prp sense. We construct DCMG[F, E]. g(c L, C S ) = C L C S. Encrypt.DCM T,ty K,h, (P1,..., Pm) 1. τ F K (P 1 P 2... P m T ) 2. for j = 1 to m 3. R j E K2 (τ x j β) 4. if ty=l 5. Cj L R j (1 x)p j 6. else Cj S R j xp j 7. endfor 8. return (C 1 C 2... C m τ) For each Cj L = R j (1 x)p j and Cj S = R j xp j We have Cj L Cj S = R j R j P j xp j xp j Cj L Cj S = P j Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 65 / 74

81 Security of DCMG Π = DCMG[F K1, E K2 ]. It offers privacy: [ ] [ Adv dcm priv Π (A) = Pr K $ K : A E K (.,.) 1 Pr A $(.,.) 1] and authentication: Adv dcm auth Π (A) = Pr[A E K (.,.,.) forges ] Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 66 / 74

82 Security of DCMG Theorem Let F : K 1 {0, 1} mn+1 be a PRF and E : K {0, 1} n {0, 1} n be a block-cipher secure in the PRP sense. Let A be an adversary attacking DCMG[F, E] who asks q queries, then there exists adversaries A and A such that Adv dcm priv (A) m2 q 2 + Adv prf DCMG[F,E] 2 n E (A ) + Adv prp E (A ) (3) Adv dcm auth (A) 1 DCMG[F,E] 2 + Advprf n E (A ) + Adv prp E (A ) (4) where A asks O(q) queries and run for time t + O(q) where t is the running time of A. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 67 / 74

83 Lightweight Disk Encryption Several devices that require disk encryption are constrained (hardware resources, power consumption and memory). Block ciphers and polynomial hashes are no useful in this escenario. Stream ciphers are lightweight cryptographic primitives. Multilinear Universal Hashes have very small hardware footprint compared with polynomial hashes. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 68 / 74

84 Tweakable Enciphering Scheme From Stream Ciphers With IV Sarkar proposed in 2007 a new TES based on stream cipher with IV. Algorithm.Encrypt K T (P 1,..., P m) 1. (A 1, A 2 ) = Υ τ (P 1,..., P m, T ); 2. (B 2, B 1 ) = Feistel K,τ (A 1, A 2 ); 3. M 1 = A1 B 1 ;M 2 = A2 B 2 ; M = M1 M 2 ; 4. (C 3,..., C m) = (P 3,..., P m) SC K (M); 5. (C 1, C 2 ) = Υ τ (C 1,..., C m, T ); return(c 1,..., C m); uauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 69 / 74

85 Some Results Core Slices Cycles Frequency Throughput Thr/Area MHz Mbits/Sec Mbits/Slice Grain l bit MLUH TES This results will be extended implementing two more stream ciphers (Mickey 128 and Trivium). We will also explore the parallelization possibilities using Grain and Trivium. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 70 / 74

86 Publications C. Mancillas-López, D. Chakraborty, and F. Rodríguez-Henríquez. Reconfigurable Hardware Implementations of Tweakable Enciphering Schemes. IEEE Transactions on Computers. November C. Mancillas-López, D. Chakraborty, and F. Rodríguez-Henríquez. On Some Weaknesses in the Disk Encryption Schemes EME and EME2. International Conference on Information Systems Security (ICISS 2009), Lecture Notes in Computer Science. Debrup Chakraborty and Cuauhtemoc Mancillas-López. Double Ciphertext Mode : A Proposal for Secure Backup. International Journal of Applied Cryptography (under review). Available in eprint. Debrup Chakraborty, Cuauhtemoc Mancillas López, Francisco Rodríguez Heríquez and Palash Sarkar. Efficient Hardware Implementations of BRW Polynomials and Tweakable Enciphering Schemes. IEEE Transactions on Computers (under review). Available in eprint. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 71 / 74

87 Contents 1 Preliminaries Finite Field Representation Cryptographic Primitives Adversaries Tweakable Enciphering Schemes 2 Implementations 3 BRW Polynomials 4 Side Channel Attacks 5 New Model for Disk Encryption 6 Secure Backup 7 Work Left to be Done Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 72 / 74

88 The following are left to be done: 1 I am in process of writing the results about BCTR as a paper. We plan to communicate these results to a journal soon. 2 I plan to enhance the contents reported side channel section, where we reported some side channel weaknesses of some modes. I plan to investigate some other modes to explore their side channel vulnerabilities and possibly propose a new leakage-resilient mode of operation suitable for disk encryption. 3 Writing the thesis. Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 73 / 74

89 Thanks for your attention. Questions? Cuauhtemoc Mancillas López Studies on Disk Encryption Nov 14, / 74 () 74 / 74