DIFFERENTIAL CRYPTANALYSIS FOR A 3-ROUND SPN

Transcription

1 IRNTIL RYPTNLYSIS OR -ROUN SPN M. Tolga Sakallı rca uluş daç Şahi atma üyüksaraçoğlu Trakya Uiversity, aculty of gieerig ad rchitecture, epartmet of omputer gieerig dire, Turkey Key words: ifferetial cryptaalysis, SPN (Substitutio Permutatio Network), S (dvaced cryptio Stadard). STRT SPNs (Substitutio Permutatio Networks) are oe of the importat architectures used for desigig block ciphers. I our study, we applied differetial cryptaalysis method for a -roud SPN. We have used a -bit iput as plaitext ad -bit output as ciphertext ad chose the first row of the third S-box of S (ata cryptio Stadard) for the ecessary S-box ad ShiftRows trasformatio which is used to permute bytes i S (dvaced cryptio Stadard) for permutatio of bits for our SPN. s a result, we have obtaied -bit key of -bit key from the last roud of the cipher usig differetial cryptaalysis method. I. INTROUTION cryptio algorithms are very importat for cryptography ad they are used to provide security ad privacy. lock ciphers are symmetric algorithms ad use oe key to ecrypt ad decrypt the data. SPNs which represet oe of the two importat architectures are used for desigig block ciphers. While S [, ] (dvaced cryptio Stadard) which is recet adoptio of Rijdael has a SPN architecture, S [] (ata cryptio Stadard) which was developed i cooperatig with IM ad Natioal Security gecy (NS) i has a feistel architecture. Square cipher [] which is the predecessor of S has also a SPN architecture. O the other had, the security of block ciphers depeds o cryptaalitic attacks ad statistical tests which ca give some useful iformatio to the attacker. Key size, substitutio boxes ad roud umber, which are importat compoets of ecryptio algorithm, should be chose very carefully i order to make the ecryptio algorithm resistat to the cryptaalytic attacks ad to pass it the statistical tests. ryptaalysis [] is the sciece of breakig ciphers. Successful cryptaalysis may recover the plaitext or the key. rom attacker's poit of view, it is ecessary that he should have the iformatio available to mout his attack. There are four mai attack models o cryptosystems accordig to the iformatio available for the attacker: - ciphertext oly attack, whe attacker possesses a strig of ciphertext y, - kow plaitext attack, whe attacker possesses a strig of plaitext x ad the correspodig ciphertext strig y, - chose plaitext attack, whe attacker ca choose a plaitext strig x ad costructs the correspodig ciphertext strig y, - chose ciphertext attack, whe attacker ca choose a ciphertext strig y ad costructs the correspodig plaitext strig x. There is a importat criterio to decide whether cryptaalysis method for block ciphers is successful or ot. If the cryptaalysis method breaks a block cipher with a effort less the exhaustive key search, it is the cosidered as a successful oe. I exhaustive search, for ay -bit block cipher with a key size of k, the attacker tries all k possible key values ad verifies if he ca derive meaigful plaitext. The two most popular attacks, differetial [, ] ad liear [] attacks for block ciphers, were developed by iham i ad Matsui i. These were methods of statistical cryptaalysis ad they were used agaist S algorithm. There was a mathematical idea behid these attacks ad the attacks were a big cotributio for desigig stroger ecryptio algorithms. fter these attacks, other cryptaalysis methods have bee developed, like trucated differetial cryptaalysis [], higher order differetial cryptaalysis [] ad impossible differetial cryptaalysis []. ifferetial cryptaalysis which was developed by iham is a chose plaitext attack ad it exploits the high probability of certai occurreces of plaitext differeces ad differeces ito the last roud of the cipher. The security of SPNs agaist differetial cryptaalysis depeds o maximum differetial probability (MP) [, ]. To guaratee provable security agaist differetial cryptaalysis, it is ecessary to demostrate that MP is sufficietly small that correspodig data complexity (the umber of chose plaitext pairs used by the attacker) is prohibitively large. I our study, we have applied differetial attack agaist the -roud SPN cipher. s a result, we have obtaied - bit key used i the last roud of the cipher.

2 II. SUSTITUTION-PRMUTTION NTWORKS SPN [,,, ] is a special type of iterative cipher. or a Nr-roud ad N-bit block SPN, it requires (Nr+) N-bit sub-keys K, K,..., K Nr, K Nr+. ach roud cosists of three layers: key mixig, substitutio, liear trasformatio (permutatio). I the key mixig layer, N- bit roud iput is XOR-ed with the sub-key for that roud. I the substitutio layer, the output of mixig layer is partitioed ito sub-blocks of size which is the umber of bits becomig the iput to a bijective x substitutio box (S-box), deoted π S :{,} {, }. I the permutatio layer, the output of substitutio layer becomes a iput to the permutatio - deoted π P :{,... N } {,...N} ad permutatio layer is used to replace N-bit with a differet set of N-bit. I the last roud, permutatio is omitted sice it adds o cryptographic stregth. or decryptio, the sub-keys are applied i reverse order. The mappigs used i S-boxes are the iverse of the mappigs i the ecryptio etwork ad we should use the iverse liear trasformatio. I igure, we showed a SPN algorithm which we will use to describe ad to apply the differetial cryptaalysis. x u v w u v w P P Subkey K mixig S S S S Subkey K mixig S S S S Roud Roud I igure, x, u, v, w, ad y values, which are the places whe we proceed through the etwork, will make uderstadable the SPN algorithm ad differetial cryptaalysis. I Table ad Table, there are displayed the S-box ad permutatio for the SPN show i igure. The mappig chose for our cipher is selected from S-boxes of S: it is the first row of the third S-box. The values for permutatio are selected from ShiftRows trasformatio of the S. I S, ShiftRows trasformatio is used to permute the bytes of that roud. I our cipher, we have used this trasformatio to permute the bits of that roud. S also icludes a additioal liear trasformatio (Mixolums) i each roud. III. IRNTIL RYPTNLYSIS s we have said before differetial cryptaalysis [] is a chose plaitext attack ad it exploits the high probability of certai occurreces of plaitext differeces ad differeces ito the last roud of the cipher. ttacker ca choose plaitext strig ad costruct ciphertext strig i a attempt to derive the key. osider our cipher with iput X = [ XX...X N ] ad output Y = [ YY...Y N ]. ifferetial cryptaalysis seeks to exploit a sceario where a particular Y occurs give a particular iput differece X with a high probability P (ifferetial Probability). The pair ( X, Y ) is referred to as a differetial where X X = X or X X = X ad Y Y = Y or Y Y = Y. To realize differetial attack agaist our SPN, we should fid a differetial characteristic (sequece of iput ad output differeces) for oe roud with a high probability. We ca develop it for the whole cipher that is why output differece from oe roud correspods to the iput differece for the ext roud. or Nr-roud block cipher, we ca costruct (N r - )-roud differetial characteristic ad we ca derive the key used i the last roud of the cipher. To costruct a highly likely differetial characteristic, we should examie properties of oliear part of our cipher, S boxes, to determie the complete differetial characteristic. u v Subkey K mixig S S S S Roud Let S: Z Z be a bijective mappig. ifferetial Probability [] for the S is defied i equatio () where the a ad b are called iput ad output differece, respectively ad they are -bit vectors. y Subkey K mixig S P ( a, b) #{ x Z S( x) S( x a) = b} = () igure. Used SPN lgorithm (Nr =, N =, = ). Z : dimesioal vector over the fiite field Z = G() # : umber of elemets i set

3 Table. S-box Represetatio for SPN. Hex. Iput Output Hex. Table. Permutatio for SPN. Iput Output If we calculate iput ad output differeces for all probable (a, b) the we obtai a table which we call differece distributio table. It meas that we should calculate #{ x Z S( x) S( x a) = b} for all probable (a, b) values. The, we ca obtai P values easily by dividig values i the differece distributio table to. The differece distributio table for the S-box of Table is give i Table. Iput ifferece a, b Table. ifferece istributio Table Output ifferece IV. IRNTIL RYPTNLYSIS OR - ROUN SPN To derive the key i the last roud of the cipher, we should costruct a differetial characteristic with a high P so that we use a small umber of plaitext pairs. or -roud SPN, we ca costruct a -roud differetial characteristic ad attack sub-key K. I igure, a sample differetial characteristic we will use is show. We use the followig differece pairs of the S-box: S : a = b = with P = S : a = b = with P = I igure, while we proceed through the etwork, it is show that we obtai a relatio betwee P ad u with P = =,. I additio to that we ca obtai -bit key of -bit key, K, usig differetial cryptaalysis. ecause we are iterested i o-zero differeces i differetial output, u or Y. We refer to -bit key [K,, K,,...K, ], which we will attack to derive, as target partial sub-key. To realize differetial attack for our cipher, we should costruct some umber of chose plaitext pairs i which a pair cotais ( P, P, Y, Y ) ( plaitexts: P ad P, ciphertexts: Y ad Y ) where P = P P or P = P P. fter that, a partial decryptio of the last roud which ivolves the XOR of ciphertexts with the target partial sub-key bits ad ruig data backwards through the S boxes, where all possible values for the target key bits would be tried is executed. or our cipher, a cout is icremeted for all possible target sub-key values whe u is obtaied as i hexadecimal otatio for a pair. This process is executed for all possible target partial sub-keys ad for all chose plaitext pairs ad the partial sub-key value which has the largest cout is assumed to idicate the correct values of the sub-key bits. N value which is the umber of chose plaitext pairs ca be foud for our cipher usig equatio (). I equatio (), c is a small costat ad P is differetial probability for (Nr - ) roud differetial characteristic. c N = () P

4 I our study, if we choose c = the N value is foud as =. We have simulated our attack usig, chose plaitext pairs. P = [ ] x u characteristic) does ot occur are referred to as wrog pairs. stimated probability of the occurreces of right pairs for the cadidate partial sub-key ca be derived from equatio (). cout p = () Table. xperimetal Results for ifferetial ttack i which Probability (p) >. for Partial Sub-key Values v S S S S Roud Partial sub-key (Hex.) Number of right pairs for the cadidate partial sub-key (cout) Probability >, (p) w,, u, v S S S S Roud,,, w,, u,, v S S S S Roud,,, y, igure. Sample ifferetial haracteristic,,, P = [ ] u = [ ],,, v = [ ] w = [ ] u = [ ] v = [ ] w = [ ],,,,,,, u = [ ],, igure. Relatio betwee P ad u,, urig the cryptaalysis process, we will geerate chose plaitext pairs for which P = [ ] ad differetial characteristic illustrated will occur with high probability, P =,. We call such pairs for P as right pairs. O the cotrary, chose plaitext pairs for which the differetial characteristic (That meas u is i hexadecimal otatio for our sample differetial,,,,,,,,

5 I Table, experimetal results for differetial attack i which probability (p) >, for partial sub-key values are show. I our study, we have tried probable partial sub-key values ad showed some partial sub-key values which satisfy p >,. s a result, partial sub-key value which is i hexadecimal otatio is the largest cout value (or probability) ad the correct sub-key value. I additio to that we would expect the probability of the occurreces of the right pair to be P =, ad we foud experimetally the probability for the sub-key value gave p =,. Other large cout values like p =, for the sub-key value may be occurred for the reaso of the S-box properties. V. ONLUSION I our study, we applied differetial cryptaalysis method for -roud SPN ad obtaied -bit key [K,, K,,...K, ], which is i hexadecimal otatio, from the last roud of the cipher. Roughly speakig, secod liear trasformatio used i S - Mixolums which is -bit additioal liear trasformatio whe it is compared with a SPN structure - is very importat ad it makes impossible to fid differetial characteristics for differetial cryptaalysis ad liear approximatios for liear cryptaalysis that ivolve few active S-boxes (active S boxes - S boxes ivolved i the differetial characteristic or i the liear approximatio).. J. aeme, L. R. Kudse, ad V. Rijme, The lock cipher Square, Proceedigs of ast Software cryptio, New York: Spriger Verlag, pp. -,.. J. aeme, V. Rijme, S Proposal: Rijdael, irst dvaced cryptio oferece, aliforia,.. K. hu, S. Kim, S. Lee, S. H. Sug, S. Yoo, ifferetial ad liear cryptaalysis for -roud SPNs, Iformatio Processig Letters, lsevier,.. L. Keliher, Liear ryptaalysis of Substitutio- Permutatio Networks, PHd Thesis,.. L. R. Kudse, Trucated ad Higher Order ifferetials, ast Software cryptio, Spriger- Verlag, pp. -,.. M. Matsui, Liear ryptaalysis Method for S ipher, dvaces i ryptology - urocrypt ', Spriger-Verlag, pp. -,. RRNS.. R. Stiso, ryptography: Theory ad Practice, Secod ditio, R Press,... iham ad. Shamir, ifferetial ryptaalysis of S-like ryptosystems, Joural of ryptology, Vol, No, pp. -,... iham,. Shamir, ifferetial ryptaalysis of the ata cryptio Stadard, Spriger-Verlag,... iham,. iryukov, ad. Shamir, ryptaalysis of Skipjack reduced to rouds usig Impossible ifferetials, dvaces i ryptology- urocrypt, Spriger-Verlag, pp. -,.. IPS -, ata cryptio Stadard, ederal Iformatio Processig Stadard (IPS), Publicatio -, Natioal ureau of Stadards, U.S. epartmet of ommerce, Washigto.., October,.. IPS, dvaced cryptio Stadard, ederal Iformatio Processig Stadard (IPS), Publicatio, Natioal ureau of Stadards, U.S. epartmet of ommerce, Washigto.., November,.. H. M. Heys, S.. Tavares, Substitutio-Permutatio Networks Resistat to ifferetial ad Liear ryptaalysis, Joural of ryptology, Vol, No, pp. -,.. H. M. Heys, Tutorial o Liear ad ifferetial ryptaalysis, ryptologia, Vol, No pp. -,.