Symmetric Cryptanalytic Techniques. Sean Murphy ショーン マーフィー Royal Holloway

Transcription

1 Symmetric Cryptanalytic Techniques Sean Murphy ショーン マーフィー Royal Holloway

2 Block Ciphers Encrypt blocks of data using a key Iterative process ( rounds ) Modified by Modes of Operation Data Encryption Standard (DES) bit blocks, 56-bit key and 16 rounds Advanced Encryption Standard (AES) bit blocks, 128-bit key and 10 rounds Royal Holloway Kyushu University 29-FEB-16 2

3 Data Encryption Standard IP repeat for 16 rounds key f key f An initial permutation and its inverse have been added to the basic Feistel structure no swap in last round key f Royal Holloway IP -1 Kyushu University 29-FEB-16 3

4 Generic Block Cipher Cryptanalytic Techniques Differential Cryptanalysis Pairs of plaintexts with known relationship Chosen ciphertext analysis DES: Biham & Shamir 1992 Linear Cryptanalysis Random plaintext Known plaintext analysis DES: Matsui 1993 Royal Holloway Kyushu University 29-FEB-16 4

5 Differential Cryptanalysis I Block Cipher Round i: X mapped to f(x+k i ) Round i Input Pair: X i and X i +Δ i Round i Input difference is X i +(X i +Δ i ) = Δ i Input difference to f is (X i +k i )+(X i +Δ i +k i ) =Δ i Input difference to f does not depend on k i Round i Output Pair: f(x i +k i ) and f(x i +Δ i +k i ) Output difference is f(x i +k i )+f(x i +Δ i +k i ) Royal Holloway Kyushu University 29-FEB-16 5

6 Differential Cryptanalysis II Round i Difference Δ i becomes Difference Δ i+1 Probability p i Overall after R rounds Initial Difference Δ 0 becomes Difference Δ R Overall Probability p 1 p R Key can be recovered for large p 1 p R DES: Δ i = with p 2i =1/234. Royal Holloway Kyushu University 29-FEB-16 6

7 Boomerang Effect (1999) Δ è Δ* under E 0 prob. p 0 è * under E -1 1 prob. p 1 Choose P and P` Encrypt to C and C` Choose D and D` Decrypt to Q and Q` Claim: Q +Q`=Δ prob. p 02 p 2 1 P? Q 4 6 E 0 4 Q 0 6 P 0 E 0 6? 6 E 0 E 0 Y 4 Y 0 r 6 r 6? 4? X X 0 E 1 E 1? 6? 6 E 1 E 1? r D C? r C 0 D 0 Royal Holloway Kyushu University 29-FEB-16 7

8 Boomerang Analysis 4-Round DES E 0 and E 1 are 2 rounds of DES Δ=Δ*= and = *=1B Probabilities p 0 =p 1 =1/234 Probability of Boomerang Effect is 0 Claim based on conditional probability Assertion that Conditioning Event has rank 2n Actual Conditioning Event has rank 3n Royal Holloway Kyushu University 29-FEB-16 8

9 Linear Cryptanalysis I Block Cipher Round i: X mapped to f(x+k i ) Round i Input: X i Round i Input projection by a i is a it X i Input projection to f is a it (X+k i )=a it X i +a it k i Input difference to f does depends on a it k i Round i Output: f(x i +k i ) Round i Output projection is a T i+1 f(x i +k i ) Royal Holloway Kyushu University 29-FEB-16 9

10 Linear Cryptanalysis II Round i a it X i +a T i+1 f(x i +k i ) = a i T k i probability ½(1+ε i ) ε i is the imbalance and 2ε i is the bias Overall after R rounds a 0T X 0 +a T R X R = ct K Overall Probability ½(1+ε 0 ε R-1 ) Key can be recovered for large ε 0 ε R-1 DES: Chain of a 0 a R with ε 0 ε R Royal Holloway Kyushu University 29-FEB-16 10

11 The Linear Hull Effect A specific linear approximation, can be explained by multiple linear approximations each involving a different set of key bits. Such a set of linear characteristics with identical input and output masks is called a linear hull. If the set of keys used in different linear characteristics are independent, then this effect might considerably re- duce the average bias of [a single linear] expression. Nyberg s paper [1994] shows that attacks will typically benefit from a linear hull effect.. Encyclopedia of Cryptography and Security Royal Holloway Kyushu University 29-FEB-16 11

12 Linear Hull Terminology Pot(a,b;k) = P(a T X+b T E(X,k)=0)-½ 2 Potential of a T X+b T E(X,k) for key k Pot(a,b,c) = P(a T X+b T E(X,K)+c T K=0)-½ 2 Potential of a T X+b T E(X,K)+c T K Approximate Linear Hull ALH(a,b) Fundamental Theorem Average Potential of a T X+b T E(X,k) over the keys k is the potential of the corresponding Approximate Linear Hull ALH(a,b) Royal Holloway Kyushu University 29-FEB-16 12

13 Simultaneous Approximations Independent Linear Approximations a T X+b T E(X,K) = c T K probability ½(1+ε) a T X+b T E(X,K) = γ T K probability ½(1+δ) Addition of Approximations 0 = (c+γ) T K probability ½(1+εδ) Information about one key bit with no data Such linear approximations cannot be statistically independent Royal Holloway Kyushu University 29-FEB-16 13

14 Fundamental Probability q(k)=p k (a T X+b T E(X,k)=0) Fundamental Theorem asserts equality of E [ ((q(k)-½) 2 ) -1 ] E [ (q(k)-½) 2 ] -1 Jensen s Inequality for convex funtion Ψ Ψ(E(Z)) E(Ψ(Z)) Inversion of positive numbers is convex Royal Holloway Kyushu University 29-FEB-16 14

15 A Linear Hull Example Fundamental Probability q(k)=p k (a T X+b T E(X,k)=0) =½(1+(-1) c.k ε+(-1) γ.k ε) Alternative Expression q(k)=½(1+2ε) if c T k = γ T k =0 q(k)=½(1-2ε) if c T k = γ T k = 1 q(k)=½ if c T k γ T k Linear Hull asserts possible to find c T k and γ T k Royal Holloway Kyushu University 29-FEB-16 15

16 Cryptographic Conclusions Probabilistic assumptions matter Probabilistic reasoning matters Fundamental errors in simple situations Royal Holloway Kyushu University 29-FEB-16 16