Cube Analysis of KATAN Family of Block Ciphers
|
|
- Robyn Newman
- 5 years ago
- Views:
Transcription
1 Cube Analysis of KATAN Family of Block Ciphers Speaker: Bingsheng Zhang University of Tartu, Estonia This talk covers partial results of the paper Algebraic, AIDA/Cube and Side Channel Analysis of KATAN Family of Block Ciphers by Gregory V. Bard, Nicolas T. Courtois, Jorge Nakahara Jr, Pouyan Sepehrdad and Bingsheng Zhang S
2 Outline S Introduction to AIDA/Cube attacks S KATAN family of block ciphers S Cube attack on reduced-round KATAN family S Side-channel attack against KATAN32 S Conclusion and further work
3 Introduction to Cube Attacks S Cube attack (see eprint.iacr.org/2008/385) is also claimed to be a remake of AIDA (Algebraic IV Differential Attack, see eprint.iacr.org/2007/413) S In this talk, we refer to Dinur and Shamir s version. S Cube attack is generic key-recovery attack that can be applied to cryptosystems in a black-box setting, i.e. the internal structure of the target cipher is unknown.
4 Introduction to Cube Attacks S A cryptosystem can be represented as multivariable polynomial over GF(2) in Algebraic Normal Form (ANF). x 1...x n k1. p i (x 1,...,x n,k 1,...,k m )=y i k m y 1...y n
5 Introduction to Cube Attacks S In chosen-plaintext/chosen-iv setting, the adversary can query p i (x 1,...,x n,k 1,...,k m )=y i with arbitrary public variables and fixed secret key variables, obtaining y i. x i S On the other hand, the polynomials can be decomposed as: p(x 1,...,x n,k 1,...,k m )=t I q I + r(x 1,...,x n,k 1,...,k m ) where t I = Y x i, for i 2 I [n] i q I does not contain x i as they are factored out. (x 2 i = x i )
6 Introduction to Cube Attacks S For example, let polynomial p(x 1,x 2,x 3,k 1,k 2,k 3,k 4 )= x 2 x 3 k 3 + x 1 x 2 k 1 + x 2 k 4 + x 1 x 3 k 2 k 3 + x 1 x 2 k 2 +1 S Let I = {1, 2}, so that t I = x 1 x 2 and we have: p(x 1,x 2,x 3,k 1,k 2,k 3,k 4 )=x 1 x 2 q I + r where q I = k 1 + k 2 and r = x 2 x 3 k 3 + x 2 k 4 + x 1 x 3 k 2 k 3 +1
7 Introduction to Cube Attacks S Main observation of cube attack: sum over GF(2) of all evaluations of p by assigning all possible binary values to the variables in I (and fixed value, usually 0, to all the public M variables not in I) is exactly q I. p(x 1,x 2,x 3,k 1,k 2,k 3,k 4 ) = p(0, 0,x 3,k 1,k 2,k 3,k 4 )+ x i,i2i p(0, 1,x 3,k 1,k 2,k 3,k 4 )+ p(1, 0,x 3,k 1,k 2,k 3,k 4 )+ p(1, 1,x 3,k 1,k 2,k 3,k 4 ) = k 1 + k 2 = q I
8 Introduction to Cube Attacks S Offline phase: S Gathering enough linear equations for key variables. S Linearity Test: S Extract the equations. f(0) + f(a)+f(b) =f(a + b) S Online phase: S Query the gathered equations S Perform some cheap computations to recover the key.
9 KATAN Cipher Family S KATAN is a family of lightweight, hardware-oriented block ciphers. S Three variants: 32, 48, 64 (block size). S 80-bit key and 254 rounds. S The design was inspired by Trivium.
10 KATAN Cipher Family S KATAN consists of two LFSR s, called L 1 and L 2. S Two nonlinear Boolean functions, f a and f b. S For KATAN48, f a and f b are applied twice per round, but the same pair of key bits are reused. S For KATAN64, f a and f b are applied 3 times.
11 KATAN Cipher Family f a (L 1 )=L 1 [x 1 ]+L 1 [x 2 ]+(L 1 [x 3 ] L 1 [x 4 ]+L 1 [x 5 ] IR + k a ) f b (L 2 )=L 2 [y 1 ]+L 2 [y 2 ]+(L 2 [y 3 ] L 2 [y 4 ]+L 2 [y 5 ] L 2 [y 6 ]+k b )
12 KATAN Cipher Family
13 KATAN Cipher Family S Key Schedule is a linear mapping that expands 80-bit key to 508 subkey bits according to ( K i, for 0 apple i apple 79 k i = k i 80 + k i 61 + k i 50 + k i 13, otherwise S The subkey of i-th round is k a k b = K 2i K 2i+1 S At least 40 rounds is needed before complete key diffusion.
14 Cube Attack Results Cipher # Rounds Time Data Attack KATAN CP AIDA/Cube CP AIDA/Cube KATAN CP AIDA/Cube KATAN CP AIDA/Cube Table 1: AIDA / Cube attack complexities on KATAN family.
15 Cube Attack Results Maxterm Degree Cube equation Cipher bit 0CB0C29808C k 5 c 44 2E A 16 k 4 c 7 10E k 1 + k 5 + k 12 c 47 0A k 8 + k 10 + k 19 c CC02C k 2 c 5 AE0C k 9 c C00 16 k 1 c 44 0E0864A20828A k 0 c k 7 c B12812A k 3 c A0D00305E08A 16 k 3 + k 10 c A k 6 c 9 439C00A k 3 + k 8 + k 17 c A0B k 1 + k 8 c C084049C k 0 + k 1 + k 2 + k 8 + k 11 c 8 3C C k 4 + k 15 c FD k 5 + k 9 + k 18 c 54
16 Side-channel Attack Against KATAN32 S Side-channel model S We use the side-channel cube attack model of Shamir. S Internal cipher data leaks after r round, r<254 S The data is supposed to be captured by some side channel information, such as power, timing analysis or electromagnetic emanations (a strong assumption). S We need only one bit of intermediate state. (Bit 19 after 40 rounds of KATAN32)
17 Side-channel Attack Against KATAN32 Cipher # Rounds Time Data Attack KATAN CP Side-Channel Table 1: Side-Channel attack on KATAN32
18 Side-channel Attack Against KATAN32 Maxterm Degree Cube equation Cipher bit k 4 c E14C 12 k 15 c 19 1EA k 5 +1 c 19 E k 1 + k 16 c 19 4A8E k 0 + k c 19 EBD k 3 + k c 19 A0867A0C 12 k 14 + k c 19 C0C34C43 12 k 4 + k 10 + k 19 c 19 E2A k 11 + k 15 + k 23 c 19 9C k 2 + k 7 + k 11 + k 16 + k 24 + k 26 c 19 bd30cb11 15 k 13 c 19 7c k 18 c 19 2cd5f k 6 + k c 19 b k 3 + k 18 + k 23 c 19
19 Strange Phenomena S Breaking 77 rounds of KATAN32 is much easier than 76 rounds. S attack on 76 rounds: 5.64 times faster than brute force. S attack on 77 rounds: times faster than brute force. S attack on 78 rounds: 3.49 times faster than brute force.
20 Conclusion and further work S Cube attacks for reduced-round KATAN32, KATAN48 and KATAN64. S Side-channel attack against full-round KATAN32. S After the acceptance of our paper, we tried to similar attack methods against KTANTAN block ciphers. S More rounds are broken since the key schedule is weaker.
21 Acknowledgement S Thanks for useful comments from reviewers, e.g. On page 3, you write close to be(ing) overdefined : that means, in fact, underdefined? It sounds to me like the girl who is a little bit pregnant.
22 Thanks
Fault Analysis of the KATAN Family of Block Ciphers
Fault Analysis of the KATAN Family of Block Ciphers Shekh Faisal Abdul-Latip 1,2, Mohammad Reza Reyhanitabar 1, Willy Susilo 1, and Jennifer Seberry 1 1 Centre for Computer and Information Security Research,
More informationAlgebraic, AIDA/Cube and Side Channel Analysis of KATAN Family of Block Ciphers
Algebraic, AIDA/Cube and Side Channel Analysis of KATAN Family of Block Ciphers Gregory V. Bard 1, Nicolas T. Courtois 2, Jorge Nakahara Jr 3, Pouyan Sepehrdad 3, and Bingsheng Zhang 4 1 Fordham University,
More informationMILP-based Cube Attack on the Reduced-Round WG-5 Lightweight Stream Cipher
MILP-based Cube Attack on the Reduced-Round WG-5 Lightweight Stream Cipher Raghvendra Rohit, Riham AlTawy, & Guang Gong Department of Electrical and Computer Engineering, University of Waterloo Waterloo,
More informationCristina Nita-Rotaru. CS355: Cryptography. Lecture 9: Encryption modes. AES
CS355: Cryptography Lecture 9: Encryption modes. AES Encryption modes: ECB } Message is broken into independent blocks of block_size bits; } Electronic Code Book (ECB): each block encrypted separately.
More informationCube Attacks on Stream Ciphers Based on Division Property
Cube Attacks on Stream Ciphers Based on Division Property Chaoyun Li ESAT-COSIC, KU Leuven 12-10-2017, Crete Chaoyun Li (ESAT-COSIC, KU Leuven) Cube attacks 12-10-2017, Crete 1 / 23 Plan 1 Cube Attack:
More informationChosen IV Statistical Analysis for Key Recovery Attacks on Stream Ciphers
Chosen IV Statistical Analysis for Key Recovery Attacks on Stream Ciphers Simon Fischer 1, Shahram Khazaei 2, and Willi Meier 1 1 FHNW and 2 EPFL (Switzerland) AfricaCrypt 2008, Casablanca - June 11-14
More informationCube attack in finite fields of higher order
Cube attack in finite fields of higher order Andrea Agnesse 1 Marco Pedicini 2 1 Dipartimento di Matematica, Università Roma Tre Largo San Leonardo Murialdo 1, Rome, Italy 2 Istituto per le Applicazioni
More informationPractical Complexity Cube Attacks on Round-Reduced Keccak Sponge Function
Practical Complexity Cube Attacks on Round-Reduced Keccak Sponge Function Itai Dinur 1, Pawe l Morawiecki 2,3, Josef Pieprzyk 4 Marian Srebrny 2,3, and Micha l Straus 3 1 Computer Science Department, École
More informationOn the Security of NOEKEON against Side Channel Cube Attacks
On the Security of NOEKEON against Side Channel Cube Attacks Shekh Faisal Abdul-Latip 1,2, Mohammad Reza Reyhanitabar 1, Willy Susilo 1, and Jennifer Seberry 1 1 Center for Computer and Information Security
More informationLinear Extension Cube Attack on Stream Ciphers ABSTRACT 1. INTRODUCTION
Malaysian Journal of Mathematical Sciences 9(S) June: 139-156 (015) Special ssue: The 4 th nternational Cryptology and nformation Security Conference 014 (Cryptology 014) MALAYSAN JOURNAL OF MATHEMATCAL
More informationAlgebraic Immunity of S-boxes and Augmented Functions
Algebraic Immunity of S-boxes and Augmented Functions Simon Fischer and Willi Meier S. Fischer and W. Meier AI of Sbox and AF 1 / 23 Outline 1 Algebraic Properties of S-boxes 2 Augmented Functions 3 Application
More informationEnhancing the Signal to Noise Ratio
Enhancing the Signal to Noise Ratio in Differential Cryptanalysis, using Algebra Martin Albrecht, Carlos Cid, Thomas Dullien, Jean-Charles Faugère and Ludovic Perret ESC 2010, Remich, 10.01.2010 Outline
More informationAlgebraic Aspects of Symmetric-key Cryptography
Algebraic Aspects of Symmetric-key Cryptography Carlos Cid (carlos.cid@rhul.ac.uk) Information Security Group Royal Holloway, University of London 04.May.2007 ECRYPT Summer School 1 Algebraic Techniques
More informationCube Testers and Key-Recovery Attacks on Reduced-Round MD6 and Trivium
Cube Testers and Key-Recovery Attacks on Reduced-Round MD6 and Trivium Jean-Philippe Aumasson, Itai Dinur, Willi Meier, Adi Shamir 1 / 27 Cube attacks 2 / 27 Timeline Aug 08: Shamir presents cube attacks
More informationKey Recovery with Probabilistic Neutral Bits
ESC 7.1. 11. 1. 2007 Key Recovery with Probabilistic Neutral Bits Simon Fischer 1, Shahram Khazaei 2 and Willi Meier 1 1 FHNW, Windisch, Switzerland 2 EPFL, Lausanne, Switzerland Outline Motivation Probabilistic
More informationCube Attacks on Non-Blackbox Polynomials Based on Division Property (Full Version)
Cube Attacks on Non-Blackbox Polynomials Based on Division Property (Full Version) Yosuke Todo 1, Takanori Isobe 2, Yonglin Hao 3, and Willi Meier 4 1 NTT Secure Platform Laboratories, Tokyo 180-8585,
More informationCryptanalysis of the Light-Weight Cipher A2U2 First Draft version
Cryptanalysis of the Light-Weight Cipher A2U2 First Draft version Mohamed Ahmed Abdelraheem, Julia Borghoff, Erik Zenner Technical University of Denmark, DK-2800 Kgs. Lyngby, Denmark {M.A.Abdelraheem,J.Borghoff,E.Zenner}@mat.dtu.dk
More informationThe Advanced Encryption Standard
Lecturers: Mark D. Ryan and David Galindo. Cryptography 2017. Slide: 48 The Advanced Encryption Standard Successor of DES DES considered insecure; 3DES considered too slow. NIST competition in 1997 15
More informationOptimized Interpolation Attacks on LowMC
Optimized Interpolation Attacks on LowMC Itai Dinur 1, Yunwen Liu 2, Willi Meier 3, and Qingju Wang 2,4 1 Département d Informatique, École Normale Supérieure, Paris, France 2 Dept. Electrical Engineering
More informationDesign of a New Stream Cipher: PALS
Design of a New Stream Cipher: PALS Mohammadreza Ashouri, University of Potsdam, Germany Ashouri@uni-potsdam.de Abstract In this paper, a new stream cipher is designed as a clock-controlled one, but with
More informationOn the Design of Trivium
On the Design of Trivium Yun Tian, Gongliang Chen, Jianhua Li School of Information Security Engineering, Shanghai Jiaotong University, China ruth tian@sjtu.edu.cn, chengl@sjtu.edu.cn, lijh888@sjtu.edu.cn
More informationAnother View on Cube Attack, Cube Tester, AIDA and Higher Order Differential Cryptanalysis
Another View on Cube Attack, Cube Tester, AIDA and Higher Order Differential Cryptanalysis Bo Zhu 1, Guang Gong 1, Xuejia Lai 2 and Kefei Chen 2 1 Department of Electrical and Computer Engineering, University
More informationNumerical Solvers in Cryptanalysis
Numerical Solvers in Cryptanalysis M. Lamberger, T. Nad, V. Rijmen Institute for Applied Information Processing and Communications (IAIK) Graz University of Technology Inffeldgasse 16a, A-8010 Graz, Austria
More informationA New Distinguisher on Grain v1 for 106 rounds
A New Distinguisher on Grain v1 for 106 rounds Santanu Sarkar Department of Mathematics, Indian Institute of Technology, Sardar Patel Road, Chennai 600036, India. sarkar.santanu.bir@gmail.com Abstract.
More informationDifferential Fault Analysis of Trivium
Differential Fault Analysis of Trivium Michal Hojsík 1,2 and Bohuslav Rudolf 2,3 1 Department of Informatics, University of Bergen, N-5020 Bergen, Norway 2 Department of Algebra, Charles University in
More informationBlock Cipher Cryptanalysis: An Overview
0/52 Block Cipher Cryptanalysis: An Overview Subhabrata Samajder Indian Statistical Institute, Kolkata 17 th May, 2017 0/52 Outline Iterated Block Cipher 1 Iterated Block Cipher 2 S-Boxes 3 A Basic Substitution
More informationThe Hash Function JH 1
The Hash Function JH 1 16 January, 2011 Hongjun Wu 2,3 wuhongjun@gmail.com 1 The design of JH is tweaked in this report. The round number of JH is changed from 35.5 to 42. This new version may be referred
More informationIntroduction. CSC/ECE 574 Computer and Network Security. Outline. Introductory Remarks Feistel Cipher DES AES
CSC/ECE 574 Computer and Network Security Topic 3.1 Secret Key Cryptography Algorithms CSC/ECE 574 Dr. Peng Ning 1 Outline Introductory Remarks Feistel Cipher DES AES CSC/ECE 574 Dr. Peng Ning 2 Introduction
More informationImproved Division Property Based Cube Attacks Exploiting Algebraic Properties of Superpoly (Full Version)
Improved Division Property Based Cube Attacks Exploiting Algebraic Properties of Superpoly (Full Version) Qingju Wang 1,2,3, Yonglin Hao 4, Yosuke Todo 5, Chaoyun Li 6, Takanori Isobe 7, and Willi Meier
More informationSome Randomness Experiments on TRIVIUM
1 Some Randomness Experiments on TRIVIUM Technical Report No. ASU/2014/3 Dated : 14 th March, 2014 Subhabrata Samajder Applied Statistics Unit Indian Statistical Institute 203, B. T. Road, Kolkata 700108,
More informationAlgebraic attack on stream ciphers Master s Thesis
Comenius University Faculty of Mathematics, Physics and Informatics Department of Computer Science Algebraic attack on stream ciphers Master s Thesis Martin Vörös Bratislava, 2007 Comenius University Faculty
More informationCorrelation Cube Attacks: From Weak-Key Distinguisher to Key Recovery
Correlation Cube Attacks: From Weak-Key Distinguisher to Key Recovery Meicheng Liu, Jingchun Yang, Wenhao Wang, and Dongdai Lin State Key Laboratory of Information Security, Institute of Information Engineering,
More informationAnalysing Relations involving small number of Monomials in AES S- Box
Analysing Relations involving small number of Monomials in AES S- Box Riddhi Ghosal Indian Statistical Institute Email: postboxriddhi@gmail.com June 13, 2017 Abstract In the present day, AES is one the
More informationQuantum Differential and Linear Cryptanalysis
Quantum Differential and Linear Cryptanalysis Marc Kaplan 1,2 Gaëtan Leurent 3 Anthony Leverrier 3 María Naya-Plasencia 3 1 LTCI, Télécom ParisTech 2 School of Informatics, University of Edinburgh 3 Inria
More information7 Cryptanalysis. 7.1 Structural Attacks CA642: CRYPTOGRAPHY AND NUMBER THEORY 1
CA642: CRYPTOGRAPHY AND NUMBER THEORY 1 7 Cryptanalysis Cryptanalysis Attacks such as exhaustive key-search do not exploit any properties of the encryption algorithm or implementation. Structural attacks
More informationAnalysis of Modern Stream Ciphers
Analysis of Modern Stream Ciphers Josef Pieprzyk Centre for Advanced Computing Algorithms and Cryptography, Macquarie University, Australia CANS - Singapore - December 2007 estream Outline 1. estream Project
More informationDeterministic Cube Attacks:
Deterministic Cube Attacks: A New Method to Recover Superpolies in Practice Chen-Dong Ye and Tian Tian National Digital Switching System Engineering & Technological Research Center, P.O. Box 407, 62 Kexue
More informationStream ciphers. Pawel Wocjan. Department of Electrical Engineering & Computer Science University of Central Florida
Stream ciphers Pawel Wocjan Department of Electrical Engineering & Computer Science University of Central Florida wocjan@eecs.ucf.edu Definition of block ciphers Block ciphers: crypto work horse n bits
More informationCryptanalysis of SP Networks with Partial Non-Linear Layers
Cryptanalysis of SP Networks with Partial Non-Linear Layers Achiya Bar-On 1, Itai Dinur 2, Orr Dunkelman 3, Nathan Keller 1, Virginie Lallemand 4, and Boaz Tsaban 1 1 Bar-Ilan University, Israel 2 École
More informationBreaking Symmetric Cryptosystems Using Quantum Algorithms
Breaking Symmetric Cryptosystems Using Quantum Algorithms Gaëtan Leurent Joined work with: Marc Kaplan Anthony Leverrier María Naya-Plasencia Inria, France FOQUS Workshop Gaëtan Leurent (Inria) Breaking
More informationDivision Property: a New Attack Against Block Ciphers
Division Property: a New Attack Against Block Ciphers Christina Boura (joint on-going work with Anne Canteaut) Séminaire du groupe Algèbre et Géometrie, LMV November 24, 2015 1 / 50 Symmetric-key encryption
More informationAlgebraic Techniques in Differential Cryptanalysis
Algebraic Techniques in Differential Cryptanalysis Martin Albrecht and Carlos Cid Information Security Group, Royal Holloway, University of London FSE 2009, Leuven, 24.02.2009 Martin Albrecht and Carlos
More informationA survey of algebraic attacks against stream ciphers
A survey of algebraic attacks against stream ciphers Frederik Armknecht NEC Europe Ltd. Network Laboratories frederik.armknecht@netlab.nec.de Special semester on Gröbner bases and related methods, May
More informationECS 189A Final Cryptography Spring 2011
ECS 127: Cryptography Handout F UC Davis Phillip Rogaway June 9, 2011 ECS 189A Final Cryptography Spring 2011 Hints for success: Good luck on the exam. I don t think it s all that hard (I do believe I
More informationStream ciphers I. Thomas Johansson. May 16, Dept. of EIT, Lund University, P.O. Box 118, Lund, Sweden
Dept. of EIT, Lund University, P.O. Box 118, 221 00 Lund, Sweden thomas@eit.lth.se May 16, 2011 Outline: Introduction to stream ciphers Distinguishers Basic constructions of distinguishers Various types
More informationAlgebraic Analysis of the Simon Block Cipher Family
Algebraic Analysis of the Simon Block Cipher amily Håvard Raddum Simula Research Laboratory, Norway Abstract. This paper focuses on algebraic attacks on the Simon family of block ciphers. We construct
More informationAdvanced Algebraic Attack on Trivium November 26, 2015 Frank-M. Quedenfeld 1 and Christopher Wolf 2 1 University of Technology Braunschweig, Germany
Advanced Algebraic Attack on Trivium November 26, 2015 Frank-M. Quedenfeld 1 and Christopher Wolf 2 1 University of Technology Braunschweig, Germany frank.quedenfeld@googlemail.com 2 Research center Jülich,
More informationMultiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs
Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs Alex Biryukov 1,2, Dmitry Khovratovich 2, Léo Perrin 2 1 CSC, University of Luxembourg 2 SnT, University of Luxembourg https://www.cryptolux.org
More informationARMADILLO: a Multi-Purpose Cryptographic Primitive Dedicated to Hardware
: a Multi-Purpose Cryptographic Primitive Dedicated to Stéphane Badel 1, Nilay Dağtekin 1, Jorge Nakahara Jr 1, Khaled Ouafi 1, Nicolas Reffé 2, Pouyan Sepehrdad 1, Petr Sušil 1, Serge Vaudenay 1 1 EPFL,
More informationHow Fast can be Algebraic Attacks on Block Ciphers?
How Fast can be Algebraic Attacks on Block Ciphers? Nicolas T. Courtois Axalto mart Cards, 36-38 rue de la Princesse BP 45, 78430 Louveciennes Cedex, France http://www.nicolascourtois.net courtois@minrank.org
More informationExtended Criterion for Absence of Fixed Points
Extended Criterion for Absence of Fixed Points Oleksandr Kazymyrov, Valentyna Kazymyrova Abstract One of the criteria for substitutions used in block ciphers is the absence of fixed points. In this paper
More informationStructural Cryptanalysis of SASAS
tructural Cryptanalysis of AA Alex Biryukov and Adi hamir Computer cience department The Weizmann Institute Rehovot 76100, Israel. Abstract. In this paper we consider the security of block ciphers which
More informationSearching Cubes for Testing Boolean Functions and Its Application to Trivium
Searching Cubes for Testing Boolean Functions and Its Application to Trivium Meicheng Liu, Dongdai Lin and Wenhao Wang State Key Laboratory of Information Security Institute of Information Engineering
More informationEssential Algebraic Structure Within the AES
Essential Algebraic Structure Within the AES Sean Murphy and Matthew J.B. Robshaw Information Security Group, Royal Holloway, University of London, Egham, Surrey, TW20 0EX, U.K. s.murphy@rhul.ac.uk m.robshaw@rhul.ac.uk
More informationAlgebraic Techniques in Differential Cryptanalysis
Algebraic Techniques in Differential Cryptanalysis Martin Albrecht and Carlos Cid Information Security Group, Royal Holloway, University of London Egham, Surrey TW20 0EX, United Kingdom {M.R.Albrecht,carlos.cid}@rhul.ac.uk
More informationCube Testers and Key Recovery Attacks On Reduced-Round MD6 and Trivium
Cube Testers and Key Recovery Attacks On Reduced-Round MD6 and Trivium Jean-Philippe Aumasson 1, Itai Dinur 2, Willi Meier 1, and Adi Shamir 2 1 FHNW, Windisch, Switzerland 2 Computer Science Department,
More informationCryptanalysis of Patarin s 2-Round Public Key System with S Boxes (2R)
Cryptanalysis of Patarin s 2-Round Public Key System with S Boxes (2R) Eli Biham Computer Science Department Technion Israel Institute of Technology Haifa 32000, Israel biham@cs.technion.ac.il http://www.cs.technion.ac.il/~biham/
More informationBlock Ciphers and Systems of Quadratic Equations
Block Ciphers and Systems of Quadratic Equations Alex Biryukov and Christophe De Cannière Katholieke Universiteit Leuven, Dept. ESAT/SCD-COSIC, Kasteelpark Arenberg 10, B 3001 Leuven-Heverlee, Belgium
More informationStream Ciphers: Cryptanalytic Techniques
Stream Ciphers: Cryptanalytic Techniques Thomas Johansson Department of Electrical and Information Technology. Lund University, Sweden ECRYPT Summer school 2007 (Lund University) Stream Ciphers: Cryptanalytic
More informationImproved Conditional Cube Attacks on Keccak Keyed Modes with MILP Method
Improved Conditional Cube Attacks on Keccak Keyed Modes with MILP Method Zheng Li 1, Wenquan Bi 1, Xiaoyang Dong 2, and Xiaoyun Wang 1,2 1 Key Laboratory of Cryptologic Technology and Information Security,
More informationRevisit and Cryptanalysis of a CAST Cipher
2017 3rd International Conference on Electronic Information Technology and Intellectualization (ICEITI 2017) ISBN: 978-1-60595-512-4 Revisit and Cryptanalysis of a CAST Cipher Xiao Zhou, Jingwei Li, Xuejia
More informationACORN: A Lightweight Authenticated Cipher (v3)
ACORN: A Lightweight Authenticated Cipher (v3) Designer and Submitter: Hongjun Wu Division of Mathematical Sciences Nanyang Technological University wuhongjun@gmail.com 2016.09.15 Contents 1 Specification
More informationCHAPTER 5 A BLOCK CIPHER INVOLVING A KEY APPLIED ON BOTH THE SIDES OF THE PLAINTEXT
82 CHAPTER 5 A BLOCK CIPHER INVOLVING A KEY APPLIED ON BOTH THE SIDES OF THE PLAINTEXT 83 5.1 Introduction In a pioneering paper, Hill [5] developed a block cipher by using the modular arithmetic inverse
More informationDynamic Cube Attack on 105 round Grain v1
Noname manuscript No. (will be inserted by the editor) Dynamic Cube Attack on 105 round Grain v1 Subhadeep Banik Received: date / Accepted: date Abstract As far as the Differential Cryptanalysis of reduced
More informationLecture 10 - MAC s continued, hash & MAC
Lecture 10 - MAC s continued, hash & MAC Boaz Barak March 3, 2010 Reading: Boneh-Shoup chapters 7,8 The field GF(2 n ). A field F is a set with a multiplication ( ) and addition operations that satisfy
More informationA Five-Round Algebraic Property of the Advanced Encryption Standard
A Five-Round Algebraic Property of the Advanced Encryption Standard Jianyong Huang, Jennifer Seberry and Willy Susilo Centre for Computer and Information Security Research (CCI) School of Computer Science
More informationTable Of Contents. ! 1. Introduction to AES
1 Table Of Contents! 1. Introduction to AES! 2. Design Principles behind AES Linear Cryptanalysis Differential Cryptanalysis Square Attack Biclique Attack! 3. Quantum Cryptanalysis of AES Applying Grover
More informationWinter 2008 Introduction to Modern Cryptography Benny Chor and Rani Hod. Assignment #2
0368.3049.01 Winter 2008 Introduction to Modern Cryptography Benny Chor and Rani Hod Assignment #2 Published Sunday, February 17, 2008 and very slightly revised Feb. 18. Due Tues., March 4, in Rani Hod
More informationDifferential properties of power functions
Differential properties of power functions Céline Blondeau, Anne Canteaut and Pascale Charpin SECRET Project-Team - INRIA Paris-Rocquencourt Domaine de Voluceau - B.P. 105-8153 Le Chesnay Cedex - France
More informationNew Distinguishers for Reduced Round Trivium and Trivia-SC using Cube Testers (Extended Abstract)
New Distinguishers for Reduced Round Trivium and Trivia-SC using Cube Testers (Extended Abstract) Anubhab Baksi 1, Subhamoy Maitra 1, Santanu Sarkar 2 1 Indian Statistical Institute, 203 B. T. Road, Kolkata
More informationInvariant Subspace Attack Against Midori64 and The Resistance Criteria for S-box Designs
Invariant Subspace Attack Against Midori64 and The Resistance Criteria for S-box Designs Jian Guo 1, Jeremy Jean 2, Ivica Nikolić 1, Kexin Qiao 3, Yu Sasaki 4, and Siang Meng Sim 1 1. Nanyang Technological
More informationAn Algebraic Approach to NTRU (q = 2 n ) via Witt Vectors and Overdetermined Systems of Nonlinear Equations
An Algebraic Approach to NTRU (q = 2 n ) via Witt Vectors and Overdetermined Systems of Nonlinear Equations J.H. Silverman 1, N.P. Smart 2, and F. Vercauteren 2 1 Mathematics Department, Box 1917, Brown
More informationSecret Key Systems (block encoding) Encrypting a small block of text (say 64 bits) General considerations for cipher design:
Secret Key Systems (block encoding) Encrypting a small block of text (say 64 bits) General considerations for cipher design: Secret Key Systems Encrypting a small block of text (say 64 bits) General considerations
More informationLinear Approximations for 2-round Trivium
Linear Approximations for 2-round Trivium Meltem Sönmez Turan 1, Orhun Kara 2 1 Institute of Applied Mathematics, Middle East Technical University Ankara, Turkey msonmez@metu.edu.tr 2 TUBITAK-UEKAE, Gebze,
More informationVirtual isomorphisms of ciphers: is AES secure against differential / linear attack?
Alexander Rostovtsev alexander. rostovtsev@ibks.ftk.spbstu.ru St. Petersburg State Polytechnic University Virtual isomorphisms of ciphers: is AES secure against differential / linear attack? In [eprint.iacr.org/2009/117]
More informationEfficient Hamming Weight-based Side-Channel Cube Attacks on PRESENT
Efficient Hamming Weight-based Side-Channel Cube Attacks on PRESENT Xinjie Zhao a,, Shize Guo b, Fan Zhang c, Tao Wang a, Zhijie Shi c a Department of Computer Engineering, Ordnance Engineering College,
More informationAES side channel attacks protection using random isomorphisms
Rostovtsev A.G., Shemyakina O.V., St. Petersburg State Polytechnic University AES side channel attacks protection using random isomorphisms General method of side-channel attacks protection, based on random
More informationUNDERSTANDING THE COST OF GROVER'S ALGORITHM FOR FINDING A SECRET KEY
UNDERSTANDING THE COST OF GROVER'S ALGORITHM FOR FINDING A SECRET KEY Rainer Steinwandt 1,2 Florida Atlantic University, USA (joint work w/ B. Amento, M. Grassl, B. Langenberg 2, M. Roetteler) 1 supported
More informationMultiplicative Complexity Gate Complexity Cryptography and Cryptanalysis
Multiplicative Complexity Gate Complexity Cryptography and Cryptanalysis Nicolas T. Courtois 1,2, Daniel Hulme 1,2, Theodosis Mourouzis 1 1 University College London, UK 2 NP-Complete Ltd, UK Two Interesting
More informationIntroducing a new variant of fast algberaic attacks and minimizing their successive data complexity
Introducing a new variant of fast algberaic attacks and minimizing their successive data complexity Frederik Armknecht 1 Gwénolé Ars 2 1 Theoretische Informatik, University of Mannheim, Germany 2 IRMAR,
More informationMatrix Power S-Box Construction
Matrix Power S-Box Construction Eligijus Sakalauskas a and Kestutis Luksys b Department of Applied Mathematics, Kaunas University of Technology, Studentu g. 50, 52368 Kaunas, Lithuania a Eligijus.Sakalauskas@ktu.lt
More informationAlgebraic Precomputations in Differential and Integral Cryptanalysis
Algebraic Precomputations in Differential and Integral Cryptanalysis Martin Albrecht 1, Carlos Cid 1, Thomas Dullien 2, Jean-Charles Faugère 3, and Ludovic Perret 3 1 Information Security Group, Royal
More informationAlgebraic Attacks and Stream Ciphers
November 25 th, 24 Algebraic Attacks and Stream Ciphers Helsinki University of Technology mkivihar@cc.hut.fi Overview Stream ciphers and the most common attacks Algebraic attacks (on LSFR-based ciphers)
More informationComputational and Algebraic Aspects of the Advanced Encryption Standard
Computational and Algebraic Aspects of the Advanced Encryption Standard Carlos Cid, Sean Murphy and Matthew Robshaw Information Security Group, Royal Holloway, University of London, Egham, Surrey, TW20
More informationFunctions on Finite Fields, Boolean Functions, and S-Boxes
Functions on Finite Fields, Boolean Functions, and S-Boxes Claude Shannon Institute www.shannoninstitute.ie and School of Mathematical Sciences University College Dublin Ireland 1 July, 2013 Boolean Function
More informationMILP-based Cube Attack on the Reduced-Round WG-5 Lightweight Stream Cipher
MILP-based Cube Attack on the Reduced-Round WG-5 Lightweight Stream Cipher Raghvendra Rohit, Riham AlTawy, and Guang Gong Department of Electrical and Computer Engineering, University of Waterloo, Waterloo,
More informationTHE UNIVERSITY OF CALGARY FACULTY OF SCIENCE DEPARTMENT OF COMPUTER SCIENCE DEPARTMENT OF MATHEMATICS & STATISTICS MIDTERM EXAMINATION 1 FALL 2018
THE UNIVERSITY OF CALGARY FACULTY OF SCIENCE DEPARTMENT OF COMPUTER SCIENCE DEPARTMENT OF MATHEMATICS & STATISTICS MIDTERM EXAMINATION 1 FALL 2018 CPSC 418/MATH 318 L01 October 17, 2018 Time: 50 minutes
More informationCube Testers and Key Recovery Attacks on Reduced-Round MD6 and Trivium
Cube Testers and Key Recovery Attacks on Reduced-Round MD6 and Trivium Jean-Philippe Aumasson 1,,ItaiDinur 2, Willi Meier 1,, and Adi Shamir 2 1 FHNW, Windisch, Switzerland 2 Computer Science Department,
More informationOn the Complexity of the Hybrid Approach on HFEv-
On the Complexity of the Hybrid Approach on HFEv- Albrecht Petzoldt National Institute of Standards and Technology, Gaithersburg, Maryland, USA albrecht.petzoldt@gmail.com Abstract. The HFEv- signature
More informationComparison of cube attacks over different vector spaces
Comparison of cube attacks over different vector spaces Richard Winter 1, Ana Salagean 1, and Raphael C.-W. Phan 2 1 Department of Computer Science, Loughborough University, Loughborough, UK {R.Winter,
More informationLeakage Resilient ElGamal Encryption
Asiacrypt 2010, December 9th, Singapore Outline 1 Hybrid Encryption, the KEM/DEM framework 2 ElGamal KEM 3 Leakage Resilient Crypto Why? How? Other models? 4 Leakage Resilient ElGamal CCA1 secure KEM (Key
More informationNew Directions in Cryptanalysis of Self-Synchronizing Stream Ciphers
New Directions in Cryptanalysis of Self-Synchronizing Stream Ciphers Shahram Khazaei 1 and Willi Meier 2 1 EPFL, Lausanne, Switzerland 2 FHNW, Windisch, Switzerland Abstract. In cryptology we commonly
More informationIntroduction The LED Round Function Minimalism for Key Schedule Security Analysis Implementations and Results
The LED Block Cipher Jian Guo, Thomas Peyrin, Axel Poschmann and Matt Robshaw I2R, NTU and Orange Labs CHE 2011 Nara, Japan Outline Introduction The LED Round Function Minimalism for ey chedule ecurity
More informationAlgebraic properties of SHA-3 and notable cryptanalysis results
Algebraic properties of SHA-3 and notable cryptanalysis results Christina Boura University of Versailles, France ICMC 2015, January 9, 2014 1 / 51 Cryptographic Hash Functions H : {0,1} {0,1} n m H h =
More informationLinks Between Theoretical and Effective Differential Probabilities: Experiments on PRESENT
Links Between Theoretical and Effective Differential Probabilities: Experiments on PRESENT Céline Blondeau, Benoît Gérard SECRET-Project-Team, INRIA, France TOOLS for Cryptanalysis - 23th June 2010 C.Blondeau
More informationInvariant Subspace Attack Against Full Midori64
Invariant Subspace Attack Against Full Midori64 Jian Guo 1, Jérémy Jean 1, Ivica Nikolić 1, Kexin Qiao 1,2, Yu Sasaki 1,3, and Siang Meng Sim 1 1 Nanyang Technological University, Singapore 2 Institute
More informationFast Evaluation of Polynomials over Binary Finite Fields. and Application to Side-channel Countermeasures
Fast Evaluation of Polynomials over Binary Finite Fields and Application to Side-channel Countermeasures Jean-Sébastien Coron 1, Arnab Roy 1,2, Srinivas Vivek 1 1 University of Luxembourg 2 DTU, Denmark
More informationIntroduction to Modern Cryptography. (1) Finite Groups, Rings and Fields. (2) AES - Advanced Encryption Standard
Introduction to Modern Cryptography Lecture 3 (1) Finite Groups, Rings and Fields (2) AES - Advanced Encryption Standard +,0, and -a are only notations! Review - Groups Def (group): A set G with a binary
More informationNew Insights into Divide-and-Conquer Attacks on the Round-Reduced Keccak-MAC
New Insights into Divide-and-onquer Attacks on the Round-Reduced Keccak-MA hen-dong Ye 1 and Tian Tian 1,* 1 National Digital Switching System Engineering & Technological Research enter, P.O. Box 407,
More informationParallel Cube Tester Analysis of the CubeHash One-Way Hash Function
Parallel Cube Tester Analysis of the CubeHash One-Way Hash Function Alan Kaminsky Department of Computer Science B. Thomas Golisano College of Computing and Information Sciences Rochester Institute of
More information