The Invariant Set Attack 26th January 2017

Transcription

1 The Invariant Set Attack 26th January 2017 Workgroup Symmetric Cryptography Ruhr University Bochum Friedrich Wiemer Friedrich Wiemer The Invariant Set Attack 26th January

2 Nonlinear Invariant Attack Practical Attack on Full SCREAM, iscream, and Midori64 Paper Todo, Leander, and Sasaki [TLS16] at AsiaCrypt 16 Structural attack, breaks SCREAM, iscream and Midori64 (surprise, surprise) 1 in the weak key setting Organisation The paper in 50 words: 1 Overview 2 The Context 3 The Attack 4 The Results 1 Useless L A T E X Fact: Did you know that \time is an anagram of \item? Friedrich Wiemer The Invariant Set Attack 26th January

3 Context or: similar attacks? Linear Statistical Invariant Set Differential Symmetric Cryptanalysis Structural Invariant Subspace Algebraic Slide Friedrich Wiemer The Invariant Set Attack 26th January

4 Context or: similar attacks? Linear Statistical Invariant Set Differential Symmetric Cryptanalysis Structural Invariant Subspace Algebraic Slide Friedrich Wiemer The Invariant Set Attack 26th January

5 Context or: similar attacks? Linear Statistical Invariant Set Differential Symmetric Cryptanalysis Structural Invariant Subspace Algebraic Slide Friedrich Wiemer The Invariant Set Attack 26th January

6 Context or: similar attacks? Linear Statistical Invariant Set Differential Symmetric Cryptanalysis Structural Invariant Subspace Algebraic Slide Friedrich Wiemer The Invariant Set Attack 26th January

7 Linear Cryptanalysis Taking the fun out of it invented by Matsui [Mat93] broke DES together with Differential Cryptanalysis best studied attack on block ciphers Image: Friedrich Wiemer The Invariant Set Attack 26th January

8 Linear Cryptanalysis Taking the fun out of it Core Idea Given a block cipher E k : F n 2 F n 2, find an input mask α Fn 2 and an output mask β F n 2, s. t. α, x β, E k (x) = c holds with high probability for a constant c. α E k β is called a linear approximation of E k much more to deal with: we have to keep the distribution over k in mind and so on and so forth Friedrich Wiemer The Invariant Set Attack 26th January

9 Invariant Subspace Attack Almost there invented by Leander et al. [Lea+11] broke PRINTCIPHER Illustration F F -1 Image: Friedrich Wiemer The Invariant Set Attack 26th January

10 Invariant Subspace Attack Almost there Core Idea Given a block cipher E k : F n 2 F n 2, s. t. E k(x) = E(x k), assume that there exists a subspace U F n 2, s. t. for two constants c, d. E(U c) = U d A key k = u c d is called weak, if u U. For a weak key: E k (U d) = E((U d) (u c d)) = E(U c) = U d. We thus can distinguish encryptions under a weak key. Friedrich Wiemer The Invariant Set Attack 26th January

11 Invariant Set Attack or: Nonlinear Invariant Attack Core Idea Given a block cipher E k : F n 2 F n 2, s. t. E k(x) = E(x k), find an efficiently computable nonlinear Boolean function g : F n 2 F 2, s. t. g(e(x k)) = g(x k) c = g(x) g(k) c (1) for a constant c and many k. g is called nonlinear invariant keys for which Eq (1) holds are called weak keys Friedrich Wiemer The Invariant Set Attack 26th January

12 Invariant Set Attack Step-by-Step Typical block cipher construction: key-alternating function Let F : F n 2 F n 2 and E k 1,k 2,...,k r : F n 2 F n 2 be of the form E k (x) = F( F(x k 1 ) k r ). Friedrich Wiemer The Invariant Set Attack 26th January

13 Invariant Set Attack Step-by-Step Notation: we write y 0 = x, y i = F(y i 1 k i ), and thus y r = E k (x). Nonlinear invariant for the round function Assume there exists a nonlinear invariant g for F, s. t. all keys k i are weak. Then: Friedrich Wiemer The Invariant Set Attack 26th January

14 Invariant Set Attack Step-by-Step Notation: we write y 0 = x, y i = F(y i 1 k i ), and thus y r = E k (x). Nonlinear invariant for the round function Assume there exists a nonlinear invariant g for F, s. t. all keys k i are weak. Then: g(e k (x)) = g(y r ) Friedrich Wiemer The Invariant Set Attack 26th January

15 Invariant Set Attack Step-by-Step Notation: we write y 0 = x, y i = F(y i 1 k i ), and thus y r = E k (x). Nonlinear invariant for the round function Assume there exists a nonlinear invariant g for F, s. t. all keys k i are weak. Then: g(e k (x)) = g(y r ) = g(f(y r 1 k r )) Friedrich Wiemer The Invariant Set Attack 26th January

16 Invariant Set Attack Step-by-Step Notation: we write y 0 = x, y i = F(y i 1 k i ), and thus y r = E k (x). Nonlinear invariant for the round function Assume there exists a nonlinear invariant g for F, s. t. all keys k i are weak. Then: g(e k (x)) = g(y r ) = g(f(y r 1 k r )) = g(y r 1 ) g(k r ) c r Friedrich Wiemer The Invariant Set Attack 26th January

17 Invariant Set Attack Step-by-Step Notation: we write y 0 = x, y i = F(y i 1 k i ), and thus y r = E k (x). Nonlinear invariant for the round function Assume there exists a nonlinear invariant g for F, s. t. all keys k i are weak. Then: g(e k (x)) = g(y r ) = g(f(y r 1 k r )) = g(y r 1 ) g(k r ) c r. = g(x) r g(k i ) c 1 i=1 Friedrich Wiemer The Invariant Set Attack 26th January

18 Invariant Set Attack Weak Keys It seems quite unlikely that Eq (1) holds for many k? Example nonlinear invariant g : F 4 2 F 2 (x 4, x 3, x 2, x 1 ) x 4 x 3 x 3 x 2 x 1 Friedrich Wiemer The Invariant Set Attack 26th January

19 Invariant Set Attack Weak Keys It seems quite unlikely that Eq (1) holds for many k? Example nonlinear invariant g : F 4 2 F 2 (x 4, x 3, x 2, x 1 ) x 4 x 3 x 3 x 2 x 1 g is nonlinear invariant for key xor and has 4 weak keys: Split g in a nonlinear part f and a linear part l: g(x 4, x 3, x 2, x 1 ) = f(x 4, x 3 ) l(x 2, x 1 ) All k of the form k = (0, 0, k 2, k 1 ) are weak and these are exactly four possible keys. Friedrich Wiemer The Invariant Set Attack 26th January

20 Results Attack Complexities # Weak k max. # Recovered Bits SCREAM bits iscream bits Midori h bits Data Complexity Time Complexity SCREAM 33 ciphertexts 32 3 iscream 33 ciphertexts 32 3 Midori64 33h ciphertexts 32 3 h Friedrich Wiemer The Invariant Set Attack 26th January

21 Questions? Thank you for your attention! Mainboard & Questionmark Images: flickr Friedrich Wiemer The Invariant Set Attack 26th January

22 References I [Lea+11] G. Leander, M. A. Abdelraheem, H. AlKhzaimi, and E. Zenner. A Cryptanalysis of PRINTcipher: The Invariant Subspace Attack. In: CRYPTO. Vol LNCS. Springer, 2011, pp [Mat93] M. Matsui. Linear Cryptanalysis Method for DES Cipher. In: EUROCRYPT. Vol LNCS. Springer, 1993, pp [TLS16] Y. Todo, G. Leander, and Y. Sasaki. Nonlinear Invariant Attack - Practical Attack on Full SCREAM, iscream, and Midori64. In: ASIACRYPT (2). Vol LNCS. 2016, pp Friedrich Wiemer The Invariant Set Attack 26th January