Improving the Performance of the SYND Stream Cipher

Transcription

1 Improving the Performance of the SYND Stream Cipher Mohammed Meziani, Gerhard Hoffmann and Pierre-Louis Cayrel AfricaCrypt 2012, July 10-12, Ifrane Morocco

2 Backgrounds Previous Works XSYND Conclusion and future work

3 Codes -1/2- A binary linear code C: k-dimensional subspace of F n 2, (r = n k the co-dimension) An element of F n 2 : word, An element of C: codeword The Hamming weight of a word x is the number of 1 : wt(x) = {i, x i = 1} A regular word consists of equal-sized blocks, each with a single 1

4 Codes -2/2- A code C is called cyclic if x = (x 1, x 2,..., x n 1, x n ) C (x n, x 1,..., x n 1 ) C A r n parity check matrix A of C : A x = 0, x C. A parity check matrix A of C is called cyclic if it can be only described by its first row A parity check matrix A of C is called quasi-cyclic if it is composed of a number of cyclic submatrices

5 Hard problems with codes Syndrome Decoding problem (SD) Given a r n random binary matrix A, a r-bit vector y, and an integer ω. Find a word x of length n and weight wt(x) = ω, s.t. A x = y. x is regular the regular syndrome decoding problem (RSD) Both problems are NP-complete

6 Fischer and Stern PRNG - description - Parameters: n, ω, and r s.t. l := log 2 ( ( n w) ) << r Expansion function: f(x) = A θ(x) A {0, 1} r n random θ converts δ-bit strings into codewords Security based on the SD problem Efficiency issue: θ is slow (computing big integers) Large storage space (matrix size)

7 Fischer and Stern PRNG - graphical -

8 SYND: overview Improve Fisher-Stern PRNG by using: Quasi-cyclic code reduce storage requirement Regular encoding speed up the key generation Two phases: Initialization: initial state creation from K and IV Update and output: key stream generation Security based on RSD problem But NO detailed security proofs

9 SYND: graphical illustration

10 SYND: the core mappings - formal - Parameters: n, w, and r = ω log 2 ( n ω ) Two different mappings based on RSD problem: fi (x) = A i φ(x), i = 1, 2, x = r Ai {0, 1} r n quasi-cyclic φ a regular encoder generating regular words from r-bit strings

11 SYND: the core mappings - graphical -

12 SYND: Initialization step K and IV with K = IV = r/2 Initialization function g: y = K IV z = f 1 (y) y g(k, IV ) = z f 2 (y f 1 (z)) = e 0 3 function evaluations + 3 XORs.

13 SYND: Key stream generation step - formal - Update function: f 1 f 1 (x) = A 1 φ(x) e i+1 = f 1 (e i ) ei : current state, e i+1 : next state Output function: f 2 f 2 (x) = A 2 φ(x) z i = f 2 (e i ) ei : current state, z i : key stream

14 SYND: Key stream generation step - graphical -

15 XSYND Improved variant of SYND in terms of performance Two major modifications: replace the core mappings by new ones simplify the initialization function Detailed security proofs

16 XSYND: First modification - formal - Replace f i by new ones: Parameters: n, ω, r = ω2 b, b := log 2 ( n ω ) Matrix A i of size r n Split Ai into ω sub-matrices A i,j of size r 2 b Input x of length r bits Divide x into ω equal-sized parts x i, x i = b Convert x i into decimal values d i Each d i corresponds to a column of A i,j XOR of selected ω columns of A i

17 XSYND: First modification - graphical - New f i

18 XSYND: Second modification Simplify the initialization function g: Instead of define g(k, IV ) = z f 2 (y f 1 (z)) g(k, IV ) = z f 2 (z) Only 2 function evaluations + 2 XORs

19 XSYND: Security - theoretical - 1. Two assumptions: (1) A i is indistinguishable from a uniform matrix (2) The regular syndrome decoding is hard 2. We prove that (1) Inverting f i is reducible to regular syndrome decoding (2) The key stream is indistinguishable from random sequence

20 XSYND: Security - practical - Three types of attacks that are applicable: (1) Linearization attacks: Bellare-Micciancio s algorithm Saarinen s attack (2) Generalized Birthday Attacks (3) Information Set Decoding

21 XSYND: Parameters choice Security and performance obviously depend on ω and b (n = ω2 b, r = ωb) Tradeoff between security and performance: Larger b increases security against previous attacks Smaller ω offers good performance

22 XSYND: Performance comparison - SYND vs. XSYND - Speed of Speed of Sec. level n r ω key/iv SYND XSYND [bits] [cpb] [cpb] Same parameter sets proposed by SYND s authors C/C++ implementation with compiler gcc (Debian ) AMD Phenom(tm) 9950 Quad-Core with 1300 MHz

23 Conclusion and future work Summary XSYND, an improved variant of SYND A generic state transformation which is directly reducible to the RSD problem Better computational characteristics than the regular encoding Security proof Future work Parallel version of XSYND Fast as AES-CTR, but only offering 80 security level

24 Thank You For Attention! Questions?