Differential Analaysis of Block Ciphers SIMON and SPECK
|
|
- Basil Walters
- 6 years ago
- Views:
Transcription
1 1 / 36 Differential Analaysis of Block Ciphers SIMON and SPECK Alex Biryukov, Arnab Roy, Vesselin Velichkov
2 2 / 36 Outline Introduction Light-Weight Block Ciphers: SIMON and SPECK Differential Anlaysis SIMON: Round Function Search for Differential Trail Search for Differential Differential Effect in SIMON Embedded Bipartite Graphs Key Recovery Attacks Practical Attack: 19-round SIMON32 Attacking 11-round SPECK Attack Summary Conclusion
3 3 / 36 Outline Introduction Light-Weight Block Ciphers: SIMON and SPECK Differential Anlaysis SIMON: Round Function Search for Differential Trail Search for Differential Differential Effect in SIMON Embedded Bipartite Graphs Key Recovery Attacks Practical Attack: 19-round SIMON32 Attacking 11-round SPECK Attack Summary Conclusion
4 4 / 36 SIMON AND SPECK SIMON, SPECK - proposed in 2013, by a group of researchers from the NSA Competitive designs Simplicity, Efficiency Both are constructed on ARX principle SIMON Feistel design with ARX based function SPECK ARX, Resemblance with Threefish
5 SIMON Feistel design with very simple F-function (1) (8) & (2) k r Block Size 32, 48, 64 with key size 64, 72 or 96, 96 or 128 respectively.
6 6 / 36 SPECK Round function is similar to Threefish XOR round-key instead of (modular)adding the round-key (7/8) k r (2/3) Block Size 32, 48, 64 with key size 64, 72 or 96, 96 or 128 respectively.
7 7 / 36 Outline Introduction Light-Weight Block Ciphers: SIMON and SPECK Differential Anlaysis SIMON: Round Function Search for Differential Trail Search for Differential Differential Effect in SIMON Embedded Bipartite Graphs Key Recovery Attacks Practical Attack: 19-round SIMON32 Attacking 11-round SPECK Attack Summary Conclusion
8 8 / 36 Outline Introduction Light-Weight Block Ciphers: SIMON and SPECK Differential Anlaysis SIMON: Round Function Search for Differential Trail Search for Differential Differential Effect in SIMON Embedded Bipartite Graphs Key Recovery Attacks Practical Attack: 19-round SIMON32 Attacking 11-round SPECK Attack Summary Conclusion
9 9 / 36 SIMON: DP of A(nd)RX round function Pr(α γ) = {x : ( x (x r) ) ( (x α) ((x α) r) ) = γ} 2 n (1) (7) & (2) k r
10 10 / 36 DP: Path counting in DAG Find DP Count paths in a DAG
11 10 / 36 DP: Path counting in DAG Find DP Count paths in a DAG (Example: n=5, r=2)
12 10 / 36 DP: Path counting in DAG Find DP Count paths in a DAG (Example: n=5, r=2) α 0 α 3 γ 0 α 2 α 0 γ 2 α 4 α 2 γ 4 α 1 α 4 γ 1 α 3 α 1 γ
13 10 / 36 DP: Path counting in DAG Find DP Count paths in a DAG (Example: α 4 α 3 n=5, α 2 α 1 r=2) α 0 α 2 α 1 α 0 α 4 α 3 α 0 α 3 γ 0 α 2 α 0 γ 2 α 4 α 2 γ 4 α 1 α 4 γ 1 α 3 α 1 γ
14 10 / 36 DP: Path counting in DAG Find DP Count paths in a DAG (Example: n=5, r=2) α 0 α 3 γ 0 α 2 α 0 γ 2 α 4 α 2 γ 4 α 1 α 4 γ 1 α 3 α 1 γ x 0 x 3 x 2 x 0 x 4 x 2 x 1 x 4 x 3 x
15 10 / 36 DP: Path counting in DAG Find DP Count paths in a DAG (Example: n=5, r=2) α 0 α 3 γ 0 α 2 α 0 γ 2 α 4 α 2 γ 4 α 1 α 4 γ 1 α 3 α 1 γ x 0 x 3 x 2 x 0 x 4 x 2 x 1 x 4 x 3 x
16 11 / 36 Example: Impossible I/O Difference α 0 α 3 γ α 2 α 0 γ α 4 α 2 γ α 1 α 4 γ α 3 α 1 γ x 0 x 3 x 2 x 0 x 4 x 2 x 1 x 4 x 3 x
17 12 / 36 Outline Introduction Light-Weight Block Ciphers: SIMON and SPECK Differential Anlaysis SIMON: Round Function Search for Differential Trail Search for Differential Differential Effect in SIMON Embedded Bipartite Graphs Key Recovery Attacks Practical Attack: 19-round SIMON32 Attacking 11-round SPECK Attack Summary Conclusion
18 13 / 36 About Extending Matsui s Search for ARX Matsui[EuroCrypt 94] : while selecting DP of round l check p = p 1 p 2... p l B n l B n, if p B n update the bound Problem: DDT requires exponential memory for ARX designs
19 13 / 36 About Extending Matsui s Search for ARX Matsui[EuroCrypt 94] : while selecting DP of round l check p = p 1 p 2... p l B n l B n, if p B n update the bound Problem: DDT requires exponential memory for ARX designs Biryukov-Velichkov [CT-RSA 14]: Use partial DDT table for ARX (Threshold Search) The pddt - D contains α β iff p(α β) p τ
20 13 / 36 About Extending Matsui s Search for ARX Matsui[EuroCrypt 94] : while selecting DP of round l check p = p 1 p 2... p l B n l B n, if p B n update the bound Problem: DDT requires exponential memory for ARX designs Biryukov-Velichkov [CT-RSA 14]: Use partial DDT table for ARX (Threshold Search) The pddt - D contains α β iff p(α β) p τ While searching, if some (α β) / D, then it is possible to take several options e.g. Choose greedily, Search all possible, Highway-Country Road approach
21 14 / 36 Using the Threshold Search for ARX Parameters in Threshold Search: Size of pddt (and p τ ), precomputaion time for pddt Lower p τ can intuitively lead to better result; But increases the search complexity and size of the pddt table
22 14 / 36 Using the Threshold Search for ARX Parameters in Threshold Search: Size of pddt (and p τ ), precomputaion time for pddt Lower p τ can intuitively lead to better result; But increases the search complexity and size of the pddt table Including New Entries: The new transitions (α β) / D are added to a secondary table D
23 14 / 36 Using the Threshold Search for ARX Parameters in Threshold Search: Size of pddt (and p τ ), precomputaion time for pddt Lower p τ can intuitively lead to better result; But increases the search complexity and size of the pddt table Including New Entries: The new transitions (α β) / D are added to a secondary table D Restrict size of D By Hamming weight of the differences; Used for SPECK Another way select (α β) at round l such that at round l + 1 there is at least one transition D; Used for SIMON together with Hamming weight
24 15 / 36 Highway-Country Road Analogy Route: Luxembourg to Frankfurt The Highway only route 2hr 46min Highway-Country Road 2hr 31min
25 16 / 36 Outline Introduction Light-Weight Block Ciphers: SIMON and SPECK Differential Anlaysis SIMON: Round Function Search for Differential Trail Search for Differential Differential Effect in SIMON Embedded Bipartite Graphs Key Recovery Attacks Practical Attack: 19-round SIMON32 Attacking 11-round SPECK Attack Summary Conclusion
26 Extension for Differential: Clustering Trails We extend the Threshold Search for clustering trails. Main Idea: for round l select transition with p l : (p 1 p 2... p l 1 p l B n l ) ɛ B n Input: Best trail found by threshold Search, pddt table, ɛ 17 / 36
27 Extension for Differential: Clustering Trails We extend the Threshold Search for clustering trails. Main Idea: for round l select transition with p l : (p 1 p 2... p l 1 p l B n l ) ɛ B n Input: Best trail found by threshold Search, pddt table, ɛ Efficiency: Hamming weight and probability constraints can be applied Difference with branch-and-bound We prune the search tree by limiting the search to ɛ region of the best known probability 17 / 36
28 Extension for Differential: Clustering Trails We extend the Threshold Search for clustering trails. Main Idea: for round l select transition with p l : (p 1 p 2... p l 1 p l B n l ) ɛ B n Input: Best trail found by threshold Search, pddt table, ɛ Efficiency: Hamming weight and probability constraints can be applied Difference with branch-and-bound We prune the search tree by limiting the search to ɛ region of the best known probability We apply this technique to both SIMON and SPECK 17 / 36
29 An overview: Differential Search in out 18 / 36
30 An overview: Differential Search in p 1 p 2... p l 1 out 18 / 36
31 An overview: Differential Search in p 1 p 2... p l 1 ɛb n B n l out 18 / 36
32 19 / 36 Search Results Cipher # rounds log 2 p, trail log 2 p, diff. # trails SIMON full search full search SIMON SIMON SPECK SPECK SPECK
33 20 / 36 Outline Introduction Light-Weight Block Ciphers: SIMON and SPECK Differential Anlaysis SIMON: Round Function Search for Differential Trail Search for Differential Differential Effect in SIMON Embedded Bipartite Graphs Key Recovery Attacks Practical Attack: 19-round SIMON32 Attacking 11-round SPECK Attack Summary Conclusion
34 21 / 36 Outline Introduction Light-Weight Block Ciphers: SIMON and SPECK Differential Anlaysis SIMON: Round Function Search for Differential Trail Search for Differential Differential Effect in SIMON Embedded Bipartite Graphs Key Recovery Attacks Practical Attack: 19-round SIMON32 Attacking 11-round SPECK Attack Summary Conclusion
35 The differential graph for S IMON trails 22 / 36
36 The differential graph for S IMON trails trails 22 / 36
37 The differential graph for S IMON trails trails 22 / 36
38 The differential graph for S IMON trails trails 22 / 36
39 23 / 36 Bipartite Subgraph of Trails Feistel: i L = 11 = i+1 R = 11 f = {000* 000* 00*0 00*0} i L i R = 106 i R = 104 i R = 1006 i+1 L = 4 i+1 L = 26 i+1 L = 6 ( i L 2) i R ) = i+1 L 120 (22) 106 = (22) 104 = 4
40 24 / 36 Outline Introduction Light-Weight Block Ciphers: SIMON and SPECK Differential Anlaysis SIMON: Round Function Search for Differential Trail Search for Differential Differential Effect in SIMON Embedded Bipartite Graphs Key Recovery Attacks Practical Attack: 19-round SIMON32 Attacking 11-round SPECK Attack Summary Conclusion
41 25 / 36 Outline Introduction Light-Weight Block Ciphers: SIMON and SPECK Differential Anlaysis SIMON: Round Function Search for Differential Trail Search for Differential Differential Effect in SIMON Embedded Bipartite Graphs Key Recovery Attacks Practical Attack: 19-round SIMON32 Attacking 11-round SPECK Attack Summary Conclusion
42 Guess 25 bits(and linear combinations) from K 18, K 17, K / Round SIMON32: Practical Attack Use 13 round differential with probability , Add 2 rounds on top, 4 rounds at the end (1) (8) & * * (2) K r * * (1) (8) & *00 000* *000 00** (2) K r+1 0*00 000* *000 01** (1) (8) & * * *000 0*** 0*00 **** (2) K r+2 *000 0*** 0*01 **** (1) (8) & 0*00 000* *000 01** (2) K r+3
43 27 / 36 Attack on SIMON32 Identify pairs satisfying top 2 rounds truncated difference guess 2 bits of K * *0 (1) (8) & *000 0**0 0*01 **0* (2) K r (1) (8) & * *0 (2) K r
44 28 / 36 Attack on SIMON32 We use four differentials D 1 : (2000, 8000) (2000, 0) D 2 : (4000, 0001) (4000, 0) D 3 : (0004, 0010) (0004, 0) D 4 : (0008, 0020) (0008, 0) Truncated diffrence for top 2 round ( * *, **00 00** 00*0 1**0) ( * *0, *000 0**0 0*01 **0*) (000* *0 0100, 0**0 0*01 **0* *000) (00* * , **00 *01* *0** 0000)
45 29 / 36 Attack on SIMON32 Data Collection: Encrypt structure of size 2 30 Filtering: = 2 12 pairs remain for any D i Counting : For each D i 2 12 pairs, 25 bit guessing 2 17 candidates for 25 bits Intersection of Counters: D1, D 2 19 common bits (guessed) = 2 15 for 35 bits Intersection: D3, D 1, D 2 20 bits common 2 12 candidates for 42 bits Intersection with D 4 = 2 7 candidates for 47 bits But 39 from last 4 rounds By brute-forcing rest total = 2 32 key guesses
46 29 / 36 Attack on SIMON32 Data Collection: Encrypt structure of size 2 30 Filtering: = 2 12 pairs remain for any D i Counting : For each D i 2 12 pairs, 25 bit guessing 2 17 candidates for 25 bits Intersection of Counters: D1, D 2 19 common bits (guessed) = 2 15 for 35 bits Intersection: D3, D 1, D 2 20 bits common 2 12 candidates for 42 bits Intersection with D 4 = 2 7 candidates for 47 bits But 39 from last 4 rounds By brute-forcing rest total = 2 32 key guesses
47 29 / 36 Attack on SIMON32 Data Collection: Encrypt structure of size 2 30 Filtering: = 2 12 pairs remain for any D i Counting : For each D i 2 12 pairs, 25 bit guessing 2 17 candidates for 25 bits Intersection of Counters: D1, D 2 19 common bits (guessed) = 2 15 for 35 bits Intersection: D3, D 1, D 2 20 bits common 2 12 candidates for 42 bits Intersection with D 4 = 2 7 candidates for 47 bits But 39 from last 4 rounds By brute-forcing rest total = 2 32 key guesses
48 29 / 36 Attack on SIMON32 Data Collection: Encrypt structure of size 2 30 Filtering: = 2 12 pairs remain for any D i Counting : For each D i 2 12 pairs, 25 bit guessing 2 17 candidates for 25 bits Intersection of Counters: D1, D 2 19 common bits (guessed) = 2 15 for 35 bits Intersection: D3, D 1, D 2 20 bits common 2 12 candidates for 42 bits Intersection with D 4 = 2 7 candidates for 47 bits But 39 from last 4 rounds By brute-forcing rest total = 2 32 key guesses
49 29 / 36 Attack on SIMON32 Data Collection: Encrypt structure of size 2 30 Filtering: = 2 12 pairs remain for any D i Counting : For each D i 2 12 pairs, 25 bit guessing 2 17 candidates for 25 bits Intersection of Counters: D1, D 2 19 common bits (guessed) = 2 15 for 35 bits Intersection: D3, D 1, D 2 20 bits common 2 12 candidates for 42 bits Intersection with D 4 = 2 7 candidates for 47 bits But 39 from last 4 rounds By brute-forcing rest total = 2 32 key guesses
50 29 / 36 Attack on SIMON32 Data Collection: Encrypt structure of size 2 30 Filtering: = 2 12 pairs remain for any D i Counting : For each D i 2 12 pairs, 25 bit guessing 2 17 candidates for 25 bits Intersection of Counters: D1, D 2 19 common bits (guessed) = 2 15 for 35 bits Intersection: D3, D 1, D 2 20 bits common 2 12 candidates for 42 bits Intersection with D 4 = 2 7 candidates for 47 bits But 39 from last 4 rounds By brute-forcing rest total = 2 32 key guesses
51 30 / 36 Outline Introduction Light-Weight Block Ciphers: SIMON and SPECK Differential Anlaysis SIMON: Round Function Search for Differential Trail Search for Differential Differential Effect in SIMON Embedded Bipartite Graphs Key Recovery Attacks Practical Attack: 19-round SIMON32 Attacking 11-round SPECK Attack Summary Conclusion
52 31 / 36 Attack on SPECK32 Use 9 round differential with p = 2 30 ; Add one round each on top and at the end (7) K Pr = 2 2 (Round-10) (2) (7) K 10 (2) Guess 16 bits from K 10, 11 bits from K 9, 1 carry bit
53 32 / 36 Attack on SPECK32 Verify the difference at the end of round 9 Keep a counter of size 2 28 Expect 2 18 counters with 4 increments Bruteforce rest of the = 37 bits of last 4 round-keys Total number of key guessing = 2 55
54 33 / 36 Outline Introduction Light-Weight Block Ciphers: SIMON and SPECK Differential Anlaysis SIMON: Round Function Search for Differential Trail Search for Differential Differential Effect in SIMON Embedded Bipartite Graphs Key Recovery Attacks Practical Attack: 19-round SIMON32 Attacking 11-round SPECK Attack Summary Conclusion
55 34 / 36 Summary of Attacks Cipher Key Rounds Rounds Our Results Known Result Size Total Attacked Time Data Time Data SIMON SIMON SIMON * * SPECK SPECK48 72/ SPECK
56 35 / 36 Outline Introduction Light-Weight Block Ciphers: SIMON and SPECK Differential Anlaysis SIMON: Round Function Search for Differential Trail Search for Differential Differential Effect in SIMON Embedded Bipartite Graphs Key Recovery Attacks Practical Attack: 19-round SIMON32 Attacking 11-round SPECK Attack Summary Conclusion
57 36 / 36 Summary Analysis and Linear time (in word size) Algorithm to find DP of SIMON round function Threshold Search with Highway-Country road approach for analysing SIMON and SPECK Extend the Threshold Search technique for Differential Search Improved differentials for SIMON and SPECK All these methods are generic and can be used to analyse ARX designs Additionally, use the differentials for key recovery attack on reduced round SIMON and SPECK
observations on the simon block cipher family
observations on the simon block cipher family Stefan Kölbl 1 Gregor Leander 2 Tyge Tiessen 1 August 17, 2015 1 DTU Compute, Technical University of Denmark, Denmark 2 Horst Görtz Institute for IT Security,
More informationA Brief Comparison of Simon and Simeck
A Brief Comparison of Simon and Simeck Stefan Kölbl, Arnab Roy {stek,arroy}@dtu.dk DTU Compute, Technical University of Denmark, Denmark Abstract. Simeck is a new lightweight block cipher design based
More informationSiwei Sun, Lei Hu, Peng Wang, Kexin Qiao, Xiaoshuang Ma, Ling Song
Automatic Security Evaluation and (Related-key) Differential Characteristic Search: Application to SIMON, PRESENT, LBlock, DES(L) and Other Bit-oriented Block Ciphers Siwei Sun, Lei Hu, Peng Wang, Kexin
More informationCryptanalysis of the SIMON Family of Block Ciphers
Cryptanalysis of the SIMON Family of Block Ciphers Hoda A. Alkhzaimi and Martin M. Lauridsen DTU Compute Section for Cryptology Department of Applied Mathematics and Computer Science Matematiktorvet, building
More informationZero-Correlation Linear Cryptanalysis with Fast Fourier Transform and Applications to Camellia and CLEFIA
Zero-Correlation Linear Cryptanalysis with Fast Fourier Transform and Applications to Camellia and CLEFIA Andrey Bogdanov, Meiqin Wang Technical University of Denmark, Shandong University, China ESC 2013,
More informationLinear Hull Attack on Round-Reduced Simeck with Dynamic Key-guessing Techniques
Linear Hull Attack on Round-Reduced Simeck with Dynamic Key-guessing Techniques Lingyue Qin 1, Huaifeng Chen 3, Xiaoyun Wang 2,3 1 Department of Computer Science and Technology, Tsinghua University, Beijing
More informationQuantum Differential and Linear Cryptanalysis
Quantum Differential and Linear Cryptanalysis Marc Kaplan 1,2 Gaëtan Leurent 3 Anthony Leverrier 3 María Naya-Plasencia 3 1 LTCI, Télécom ParisTech 2 School of Informatics, University of Edinburgh 3 Inria
More informationAutomatic Search for Differential Trails in ARX Ciphers (extended version)
Automatic Search for Differential Trails in ARX Ciphers (extended version) Alex Biryukov and Vesselin Velichkov Laboratory of Algorithmics, Cryptology and Security (LACS) University of Luxembourg {Alex.Biryukov,Vesselin.Velichkov}@uni.lu
More informationImproved Linear (hull) Cryptanalysis of Round-reduced Versions of SIMON
Improved Linear (hull) Cryptanalysis of Round-reduced Versions of SIMON Danping Shi 1,2, Lei Hu 1,2, Siwei Sun 1,2, Ling Song 1,2, Kexin Qiao 1,2, Xiaoshuang Ma 1,2 1 State Key Laboratory of Information
More informationLinear Cryptanalysis of Reduced-Round Speck
Linear Cryptanalysis of Reduced-Round Speck Tomer Ashur Daniël Bodden KU Leuven and iminds Dept. ESAT, Group COSIC Address Kasteelpark Arenberg 10 bus 45, B-3001 Leuven-Heverlee, Belgium tomer.ashur-@-esat.kuleuven.be
More informationExperiments on the Multiple Linear Cryptanalysis of Reduced Round Serpent
Experiments on the Multiple Linear Cryptanalysis of Reduced Round Serpent B. Collard, F.-X. Standaert, J.-J. Quisquater UCL Crypto Group Microelectronics Laboratory Catholic University of Louvain - UCL
More informationStructural Evaluation of AES and Chosen-Key Distinguisher of 9-round AES-128
Structural Evaluation of AES and Chosen-Key Distinguisher of 9-round AES-128 Pierre-Alain Fouque 1 Jérémy Jean 2 Thomas Peyrin 3 1 Université de Rennes 1, France 2 École Normale Supérieure, France 3 Nanyang
More informationTruncated differential cryptanalysis of five rounds of Salsa20
Truncated differential cryptanalysis of five rounds of Salsa20 Paul Crowley 17th October 2005 Abstract We present an attack on Salsa20 reduced to five of its twenty rounds. This attack uses many clusters
More informationThe Improbable Differential Attack. Cryptanalysis of Reduced Round CLEFIA
: Cryptanalysis of Reduced Round CLEFIA École Polytechnique Fédérale de Lausanne, Switzerland (This work was done at) Institute of Applied Mathematics Middle East Technical University, Ankara, Turkey INDOCRYPT
More informationImprobable Differential Cryptanalysis and Undisturbed Bits
Improbable Differential Cryptanalysis and Undisturbed Bits Institute of Applied Mathematics Department of Cryptography Middle East Technical University September 5, 2013 Leuven, Belgium A (Very) Short
More informationZero-Correlation Linear Cryptanalysis of Reduced-Round LBlock
Zero-Correlation Linear Cryptanalysis of Reduced-Round LBlock Hadi Soleimany and Kaisa Nyberg Department of Information and Computer Science, Aalto University School of Science, Finland WCC 2013 1/53 Outline
More informationBlock Cipher Cryptanalysis: An Overview
0/52 Block Cipher Cryptanalysis: An Overview Subhabrata Samajder Indian Statistical Institute, Kolkata 17 th May, 2017 0/52 Outline Iterated Block Cipher 1 Iterated Block Cipher 2 S-Boxes 3 A Basic Substitution
More informationOn Reverse-Engineering S-boxes with Hidden Design Criteria or Structure
On Reverse-Engineering S-boxes with Hidden Design Criteria or Structure Alex Biryukov, Léo Perrin {alex.biryukov,leo.perrin}@uni.lu University of Luxembourg January 13, 2015 1 / 42 Introduction Skipjack
More informationComplementing Feistel Ciphers
Complementing Feistel Ciphers Alex Biryukov 1 and Ivica Nikolić 2 1 University of Luxembourg 2 Nanyang Technological University, Singapore alex.biryukov@uni.lu inikolic@ntu.edu.sg Abstract. In this paper,
More informationBreaking Symmetric Cryptosystems Using Quantum Algorithms
Breaking Symmetric Cryptosystems Using Quantum Algorithms Gaëtan Leurent Joined work with: Marc Kaplan Anthony Leverrier María Naya-Plasencia Inria, France FOQUS Workshop Gaëtan Leurent (Inria) Breaking
More informationIntroduction to Symmetric Cryptography
Introduction to Symmetric Cryptography COST Training School on Symmetric Cryptography and Blockchain Stefan Kölbl February 19th, 2018 DTU Compute, Technical University of Denmark Practical Information
More informationIntegrals go Statistical: Cryptanalysis of Full Skipjack Variants
Integrals go Statistical: Cryptanalysis of ull Skipjack Variants Meiqin Wang mqwang@sdu.edu.cn Joint Work with Tingting Cui, Huaifeng Chen, Ling Sun, Long Wen, Andrey Bogdanov Shandong University, China;
More informationA New Technique for Multidimensional Linear Cryptanalysis with Applications on Reduced Round Serpent
A New Technique for Multidimensional Linear Cryptanalysis with Applications on Reduced Round Serpent Joo Yeon Cho, Miia Hermelin, and Kaisa Nyberg Helsinki University of Technology, Department of Information
More informationImproved Differential-Linear Cryptanalysis of 7-round Chaskey with Partitioning
Improved Differential-Linear Cryptanalysis of 7-round Chaskey with Partitioning Gaëtan Leurent Inria, France Abstract. In this work we study the security of Chaskey, a recent lightweight MAC designed by
More informationTowards Provable Security of Substitution-Permutation Encryption Networks
Towards Provable Security of Substitution-Permutation Encryption Networks Zhi-Guo Chen and Stafford E. Tavares Department of Electrical and Computer Engineering Queen s University at Kingston, Ontario,
More informationand Céline Blondeau October 8, 2012 joint work with Benoît Gérard and Kaisa Nyberg Multiple differential cryptanalysis using LLR and October, 8 1/27
Multiple differential cryptanalysis using LLR and Céline Blondeau joint work with Benoît Gérard and Kaisa Nyberg October 8, 2012 1/27 Outline Introduction Block Ciphers Differential Cryptanalysis Last
More informationCryptanalysis of SP Networks with Partial Non-Linear Layers
Cryptanalysis of SP Networks with Partial Non-Linear Layers Achiya Bar-On 1, Itai Dinur 2, Orr Dunkelman 3, Nathan Keller 1, Virginie Lallemand 4, and Boaz Tsaban 1 1 Bar-Ilan University, Israel 2 École
More informationLecture 12: Block ciphers
Lecture 12: Block ciphers Thomas Johansson T. Johansson (Lund University) 1 / 19 Block ciphers A block cipher encrypts a block of plaintext bits x to a block of ciphertext bits y. The transformation is
More informationSide Channel Attack to Actual Cryptanalysis: Breaking CRT-RSA with Low Weight Decryption Exponents
Side Channel Attack to Actual Cryptanalysis: Breaking CRT-RSA with Low Weight Decryption Exponents Santanu Sarkar and Subhamoy Maitra Leuven, Belgium 12 September, 2012 Outline of the Talk RSA Cryptosystem
More informationNew Results in the Linear Cryptanalysis of DES
New Results in the Linear Cryptanalysis of DES Igor Semaev Department of Informatics University of Bergen, Norway e-mail: igor@ii.uib.no phone: (+47)55584279 fax: (+47)55584199 May 23, 2014 Abstract Two
More informationStructural Evaluation of AES and Chosen-Key Distinguisher of 9-round AES-128
Structural Evaluation of AES and Chosen-Key Distinguisher of 9-round AES-18 Pierre-Alain Fouque 1, Jérémy Jean,, and Thomas Peyrin 3 1 Université de Rennes 1, France École Normale Supérieure, France 3
More informationMultiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs
Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs Alex Biryukov 1,2, Dmitry Khovratovich 2, Léo Perrin 2 1 CSC, University of Luxembourg 2 SnT, University of Luxembourg https://www.cryptolux.org
More informationDifferential Fault Analysis on DES Middle Rounds
Differential Fault Analysis on DES Middle Rounds Matthieu Rivain Speaker: Christophe Giraud Oberthur Technologies Agenda 1 Introduction Data Encryption Standard DFA on DES Last & Middle Rounds 2 Our Attack
More informationAnalysis of Differential Attacks in ARX Constructions
.. Analysis of Differential Attacks in ARX Constructions Gaëtan Leurent UCL Crypto Group University of Luxembourg Asiacrypt 2012 G. Leurent (UCL & uni.lu) Analysis of Differential Attacks in ARX Constructions
More informationOn Stream Ciphers with Small State
ESC 2017, Canach, January 16. On Stream Ciphers with Small State Willi Meier joint work with Matthias Hamann, Matthias Krause (University of Mannheim) Bin Zhang (Chinese Academy of Sciences, Beijing) 1
More informationKey Recovery with Probabilistic Neutral Bits
ESC 7.1. 11. 1. 2007 Key Recovery with Probabilistic Neutral Bits Simon Fischer 1, Shahram Khazaei 2 and Willi Meier 1 1 FHNW, Windisch, Switzerland 2 EPFL, Lausanne, Switzerland Outline Motivation Probabilistic
More informationCryptanalysis of PRESENT-like ciphers with secret S-boxes
Cryptanalysis of PRESENT-like ciphers with secret S-boxes Julia Borghoff Lars Knudsen Gregor Leander Søren S. Thomsen DTU, Denmark FSE 2011 Cryptanalysis of Maya Julia Borghoff Lars Knudsen Gregor Leander
More informationDifferential-Linear Cryptanalysis of Serpent
Differential-Linear Cryptanalysis of Serpent Eli Biham, 1 Orr Dunkelman, 1 Nathan Keller 2 1 Computer Science Department, Technion. Haifa 32000, Israel {biham,orrd}@cs.technion.ac.il 2 Mathematics Department,
More informationRelated-Key Rectangle Attack on Round-reduced Khudra Block Cipher
Related-Key Rectangle Attack on Round-reduced Khudra Block Cipher Xiaoshuang Ma 1,2 Kexin Qiao 1,2 1 State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy
More informationSubspace Trail Cryptanalysis and its Applications to AES
Subspace Trail Cryptanalysis and its Applications to AES Lorenzo Grassi, Christian Rechberger and Sondre Rønjom March, 2017 1 / 28 Introduction In the case of AES, several alternative representations (algebraic
More informationLinear Cryptanalysis of DES with Asymmetries
Linear Cryptanalysis of DES with Asymmetries Andrey Bogdanov and Philip S. Vejre Technical University of Denmark {anbog,psve}@dtu.dk Abstract. Linear cryptanalysis of DES, proposed by Matsui in 1993, has
More informationDifferential Attack on Five Rounds of the SC2000 Block Cipher
Differential Attack on Five Rounds of the SC2 Block Cipher Jiqiang Lu Department of Mathematics and Computer Science, Eindhoven University of Technology, 56 MB Eindhoven, The Netherlands lvjiqiang@hotmail.com
More informationBernoulli variables. Let X be a random variable such that. 1 with probability p X = 0 with probability q = 1 p
Unit 20 February 25, 2011 1 Bernoulli variables Let X be a random variable such that { 1 with probability p X = 0 with probability q = 1 p Such an X is called a Bernoulli random variable Unit 20 February
More informationMixed-integer Programming based Differential and Linear Cryptanalysis
Mixed-integer Programming based Differential and Linear Cryptanalysis Siwei Sun State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences Data Assurance
More informationAn average case analysis of a dierential attack. on a class of SP-networks. Distributed Systems Technology Centre, and
An average case analysis of a dierential attack on a class of SP-networks Luke O'Connor Distributed Systems Technology Centre, and Information Security Research Center, QUT Brisbane, Australia Abstract
More informationRelated Key Differential Cryptanalysis of Midori
Related Key Differential Cryptanalysis of Midori Using constraint programming David Gerault Pascal Lafourcade LIMOS, University Clermont Auvergne Gerault, Lafourcade Related Key Differential Cryptanalysis
More informationLinear Cryptanalysis of Long-Key Iterated Cipher with Applications to Permutation-Based Ciphers
Linear Cryptanalysis of Long-Key Iterated Cipher with Applications to Permutation-Based Ciphers Kaisa Nyberg Aalto University School of Science kaisa.nyberg@aalto.fi Luxemburg January 2017 Outline Introduction
More informationDD2448 Foundations of Cryptography Lecture 3
DD2448 Foundations of Cryptography Lecture 3 Douglas Wikström KTH Royal Institute of Technology dog@kth.se February 3, 2016 Linear Cryptanalysis of the SPN Basic Idea Linearize Find an expression of the
More informationCryptanalysis of SP Networks with Partial Non-Linear Layers
Cryptanalysis of SP Networks with Partial Non-Linear Layers Achiya Bar-On 1, Itai Dinur 2, Orr Dunkelman 3,5,, Virginie Lallemand 4,, Nathan Keller 1,5,, and Boaz Tsaban 1 1 Department of Mathematics,
More informationData complexity and success probability of statisticals cryptanalysis
Data complexity and success probability of statisticals cryptanalysis Céline Blondeau SECRET-Project-Team, INRIA, France Joint work with Benoît Gérard and Jean-Pierre Tillich aaa C.Blondeau Data complexity
More informationCryptanalysis of EnRUPT
Cryptanalysis of EnRUPT Dmitry Khovratovich and Ivica Nikolić University of Luxembourg Abstract. In this paper we present a preimage attack on EnRUPT- 512. We exploit the fact that the internal state is
More informationData Complexity and Success Probability for Various Cryptanalyses
Data Complexity and Success Probability for Various Cryptanalyses Céline Blondeau, Benoît Gérard and Jean Pierre Tillich INRIA project-team SECRET, France Blondeau, Gérard and Tillich. Data Complexity
More informationA block cipher enciphers each block with the same key.
Ciphers are classified as block or stream ciphers. All ciphers split long messages into blocks and encipher each block separately. Block sizes range from one bit to thousands of bits per block. A block
More informationKnown and Chosen Key Differential Distinguishers for Block Ciphers
1/19 Known and Chosen Key Differential Distinguishers for Block Ciphers Josef Pieprzyk joint work with Ivica Nikolić, Przemys law Soko lowski, and Ron Steinfeld ASK 2011, August 29-31, 2011 2/19 Outline
More informationThe Artin-Feistel Symmetric Cipher
The Artin-Feistel Symmetric Cipher May 23, 2012 I. Anshel, D. Goldfeld. Introduction. The Feistel cipher and the Braid Group The main aim of this paper is to introduce a new symmetric cipher, which we
More informationImproving the Time Complexity of Matsui s Linear Cryptanalysis
Improving the Time Complexity of Matsui s Linear Cryptanalysis B. Collard, F.-X. Standaert, J.-J. Quisquater UCL Crypto Group, Université Catholique de Louvain Abstract. This paper reports on an improvement
More informationInvariant Subspace Attack Against Midori64 and The Resistance Criteria for S-box Designs
Invariant Subspace Attack Against Midori64 and The Resistance Criteria for S-box Designs Jian Guo 1, Jeremy Jean 2, Ivica Nikolić 1, Kexin Qiao 3, Yu Sasaki 4, and Siang Meng Sim 1 1. Nanyang Technological
More informationLinks Between Theoretical and Effective Differential Probabilities: Experiments on PRESENT
Links Between Theoretical and Effective Differential Probabilities: Experiments on PRESENT Céline Blondeau, Benoît Gérard SECRET-Project-Team, INRIA, France TOOLS for Cryptanalysis - 23th June 2010 C.Blondeau
More informationBuilding Secure Block Ciphers on Generic Attacks Assumptions
Building Secure Block Ciphers on Generic Attacks Assumptions Jacques Patarin and Yannick Seurin University of Versailles and Orange Labs SAC 2008 August 14-15, 2008 the context security of symmetric primitives
More informationSecurity Analysis of the Block Cipher SC2000
Security Analysis of the Block Cipher SC2000 VERSION 1.1 FINAL REPORT Alex Biryukov University of Luxembourg, Luxembourg Ivica Nikolić Nanyang Technological University, Singapore Contents 1 Introduction
More informationDES S-box Generator. 2 EPFL, Switzerland
DES S-box Generator Lauren De Meyer 1 and Serge Vaudenay 2 lauren.demeyer@student.kuleuven.be serge.vaudenay@epfl.ch 1 KU Leuven, Belgium 2 EPFL, Switzerland Abstract. The Data Encryption Standard (DES)
More informationMILP Modeling for (Large) S-boxes to Optimize Probability of Differential Characteristics
MILP Modeling for (Large) S-boxes to Optimize Probability of Differential Characteristics Ahmed Abdelkhalek, Yu Sasaki 2, Yosuke Todo 2, Mohamed Tolba, and Amr M. Youssef :Concordia University, 2: NTT
More informationSymmetric Crypto Systems
T H E U N I V E R S I T Y O F B R I T I S H C O L U M B I A Symmetric Crypto Systems EECE 412 Copyright 2004-2008 Konstantin Beznosov 09/16/08 Module Outline Stream ciphers under the hood Block ciphers
More informationIntroduction on Block cipher Yoyo Game Application on AES Conclusion. Yoyo Game with AES. Navid Ghaedi Bardeh. University of Bergen.
Yoyo Game with AES Navid Ghaedi Bardeh University of Bergen May 8, 2018 1 / 33 Outline 1 Introduction on Block cipher 2 Yoyo Game 3 Application on AES 4 Conclusion 2 / 33 Classical Model of Symmetric Cryptography
More informationLS-Designs. Bitslice Encryption for Efficient Masked Software Implementations
Bitslice Encryption for Efficient Masked Software Implementations Vincent Grosso 1 Gaëtan Leurent 1,2 François Xavier Standert 1 Kerem Varici 1 1 UCL, Belgium 2 Inria, France FSE 2014 G Leurent (UCL,Inria)
More informationNew Results on Boomerang and Rectangle Attacks
New Results on Boomerang and Rectangle Attacks Eli Biham, 1 Orr Dunkelman, 1 Nathan Keller 2 1 Computer Science Department, Technion. Haia 32000, Israel {biham,orrd}@cs.technion.ac.il 2 Mathematics Department,
More informationSOBER Cryptanalysis. Daniel Bleichenbacher and Sarvar Patel Bell Laboratories Lucent Technologies
SOBER Cryptanalysis Daniel Bleichenbacher and Sarvar Patel {bleichen,sarvar}@lucent.com Bell Laboratories Lucent Technologies Abstract. SOBER is a new stream cipher that has recently been developed by
More information7 Cryptanalysis. 7.1 Structural Attacks CA642: CRYPTOGRAPHY AND NUMBER THEORY 1
CA642: CRYPTOGRAPHY AND NUMBER THEORY 1 7 Cryptanalysis Cryptanalysis Attacks such as exhaustive key-search do not exploit any properties of the encryption algorithm or implementation. Structural attacks
More informationRotational Cryptanalysis in the Presence of Constants
Rotational Cryptanalysis in the Presence of Constants Tomer Ashur 1 and Yunwen Liu 1,2 1 Dept. Electrical Engineering (ESAT), KU Leuven and iminds, Leuven, Belgium 2 College of Science, National University
More informationCryptanalysis of the Light-Weight Cipher A2U2 First Draft version
Cryptanalysis of the Light-Weight Cipher A2U2 First Draft version Mohamed Ahmed Abdelraheem, Julia Borghoff, Erik Zenner Technical University of Denmark, DK-2800 Kgs. Lyngby, Denmark {M.A.Abdelraheem,J.Borghoff,E.Zenner}@mat.dtu.dk
More informationChosen IV Statistical Analysis for Key Recovery Attacks on Stream Ciphers
Chosen IV Statistical Analysis for Key Recovery Attacks on Stream Ciphers Simon Fischer 1, Shahram Khazaei 2, and Willi Meier 1 1 FHNW and 2 EPFL (Switzerland) AfricaCrypt 2008, Casablanca - June 11-14
More informationImpossible differential and square attacks: Cryptanalytic link and application to Skipjack
UCL Crypto Group Technical Report Series Impossible differential and square attacks: Cryptanalytic link and application to Skipjack Gilles Piret Jean-Jacques Quisquater REGARDS GROUPE http://www.dice.ucl.ac.be/crypto/
More informationImproved Linear Cryptanalysis of reduced-round SIMON-32 and SIMON-48
Improved inear Cryptanalysis of reduced-round SIMON-32 and SIMON-48 Mohamed Ahmed Abdelraheem, Javad Alizadeh 2, Hoda A. Alkhzaimi 3, Mohammad eza Aref 2, Nasour Bagheri 4, and Praveen Gauravaram 5 SICS
More informationStream ciphers. Pawel Wocjan. Department of Electrical Engineering & Computer Science University of Central Florida
Stream ciphers Pawel Wocjan Department of Electrical Engineering & Computer Science University of Central Florida wocjan@eecs.ucf.edu Definition of block ciphers Block ciphers: crypto work horse n bits
More informationThesis Research Notes
Thesis Research Notes Week 26-2012 Christopher Wood June 29, 2012 Abstract This week was devoted to reviewing some classical literature on the subject of Boolean functions and their application to cryptography.
More informationImpossible Differential-Linear Cryptanalysis of Reduced-Round CLEFIA-128
Impossible Differential-Linear Cryptanalysis of Reduced-Round CLEFIA-8 Zheng Yuan,,, ian Li, Beijing Electronic Science & Technology Institute, Beijing 7, P.R. China zyuan@tsinghua.edu.cn, sharonlee95@6.com
More informationImproved Slender-set Linear Cryptanalysis
1 / 37 Improved Slender-set Linear Cryptanalysis Guo-Qiang Liu 1 Chen-Hui Jin 1 Chuan-Da Qi 2 1 Information Science Technology Institute Zhengzhou, Henan, China 2 Xinyang Normal University Xinyang, Henan,
More informationChapter 1 - Linear cryptanalysis.
Chapter 1 - Linear cryptanalysis. James McLaughlin 1 Introduction. Linear cryptanalysis was first introduced by Mitsuru Matsui in [12]. The cryptanalyst attempts to find a linear equation x 1... x i =
More informationDifferential Fault Analysis on the families of SIMON and SPECK ciphers
Differential Fault Analysis on the families of SIMON and SPECK ciphers Harshal Tupsamudre, Shikha Bisht, Debdeep Mukhopadhyay Indian Institute of Technology, Kharagpur Abstract. In 2013, the US National
More informationRevisiting AES Related-Key Differential Attacks with Constraint Programming
Revisiting AES Related-Key Differential Attacs with Constraint Programming D Gerault (), P Lafourcade (), M Minier (2), C Solnon (3) () - LIMOS, Université Clermont-Ferrand (2) - LORIA, Université de Lorraine
More informationOutline. Two-batch liar games on a general bounded channel. Paul s t-ary questions: binary case. Basic liar game setting
Outline Two-batch liar games on a general bounded channel Robert B. Ellis 1 Kathryn L. Nyman 2 1 Illinois Institute of Technology 2 Loyola University, Chicago University of Illinois at Urbana-Champaign
More informationMulti-Approximate-Keyword Routing Query
Bin Yao 1, Mingwang Tang 2, Feifei Li 2 1 Department of Computer Science and Engineering Shanghai Jiao Tong University, P. R. China 2 School of Computing University of Utah, USA Outline 1 Introduction
More informationNew attacks on Keccak-224 and Keccak-256
New attacks on Keccak-224 and Keccak-256 Itai Dinur 1, Orr Dunkelman 1,2 and Adi Shamir 1 1 Computer Science department, The Weizmann Institute, Rehovot, Israel 2 Computer Science Department, University
More informationIntroduction to Modern Cryptography. (1) Finite Groups, Rings and Fields. (2) AES - Advanced Encryption Standard
Introduction to Modern Cryptography Lecture 3 (1) Finite Groups, Rings and Fields (2) AES - Advanced Encryption Standard +,0, and -a are only notations! Review - Groups Def (group): A set G with a binary
More informationLinear Cryptanalysis of Reduced-Round PRESENT
Linear Cryptanalysis of Reduced-Round PRESENT Joo Yeon Cho 1 Helsinki University of Technology, Finland 2 Nokia A/S, Denmark joo.cho@tkk.fi Abstract. PRESENT is a hardware-oriented block cipher suitable
More informationBlock ciphers. Block ciphers. Data Encryption Standard (DES) DES: encryption circuit
Block ciphers Block ciphers Myrto Arapinis School o Inormatics University o Edinburgh January 22, 2015 A block cipher with parameters k and l is a pair o deterministic algorithms (E, D) such that Encryption
More informationBit-Based Division Property and Application to Simon Family
Bit-Based Division Property and Application to Simon Family Yosuke Todo 1,2 and Masakatu Morii 2 1 NTT Secure Platform Laboratories, Tokyo, Japan todo.yosuke@lab.ntt.co.jp 2 Kobe University, Kobe, Japan
More informationExercise Sheet Cryptography 1, 2011
Cryptography 1 http://www.cs.ut.ee/~unruh/crypto1-11/ Exercise Sheet Cryptography 1, 2011 Exercise 1 DES The Data Encryption Standard (DES) is a very famous and widely used block cipher. It maps 64-bit
More informationModified version of Latin Dances Revisited: New Analytic Results of Salsa20 and ChaCha
Modified version of Latin Dances Revisited: New Analytic Results of Salsa20 and ChaCha Tsukasa Ishiguro KDDI R&D Laboratories Inc. 2-1-15 Ohara, Fujimino, Saitama 356-8502, Japan tsukasa@kddilabs.jp 1
More informationAlgebraic Techniques in Differential Cryptanalysis
Algebraic Techniques in Differential Cryptanalysis Martin Albrecht and Carlos Cid Information Security Group, Royal Holloway, University of London FSE 2009, Leuven, 24.02.2009 Martin Albrecht and Carlos
More informationVirtual isomorphisms of ciphers: is AES secure against differential / linear attack?
Alexander Rostovtsev alexander. rostovtsev@ibks.ftk.spbstu.ru St. Petersburg State Polytechnic University Virtual isomorphisms of ciphers: is AES secure against differential / linear attack? In [eprint.iacr.org/2009/117]
More informationCryptanalysis of Achterbahn
Cryptanalysis of Achterbahn Thomas Johansson 1, Willi Meier 2, and Frédéric Muller 3 1 Department of Information Technology, Lund University P.O. Box 118, 221 00 Lund, Sweden thomas@it.lth.se 2 FH Aargau,
More informationDistinguishing Attacks on a Kind of Generalized Unbalanced Feistel Network
Distinguishing Attacks on a Kind of Generalized Unbalanced Feistel Network Ruilin Li, Bing Sun, and Chao Li Department of Mathematics and System Science, Science College, National University of Defense
More informationSTP Models of Optimal Differential and Linear Trail for S-box Based Ciphers
STP Models of Optimal Differential and Linear Trail for S-box Based Ciphers Yu Liu 1,2, Huicong Liang 1, Muzhou Li 1, Luning Huang 1, Kai Hu 1, Chenhe Yang 1, and Meiqin Wang 1,3 1 Key Laboratory of Cryptologic
More informationDifferential Cryptanalysis and Boomerang Cryptanalysis of LBlock
Differential Cryptanalysis and Boomerang Cryptanalysis of LBlock Jiageng Chen, Atsuko Miyaji To cite this version: Jiageng Chen, Atsuko Miyaji. Differential Cryptanalysis and Boomerang Cryptanalysis of
More informationLinear Cryptanalysis Using Low-bias Linear Approximations
Linear Cryptanalysis Using Low-bias Linear Approximations Tomer Ashur 1, Daniël Bodden 1, and Orr Dunkelman 2 1 Dept. Electrical Engineering, COSIC-imec, KU Leuven, Belgium [tashur,dbodden]@esat.kuleuven.be
More informationImpossible Differential Attacks on 13-Round CLEFIA-128
Mala H, Dakhilalian M, Shakiba M. Impossible differential attacks on 13-round CLEFIA-128. JOURNAL OF COMPUTER SCIENCE AND TECHNOLOGY 26(4): 744 750 July 2011. DOI 10.1007/s11390-011-1173-0 Impossible Differential
More informationOn the Design Rationale of Simon Block Cipher: Integral Attacks and Impossible Differential Attacks against Simon Variants
On the Design Rationale of Simon Block Cipher: Integral Attacks and Impossible Differential Attacks against Simon Variants Kota Kondo 1, Yu Sasaki 2, and Tetsu Iwata 3 1 Nagoya University, Japan, k kondo@echo.nuee.nagoya-u.ac.jp
More informationBreaking the FF3 Format Preserving Encryption
Breaking the 3 ormat Preserving Encryption. Betül Durak and Serge Vaudenay ÉCOLE POLYTECHNIQUE ÉDÉRALE DE LAUSANNE http://lasec.epfl.ch/ SV 2017 breaking 3 ESC 17 1 / 23 1 ormat Preserving Encryption 2
More informationSalsa20 Cryptanalysis: New Moves and Revisiting Old Styles
Salsa0 Cryptanalysis: New Moves and Revisiting Old Styles Subhamoy Maitra 1, Goutam Paul 1, Willi Meier 1 Indian Statistical Institute, Kolkata, India {subho,goutam.paul}@isical.ac.in FHNW, Windisch, Switzerland
More information