DOCSLIB.ORG

The Return of the Cryptographic Boomerang S

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text

Load more

IEEE TRANSACTIONS ON INFORMATION THEORY, VOL. XX, NO. XX, XXX 20XX 2 The Return of the Cryptographic Boomerang S. Murphy △ Abstract—The boomerang analysis, together with its offspring Q ′ the amplified boomerang analysis and the rectangle analysis, Q are techniques that are widely used in the analysis of block 6 6 ciphers. We give realistic examples which demonstrate that the boomerang analysis can commonly give probability values that △ are highly inaccurate. Thus any complexity estimates for the P P ′ security of a block cipher based on the boomerang or rectangle −1 −1 analysis must be viewed extremely sceptically. E0 E0 Index Terms—Block Ciphers, Boomerang Analysis, Rectangle ? 6 ? 6 Analysis. E0 E0 I. INTRODUCTION ′ Y △∗ Y The boomerang analysis of [1] is an adaptation of differ- ∇∗ 6 ∇∗ 6 ential cryptanalysis [2], [3] in which quartets of encryptions and decryptions are used. Two related plaintexts are encrypted, ? △∗ ? and the resulting pair of ciphertexts is then used to generate X X′ two new related ciphertexts. These two new ciphertexts are then decrypted to give two new plaintexts. The aim of the E−1 E−1 boomerang analysis is to use such quartets of plaintexts and 1 1 of ciphertexts to find key information. Furthermore, enhanced ? 6 ? 6 versions of the boomerang analysis based on this idea have E1 E1 also been developed, such as the amplified boomerang analy- sis [4] and the rectangle analysis [5]. ′ ∇ D ∇ D There is however no a priori reason for the probabilistic argument of [1] concerning the boomerang analysis, and there- ? ? fore for the related analyses, to be correct. We demonstrate this C C′ by giving simple examples using the Data Encryption Standard (DES) [6] and the Advanced Encryption Standard (AES) [7]. Fig. 1. Schematic Diagram of the Basic Boomerang Analysis. The motivation for the use of the word boomerang to describe such an analysis of quartets is given in [1]. 0 This is why we call it the boomerang attack: when ² Encrypt P and P to obtain ciphertexts C = E(P ) and 0 0 you send it properly, it always comes back to you. C = E(P ). 0 We send a DES or an AES boomerang, but our boomerang ² Obtain two further ciphertexts D = C + r and D = 0 won’t come back. C + r. 0 ¡1 ² Decrypt D and D to obtain plaintexts Q = E (D) and Q0 = E¡1(D0). II. THE BOOMERANG ANALYSIS We describe the basic boomerang analysis in the manner The boomerang analysis is an attempt to use the ideas of differential cryptanalysis [2], [3] to analyse the plaintext of [1], and a schematic diagram of the boomerang analysis, 0 0 0 0 based on Figure 1 of [1], is given in Figure 1. We base quartet (P; P ; Q; Q ) and ciphertext quartet (C; C ; D; D ). our notation on that of [1], so we suppose that E represents To this end, we consider the encryption operation in two parts, the block cipher encryption under a fixed key. The basic so we may write E = E1 ± E0. Thus E0 represents the initial part of the encryption operation, and E1 represents the final boomerang analysis is based on a quartet of encryptions and 0 0 decryptions, and the process for generating such a quartet is part. We let (X; X ; Y; Y ) denote the intermediate result of described below. the encryption and decryption operations, so we have: ² Choose values 4 and r. ¡1 0 0 ¡1 0 X = E0(P ) = E1 (C);X = E0(P ) = E1 (C ); 0 0 ² Choose a pair of plaintexts P and P such that P +P = ¡1 0 0 ¡1 0 Y = E0(Q) = E1 (D);Y = E0(Q ) = E1 (D ): 4. The basic boomerang analysis uses two differential charac- S. Murphy is with the Information Security Group, Department of Mathe- teristics [2], [3]. The differential characteristic 4 ! 4¤ is matics, Royal Holloway, University of London, Egham, Surrey TW20 0EX, U.K. used for the initial part E0 of the overall encryption E and Manuscript received XX; revised XX. the differential characteristic r¤ ! r is used for the final IEEE TRANSACTIONS ON INFORMATION THEORY, VOL. XX, NO. XX, XXX 20XX 3 ¤ part E1 of the overall encryption E, for some values 4 and inputs to DES S-Box 2 in the fourth round of this cipher. Thus r¤. A quartet of encryptions and decryptions, or equivalently c; c0; d; d0 are a selection of six bits of C; C0; D; D0. For a right 0 0 ¤ the corresponding plaintext and ciphertext quartets, is called a quartet, we require that X + X = Y + Y = 4 = ±9 and 0 0 ¤ right quartet if the following conditions hold: X + Y = X + Y = r = ±B. Allowing for the expansion phase of the DES round function [6], a right quartet therefore P + P 0 = Q + Q0 = 4;X + X0 = Y + Y 0 = 4¤; satisfies X + Y = X0 + Y 0 = r¤;C + D = C0 + D0 = r: A motivation for using this quartet of encryptions and c + c0 = d + d0 = 110010 and c + d = c0 + d0 = 110110; decryptions, and for the definition of a right quartet is given in [1]. which gives the following relationship between the four 6-bit We want to cover the pair P; P 0 with the char- S-Box inputs: acteristic for E0, and to cover the pairs P; Q and 0 0 ¡1 0 P ;Q with the characteristic for E1 . Then (we c = c + 110010; claim) the pair Q; Q0 is perfectly set up to use the d = c + 110110; ¤ ¡1 0 characteristic 4 ! 4 for E0 . and d = d + 110010 = c + 000100: It is the case that In the classical differential cryptanalysis of the DES, we E (Q) + E (Q0) = Y + Y 0 0 0 require that the outputs of the respective pairs of S-Boxes are = (Y + X) + (X + X0) + (X0 + Y 0) identical. Thus we have = r¤ + 4¤ + r¤ = 4¤ 0 0 is indeed a condition required to start the characteristic S2(c) = S2(d) and S2(c ) = S2(d ); ¤ ¡1 4 ! 4 for E0 , the inverse of the initial part of the 6 4 encryption operation. However, whilst this condition is a where S2 : Z2 ! Z2 is the 6-bit to 4-bit function given by necessary condition, it is not a sufficient condition, as the DES S-Box 2. For a right quartet to exist, we therefore require examples of Section III and VI demonstrate. that there exists a 6-bit value c such that The statistical reasoning of the boomerang analysis given in Section 4 of [1] states that the probability p of a right quartet S2(c) = S2(c + 110110) satisfies and S2(c + 110010) = S2(c + 000100): 2 2 p ¸ p0p1; It is easy to verify by a direct search of all 26 = 64 possibilities where p0 is the probability of the differential characteristic for c that no such value for c exists. ¤ 4 ! 4 under E0 and p1 is the probability of the differential ¤ It is is not therefore possible for a right quartet to exist in characteristic r ! r under E1. The complexity estimates this boomerang analysis. In other words, a right quartet exists for the boomerang analysis given in [1] are based on this in this boomerang analysis with probability zero, rather than p ¡ ¢4 estimate of . However, in both Sections III and VI we give than the probability of at least p2p2 ¼ 1 > 0 asserted p ; p > 0 0 1 234 examples of a boomerang analysis with 0 1 , but for by [1]. This DES boomerang never comes back. which a right quartet can never occur, that is p = 0. III. A DES BOOMERANG IV. THE AMPLIFIED BOOMERANG ANALYSIS We consider a boomerang analysis on a block cipher that consists of four rounds of the Data Encryption Standard The amplified boomerang analysis of [4] is an adaptation (DES) [6]. Thus E is the encryption under some fixed key of the basic boomerang analysis that only uses encryptions of four rounds of the DES (without IP and IP ¡1), and we and no decryptions in a chosen plaintext analysis. The idea 0 0 suppose that E0 is the initial two rounds of this encryption and is to encrypt pairs (P; P ) or (Q; Q ) of plaintexts satisfying 0 0 0 that E1 the final two rounds of this encryption. We use the P + P = Q + Q = 4. As before, we let (X; X ) = 0 0 0 two differential characteristics used in the iterated differential (E0(P );E0(P )) and (Y; Y ) = (E0(Q);E0(Q )) denote the cryptanalysis of the DES [2], [3]. Thus we define intermediate values of encryptions under E. Such intermediate values (X; X0) or (Y; Y 0) then satisfy X + X0 = 4¤ or 4 = 4¤ = 19600000 00000000 = (γ ; 0) = ± 9 9 Y + Y 0 = 4¤ with probability p . Thus if we start with and r = r¤ = 1B600000 00000000 = (γ ; 0) = ± ; 0 B B N such plaintext pairs, we expect to obtain Np intermedi- so in particular we have: ate pairs with difference 4¤, and so we expect to obtain about 1 (Np)2 intermediate quartets (X; X0; Y; Y 0) satisfying E (Z) + E (Z + 4) = 4¤ with probability p ¼ 1 ; 2 0 0 0 234 X +X0 = Y +Y 0 = 4¤. It is then asserted by [4] that such an E (Z) + E (Z + r¤) = r with probability p ¼ 1 : 1 1 1 234 intermediate quartet also satisfies X +Y = X0 +Y 0 = r¤, the The reasoning of Section 4 of [1] would now assert¡ ¢ that the other part of the boomerang condition, uniformly at random.
Recommended publications
  • Improved Rectangle Attacks on SKINNY and CRAFT

    Improved Rectangle Attacks on SKINNY and CRAFT

    Improved Rectangle Attacks on SKINNY and CRAFT Hosein Hadipour1, Nasour Bagheri2 and Ling Song3( ) 1 Department of Mathematics and Computer Science, University of Tehran, Tehran, Iran, [email protected] 2 Electrical Engineering Department, Shahid Rajaee Teacher Training University, Tehran, Iran, [email protected] 3 Jinan University, Guangzhou, China [email protected] Abstract. The boomerang and rectangle attacks are adaptions of differential crypt- analysis that regard the target cipher E as a composition of two sub-ciphers, i.e., 2 2 E = E1 ◦ E0, to construct a distinguisher for E with probability p q by concatenat- ing two short differential trails for E0 and E1 with probability p and q respectively. According to the previous research, the dependency between these two differential characteristics has a great impact on the probability of boomerang and rectangle distinguishers. Dunkelman et al. proposed the sandwich attack to formalise such dependency that regards E as three parts, i.e., E = E1 ◦ Em ◦ E0, where Em contains the dependency between two differential trails, satisfying some differential propagation with probability r. Accordingly, the entire probability is p2q2r. Recently, Song et al. have proposed a general framework to identify the actual boundaries of Em and systematically evaluate the probability of Em with any number of rounds, and applied their method to accurately evaluate the probabilities of the best SKINNY’s boomerang distinguishers. In this paper, using a more advanced method to search for boomerang distinguishers, we show that the best previous boomerang distinguishers for SKINNY can be significantly improved in terms of probability and number of rounds.
  • Lecture Note 8 ATTACKS on CRYPTOSYSTEMS I Sourav Mukhopadhyay

    Lecture Note 8 ATTACKS on CRYPTOSYSTEMS I Sourav Mukhopadhyay

    Lecture Note 8 ATTACKS ON CRYPTOSYSTEMS I Sourav Mukhopadhyay Cryptography and Network Security - MA61027 Attacks on Cryptosystems • Up to this point, we have mainly seen how ciphers are implemented. • We have seen how symmetric ciphers such as DES and AES use the idea of substitution and permutation to provide security and also how asymmetric systems such as RSA and Diffie Hellman use other methods. • What we haven’t really looked at are attacks on cryptographic systems. Cryptography and Network Security - MA61027 (Sourav Mukhopadhyay, IIT-KGP, 2010) 1 • An understanding of certain attacks will help you to understand the reasons behind the structure of certain algorithms (such as Rijndael) as they are designed to thwart known attacks. • Although we are not going to exhaust all possible avenues of attack, we will get an idea of how cryptanalysts go about attacking ciphers. Cryptography and Network Security - MA61027 (Sourav Mukhopadhyay, IIT-KGP, 2010) 2 • This section is really split up into two classes of attack: Cryptanalytic attacks and Implementation attacks. • The former tries to attack mathematical weaknesses in the algorithms whereas the latter tries to attack the specific implementation of the cipher (such as a smartcard system). • The following attacks can refer to either of the two classes (all forms of attack assume the attacker knows the encryption algorithm): Cryptography and Network Security - MA61027 (Sourav Mukhopadhyay, IIT-KGP, 2010) 3 – Ciphertext-only attack: In this attack the attacker knows only the ciphertext to be decoded. The attacker will try to find the key or decrypt one or more pieces of ciphertext (only relatively weak algorithms fail to withstand a ciphertext-only attack).
  • Hash Functions and the (Amplified) Boomerang Attack

    Hash Functions and the (Amplified) Boomerang Attack

    Hash Functions and the (Amplified) Boomerang Attack Antoine Joux1,3 and Thomas Peyrin2,3 1 DGA 2 France T´el´ecomR&D [email protected] 3 Universit´ede Versailles Saint-Quentin-en-Yvelines [email protected] Abstract. Since Crypto 2004, hash functions have been the target of many at- tacks which showed that several well-known functions such as SHA-0 or MD5 can no longer be considered secure collision free hash functions. These attacks use classical cryptographic techniques from block cipher analysis such as differential cryptanal- ysis together with some specific methods. Among those, we can cite the neutral bits of Biham and Chen or the message modification techniques of Wang et al. In this paper, we show that another tool of block cipher analysis, the boomerang attack, can also be used in this context. In particular, we show that using this boomerang attack as a neutral bits tool, it becomes possible to lower the complexity of the attacks on SHA-1. Key words: hash functions, boomerang attack, SHA-1. 1 Introduction The most famous design principle for dedicated hash functions is indisputably the MD-SHA family, firstly introduced by R. Rivest with MD4 [16] in 1990 and its improved version MD5 [15] in 1991. Two years after, the NIST publishes [12] a very similar hash function, SHA-0, that will be patched [13] in 1995 to give birth to SHA-1. This family is still very active, as NIST recently proposed [14] a 256-bit new version SHA-256 in order to anticipate the potential cryptanalysis results and also to increase its security with regard to the fast growth of the computation power.
  • Boomerang Analysis Method Based on Block Cipher

    Boomerang Analysis Method Based on Block Cipher

    International Journal of Security and Its Application Vol.11, No.1 (2017), pp.165-178 http://dx.doi.org/10.14257/ijsia.2017.11.1.14 Boomerang Analysis Method Based on Block Cipher Fan Aiwan and Yang Zhaofeng Computer School, Pingdingshan University, Pingdingshan, 467002 Henan province, China { Fan Aiwan} [email protected] Abstract This paper fused together the related key analysis and differential analysis and did multiple rounds of attack analysis for the DES block cipher. On the basis of deep analysis of Boomerang algorithm principle, combined with the characteristics of the key arrangement of the DES block cipher, the 8 round DES attack experiment and the 9 round DES attack experiment were designed based on the Boomerang algorithm. The experimental results show that, after the design of this paper, the value of calculation complexity of DES block cipher is only 240 and the analysis performance is greatly improved by the method of Boomerang attack. Keywords: block cipher, DES, Boomerang, Computational complexity 1. Introduction With the advent of the information society, especially the extensive application of the Internet to break the traditional limitations of time and space, which brings great convenience to people. However, at the same time, a large amount of sensitive information is transmitted through the channel or computer network, especially the rapid development of e-commerce and e-government, more and more personal information such as bank accounts require strict confidentiality, how to guarantee the security of information is particularly important [1-2]. The essence of information security is to protect the information system or the information resources in the information network from various types of threats, interference and destruction, that is, to ensure the security of information [3].
  • Report on the AES Candidates

    Report on the AES Candidates

    Rep ort on the AES Candidates 1 2 1 3 Olivier Baudron , Henri Gilb ert , Louis Granb oulan , Helena Handschuh , 4 1 5 1 Antoine Joux , Phong Nguyen ,Fabrice Noilhan ,David Pointcheval , 1 1 1 1 Thomas Pornin , Guillaume Poupard , Jacques Stern , and Serge Vaudenay 1 Ecole Normale Sup erieure { CNRS 2 France Telecom 3 Gemplus { ENST 4 SCSSI 5 Universit e d'Orsay { LRI Contact e-mail: [email protected] Abstract This do cument rep orts the activities of the AES working group organized at the Ecole Normale Sup erieure. Several candidates are evaluated. In particular we outline some weaknesses in the designs of some candidates. We mainly discuss selection criteria b etween the can- didates, and make case-by-case comments. We nally recommend the selection of Mars, RC6, Serp ent, ... and DFC. As the rep ort is b eing nalized, we also added some new preliminary cryptanalysis on RC6 and Crypton in the App endix which are not considered in the main b o dy of the rep ort. Designing the encryption standard of the rst twentyyears of the twenty rst century is a challenging task: we need to predict p ossible future technologies, and wehavetotake unknown future attacks in account. Following the AES pro cess initiated by NIST, we organized an op en working group at the Ecole Normale Sup erieure. This group met two hours a week to review the AES candidates. The present do cument rep orts its results. Another task of this group was to up date the DFC candidate submitted by CNRS [16, 17] and to answer questions which had b een omitted in previous 1 rep orts on DFC.
  • Identifying Open Research Problems in Cryptography by Surveying Cryptographic Functions and Operations 1

    Identifying Open Research Problems in Cryptography by Surveying Cryptographic Functions and Operations 1

    International Journal of Grid and Distributed Computing Vol. 10, No. 11 (2017), pp.79-98 http://dx.doi.org/10.14257/ijgdc.2017.10.11.08 Identifying Open Research Problems in Cryptography by Surveying Cryptographic Functions and Operations 1 Rahul Saha1, G. Geetha2, Gulshan Kumar3 and Hye-Jim Kim4 1,3School of Computer Science and Engineering, Lovely Professional University, Punjab, India 2Division of Research and Development, Lovely Professional University, Punjab, India 4Business Administration Research Institute, Sungshin W. University, 2 Bomun-ro 34da gil, Seongbuk-gu, Seoul, Republic of Korea Abstract Cryptography has always been a core component of security domain. Different security services such as confidentiality, integrity, availability, authentication, non-repudiation and access control, are provided by a number of cryptographic algorithms including block ciphers, stream ciphers and hash functions. Though the algorithms are public and cryptographic strength depends on the usage of the keys, the ciphertext analysis using different functions and operations used in the algorithms can lead to the path of revealing a key completely or partially. It is hard to find any survey till date which identifies different operations and functions used in cryptography. In this paper, we have categorized our survey of cryptographic functions and operations in the algorithms in three categories: block ciphers, stream ciphers and cryptanalysis attacks which are executable in different parts of the algorithms. This survey will help the budding researchers in the society of crypto for identifying different operations and functions in cryptographic algorithms. Keywords: cryptography; block; stream; cipher; plaintext; ciphertext; functions; research problems 1. Introduction Cryptography [1] in the previous time was analogous to encryption where the main task was to convert the readable message to an unreadable format.
  • Applications of Search Techniques to Cryptanalysis and the Construction of Cipher Components. James David Mclaughlin Submitted F

    Applications of Search Techniques to Cryptanalysis and the Construction of Cipher Components. James David Mclaughlin Submitted F

    Applications of search techniques to cryptanalysis and the construction of cipher components. James David McLaughlin Submitted for the degree of Doctor of Philosophy (PhD) University of York Department of Computer Science September 2012 2 Abstract In this dissertation, we investigate the ways in which search techniques, and in particular metaheuristic search techniques, can be used in cryptology. We address the design of simple cryptographic components (Boolean functions), before moving on to more complex entities (S-boxes). The emphasis then shifts from the construction of cryptographic arte- facts to the related area of cryptanalysis, in which we first derive non-linear approximations to S-boxes more powerful than the existing linear approximations, and then exploit these in cryptanalytic attacks against the ciphers DES and Serpent. Contents 1 Introduction. 11 1.1 The Structure of this Thesis . 12 2 A brief history of cryptography and cryptanalysis. 14 3 Literature review 20 3.1 Information on various types of block cipher, and a brief description of the Data Encryption Standard. 20 3.1.1 Feistel ciphers . 21 3.1.2 Other types of block cipher . 23 3.1.3 Confusion and diffusion . 24 3.2 Linear cryptanalysis. 26 3.2.1 The attack. 27 3.3 Differential cryptanalysis. 35 3.3.1 The attack. 39 3.3.2 Variants of the differential cryptanalytic attack . 44 3.4 Stream ciphers based on linear feedback shift registers . 48 3.5 A brief introduction to metaheuristics . 52 3.5.1 Hill-climbing . 55 3.5.2 Simulated annealing . 57 3.5.3 Memetic algorithms . 58 3.5.4 Ant algorithms .
  • Cryptanalysis of Block Ciphers

    Cryptanalysis of Block Ciphers

    Cryptanalysis of Block Ciphers Jiqiang Lu Technical Report RHUL–MA–2008–19 30 July 2008 Royal Holloway University of London Department of Mathematics Royal Holloway, University of London Egham, Surrey TW20 0EX, England http://www.rhul.ac.uk/mathematics/techreports CRYPTANALYSIS OF BLOCK CIPHERS JIQIANG LU Thesis submitted to the University of London for the degree of Doctor of Philosophy Information Security Group Department of Mathematics Royal Holloway, University of London 2008 Declaration These doctoral studies were conducted under the supervision of Prof. Chris Mitchell. The work presented in this thesis is the result of original research carried out by myself, in collaboration with others, whilst enrolled in the Information Security Group of Royal Holloway, University of London as a candidate for the degree of Doctor of Philosophy. This work has not been submitted for any other degree or award in any other university or educational establishment. Jiqiang Lu July 2008 2 Acknowledgements First of all, I thank my supervisor Prof. Chris Mitchell for suggesting block cipher cryptanalysis as my research topic when I began my Ph.D. studies in September 2005. I had never done research in this challenging ¯eld before, but I soon found it to be really interesting. Every time I ¯nished a manuscript, Chris would give me detailed comments on it, both editorial and technical, which not only bene¯tted my research, but also improved my written English. Chris' comments are fantastic, and it is straightforward to follow them to make revisions. I thank my advisor Dr. Alex Dent for his constructive suggestions, although we work in very di®erent ¯elds.
  • Differential-Linear Cryptanalysis Revisited

    Differential-Linear Cryptanalysis Revisited

    Differential-Linear Cryptanalysis Revisited C´elineBlondeau1 and Gregor Leander2 and Kaisa Nyberg1 1 Department of Information and Computer Science, Aalto University School of Science, Finland fceline.blondeau, [email protected] 2 Faculty of Electrical Engineering and Information Technology, Ruhr Universit¨atBochum, Germany [email protected] Abstract. Block ciphers are arguably the most widely used type of cryptographic primitives. We are not able to assess the security of a block cipher as such, but only its security against known attacks. The two main classes of attacks are linear and differential attacks and their variants. While a fundamental link between differential and linear crypt- analysis was already given in 1994 by Chabaud and Vaudenay, these at- tacks have been studied independently. Only recently, in 2013 Blondeau and Nyberg used the link to compute the probability of a differential given the correlations of many linear approximations. On the cryptana- lytical side, differential and linear attacks have been applied on different parts of the cipher and then combined to one distinguisher over the ci- pher. This method is known since 1994 when Langford and Hellman presented the first differential-linear cryptanalysis of the DES. In this paper we take the natural step and apply the theoretical link between linear and differential cryptanalysis to differential-linear cryptanalysis to develop a concise theory of this method. We give an exact expression of the bias of a differential-linear approximation in a closed form under the sole assumption that the two parts of the cipher are independent. We also show how, under a clear assumption, to approximate the bias effi- ciently, and perform experiments on it.
  • Boomerang Connectivity Table: a New Cryptanalysis Tool

    Boomerang Connectivity Table: a New Cryptanalysis Tool

    Boomerang Connectivity Table: A New Cryptanalysis Tool Carlos Cid1, Tao Huang2, Thomas Peyrin2;3;4, Yu Sasaki5, and Ling Song2;3;6 1 Information Security Group Royal Holloway, University of London, UK [email protected] 2 School of Physical and Mathematical Sciences Nanyang Technological University, Singapore [email protected] [email protected] [email protected] 3 Temasek Laboratories, Nanyang Technological University, Singapore 4 School of Computer Science and Engineering Nanyang Technological University, Singapore 5 NTT Secure Platform Laboratories, Japan [email protected] 6 State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, China Abstract. A boomerang attack is a cryptanalysis framework that re- gards a block cipher E as the composition of two sub-ciphers E1 ◦E0 and builds a particular characteristic for E with probability p2q2 by combin- ing differential characteristics for E0 and E1 with probability p and q, respectively. Crucially the validity of this figure is under the assumption that the characteristics for E0 and E1 can be chosen independently. In- deed, Murphy has shown that independently chosen characteristics may turn out to be incompatible. On the other hand, several researchers ob- served that the probability can be improved to p or q around the bound- ary between E0 and E1 by considering a positive dependency of the two characteristics, e.g. the ladder switch and S-box switch by Biryukov and Khovratovich. This phenomenon was later formalised by Dunkelman et al. as a sandwich attack that regards E as E1 ◦ Em ◦ E0, where Em sat- isfies some differential propagation among four texts with probability r, and the entire probability is p2q2r.
  • The Retracing Boomerang Attack

    The Retracing Boomerang Attack

    The Retracing Boomerang Attack Orr Dunkelman1, Nathan Keller2, Eyal Ronen3;4, and Adi Shamir5 1 Computer Science Department, University of Haifa, Israel [email protected] 2 Department of Mathematics, Bar-Ilan University, Israel [email protected] 3 School of Computer Science, Tel Aviv University, Tel Aviv, Israel [email protected] 4 COSIC, KU Leuven, Heverlee, Belgium 5 Faculty of Mathematics and Computer Science, Weizmann Institute of Science, Israel [email protected] Abstract. Boomerang attacks are extensions of differential attacks, that make it possible to combine two unrelated differential properties of the first and second part of a cryptosystem with probabilities p and q into a new differential-like property of the whole cryptosystem with probability p2q2 (since each one of the properties has to be satisfied twice). In this paper we describe a new version of boomerang attacks which uses the counterintuitive idea of throwing out most of the data (including poten- tially good cases) in order to force equalities between certain values on the ciphertext side. This creates a correlation between the four proba- bilistic events, which increases the probability of the combined property to p2q and increases the signal to noise ratio of the resultant distin- guisher. We call this variant a retracing boomerang attack since we make sure that the boomerang we throw follows the same path on its forward and backward directions. To demonstrate the power of the new technique, we apply it to the case of 5-round AES. This version of AES was repeatedly attacked by a large variety of techniques, but for twenty years its complexity had remained stuck at 232.
  • SKINNY-AEAD and SKINNY-Hash Specification

    SKINNY-AEAD and SKINNY-Hash Specification

    SKINNY-AEAD and SKINNY-Hash v1.1 Christof Beierle1;4, J´er´emy Jean2, Stefan K¨olbl3, Gregor Leander4, Amir Moradi4, Thomas Peyrin5, Yu Sasaki6, Pascal Sasdrich4;7, and Siang Meng Sim5 1 SnT, University of Luxembourg, Luxembourg [email protected] 2 ANSSI, Paris, France [email protected] 3 Cybercrypt A/S, Denmark [email protected] 4 Horst G¨ortzInstitute for IT Security, Ruhr-Universit¨atBochum, Germany [email protected] 5 School of Physical and Mathematical Sciences Nanyang Technological University, Singapore [email protected], [email protected] 6 NTT Secure Platform Laboratories, Japan [email protected] 7 Rambus Cryptography, The Netherlands Table of Contents 1 Introduction...........................................................3 2 Specification..........................................................5 2.1 Notations........................................................5 2.2 Parameter Sets....................................................5 2.3 The Tweakable Block Ciphers SKINNY-128-256 and SKINNY-128-384 ....6 2.4 The AEAD Scheme SKINNY-AEAD....................................9 2.5 The Hash Functionality SKINNY-Hash ................................ 26 3 Security Claims........................................................ 29 4 Design Rationale....................................................... 31 4.1 Rationale for the Tweakable Block Ciphers........................... 31 4.2 Rationale for the AEAD scheme..................................... 33 4.3 Rationale for the Hash Function Scheme............................