DOCSLIB.ORG

Zero Correlation Linear Cryptanalysis on LEA Family Ciphers

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Zero Correlation Linear Cryptanalysis on LEA Family Ciphers Journal of Communications Vol. 11, No. 7, July 2016 Zero Correlation Linear Cryptanalysis on LEA Family Ciphers Kai Zhang, Jie Guan, and Bin Hu Information Science and Technology Institute, Zhengzhou 450000, China Email: [email protected]; [email protected]; [email protected] Abstract—In recent two years, zero correlation linear Zero correlation linear cryptanalysis was firstly cryptanalysis has shown its great potential in cryptanalysis and proposed by Andrey Bogdanov and Vicent Rijmen in it has proven to be effective against massive ciphers. LEA is a 2011 [2], [3]. Generally speaking, this cryptanalytic block cipher proposed by Deukjo Hong, who is the designer of method can be concluded as “use linear approximation of an ISO standard block cipher - HIGHT. This paper evaluates the probability 1/2 to eliminate the wrong key candidates”. security level on LEA family ciphers against zero correlation linear cryptanalysis. Firstly, we identify some 9-round zero However, in this basic model of zero correlation linear correlation linear hulls for LEA. Accordingly, we propose a cryptanalysis, the data complexity is about half of the full distinguishing attack on all variants of 9-round LEA family code book. The high data complexity greatly limits the ciphers. Then we propose the first zero correlation linear application of this new method. In FSE 2012, multiple cryptanalysis on 13-round LEA-192 and 14-round LEA-256. zero correlation linear cryptanalysis [4] was proposed For 13-round LEA-192, we propose a key recovery attack with which use multiple zero correlation linear approximations time complexity of 2131.30 13-round LEA encryptions, data to reduce the data complexity. In this version of zero complexity of 2128 plaintext-ciphertext pairs and memory correlation linear cryptanalysis, although the data complexity of 260.58 bytes. For 14-round LEA-256, we propose complexity can be reduced to some extent, however, a key recovery attack with time complexity of 2250.19 14-round multiple zero correlation linear cryptanalysis method is LEA encryptions, data complexity of 2128 plaintext-ciphertext based on a strong hypothesis that all zero correlation pairs and memory complexity of 2142.35 bytes. As far as we linear approximations used are independent from each know, these are the best results on LEA using zero correlation other. In ASIACRYPT 2012, integral zero correlation linear cryptanalysis so far. distinguisher and multidimensional zero correlation linear Index Terms—Cryptography, cryptanalysis, zero correlation cryptanalysis model [5] were proposed. The data linear cryptanalysis, LEA family ciphers, ARX ciphers complexity for multidimensional zero correlation linear cryptanalysis is the same as multiple zero correlation linear cryptanalysis, however, it doesn’t rely on the I. INTRODUCTION strong assumption. Nowadays, zero correlation linear cryptanalysis has been a new criterion to evaluate the Recently, large numbers of ciphers using only addition, security of newly proposed ciphers [6]-[10]. rotation and XOR have emerged, usually they are called In the specification of LEA [1], the designers evaluated ARX ciphers. Due to the simple operation and high the security level on LEA against massive cryptanalytic efficiency in software and hardware, these ciphers usually methods such as differential cryptanalysis, linear have very good software and hardware performances. cryptanalysis, impossible differential cryptanalysis and One typical application of this kind of ciphers is low zero correlation linear cryptanalysis etc. Among these resource devices such as sensor nodes and RFID tags. attacks, boomerang attack seems to attack the longest Lightweight block cipher LEA [1] was proposed by rounds for LEA-128/192/256, which is 15/16/17 round Electronics and Telecommunications Research Institute respectively. And the rounds attacked with differential of Korea in 2013. It is a typical ARX block cipher and it cryptanalysis, truncated differential cryptanalysis and provides a high-speed software encryption on general- impossible differential cryptanalysis seems to be a little purpose processors. In the specification of LEA [1], shorter, which is 12/13/14 round respectively. For designers have a thorough investigation on the security integral and zero correlation linear cryptanalysis, these level of LEA with a wide variety of cryptanalytic two kinds of distinguishers seem to be much shorter than methods such as differential attack, linear attack, zero others, while the rounds attacked with these two methods correlation attack, impossible differential attack and so on. are much shorter too. This paper reevaluates the security level on LEA family ciphers against zero correlation Manuscript received January 19, 2016; revised July 19, 2016. linear cryptanalysis. This work was supported by the National Natural Science Foundation of China under Grant No.61202491, 61272041, 61272488, Our contributions 61402523 and 61572516. The main purpose of this paper is to evaluate the Corresponding author email: [email protected]. security level of LEA family ciphers against zero doi:10.12720/jcm.11.7.677-685 ©2016 Journal of Communications 677 Journal of Communications Vol. 11, No. 7, July 2016 correlation linear cryptanalysis. Firstly, we identify some just identified a 7-round zero correlation approximation 9-round zero correlation linear hulls which can attack all and consider the possibility of 9-round attack for 128-bit versions of 9-round LEA family ciphers. Secondly, we keys, 10-round attack for 192-bit keys, and 11-round propose the first zero correlation linear cryptanalysis on attack for 256-bit keys. 13-round LEA-192 and 14-round LEA-256. Compared The summary of cryptanalysis on LEA family ciphers with our results, the specification of LEA block ciphers is concluded in the Table I below. TABLE I: SUMMARY OF CRYPTANALYSIS ON LEA FAMILY CIPHERS Length of the Rounds Complexity Attack type Algorithm Reference Distinguisher Attacked Time Data Memory LEA-128/ Differential 11 12/13/14 -- -- -- [1] 192/256 10 11 -- 292 -- Linear LEA [1] 11 11 -- 2126 -- Truncated LEA-128/ 11 12/13/14 -- -- -- [1] Differential 192/256 LEA-128/ Boomerang 14 15/16/17 -- -- -- [1] 192/256 Impossible LEA-128/ 10 12/13/14 -- -- -- [1] Differential 192/256 LEA-128/ Integral 6 9/10/11 -- -- -- [1] 192/256 Differential- LEA-128/ 14 -- -- -- -- [1] Linear 192/256 7 9 -- -- -- [1] LEA-128 9 9. O()2127 O()2127 -- Section 4.1 7 10 -- -- -- [1] Zero Correlation LEA-192 9 13 O()2131. 30 O()2128 260. 58 bytes Section 4.2 7 11 -- -- -- [1] LEA-256 9 14 O()2250. 19 O()2128 2142. 35 bytes Section 4.3 .: This attack is a distinguishing attack, not a key recovery attack. This paper is organized as follows. LEA family ciphers RK i : a 192-bit round key for the i-th round, are briefly introduced in Section 2. Section 3 proposes consisting of six 32-bit words RKi (,, RK i RK i some key observations on LEA block ciphers which will 01 i i i i i be used in our cryptanalysis. In Section 4, first of all, RK2,,,) RK 3 RK 4 RK 5 . RK j,( m n ) represents the bits some 9-round zero correlation linear hulls are proposed i m to n of RKj (0 j 5) ; for all variants of LEA family ciphers. Then based on K : master key. For LEA-128, KKKKK (,,,) , these newly proposed distinguishers, zero correlation 0 1 2 3 linear cryptanalysis for 13-round LEA-192 and 14-round for LEA-192, KKKKKKK (,,,,,)0 1 2 3 4 5 , for LEA- LEA-256 are proposed. Section 5 concludes the paper. 256, KKKKKKKKK (,,,,,,,)0 1 2 3 4 5 6 7 ; r : the number of rounds. For LEA-128, r 24 , for II. BRIEF DESCRIPTION ON LEA FAMILY CIPHERS LEA-192, r 28 , for LEA-256, r 32 ; LEA has the block size of 128 bits and the key size of : XOR operation; 128, 192 or 256 bits. The word size of LEA is 32 bits. : Addition modulo 232; The number of rounds is 24 for 128-bit keys, 28 for 192- : Subtraction modulo 232; bit keys, and 32 for 256-bit keys. ROLi (),i : left rotation for i bits; A. Notations RORi (),i : right rotation for i bits; P : a 128-bit plaintext, consisting of four 32-bit LEAi : i-round LEA algorithm. words PPPPP (,,,)0 1 2 3 . Pi,( m n ) represents the bits m B. Round Function for Encryption and Decryption to n of Pi(0 3) ; i The round function for LEA is computed as follows: C : a 128-bit ciphertext, consisting of four 32-bit Xi1 ROL(( X i RK i ) ( X i RK i )) words CCCCC (,,,)0 1 2 3 . Ci,( m n ) represents the bits 0 9 0 0 1 1 i1 i i i i m to n of Ci(0 3) ; X1 ROR 5(( X 1 RK 2 ) ( X 2 RK 3 )) i i1 i i i i i X : a 128-bit intermediate value (input of i-th round X2 ROR 3(( X 2 RK 4 ) ( X 3 RK 5 )) ii1 in the encryption), consisting of four 32-bit words XX30 i i i i i i XXXXX (,,,)0 1 2 3 . X j,( m n ) represents the bits m To describe the round functions for encryption and i decryption clearer, we depict them in the Fig. 1 below. to n of Xjj (0 3) ; ©2016 Journal of Communications 678 Journal of Communications Vol. 11, No. 7, July 2016 i i i i X i1 X i1 X i1 X i1 X 0 X1 X 2 X 3 0 1 2 3 i i RK5 RK4 >>>9 i i RK2 RK3 >>>3 i i <<<5 RK0 RK1 i i RK0 RK1 >>>5 RK i i 2 RK3 <<<3 <<<9 i RK4 i RK5 X i X i X i X i X i X i X i X i 0 1 2 3 0 1 2 3 Fig.
Load more

Recommended publications
  • Camellia: a 128-Bit Block Cipher Suitable for Multiple Platforms
    gopyright x nd witsuishi iletri gorp ortion PHHHEPHHI g mel l iX e IPVEfit flo k gipher uitle for wultiple ltforms y z y uzumro eoki etsuyshikw wsyuki und z y z z witsuru wtsui hiho worii tunkoxkjim oshio okit y xipp on elegrph nd elephone gorp ortion IEI rikrino okD okosukD ungwD PQWEHVRU tpn fmroDkndDshihogdislFnttFoFjp z witsuishi iletri gorp ortion SEIEI yfunD umkurD ungwD PRUEVSHI tpn fihikwDmtsuiDjuneISDtokitgdissFislFmeloFoFjp er IFHX tuly IQD PHHH er PFHX eptemer PTD PHHI estrtF e present new IPVEit lo k ipher lled gmel liF gmelli supp orts IPVEit lo ksizend IPVED IWPED nd PSTEit keysD iFeF the sme interfe sp eitions s the edvned inryption tndrd @eiAF iieny on oth softE wre nd hrdwre pltforms is remrkle hrteristi of gmelli in ddition to its high level of seurityF st is onrmed tht gmelli provides strong seurity ginst dierentil nd liner ryptnlysisF gompred to the ei nlistsD iFeF weD gTD ijndelD erp entD nd woshD gmelli oers t lest omprle enryption sp eed in softwre nd hrdwreF en optimized implementtion of gmelE li in ssemly lnguge n enrypt on entiums s s @IFIQqrzA t the rte of RUI wits p er seondF sn dditionD distinguishing feture is its smll hrdwre designF e hrdwre implementtionD whih inludes enryptionD deryptionD nd the key shedule for IPVEit keysD o upies only VFIPu gtes using HFIV"m gwy esg lirryF his is in the smllest lss mong ll existing IPVEit lo k iphersF gopyright x nd witsuishi iletri gorp ortion PHHHEPHHI gontents I sntro dution I P hesign tionle Q PFI p Efuntion X X X X X X X X X X X X X X X X X X X X X X X X X
    [Show full text]
  • On the Feistel Counterpart of the Boomerang Connectivity Table Introduction and Analysis of the FBCT
    IACR Transactions on Symmetric Cryptology ISSN 2519-173X, Vol. 2020, No. 1, pp. 331–362. DOI:10.13154/tosc.v2020.i1.331-362 On the Feistel Counterpart of the Boomerang Connectivity Table Introduction and Analysis of the FBCT Hamid Boukerrou, Paul Huynh, Virginie Lallemand, Bimal Mandal and Marine Minier Université de Lorraine, CNRS, Inria, LORIA, F-54000 Nancy, France [email protected] Abstract. At Eurocrypt 2018, Cid et al. introduced the Boomerang Connectivity Table (BCT), a tool to compute the probability of the middle round of a boomerang distinguisher from the description of the cipher’s Sbox(es). Their new table and the following works led to a refined understanding of boomerangs, and resulted in a series of improved attacks. Still, these works only addressed the case of Substitution Permutation Networks, and completely left out the case of ciphers following a Feistel construction. In this article, we address this lack by introducing the FBCT, the Feistel counterpart of the BCT. We show that the coefficient at row ∆i, ∇o corresponds to the number of times the second order derivative at points (∆i, ∇o) cancels out. We explore the properties of the FBCT and compare it to what is known on the BCT. Taking matters further, we show how to compute the probability of a boomerang switch over multiple rounds with a generic formula. Keywords: Cryptanalysis · Feistel cipher · Boomerang attack · Boomerang switch 1 Introduction Boomerang attacks date back to 1999, when David Wagner introduced them at FSE to break COCONUT98 [Wag99]. When presented, this variant of differential attacks [BS91] shook up the conventional thinking that consisted in believing that a cipher with only small probability differentials is secure.
    [Show full text]
  • On the NIST Lightweight Cryptography Standardization
    On the NIST Lightweight Cryptography Standardization Meltem S¨onmez Turan NIST Lightweight Cryptography Team ECC 2019: 23rd Workshop on Elliptic Curve Cryptography December 2, 2019 Outline • NIST's Cryptography Standards • Overview - Lightweight Cryptography • NIST Lightweight Cryptography Standardization Process • Announcements 1 NIST's Cryptography Standards National Institute of Standards and Technology • Non-regulatory federal agency within U.S. Department of Commerce. • Founded in 1901, known as the National Bureau of Standards (NBS) prior to 1988. • Headquarters in Gaithersburg, Maryland, and laboratories in Boulder, Colorado. • Employs around 6,000 employees and associates. NIST's Mission to promote U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life. 2 NIST Organization Chart Laboratory Programs Computer Security Division • Center for Nanoscale Science and • Cryptographic Technology Technology • Secure Systems and Applications • Communications Technology Lab. • Security Outreach and Integration • Engineering Lab. • Security Components and Mechanisms • Information Technology Lab. • Security Test, Validation and • Material Measurement Lab. Measurements • NIST Center for Neutron Research • Physical Measurement Lab. Information Technology Lab. • Advanced Network Technologies • Applied and Computational Mathematics • Applied Cybersecurity • Computer Security • Information Access • Software and Systems • Statistical
    [Show full text]
  • Internet Engineering Task Force (IETF) S. Kanno Request for Comments: 6367 NTT Software Corporation Category: Informational M
    Internet Engineering Task Force (IETF) S. Kanno Request for Comments: 6367 NTT Software Corporation Category: Informational M. Kanda ISSN: 2070-1721 NTT September 2011 Addition of the Camellia Cipher Suites to Transport Layer Security (TLS) Abstract This document specifies forty-two cipher suites for the Transport Security Layer (TLS) protocol to support the Camellia encryption algorithm as a block cipher. Status of This Memo This document is not an Internet Standards Track specification; it is published for informational purposes. This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Not all documents approved by the IESG are a candidate for any level of Internet Standard; see Section 2 of RFC 5741. Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc6367. Copyright Notice Copyright (c) 2011 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
    [Show full text]
  • 3GPP TR 55.919 V6.1.0 (2002-12) Technical Report
    3GPP TR 55.919 V6.1.0 (2002-12) Technical Report 3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; 3G Security; Specification of the A5/3 Encryption Algorithms for GSM and ECSD, and the GEA3 Encryption Algorithm for GPRS; Document 4: Design and evaluation report (Release 6) R GLOBAL SYSTEM FOR MOBILE COMMUNICATIONS The present document has been developed within the 3rd Generation Partnership Project (3GPP TM) and may be further elaborated for the purposes of 3GPP. The present document has not been subject to any approval process by the 3GPP Organizational Partners and shall not be implemented. This Specification is provided for future development work within 3GPP only. The Organizational Partners accept no liability for any use of this Specification. Specifications and reports for implementation of the 3GPP TM system should be obtained via the 3GPP Organizational Partners' Publications Offices. Release 6 2 3GPP TR 55.919 V6.1.0 (2002-12) Keywords GSM, GPRS, security, algorithm 3GPP Postal address 3GPP support office address 650 Route des Lucioles - Sophia Antipolis Valbonne - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Internet http://www.3gpp.org Copyright Notification No part may be reproduced except as authorized by written permission. The copyright and the foregoing restriction extend to reproduction in all media. © 2002, 3GPP Organizational Partners (ARIB, CWTS, ETSI, T1, TTA, TTC). All rights reserved. 3GPP Release 6 3 3GPP TR 55.919 V6.1.0 (2002-12) Contents Foreword ............................................................................................................................................................5
    [Show full text]
  • LEA 192: High Speed Architecture of Lightweight Block Cipher
    International Journal of Innovative Technology and Exploring Engineering (IJITEE) ISSN: 2278-3075, Volume-9 Issue-2S, December 2019 LEA 192: High Speed Architecture of Lightweight Block Cipher Zeesha Mishra, Shubham Mishra, Bibhudendra Acharya The communication among connected things must be secure Abstract: High-throughput lightweight cryptography and fast while processing confidential data. Due to a calculation is the need of the present world to convey between two substantial amount of sensitive and valuable data and low asset obliged devices Pipelining is the technique have been used computational resources in the network, it has become to achieve high throughput. In this paper we have target to cumbersome to provide security in the IoT[2]. lightweight block cipher LEA. Block size of LEA is 128 and key Resource-constrained applications comprising of sensor size 128, 192, and 256 bit. In this paper we have focus on LEA architecture for 192- bit key size and achieve very good nodes in wireless sensor networks, RFID tags require smaller throughput. This method has a higher capability of throughput as footprint with minimum battery consumption. compared to previous LEA ciphers. Proposed work is 56% LEA[3] is a lightweight block cipher. LEA has 128-bit improved version of compared paper for respective Speed and block size with 128, 192, 256-bit key sizes and rounds 24, 28 area also less than previous architecture. Graph representation and 32 respectively. LEA supports simple ARX (addition have been shown of different matrices and comparison. rotation XOR ) operation, LEA is not using complex S-box Keywords : ARX, Block Cipher, Cryptography, LEA, structure like AES [4] hence it will give high-speed Lightweight, Pipeline, Throughput.
    [Show full text]
  • Balanced Permutations Even–Mansour Ciphers
    Article Balanced Permutations Even–Mansour Ciphers Shoni Gilboa 1, Shay Gueron 2,3 ∗ and Mridul Nandi 4 1 Department of Mathematics and Computer Science, The Open University of Israel, Raanana 4353701, Israel; [email protected] 2 Department of Mathematics, University of Haifa, Haifa 3498838, Israel 3 Intel Corporation, Israel Development Center, Haifa 31015, Israel 4 Indian Statistical Institute, Kolkata 700108, India; [email protected] * Correspondence: [email protected]; Tel.: +04-824-0161 Academic Editor: Kwangjo Kim Received: 2 February 2016; Accepted: 30 March 2016; Published: 1 April 2016 Abstract: The r-rounds Even–Mansour block cipher is a generalization of the well known Even–Mansour block cipher to r iterations. Attacks on this construction were described by Nikoli´c et al. and Dinur et al. for r = 2, 3. These attacks are only marginally better than brute force but are based on an interesting observation (due to Nikoli´c et al.): for a “typical” permutation P, the distribution of P(x) ⊕ x is not uniform. This naturally raises the following question. Let us call permutations for which the distribution of P(x) ⊕ x is uniformly “balanced” — is there a sufficiently large family of balanced permutations, and what is the security of the resulting Even–Mansour block cipher? We show how to generate families of balanced permutations from the Luby–Rackoff construction and use them to define a 2n-bit block cipher from the 2-round Even–Mansour scheme. We prove that this cipher is indistinguishable from a random permutation of f0, 1g2n, for any adversary who has oracle access to the public permutations and to an encryption/decryption oracle, as long as the number of queries is o(2n/2).
    [Show full text]
  • State of the Art in Lightweight Symmetric Cryptography
    State of the Art in Lightweight Symmetric Cryptography Alex Biryukov1 and Léo Perrin2 1 SnT, CSC, University of Luxembourg, [email protected] 2 SnT, University of Luxembourg, [email protected] Abstract. Lightweight cryptography has been one of the “hot topics” in symmetric cryptography in the recent years. A huge number of lightweight algorithms have been published, standardized and/or used in commercial products. In this paper, we discuss the different implementation constraints that a “lightweight” algorithm is usually designed to satisfy. We also present an extensive survey of all lightweight symmetric primitives we are aware of. It covers designs from the academic community, from government agencies and proprietary algorithms which were reverse-engineered or leaked. Relevant national (nist...) and international (iso/iec...) standards are listed. We then discuss some trends we identified in the design of lightweight algorithms, namely the designers’ preference for arx-based and bitsliced-S-Box-based designs and simple key schedules. Finally, we argue that lightweight cryptography is too large a field and that it should be split into two related but distinct areas: ultra-lightweight and IoT cryptography. The former deals only with the smallest of devices for which a lower security level may be justified by the very harsh design constraints. The latter corresponds to low-power embedded processors for which the Aes and modern hash function are costly but which have to provide a high level security due to their greater connectivity. Keywords: Lightweight cryptography · Ultra-Lightweight · IoT · Internet of Things · SoK · Survey · Standards · Industry 1 Introduction The Internet of Things (IoT) is one of the foremost buzzwords in computer science and information technology at the time of writing.
    [Show full text]
  • Non-Monopolizable Caches: Low-Complexity Mitigation of Cache Side Channel Attacks
    A Non-Monopolizable Caches: Low-Complexity Mitigation of Cache Side Channel Attacks Leonid Domnitser, State University of New York at Binghamton Aamer Jaleel, Intel Corporation, VSSAD, Hudson, MA Jason Loew, Nael Abu-Ghazaleh and Dmitry Ponomarev, State University of New York at Binghamton We propose a flexibly-partitioned cache design that either drastically weakens or completely eliminates cache-based side channel attacks. The proposed Non-Monopolizable (NoMo) cache dynamically reserves cache lines for active threads and prevents other co-executing threads from evicting reserved lines. Unreserved lines remain available for dynamic sharing among threads. NoMo requires only simple modifications to the cache replacement logic, making it straightforward to adopt. It requires no software support enabling it to automatically protect pre-existing binaries. NoMo results in performance degradation of about 1% on average. We demonstrate that NoMo can provide strong security guarantees for the AES and Blowfish encryption algorithms. Categories and Subject Descriptors: C.1.0 [Computer Systems Organization]: Processor Architectures General Terms: Design, Security, Performance Additional Key Words and Phrases: Side-Channel Attacks, Shared Caches, Secure Architectures 1. INTRODUCTION In recent years, security has emerged as a key design consideration in computing and commu- nication systems. Security solutions center around the use of cryptographic algorithms, such as symmetric ciphers, public-key ciphers, and hash functions. The strength of modern cryptography makes it infeasible for the attackers to uncover the secret keys using brute-force trials, differen- tial analysis [E.Biham and Shamir 1991] or linear cryptanalysis [Matsui 1994]. Instead, almost all known attacks today exploit weaknesses in the physical implementation of the system performing the encryption, rather than exploiting the mathematical properties of the cryptographic algorithms themselves.
    [Show full text]
  • Low Probability Differentials and the Cryptanalysis of Full-Round
    Low Probability Differentials and the Cryptanalysis of Full-Round CLEFIA-128 Sareh Emami2, San Ling1, Ivica Nikoli´c1?, Josef Pieprzyk3 and Huaxiong Wang1 1 Nanyang Technological University, Singapore 2 Macquarie University, Australia 3 Queensland University of Technology, Australia Abstract. So far, low probability differentials for the key schedule of block ciphers have been used as a straightforward proof of security against related-key differential analysis. To achieve resistance, it is believed that for cipher with k-bit key it suffices the upper bound on the probabil- ity to be 2−k. Surprisingly, we show that this reasonable assumption is incorrect, and the probability should be (much) lower than 2−k. Our counter example is a related-key differential analysis of the well estab- lished block cipher CLEFIA-128. We show that although the key sched- ule of CLEFIA-128 prevents differentials with a probability higher than 2−128, the linear part of the key schedule that produces the round keys, and the Feistel structure of the cipher, allow to exploit particularly cho- sen differentials with a probability as low as 2−128. CLEFIA-128 has 214 such differentials, which translate to 214 pairs of weak keys. The prob- ability of each differential is too low, but the weak keys have a special structure which allows with a divide-and-conquer approach to gain an advantage of 27 over generic analysis. We exploit the advantage and give a membership test for the weak-key class and provide analysis of the hashing modes. The proposed analysis has been tested with computer experiments on small-scale variants of CLEFIA-128.
    [Show full text]
  • Optimization of Core Components of Block Ciphers Baptiste Lambin
    Optimization of core components of block ciphers Baptiste Lambin To cite this version: Baptiste Lambin. Optimization of core components of block ciphers. Cryptography and Security [cs.CR]. Université Rennes 1, 2019. English. NNT : 2019REN1S036. tel-02380098 HAL Id: tel-02380098 https://tel.archives-ouvertes.fr/tel-02380098 Submitted on 26 Nov 2019 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. THÈSE DE DOCTORAT DE L’UNIVERSITE DE RENNES 1 COMUE UNIVERSITE BRETAGNE LOIRE Ecole Doctorale N°601 Mathématique et Sciences et Technologies de l’Information et de la Communication Spécialité : Informatique Par Baptiste LAMBIN Optimization of Core Components of Block Ciphers Thèse présentée et soutenue à RENNES, le 22/10/2019 Unité de recherche : IRISA Rapporteurs avant soutenance : Marine Minier, Professeur, LORIA, Université de Lorraine Jacques Patarin, Professeur, PRiSM, Université de Versailles Composition du jury : Examinateurs : Marine Minier, Professeur, LORIA, Université de Lorraine Jacques Patarin, Professeur, PRiSM, Université de Versailles Jean-Louis Lanet, INRIA Rennes Virginie Lallemand, Chargée de Recherche, LORIA, CNRS Jérémy Jean, ANSSI Dir. de thèse : Pierre-Alain Fouque, IRISA, Université de Rennes 1 Co-dir. de thèse : Patrick Derbez, IRISA, Université de Rennes 1 Remerciements Je tiens à remercier en premier lieu mes directeurs de thèse, Pierre-Alain et Patrick.
    [Show full text]
  • Tongan Ways of Talking
    TONGAN WAYS OF TALKING MELENAITE TAUMOEFOLAU University of Auckland Some excellent work has been published on Tongan speech levels from a sociolinguistic perspective (e.g., Philips 1991). The purpose of this article is to contribute to the literature by describing some important, not previously well-described features of ways of talking (WOT) in Tongan. I will use as my theoretical framework George Grace’s theory of language; he argued that a language is “a generalized way of talking about things” (Grace 1987: 99), a device for saying things, and it is, in turn, made up of “conventionalized ways of talking about consecrated subject-matters” (p. 103). In this article I will distinguish the following “ways of talking” (WOT):1 WOT 1. lea fakatu‘i—way of talking to or about the monarch/king (tu‘i) WOT 2. lea fakahouhou‘eiki—way of talking to or about chiefly people (hou‘eiki) WOT 3. lea fakamatäpule—polite way of talking that is characteristic of titled orators (matäpule) WOT 4. lea fakatökilalo / faka‘aki‘akimui—self-derogatory way of talking when addressing those of higher rank WOT 5. lea tavale—way of talking to a person with whom one is familiar or with whom one is socially equal, or way of talking to or about commoners (tu‘a) WOT 6. lea ‘ita—abusive way of talking Here I make four main claims about Tongan ways of talking: • The number of registers described for Tongan has been underestimated. I distinguish six (above) instead of the three that are traditionally described: of king—tu‘i, of chiefs—hou‘eiki, of commoners—tu‘a.
    [Show full text]