DOCSLIB.ORG

Identification of Cryptographic Algorithms in Binary Programs Pierre Lestringant

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text

Load more

Identification of cryptographic algorithms in binary programs Pierre Lestringant To cite this version: Pierre Lestringant. Identification of cryptographic algorithms in binary programs. Cryptography and Security [cs.CR]. Université Rennes 1, 2017. English. NNT : 2017REN1S067. tel-01699544 HAL Id: tel-01699544 https://tel.archives-ouvertes.fr/tel-01699544 Submitted on 2 Feb 2018 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. ANNÉE 2017 THÈSE / UNIVERSITÉ DE RENNES 1 sous le sceau de l’Université Bretagne Loire pour le grade de DOCTEUR DE L’UNIVERSITÉ DE RENNES 1 Mention : informatique Ecole doctorale Mathématiques et STIC présentée par Pierre Lestringant préparée à l’Institut de Recherche en Informatique et Systèmes Aléatoires (IRISA) UMR 6074 en partenariat avec Amossys Thèse soutenue à Rennes le 12 décembre 2017 Identification devant le jury composé de : d’Algorithmes Jean-Yves MARION Professeur, U. Lorraine - rapporteur Pascal JUNOD Cryptographiques dans Chercheur, Snap Inc. - rapporteur Sandrine BLAZY du Code Natif Professeur, U. Rennes 1 - examinatrice Marion VIDEAU Maître de conférences, U. Lorraine en détachement auprès de Quarkslab - examinatrice Colas LE GUERNIC Ingénieur de recherche, DGA - examinateur Frédéric GUIHÉRY Responsable R&D, Amossys - examinateur Pierre-Alain FOUQUE Professeur, U. Rennes 1 - directeur de thèse Contents R´esum´een Fran¸cais 4 1 Identification des Primitives . 4 2 Identification des Modes Op´eratoires . 6 3 Evaluation´ Exp´erimentale . 7 4 Organisation du Manuscrit . 8 5 Impl´ementation . 8 6 Liste des Publications . 8 Introduction 9 1 Reverse Engineering . 9 2 Cryptographic Notions . 10 3 Motivation . 11 4 Solution Overview . 12 5 Layout of the Thesis . 14 1 Related Work 16 1.1 Basic Techniques . 16 1.2 Cryptographic Parameters Retrieval . 18 1.3 Binary Code Comparison . 19 1.4 Primitive Identification . 20 2 Data Flow Graph 33 2.1 DFG Definition . 33 2.2 Sequence of Dynamic Instructions . 37 2.3 Construction . 40 2.4 Built-in Mechanisms . 43 3 Normalization 46 3.1 Formal Presentation . 46 3.2 Practical Aspects . 51 3.3 Common Subexpression Elimination . 52 3.4 Constant Simplification . 54 3.5 Constant Expression Detection . 57 3.6 Memory Access Simplification . 59 3.7 Memory Coalescing . 66 3.8 Commutative and Associative Operation Normalization . 70 3.9 Affine Expression Simplification . 72 3.10 Operation Size Expansion . 73 3.11 Miscellaneous Rewrite Rules . 75 3.12 Conclusion . 75 4 Subgraph Isomorphism for Primitive Identification 77 4.1 Signature . 77 4.2 Signature Detection . 81 4.3 Experimental Evaluation . 88 2 5 Dynamic Slicing for Mode of Operation Identification 105 5.1 Primitive Identification . 105 5.2 Slicing Definition . 108 5.3 Adjustments Based on Semantics . 112 5.4 Slice Construction . 115 5.5 Experimental Evaluation . 117 6 Detailed Use Cases 124 6.1 Automatic Test Vectors Verification . 124 6.2 Complete Analysis of an Instant Messaging Application . 128 A Cryptographic Algorithms Background 133 A.1 Primitives . 133 A.2 Modes of Operation . 136 3 R´esum´een Fran¸cais Durant ma th`ese,j'ai travaill´e`ala conception de m´ethodes automatis´eespermettant l'identification d'algorithmes cryptographiques dans des programmes compil´esen langage machine. Ce besoin bien sp´ecifiquetrouve une partie de son origine dans le domaine de l'´evaluation logicielle. L'utilisation d'algorithmes cryptographiques se fait dans le but d'obtenir des fonctions de s´ecurit´etelles que la confidentialit´e,l'int´egrit´eet l'authenticit´epour la cryptographie sym´etrique ou des fonctions plus diverses comme la signature num´erique, l'´etablissement de secrets partag´esou le chiffre- ment `acl´epublique pour la cryptographie asym´etrique. Cependant le choix des algorithmes, leur impl´ementation et leur utilisation au sein d'un programme informatique sont autant de points sensibles pouvant remettre en cause la robustesse de ces fonctions de s´ecurit´e.Il est donc primor- dial dans le cadre de l'´evaluation logicielle d'analyser les impl´ementations cryptographiques afin de s'assurer de leur bon niveau de s´ecurit´e. Si dans bien des cas il est possible et plus commode de conduire cette analyse `apartir du code source, il n'en demeure pas moins important de pouvoir ´egalement op´erer`apartir du code machine. En effet le code source n'est ni toujours disponible (´evaluation pour le compte d'une tierce partie ou avec des informations limit´eesdans le but de simuler un attaquant r´eel)ni toujours fiable (biais d´elib´er´eou non entre le code source et le code machine, d^upar exemple aux optimisations du compilateur [5]). L'id´een'est pas ici d'automatiser un type d'analyse particulier (par exemple: v´erifierl'absence de corr´elationentre temps d'ex´ecutionet param`etressecrets pour emp^echer les attaques par canaux temporels), mais d'automatiser l'identification des algorithmes cryptographiques, premi`ere´etape n´ecessaire`atoute analyse plus approfondie. A` ce titre, les r´esultatsobtenus ne permettront pas directement dans bien des cas de juger du bon niveau de s´ecurit´edes m´ecanismescryptographiques, mais serviront de socle `al'´evaluateur pour d´ebuterson analyse. Pour ce travail, je me suis limit´e `ala cryptographie sym´etrique,proposant deux m´ethodes: une pour l'identification des primitives cryptographiques et l'autre pour l'identification des modes op´eratoires.Note: ces deux m´ethodes n'ayant pas ´et´econ¸cuespour l'analyse de code obfusqu´e,elles n’offrent aucune garantie de bon fonctionnement dans ce domaine. 1 Identification des Primitives Il est possible, `al'aide d'heuristiques simples (instructions particuli`eres,constantes particuli`eres, taille des blocs de base, fr´equenced'ex´ecution,position dans l'arbre d'appels), d'identifier efficace- ment et de fa¸cons^ureun petit nombre de parties du code comme ´etant de possibles impl´ementations cryptographiques [33, 81]. La m´ethode propos´eepour l'identification des primitives a donc ´et´e con¸cuepour s'ex´ecuternon sur l'ensemble du programme, mais sur des portions de taille restreinte pouvant ^etres´electionn´ees`al'aide de ces heuristiques. Elle utilise des signatures. Une approche par signatures est particuli`erement adapt´eedans le cas des primitives puisque le nombre de prim- itives fr´equemment utilis´eesen pratique est faible et que leurs impl´ementations sont peu sujettes aux variations. 1.1 Graphe de Flot de Donn´ees Le code machine est repr´esent´epar une structure de donn´eesappel´eeDFG (pour Data Flow Graph). Bien qu'initialement con¸cuede fa¸conind´ependante, cette structure de donn´eesse rapproche des Term Graphs [60] et des jungles [39]. Elle permet de repr´esenter une ou plusieurs expressions compos´eesde symboles d'op´erationet de symboles de variable sous forme de multigraphe orient´e 4 acyclique. Un sommet v poss`edeune ´etiquettenot´ee labV (v) qui est soit un symbole d'op´eration, soit un symbole de variable. Chaque sommet v repr´esente une expression, not´ee term(v), qui se d´efinitr´ecursivement de la fa¸consuivante: ( labV (v) si v est ´etiquet´eavec un symbole de variable term(v) = labV (v)(term(v1); :::; term(vn)) si v est ´etiquet´eavec un symbole d'op´eration Dans le second cas, v1; :::; vn d´esignent les pr´ed´ecesseursdirects de v ordonn´esd'apr`esles ´etiquettes des ar^etesles reliant respectivement `a v. L'organisation sous forme de graphe a l'avantage par rapport `aune organisation plus naturelle sous forme d'arbre, de permettre le partage des sous- expressions communes r´eduisant fortement les besoins en m´emoireet les temps de traitement. La portion du programme `aanalyser est vue comme une s´equenced'instructions. Cette hypoth`esesimplificatrice s'explique par le fait que les primitives sym´etriquescontiennent peu d'instructions conditionnelles et que celles-ci ne d´ependent g´en´eralement pas des arguments d'entr´ee et de sortie. Par cons´equent, le chemin d'ex´ecutionne varie pas d'une ex´ecution`al'autre `a l'int´erieurdu code cryptographique qui peut donc ^etreassimil´e`aune s´equenced'instructions. Les DFGs sont construits par compositions successives. Chaque instruction de la s´equence`a analyser est convertie vers un petit DFG. Ceux-ci sont ensuite compos´espour obtenir le DFG final repr´esentant la totalit´ede la s´equence. Ce mode de construction se r´ev`eleparticuli`erement utile par la suite puisque m^emeune fois modifi´esil sera toujours possible de composer les DFGs (technique utilis´eelors de l'agrandissement de la fen^etred'analyse par exemple). Un effort partic- ulier a ´et´eapport´e`ala traduction des instructions vectorielles (couramment utilis´eespar certaines impl´ementation cryptographique). L'utilisation de DFGs pour repr´esenter le code machine permet de r´epondre `aun certain nombre de besoins: r´e´ecritured'expressions tout en pr´eservant une certaine notion de s´emantique appel´ee similarit´eobservable, comparaison d'expressions et recherche de sous-expressions `atravers la notion d'isomorphisme de graphes, slicing, et m^emevisualisation par un op´erateurd'une partie du code. Cette repr´esentation sera ´egalement utilis´eepour l'identification des modes op´eratoires. 1.2 Normalisation Le but de la phase de normalisation est de supprimer au maximum les diff´erencesqui peuvent exister entre plusieurs impl´ementations d'une m^emeprimitive afin de pouvoir d´etecteravec un petit nombre de signatures une grande vari´et´ed'impl´ementations.
Recommended publications
  • RESOURCE-EFFICIENT CRYPTOGRAPHY for UBIQUITOUS COMPUTING Lightweight Cryptographic Primitives from a Hardware & Software Perspective

    RESOURCE-EFFICIENT CRYPTOGRAPHY for UBIQUITOUS COMPUTING Lightweight Cryptographic Primitives from a Hardware & Software Perspective

    RESOURCE-EFFICIENT CRYPTOGRAPHY FOR UBIQUITOUS COMPUTING Lightweight Cryptographic Primitives from a Hardware & Software Perspective DISSERTATION for the degree of Doktor-Ingenieur of the Faculty of Electrical Engineering and Information Technology at the Ruhr University Bochum, Germany by Elif Bilge Kavun Bochum, December 2014 Copyright © 2014 by Elif Bilge Kavun. All rights reserved. Printed in Germany. Anneme ve babama... Elif Bilge Kavun Place of birth: Izmir,˙ Turkey Author’s contact information: [email protected] www.emsec.rub.de/chair/ staff/elif bilge kavun Thesis Advisor: Prof. Dr.-Ing. Christof Paar Ruhr-Universit¨atBochum, Germany Secondary Referee: Prof. Christian Rechberger Danmarks Tekniske Universitet, Denmark Thesis submitted: December 19, 2014 Thesis defense: February 6, 2015 v Abstract Technological advancements in the semiconductor industry over the last few decades made the mass production of very small-scale computing devices possible. Thanks to the compactness and mobility of these devices, they can be deployed “pervasively”, in other words, everywhere and anywhere – such as in smart homes, logistics, e-commerce, and medical technology. Em- bedding the small-scale devices into everyday objects pervasively also indicates the realization of the foreseen “ubiquitous computing” concept. However, ubiquitous computing and the mass deployment of the pervasive devices in turn brought some concerns – especially, security and privacy. Many people criticize the security and privacy management in the ubiquitous context. It is even believed that an inadequate level of security may be the greatest barrier to the long-term success of ubiquitous computing. For ubiquitous computing, the adversary model and the se- curity level is not the same as in traditional applications due to limited resources in pervasive devices – area, power, and energy are actually harsh constraints for such devices.
  • Fair and Comprehensive Methodology for Comparing Hardware Performance of Fourteen Round Two SHA-3 Candidates Using Fpgas

    Fair and Comprehensive Methodology for Comparing Hardware Performance of Fourteen Round Two SHA-3 Candidates Using Fpgas

    Fair and Comprehensive Methodology for Comparing Hardware Performance of Fourteen Round Two SHA-3 Candidates Using FPGAs Kris Gaj, Ekawat Homsirikamol, and Marcin Rogawski ECE Department, George Mason University, Fairfax, VA 22030, U.S.A. {kgaj,ehomsiri,mrogawsk}@gmu.edu http://cryptography.gmu.edu Abstract. Performance in hardware has been demonstrated to be an important factor in the evaluation of candidates for cryptographic stan- dards. Up to now, no consensus exists on how such an evaluation should be performed in order to make it fair, transparent, practical, and ac- ceptable for the majority of the cryptographic community. In this pa- per, we formulate a proposal for a fair and comprehensive evaluation methodology, and apply it to the comparison of hardware performance of 14 Round 2 SHA-3 candidates. The most important aspects of our methodology include the definition of clear performance metrics, the de- velopment of a uniform and practical interface, generation of multiple sets of results for several representative FPGA families from two major vendors, and the application of a simple procedure to convert multiple sets of results into a single ranking. Keywords: benchmarking, hash functions, SHA-3, FPGA. 1 Introduction and Motivation Starting from the Advanced Encryption Standard (AES) contest organized by NIST in 1997-2000 [1], open contests have become a method of choice for select- ing cryptographic standards in the U.S. and over the world. The AES contest in the U.S. was followed by the NESSIE competition in Europe [2], CRYPTREC in Japan, and eSTREAM in Europe [3]. Four typical criteria taken into account in the evaluation of candidates are: security, performance in software, performance in hardware, and flexibility.
  • Sharing Resources Between AES and the SHA-3 Second Round

    Sharing Resources Between AES and the SHA-3 Second Round

    Sharing Resources Between AES and the SHA-3 Second Round Candidates Fugue and Grøstl Kimmo Järvinen Department of Information and Computer Science Aalto University, School of Science and Technology Espoo, Finland AES-inspired SHA-3 Candidates I Design strongly influenced by AES: Share the structure and have significant similarity in transformations, or even use AES as a subroutine I ECHO, Fugue, Grøstl, and SHAvite-3 I Benadjila et al. (ASIACRYPT 2009) studied useability of Intel’s AES instructions for AES-inspired candidates Conclusion: only ECHO and SHAvite-3, which use AES as a subroutine, benefit from the instructions I This is the first study of combining AES with the SHA-3 candidates on hardware (FPGA) The 2nd SHA-3 Candidate Conference Santa Barbara, CA, USA August 23–24, 2010 Research Topics and Motivation Research Questions I What modifications are required to embed AES into the data path of the hash algorithm (or vice versa)? I How much resources can be shared (logic, registers, memory, . )? I What are the costs (area, delay, throughput, power consumption, . )? Applications I Any applications that require dedicated hardware implementations of a hash algorithm and a block cipher would benefit from reduced costs I Particularly important if resources are very limited The 2nd SHA-3 Candidate Conference Santa Barbara, CA, USA August 23–24, 2010 Advanced Encryption Standard AES with a 128-bit key (AES-128) 8 I State: 4 × 4 bytes; each byte is an element of GF(2 ) I 10 rounds with four transformations Transformations I SubBytes: Bytes mapped
  • The First Collision for Full SHA-1

    The First Collision for Full SHA-1

    The first collision for full SHA-1 Marc Stevens1, Elie Bursztein2, Pierre Karpman1, Ange Albertini2, Yarik Markov2 1 CWI Amsterdam 2 Google Research [email protected] https://shattered.io Abstract. SHA-1 is a widely used 1995 NIST cryptographic hash function standard that was officially deprecated by NIST in 2011 due to fundamental security weaknesses demonstrated in various analyses and theoretical attacks. Despite its deprecation, SHA-1 remains widely used in 2017 for document and TLS certificate signatures, and also in many software such as the GIT versioning system for integrity and backup purposes. A key reason behind the reluctance of many industry players to replace SHA-1 with a safer alternative is the fact that finding an actual collision has seemed to be impractical for the past eleven years due to the high complexity and computational cost of the attack. In this paper, we demonstrate that SHA-1 collision attacks have finally become practical by providing the first known instance of a collision. Furthermore, the prefix of the colliding messages was carefully chosen so that they allow an attacker to forge two PDF documents with the same SHA-1 hash yet that display arbitrarily-chosen distinct visual contents. We were able to find this collision by combining many special cryptanalytic techniques in complex ways and improving upon previous work. In total the computational effort spent is equivalent to 263:1 SHA-1 compressions and took approximately 6 500 CPU years and 100 GPU years. As a result while the computational power spent on this collision is larger than other public cryptanalytic computations, it is still more than 100 000 times faster than a brute force search.
  • FPGA Parallel-Pipelined AES-GCM Core for 100G Ethernet Applications

    FPGA Parallel-Pipelined AES-GCM Core for 100G Ethernet Applications

    FPGA Parallel-Pipelined AES-GCM Core for 100G Ethernet Applications Luca Henzen and Wolfgang Fichtner Integrated Systems Laboratory, ETH Zurich, Switzerland E-mail: {henzen, fw}@iis.ee.ethz.ch Abstract—The forthcoming IEEE 802.3ba Ethernet standard Exploiting the parallelization of four cores plus the extensive will provide data transmission at a bandwidth of 100 Gbit/s. Cur- utilization of pipelining, we were able to design three different rently, the fastest cryptographic primitive approved by the U.S. National Institute for Standard and Technology, that combines 100G AES-GCM implementations for Xilinx Virtex-5 FPGAs. data encryption and authentication, is the Galois/Counter Mode (GCM) of operation. If the feasibility to increase the speed of the II. GCM AUTHENTICATED ENCRYPTION GCM up to 100 Gbit/s on ASIC technologies has already been The GCM is a block cipher mode of operation that is demonstrated, the FPGA implementation of the GCM in secure able to encrypt or decrypt data, providing at the same time 100G Ethernet network systems arises some important structural issues. In this paper, we report on an efficient FPGA architecture authentication and data integrity . In practice, it combines a of the GCM combined with the AES block cipher. With the block cipher in the counter mode with universal hashing over parallelization of four pipelined AES-GCM cores we were able the binary field GF(2128). In this work, we used the Advanced to reach the speed required by the new Ethernet standard. Encryption Standard (AES) [4] for encryption and decryption, Furthermore, the time-critical binary field multiplication of the authentication process relies on four pipelined 2-step Karatsuba- supporting key sizes of 128, 192 and 256bits.
  • Julius: Secure Mode of Operation for Authenticated Encryption Based on ECB and Finite Field Multiplications

    Julius: Secure Mode of Operation for Authenticated Encryption Based on ECB and Finite Field Multiplications

    Julius: Secure Mode of Operation for Authenticated Encryption Based on ECB and Finite Field Multiplications Lear Bahack∗ Submission to the CAESAR competition, version 1.0, March 2014 Gaius Julius Caesar, 100 BC – 44 BC. Source: Mcleclat, GNU, Creative Commons via Wikimedia Commons. ∗Weizmann Institute of Science, Rehovot, Israel. E-mail: [email protected] 1 Abstract We present two new blockcipher modes of operation for authenti- cated encryption with associated data, designed to achieve the maxi- mal possible security in case of misused IV, while being efficient as the Galois/Counter Mode (GCM). Both of the modes are provably secure up to the birthday bound, are suitable for both software and hard- ware, and are based on GF(2128) multiplications by a secret element of the field. The Julius-CTR mode can be viewed as a certain variation combin- ing the GCM, SIV and Unbalanced Feistel Network, while the Julius- ECB mode can be viewed as a certain variation of the Naor-Reingold mode. We specify two versions for each mode: a regular version and a compact version, having different ciphertexts redundancies. Sev- eral variants aimed to achieve increased security, parallelization, and efficiency are briefly explored. Based on the two Julius modes of operation and the AES-128 block- cipher, we propose a family of four specific algorithms for authenti- cated encryption with associated data to the CAESAR competition. 1 Introduction Symmetric key authenticated encryption (AE) is in a sense the most basic and fundamental usage of cryptography. Although today’s cryptography is far broader and contains complicated algorithms aiming to achieve other (more complicated) goals, the vast majority of applications use "compli- cated" cryptographic algorithms only in addition to a "basic" symmetric key AE algorithm.
  • Algebraic Frameworks for Cryptographic Primitives

    Algebraic Frameworks for Cryptographic Primitives

    Algebraic Frameworks for Cryptographic Primitives by Navid Alamati A dissertation submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy (Computer Science and Engineering) in the University of Michigan 2020 Doctoral Committee: Associate Professor Chris Peikert, Chair Professor Jeffrey Lagarias Professor Quentin Stout Professor Martin Strauss “It must be admitted that the use of geometric intuition has no logical necessity in mathematics, and is often left out of the formal presentation of results. If one had to construct a mathematical brain, one would probably use resources more efficiently than creating a visual system. But the system is there already, it is used to great advantage by human mathematicians, and it gives a special flavor to human mathematics.” David Ruelle [Conversations on Mathematics with a Visitor from Outer Space, 1998] Navid Alamati [email protected] ORCID iD: 0000-0001-8621-7486 2020 Acknowledgments Undoubtedly, I was more than fortunate to be advised by Chris Peikert. He has guided me during the past five years with unwavering patience and unparalleled percipience. No words can adequately describe my appreciation for him. I thank the other members of the committee—Jeffrey Lagarias, Quentin Stout, and Martin Strauss. I was lucky to be interned twice at Fujitsu Labs of America, during which I have had the chance of working with wonderful researchers—Arnab Roy, Hart Montgomery, and Sikhar Patranabis. I am grateful to Hart and Sikhar for the innumerable hours of discussion and the countless moments of wonder through which I tried to do research in cryptography. I am also thankful to Luca De Feo for being a great companion for an attempt on isogenies for dummies, one of whom has written this thesis.
  • Cryptographic Sponge Functions

    Cryptographic Sponge Functions

    Cryptographic sponge functions Guido B1 Joan D1 Michaël P2 Gilles V A1 http://sponge.noekeon.org/ Version 0.1 1STMicroelectronics January 14, 2011 2NXP Semiconductors Cryptographic sponge functions 2 / 93 Contents 1 Introduction 7 1.1 Roots .......................................... 7 1.2 The sponge construction ............................... 8 1.3 Sponge as a reference of security claims ...................... 8 1.4 Sponge as a design tool ................................ 9 1.5 Sponge as a versatile cryptographic primitive ................... 9 1.6 Structure of this document .............................. 10 2 Definitions 11 2.1 Conventions and notation .............................. 11 2.1.1 Bitstrings .................................... 11 2.1.2 Padding rules ................................. 11 2.1.3 Random oracles, transformations and permutations ........... 12 2.2 The sponge construction ............................... 12 2.3 The duplex construction ............................... 13 2.4 Auxiliary functions .................................. 15 2.4.1 The absorbing function and path ...................... 15 2.4.2 The squeezing function ........................... 16 2.5 Primary aacks on a sponge function ........................ 16 3 Sponge applications 19 3.1 Basic techniques .................................... 19 3.1.1 Domain separation .............................. 19 3.1.2 Keying ..................................... 20 3.1.3 State precomputation ............................ 20 3.2 Modes of use of sponge functions .........................
  • A Matter of Security, Privacy and Trust

    A Matter of Security, Privacy and Trust

    A matter of security, privacy and trust: A study of the principles and values of encryption in New Zealand Michael Dizon Ryan Ko Wayne Rumbles Patricia Gonzalez Philip McHugh Anthony Meehan Acknowledgements This study was funded by grants from the New Zealand Law Foundation and the University of Waikato. We would like to express our gratitude to our project collaborators and members of the Advisory Board – Prof Bert-Jaap Koops (Tilburg University), Prof Lyria Bennett Moses (UNSW Sydney), Prof Alana Maurushat (Western Sydney University), and Associate Professor Alex Sims (University of Auckland) – for their support as well as feedback on specific parts of this report. We would also like to thank Patricia Gonzalez, Joseph Graddy, Philip McHugh, Anthony Meehan, Jean Murray and Peter Upson for their valuable research assistance and other contributions to this study. Michael Dizon, Ryan Ko and Wayne Rumbles Principal investigators December 2019 Executive summary Cybersecurity is crucial for ensuring the safety and well-being of the general public, businesses, government, and the country as a whole. New Zealand has a reasonably comprehensive and well-grounded legal regime and strategy for dealing with cybersecurity matters. However, there is one area that deserves further attention and discussion – encryption. Encryption is at the heart of and underpins many of the technologies and technical processes used for computer and network security, but current laws and policies do not expressly cover this significant technology. The principal objective of this study is to identify the principles and values of encryption in New Zealand with a view to informing future developments of encryption- related laws and policies.
  • Chapter 1. Introducing Cryptography and ICSF

    Chapter 1. Introducing Cryptography and ICSF

    z/OS Version 2 Release 3 Cryptographic Services Integrated Cryptographic Service Facility Overview IBM SC14-7505-06 Note Before using this information and the product it supports, read the information in “Notices” on page 83. This edition applies to ICSF FMID HCR77C0 and Version 2 Release 3 of z/OS (5650-ZOS) and to all subsequent releases and modifications until otherwise indicated in new editions. Last updated: 2019-06-24 © Copyright International Business Machines Corporation 1996, 2019. US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. Contents Figures................................................................................................................ vii Tables.................................................................................................................. ix About this information.......................................................................................... xi ICSF features............................................................................................................................................... xi Who should use this information................................................................................................................ xi How to use this information........................................................................................................................ xi Where to find more information.................................................................................................................xii
  • Rebound Attack

    Rebound Attack

    Rebound Attack Florian Mendel Institute for Applied Information Processing and Communications (IAIK) Graz University of Technology Inffeldgasse 16a, A-8010 Graz, Austria http://www.iaik.tugraz.at/ Outline 1 Motivation 2 Whirlpool Hash Function 3 Application of the Rebound Attack 4 Summary SHA-3 competition Abacus ECHO Lesamnta SHAMATA ARIRANG ECOH Luffa SHAvite-3 AURORA Edon-R LUX SIMD BLAKE EnRUPT Maraca Skein Blender ESSENCE MCSSHA-3 Spectral Hash Blue Midnight Wish FSB MD6 StreamHash Boole Fugue MeshHash SWIFFTX Cheetah Grøstl NaSHA Tangle CHI Hamsi NKS2D TIB3 CRUNCH HASH 2X Ponic Twister CubeHash JH SANDstorm Vortex DCH Keccak Sarmal WaMM Dynamic SHA Khichidi-1 Sgàil Waterfall Dynamic SHA2 LANE Shabal ZK-Crypt SHA-3 competition Abacus ECHO Lesamnta SHAMATA ARIRANG ECOH Luffa SHAvite-3 AURORA Edon-R LUX SIMD BLAKE EnRUPT Maraca Skein Blender ESSENCE MCSSHA-3 Spectral Hash Blue Midnight Wish FSB MD6 StreamHash Boole Fugue MeshHash SWIFFTX Cheetah Grøstl NaSHA Tangle CHI Hamsi NKS2D TIB3 CRUNCH HASH 2X Ponic Twister CubeHash JH SANDstorm Vortex DCH Keccak Sarmal WaMM Dynamic SHA Khichidi-1 Sgàil Waterfall Dynamic SHA2 LANE Shabal ZK-Crypt The Rebound Attack [MRST09] Tool in the differential cryptanalysis of hash functions Invented during the design of Grøstl AES-based designs allow a simple application of the idea Has been applied to a wide range of hash functions Echo, Grøstl, JH, Lane, Luffa, Maelstrom, Skein, Twister, Whirlpool, ... The Rebound Attack Ebw Ein Efw inbound outbound outbound Applies to block cipher and permutation based
  • A Short Note on AES-Inspired Hashes

    A Short Note on AES-Inspired Hashes

    A Short Note on AES-Inspired Hashes Tor E. Bjørstad University of Bergen, Norway Email : [email protected] 1 Introduction This paper gives a rough classification of various AES-based hash algorithms that have been accepted for Round 1 of the NIST Hash Function Competition. We compare the different algorithms based on the number of \AES-like" rounds performed by a single invocation of the compression function, versus the size of the input block. This is not particularly rigorous or scientific way of comparing hash algorithms, but as we shall see it may still yield somewhat interesting results. With the exception of Sarmal and Whirlpool, all the listed algorithms use the AES S-box as their only source of nonlinearity. How they use it is a different matter. What all the algorithms do have in common, is that they use the 8 bit S-box together with a MDS matrix, in a construction where SubBytes() and MixColumns() are applied after one another on some internal data structure. The actual MDS matrices used are frequently different from the one in AES; for instance, Fugue uses a 16 × 16 matrix. For the sake of comparison, the number of of rounds has been normalised to correspond to those of AES-128. This is not entirely fair, but it would be hard to make any comparison between the internals of such wildly different hash algorithms without making some (over)simplifications. The reader is invited to take note of 3 main observations. First, there is a very wide spread between the number of \rounds" used by the different algorithms { but a strong tendency of clustering.