DOCSLIB.ORG

Hidden Structures and Quantum Cryptanalysis Xavier Bonnetain

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Hidden Structures and Quantum Cryptanalysis Xavier Bonnetain Hidden Structures and Quantum Cryptanalysis Xavier Bonnetain To cite this version: Xavier Bonnetain. Hidden Structures and Quantum Cryptanalysis. Cryptography and Security [cs.CR]. Sorbonne Université, 2019. English. NNT : 2019SORUS181. tel-02400328v2 HAL Id: tel-02400328 https://tel.archives-ouvertes.fr/tel-02400328v2 Submitted on 11 Sep 2020 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Sorbonne Université École doctorale Informatique, Télécommunications et Électronique (Paris) Inria de Paris / Équipe-projet SECRET Hidden Structures and Quantum Cryptanalysis Thèse de doctorat d’informatique présentée par Xavier Bonnetain dirigée par María Naya-Plasencia soutenue publiquement le 15 novembre 2019 devant un jury composé de : María Naya-Plasencia Inria Directrice Gilles Van Assche STMicroelectronics, Belgique Rapporteur André Chailloux Inria Examinateur Luca De Feo IBM Research, Suisse Examinateur Henri Gilbert ANSSI Examinateur Gregor Leander Ruhr-Universität Bochum, Examinateur Allemagne Damien Vergnaud Sorbonne Université Examinateur Yu Sasaki NTT, Japon Examinateur rapportée par : Bart Preneel Katholieke Universiteit Leuven, Belgique Gilles Van Assche STMicroelectronics, Belgique Illustration de couverture : Elizabeth Fearne Bonsall, frontispice de The Fireside Sphinx, 1901. Version 28112019, 2nde édition. À Paul, Maxence, Ghislain. Aux autres. Remerciements En premier lieu, je souhaiterais remercier María Naya-Plasencia, ma directrice de thèse, qui fin 2015 me proposa de travailler sur des attaques quantiques, alors que je savaisà peine ce qu’était un qubit. Merci pour cette chance que tu m’as donnée, pour ce temps que tu n’avais pas et que tu m’as tout même consacré, pour m’avoir accompagné et guidé, pour ton indéfectible optimisme. Pour ces années, merci. Je tiens à remercier Bart Preneel et Gilles Van Assche, qui ont accepté la lourde tâche de rapporter les pages qui vont suivre. Je remercie du même coup Gilles Van Assche, André Chailloux, Henri Gilbert, Gre- gor Leander, Damien Vergnaud, Luca De Feo et Yu Sasaki pour avoir accepté de faire partie de mon jury. De plus, Henri, avec Ludovic Perret, a assuré mon suivi doctoral, et je les en remercie. Je remercie mon école doctorale et plus largement les services administratifs univer- sitaires ainsi que le royaume des Pays-Bas, sans qui cette thèse aurait probablement été significativement plus morne. Je souhaite remercier ceux grâce à qui j’ai pris le chemin de la thèse, et en particulier Hugues Randriam, dont les cours à Télécom m’ont redonné le goût des mathématiques, et Anne Canteaut, qui par une conférence à l’X m’a donné l’envie de faire de la cryp- tographie. Ces années auraient été bien différentes sans l’ambiance extraordinaire de l’équipe SECRET (qui dit-on, rejoindra bientôt les étoiles), et je souhaite remercier, par ordre lexicographique et en espérant n’oublier personne : Adrien, Anais, André (l’Ancien), André (le Jeune), Andrea, Anirudh, Anne, Anthony, Antoine, Antonio, Augustin, Chris- telle, Christina, Daniel, Ferdinand, Florian, Gaëtan, Ghazal, Ivan, Jean-Pierre, Kaushik, Kévin, Léo, María, Mariem, Mathilde, Matthieu, Matthieu, Nicky, Nicolas, Nicolas, Pas- cale, Pierre, Rémi, Rocco, Rodolfo, Sébastien, Simon, Shizhu, Shouvik, Sristy, Thomas, Tim, Valentin, Virginie, Vivien et Yann. La recherche, ça se ne fait pas seul, et je voudrais remercier ceux avec qui j’ai eu l’occasion de collaborer, bien évidemment María, mais aussi Akinori, André, Gaëtan, Jean-Francois, Léo, Rémi, Shizhu, Yixin et Yu. Plus généralement, je souhaiterais remercier ceux qui m’ont montré que tout le monde pouvait être membre de la communauté des cryptographes, et je n’oublie pas ceux qui m’ont montré que n’importe qui pouvait en faire partie. J’ai une pensée particulière pour les membres du bureau C201 : tout d’abord, à ceux qui m’ont précédé, Virginie (ton bureau est super), Sébastien (le tableau est quand même plus vide, depuis que tu n’es plus là) et Yann (dont on ne peut que regreter i l’immense verve), et qui m’ont accueilli chaleureusement. Puis à ceux qui ont suivi, Antonio, Daniel et Nicolas. Je vous laisse juge de mon accueil, et j’espère que vous porterez haut les couleurs de ce fier bureau1. Je ne t’oublie pas, Thomas, cher camarade. On a été en stage ensemble, puis en thèse ensemble, on a rempli des formulaires de mots de passe ensemble, on a donné cours ensemble. J’espère que tout ira bien en perfide Albion, et que tu n’oublieras pas l’essentiel : L’important, c’est les valeurs. Léo, ce fut un plaisir, que ce soit pour affronter les audaces culinaires des marchands d’opium ou les audaces statistiques de la Loubianka. J’espère qu’on aura l’occasion de remettre ça, et que tu ne finiras pas par faire de la plongée pour baliser le passage du Nord-Est. Merci Jean-Pierre, futur grand sachem2 qui se comprend très bien, pour toutes ces discussions, et pour le babyfoot3. Je sais que ta porte restera toujours ouverte. Enfin, au sein de l’équipe, je voudrais remercier André (le Jeune), qui m’a emmerdé durant tout son stage avec ses foutues question s’est tout de suite montré très curieux, et se révéla être un collègue d’une redoutable efficacité, qui sût se dépasser, et sans aucun angle mort. Cette thèse, finalement, elle est aussi un peu à toi, et j’espère vraiment qu’on continuera à collaborer après mon départ. Merci, pêle-mèle, à la clique faërixienne, à #doctorat, aux rustacées parisiennes, qui m’ont accompagnés durant ces années. Je remercie ma famille, qui m’a toujours soutenu et accompagné, malgré ma fatigue, malgré les deadlines qui tombent mal, malgré les emplois du temps compliqués. Finalement, je te remercie, toi qui prends la peine de lire ces mots, et j’espère que tu trouveras quelque intérêt dans la prose qui suit. 1Je vous souhaite notamment d’en maintenir le ratio de prix de thèse. 2Ou peut-être grand groumpf ? 3N’oublions pas que 0–8, ça se remonte. Contents Contents 1 Présentation des travaux 7 Main publications 11 1 Introduction to Cryptography 13 1.1 History .................................... 13 1.2 Constructions in symmetric cryptography . 16 1.2.1 Block ciphers ............................. 16 1.2.2 Hash functions & MACs ....................... 17 1.2.3 Authenticated encryption ...................... 18 1.2.4 Sponges ................................ 19 1.3 Cryptanalysis ................................. 19 1.3.1 Generic attacks ............................ 19 1.3.2 Attack models ............................ 20 1.3.3 Cost models .............................. 21 2 Quantum Computing 23 2.1 History .................................... 23 2.2 Differences with classical computations ................... 24 2.3 Qubits ..................................... 24 2.4 Quantum gates ................................ 26 2.4.1 Notable gates ............................. 27 2.4.2 Tensor product of quantum operators . 30 2.4.3 Computing classical functions .................... 30 I Hide and Seek 33 3 Quantum Search 35 3.1 Unstructured search ............................. 35 3.1.1 Classical resolution .......................... 36 3.1.2 Grover’s algorithm .......................... 36 3.1.3 Amplitude amplification ....................... 38 1 3.1.4 Approximate test functions ..................... 39 3.2 Nested search ................................. 40 3.2.1 Classical nested search ........................ 40 3.2.2 Quantum nested search ....................... 42 3.3 Collision search ................................ 43 3.3.1 Classical resolution .......................... 44 3.3.2 Quantum resolution ......................... 45 3.3.3 Structured collisions ......................... 46 4 Simon’s Algorithm 49 4.1 Algorithm description ............................ 49 4.2 Weakening the promise ............................ 52 4.2.1 Partial period ............................. 52 4.2.2 Non-injective functions ........................ 53 4.2.3 Families of functions ......................... 56 5 Abelian Hidden Shift Algorithms 57 5.1 The problem ................................. 58 5.2 Preliminaries: subset-sum and k-list .................... 58 5.2.1 Subset-sum algorithms ........................ 58 5.2.2 k-list algorithms ........................... 61 5.3 The easy instances .............................. 62 5.3.1 Case of pZ{ p2qqn ........................... 62 5.3.2 Case f “ g .............................. 63 5.4 The generation algorithm .......................... 65 5.5 Quantum query complexity ......................... 66 5.6 Hidden shift modulo a power of 2 ...................... 67 5.6.1 Recovering the shift ......................... 68 5.6.2 Kuperberg’s first algorithm: ˘ ................... 68 5.6.3 Regev’s subset-sum variant ..................... 70 5.6.4 Kuperberg’s second algorithm: k-list . 73 5.7 General hidden shift algorithms ....................... 77 5.7.1 Optimizing Algorithm 5.3 ...................... 77 5.7.2 Hidden shift in Z{ pNq ........................ 79 5.7.3 Hidden shift in abelian groups ................... 81 5.7.4 Combining the different algorithms . 82
Load more

Recommended publications
  • Cryptanalysis of Feistel Networks with Secret Round Functions Alex Biryukov, Gaëtan Leurent, Léo Perrin
    Cryptanalysis of Feistel Networks with Secret Round Functions Alex Biryukov, Gaëtan Leurent, Léo Perrin To cite this version: Alex Biryukov, Gaëtan Leurent, Léo Perrin. Cryptanalysis of Feistel Networks with Secret Round Functions. Selected Areas in Cryptography - SAC 2015, Aug 2015, Sackville, Canada. hal-01243130 HAL Id: hal-01243130 https://hal.inria.fr/hal-01243130 Submitted on 14 Dec 2015 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Cryptanalysis of Feistel Networks with Secret Round Functions ? Alex Biryukov1, Gaëtan Leurent2, and Léo Perrin3 1 [email protected], University of Luxembourg 2 [email protected], Inria, France 3 [email protected], SnT,University of Luxembourg Abstract. Generic distinguishers against Feistel Network with up to 5 rounds exist in the regular setting and up to 6 rounds in a multi-key setting. We present new cryptanalyses against Feistel Networks with 5, 6 and 7 rounds which are not simply distinguishers but actually recover completely the unknown Feistel functions. When an exclusive-or is used to combine the output of the round function with the other branch, we use the so-called yoyo game which we improved using a heuristic based on particular cycle structures.
    [Show full text]
  • Battle Management Language: History, Employment and NATO Technical Activities
    Battle Management Language: History, Employment and NATO Technical Activities Mr. Kevin Galvin Quintec Mountbatten House, Basing View, Basingstoke Hampshire, RG21 4HJ UNITED KINGDOM [email protected] ABSTRACT This paper is one of a coordinated set prepared for a NATO Modelling and Simulation Group Lecture Series in Command and Control – Simulation Interoperability (C2SIM). This paper provides an introduction to the concept and historical use and employment of Battle Management Language as they have developed, and the technical activities that were started to achieve interoperability between digitised command and control and simulation systems. 1.0 INTRODUCTION This paper provides a background to the historical employment and implementation of Battle Management Languages (BML) and the challenges that face the military forces today as they deploy digitised C2 systems and have increasingly used simulation tools to both stimulate the training of commanders and their staffs at all echelons of command. The specific areas covered within this section include the following: • The current problem space. • Historical background to the development and employment of Battle Management Languages (BML) as technology evolved to communicate within military organisations. • The challenges that NATO and nations face in C2SIM interoperation. • Strategy and Policy Statements on interoperability between C2 and simulation systems. • NATO technical activities that have been instigated to examine C2Sim interoperation. 2.0 CURRENT PROBLEM SPACE “Linking sensors, decision makers and weapon systems so that information can be translated into synchronised and overwhelming military effect at optimum tempo” (Lt Gen Sir Robert Fulton, Deputy Chief of Defence Staff, 29th May 2002) Although General Fulton made that statement in 2002 at a time when the concept of network enabled operations was being formulated by the UK and within other nations, the requirement remains extant.
    [Show full text]
  • Statistical Weaknesses in 20 RC4-Like Algorithms and (Probably) the Simplest Algorithm Free from These Weaknesses - VMPC-R
    Statistical weaknesses in 20 RC4-like algorithms and (probably) the simplest algorithm free from these weaknesses - VMPC-R Bartosz Zoltak www.vmpcfunction.com [email protected] Abstract. We find statistical weaknesses in 20 RC4-like algorithms including the original RC4, RC4A, PC-RC4 and others. This is achieved using a simple statistical test. We found only one algorithm which was able to pass the test - VMPC-R. This algorithm, being approximately three times more complex then RC4, is probably the simplest RC4-like cipher capable of producing pseudo-random output. Keywords: PRNG; CSPRNG; RC4; VMPC-R; stream cipher; distinguishing attack 1 Introduction RC4 is a popular and one of the simplest symmetric encryption algorithms. It is also probably one of the easiest to modify. There is a bunch of RC4 modifications out there. But is improving the old RC4 really as simple as it appears to be? To state the contrary we confront 20 candidates (including the original RC4) against a simple statistical test. In doing so we try to support four theses: 1. Modifying RC4 is easy to do but it is hard to do well. 2. Statistical weaknesses in almost all RC4-like algorithms can be easily found using a simple test discussed in this paper. 3. The only RC4-like algorithm which was able to pass the test was VMPC-R. It is approximately three times more complex than RC4. We believe that any algorithm simpler than VMPC-R would most likely fail the test. 4. Before introducing a new RC4-like algorithm it might be a good idea to run the statistical test described in this paper.
    [Show full text]
  • An Integrated Symmetric Key Cryptographic Method
    I.J.Modern Education and Computer Science, 2012, 5, 1-9 Published Online June 2012 in MECS (http://www.mecs-press.org/) DOI: 10.5815/ijmecs.2012.05.01 An Integrated Symmetric Key Cryptographic Method – Amalgamation of TTJSA Algorithm , Advanced Caesar Cipher Algorithm, Bit Rotation and Reversal Method: SJA Algorithm Somdip Dey Department of Computer Science, St. Xavier’s College [Autonomous], Kolkata, India. Email: [email protected] Joyshree Nath A.K. Chaudhuri School of IT, Calcutta University, Kolkata, India. Email: [email protected] Asoke Nath Department of Computer Science, St. Xavier’s College [Autonomous], Kolkata, India. Email: [email protected] Abstract—In this paper the authors present a new In banking system the data must be fully secured. Under integrated symmetric-key cryptographic method, named no circumstances the authentic data should go to hacker. SJA, which is the combination of advanced Caesar Cipher In defense the security of data is much more prominent. method, TTJSA method, Bit wise Rotation and Reversal The leakage of data in defense system can be highly fatal method. The encryption method consists of three basic and can cause too much destruction. Due to this security steps: 1) Encryption Technique using Advanced Caesar issue different cryptographic methods are used by Cipher, 2) Encryption Technique using TTJSA Algorithm, different organizations and government institutions to and 3) Encryption Technique using Bit wise Rotation and protect their data online. But, cryptography hackers are Reversal. TTJSA Algorithm, used in this method, is again always trying to break the cryptographic methods or a combination of generalized modified Vernam Cipher retrieve keys by different means.
    [Show full text]
  • State of the Art in Lightweight Symmetric Cryptography
    State of the Art in Lightweight Symmetric Cryptography Alex Biryukov1 and Léo Perrin2 1 SnT, CSC, University of Luxembourg, [email protected] 2 SnT, University of Luxembourg, [email protected] Abstract. Lightweight cryptography has been one of the “hot topics” in symmetric cryptography in the recent years. A huge number of lightweight algorithms have been published, standardized and/or used in commercial products. In this paper, we discuss the different implementation constraints that a “lightweight” algorithm is usually designed to satisfy. We also present an extensive survey of all lightweight symmetric primitives we are aware of. It covers designs from the academic community, from government agencies and proprietary algorithms which were reverse-engineered or leaked. Relevant national (nist...) and international (iso/iec...) standards are listed. We then discuss some trends we identified in the design of lightweight algorithms, namely the designers’ preference for arx-based and bitsliced-S-Box-based designs and simple key schedules. Finally, we argue that lightweight cryptography is too large a field and that it should be split into two related but distinct areas: ultra-lightweight and IoT cryptography. The former deals only with the smallest of devices for which a lower security level may be justified by the very harsh design constraints. The latter corresponds to low-power embedded processors for which the Aes and modern hash function are costly but which have to provide a high level security due to their greater connectivity. Keywords: Lightweight cryptography · Ultra-Lightweight · IoT · Internet of Things · SoK · Survey · Standards · Industry 1 Introduction The Internet of Things (IoT) is one of the foremost buzzwords in computer science and information technology at the time of writing.
    [Show full text]
  • Investigation of Some Cryptographic Properties of the 8X8 S-Boxes Created by Quasigroups
    Computer Science Journal of Moldova, vol.28, no.3(84), 2020 Investigation of Some Cryptographic Properties of the 8x8 S-boxes Created by Quasigroups Aleksandra Mileva, Aleksandra Stojanova, Duˇsan Bikov, Yunqing Xu Abstract We investigate several cryptographic properties in 8-bit S- boxes obtained by quasigroups of order 4 and 16 with several different algebraic constructions. Additionally, we offer a new construction of N-bit S-boxes by using different number of two layers – the layer of bijectional quasigroup string transformations, and the layer of modular addition with N-bit constants. The best produced 8-bit S-boxes so far are regular and have algebraic degree 7, nonlinearity 98 (linearity 60), differential uniformity 8, and autocorrelation 88. Additionally we obtained 8-bit S-boxes with nonlinearity 100 (linearity 56), differential uniformity 10, autocorrelation 88, and minimal algebraic degree 6. Relatively small set of performed experiments compared with the extremly large set of possible experiments suggests that these results can be improved in the future. Keywords: 8-bit S-boxes, nonlinearity, differential unifor- mity, autocorrelation. MSC 2010: 20N05, 94A60. 1 Introduction The main building blocks for obtaining confusion in all modern block ciphers are so called substitution boxes, or S-boxes. Usually, they work with much less data (for example, 4 or 8 bits) than the block size, so they need to be highly nonlinear. Two of the most successful attacks against modern block ciphers are linear cryptanalysis (introduced by ©2020 by CSJM; A. Mileva, A. Stojanova, D. Bikov, Y. Xu 346 Investigation of Some Cryptographic Properties of 8x8 S-boxes .
    [Show full text]
  • Asymptotic Analysis of Plausible Tree Hash Modes for SHA-3
    Asymptotic Analysis of Plausible Tree Hash Modes for SHA-3 Kevin Atighehchi1 and Alexis Bonnecaze2 1 Normandie Univ, UNICAEN, ENSICAEN, CNRS, GREYC, 14000 Caen, France [email protected] 2 Aix Marseille Univ, CNRS, Centrale Marseille, I2M, Marseille, France [email protected] Abstract. Discussions about the choice of a tree hash mode of operation for a standardization have recently been undertaken. It appears that a single tree mode cannot address adequately all possible uses and specifications of a system. In this paper, we review the tree modes which have been proposed, we discuss their problems and propose solutions. We make the reasonable assumption that communicating systems have different specifications and that software applications are of different types (securing stored content or live-streamed content). Finally, we propose new modes of operation that address the resource usage problem for three representative categories of devices and we analyse their asymptotic behavior. Keywords: SHA-3 · Hash functions · Sakura · Keccak · SHAKE · Parallel algorithms · Merkle trees · Live streaming 1 Introduction 1.1 Context In this article, we are interested in the parallelism of cryptographic hash functions. De- pending on the nature of the application, we seek to achieve either of the two alternative objectives: • Priority to memory usage. We first reduce the (asymptotic) parallel running time, and then the number of involved processors, while minimizing the required memory of an implementation using as few as one processor. • Priority to parallel time. We retain an asymptotically optimal parallel time while containing the other computational resources. Historically, a cryptographic hash function makes use of an underlying function, de- noted f, having a fixed input size, like a compression function, a block cipher or more recently, a permutation [BDPA13, BDPA11].
    [Show full text]
  • Security Evaluation of the K2 Stream Cipher
    Security Evaluation of the K2 Stream Cipher Editors: Andrey Bogdanov, Bart Preneel, and Vincent Rijmen Contributors: Andrey Bodganov, Nicky Mouha, Gautham Sekar, Elmar Tischhauser, Deniz Toz, Kerem Varıcı, Vesselin Velichkov, and Meiqin Wang Katholieke Universiteit Leuven Department of Electrical Engineering ESAT/SCD-COSIC Interdisciplinary Institute for BroadBand Technology (IBBT) Kasteelpark Arenberg 10, bus 2446 B-3001 Leuven-Heverlee, Belgium Version 1.1 | 7 March 2011 i Security Evaluation of K2 7 March 2011 Contents 1 Executive Summary 1 2 Linear Attacks 3 2.1 Overview . 3 2.2 Linear Relations for FSR-A and FSR-B . 3 2.3 Linear Approximation of the NLF . 5 2.4 Complexity Estimation . 5 3 Algebraic Attacks 6 4 Correlation Attacks 10 4.1 Introduction . 10 4.2 Combination Generators and Linear Complexity . 10 4.3 Description of the Correlation Attack . 11 4.4 Application of the Correlation Attack to KCipher-2 . 13 4.5 Fast Correlation Attacks . 14 5 Differential Attacks 14 5.1 Properties of Components . 14 5.1.1 Substitution . 15 5.1.2 Linear Permutation . 15 5.2 Key Ideas of the Attacks . 18 5.3 Related-Key Attacks . 19 5.4 Related-IV Attacks . 20 5.5 Related Key/IV Attacks . 21 5.6 Conclusion and Remarks . 21 6 Guess-and-Determine Attacks 25 6.1 Word-Oriented Guess-and-Determine . 25 6.2 Byte-Oriented Guess-and-Determine . 27 7 Period Considerations 28 8 Statistical Properties 29 9 Distinguishing Attacks 31 9.1 Preliminaries . 31 9.2 Mod n Cryptanalysis of Weakened KCipher-2 . 32 9.2.1 Other Reduced Versions of KCipher-2 .
    [Show full text]
  • The Subterranean 2.0 Cipher Suite Joan Daemen, Pedro Maat Costa Massolino, Alireza Mehrdad, Yann Rotella
    The subterranean 2.0 cipher suite Joan Daemen, Pedro Maat Costa Massolino, Alireza Mehrdad, Yann Rotella To cite this version: Joan Daemen, Pedro Maat Costa Massolino, Alireza Mehrdad, Yann Rotella. The subterranean 2.0 cipher suite. IACR Transactions on Symmetric Cryptology, Ruhr Universität Bochum, 2020, 2020 (Special Issue 1), pp.262-294. 10.13154/tosc.v2020.iS1.262-294. hal-02889985 HAL Id: hal-02889985 https://hal.archives-ouvertes.fr/hal-02889985 Submitted on 15 Jul 2020 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Distributed under a Creative Commons Attribution| 4.0 International License IACR Transactions on Symmetric Cryptology ISSN 2519-173X, Vol. 2020, No. S1, pp. 262–294. DOI:10.13154/tosc.v2020.iS1.262-294 The Subterranean 2.0 Cipher Suite Joan Daemen1, Pedro Maat Costa Massolino1, Alireza Mehrdad1 and Yann Rotella2 1 Digital Security Group, Radboud University, Nijmegen, The Netherlands 2 Laboratoire de Mathématiques de Versailles, University of Versailles Saint-Quentin-en-Yvelines (UVSQ), The French National Centre for Scientific Research (CNRS), Paris-Saclay University, Versailles, France [email protected], [email protected], [email protected], [email protected] Abstract.
    [Show full text]
  • Data Encryption Standard
    Data Encryption Standard The Data Encryption Standard (DES /ˌdiːˌiːˈɛs, dɛz/) is a Data Encryption Standard symmetric-key algorithm for the encryption of electronic data. Although insecure, it was highly influential in the advancement of modern cryptography. Developed in the early 1970s atIBM and based on an earlier design by Horst Feistel, the algorithm was submitted to the National Bureau of Standards (NBS) following the agency's invitation to propose a candidate for the protection of sensitive, unclassified electronic government data. In 1976, after consultation with theNational Security Agency (NSA), the NBS eventually selected a slightly modified version (strengthened against differential cryptanalysis, but weakened against brute-force attacks), which was published as an official Federal Information Processing Standard (FIPS) for the United States in 1977. The publication of an NSA-approved encryption standard simultaneously resulted in its quick international adoption and widespread academic scrutiny. Controversies arose out of classified The Feistel function (F function) of DES design elements, a relatively short key length of the symmetric-key General block cipher design, and the involvement of the NSA, nourishing Designers IBM suspicions about a backdoor. Today it is known that the S-boxes that had raised those suspicions were in fact designed by the NSA to First 1975 (Federal Register) actually remove a backdoor they secretly knew (differential published (standardized in January 1977) cryptanalysis). However, the NSA also ensured that the key size was Derived Lucifer drastically reduced such that they could break it by brute force from [2] attack. The intense academic scrutiny the algorithm received over Successors Triple DES, G-DES, DES-X, time led to the modern understanding of block ciphers and their LOKI89, ICE cryptanalysis.
    [Show full text]
  • Miss in the Middle Attacks on IDEA and Khufu
    Miss in the Middle Attacks on IDEA and Khufu Eli Biham? Alex Biryukov?? Adi Shamir??? Abstract. In a recent paper we developed a new cryptanalytic techni- que based on impossible differentials, and used it to attack the Skipjack encryption algorithm reduced from 32 to 31 rounds. In this paper we describe the application of this technique to the block ciphers IDEA and Khufu. In both cases the new attacks cover more rounds than the best currently known attacks. This demonstrates the power of the new cryptanalytic technique, shows that it is applicable to a larger class of cryptosystems, and develops new technical tools for applying it in new situations. 1 Introduction In [5,17] a new cryptanalytic technique based on impossible differentials was proposed, and its application to Skipjack [28] and DEAL [17] was described. In this paper we apply this technique to the IDEA and Khufu cryptosystems. Our new attacks are much more efficient and cover more rounds than the best previously known attacks on these ciphers. The main idea behind these new attacks is a bit counter-intuitive. Unlike tra- ditional differential and linear cryptanalysis which predict and detect statistical events of highest possible probability, our new approach is to search for events that never happen. Such impossible events are then used to distinguish the ci- pher from a random permutation, or to perform key elimination (a candidate key is obviously wrong if it leads to an impossible event). The fact that impossible events can be useful in cryptanalysis is an old idea (for example, some of the attacks on Enigma were based on the observation that letters can not be encrypted to themselves).
    [Show full text]
  • Identifying Open Research Problems in Cryptography by Surveying Cryptographic Functions and Operations 1
    International Journal of Grid and Distributed Computing Vol. 10, No. 11 (2017), pp.79-98 http://dx.doi.org/10.14257/ijgdc.2017.10.11.08 Identifying Open Research Problems in Cryptography by Surveying Cryptographic Functions and Operations 1 Rahul Saha1, G. Geetha2, Gulshan Kumar3 and Hye-Jim Kim4 1,3School of Computer Science and Engineering, Lovely Professional University, Punjab, India 2Division of Research and Development, Lovely Professional University, Punjab, India 4Business Administration Research Institute, Sungshin W. University, 2 Bomun-ro 34da gil, Seongbuk-gu, Seoul, Republic of Korea Abstract Cryptography has always been a core component of security domain. Different security services such as confidentiality, integrity, availability, authentication, non-repudiation and access control, are provided by a number of cryptographic algorithms including block ciphers, stream ciphers and hash functions. Though the algorithms are public and cryptographic strength depends on the usage of the keys, the ciphertext analysis using different functions and operations used in the algorithms can lead to the path of revealing a key completely or partially. It is hard to find any survey till date which identifies different operations and functions used in cryptography. In this paper, we have categorized our survey of cryptographic functions and operations in the algorithms in three categories: block ciphers, stream ciphers and cryptanalysis attacks which are executable in different parts of the algorithms. This survey will help the budding researchers in the society of crypto for identifying different operations and functions in cryptographic algorithms. Keywords: cryptography; block; stream; cipher; plaintext; ciphertext; functions; research problems 1. Introduction Cryptography [1] in the previous time was analogous to encryption where the main task was to convert the readable message to an unreadable format.
    [Show full text]