DOCSLIB.ORG

Iso/Iec 18033-3:2010 Dam 2

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Iso/Iec 18033-3:2010 Dam 2 DRAFT AMENDMENT ISO/IEC 18033-3:2010 DAM 2 ISO/IEC JTC 1/SC 27 Secretariat: DIN Voting begins on: Voting terminates on: 2018-07-19 2018-10-11 Information technology — Security techniques — Encryption algorithms — Part 3: Block ciphers AMENDMENT 2: SM4 Technologies de l'information — Techniques de sécurité — Algorithmes de chiffrement — Partie 3: Chiffrement par blocs AMENDEMENT 2: . iTeh STANDARD PREVIEW ICS: 35.030 (standards.iteh.ai) ISO/IEC 18033-3:2010/DAmd 2 https://standards.iteh.ai/catalog/standards/sist/b9d423fe-1fde-4195-82d8- a232c08c09b0/iso-iec-18033-3-2010-damd-2 THIS DOCUMENT IS A DRAFT CIRCULATED FOR COMMENT AND APPROVAL. IT IS THEREFORE SUBJECT TO CHANGE AND MAY NOT BE REFERRED TO AS AN INTERNATIONAL STANDARD UNTIL PUBLISHED AS SUCH. IN ADDITION TO THEIR EVALUATION AS BEING ACCEPTABLE FOR INDUSTRIAL, This document is circulated as received from the committee secretariat. TECHNOLOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT INTERNATIONAL STANDARDS MAY ON OCCASION HAVE TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL TO BECOME STANDARDS TO WHICH REFERENCE MAY BE MADE IN Reference number NATIONAL REGULATIONS. ISO/IEC 18033-3:2010/DAM 2:2018(E) RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT, WITH THEIR COMMENTS, NOTIFICATION OF ANY RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE AND TO PROVIDE SUPPORTING DOCUMENTATION. © ISO/IEC 2018 ISO/IEC 18033-3:2010/DAM 2:2018(E) iTeh STANDARD PREVIEW (standards.iteh.ai) ISO/IEC 18033-3:2010/DAmd 2 https://standards.iteh.ai/catalog/standards/sist/b9d423fe-1fde-4195-82d8- a232c08c09b0/iso-iec-18033-3-2010-damd-2 COPYRIGHT PROTECTED DOCUMENT © ISO/IEC 2018 All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address belowCP 401or ISO’s • Ch. member de Blandonnet body in 8 the country of the requester. ISOCH-1214 copyright Vernier, office Geneva Phone: +41 22 749 01 11 Fax:Website: +41 22www.iso.org 749 09 47 PublishedEmail: copyright@iso.orgin Switzerland ii © ISO/IEC 2018 – All rights reserved ISO/IEC 18033-3:2010/DAM 2:2018(E) Foreword ISO (the International Organization for Standardization) and IEC (the International Electrotechnical members of ISO or IEC participate in the development of International Standards through technical Commission) form the specialized system for worldwide standardization. National bodies that are committeesorganizations, established governmental by the and respective non-governmental, organization in liaison to deal with with ISO particularand IEC, also fields take of part technical in the activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international ISO/IEC JTC 1. work. In the field of information technology, ISO and IEC have established a joint technical committee, The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for editorial rules of the ISO/IEC Directives, Part 2 (see www .iso .org/directives). the different types of document should be noted. This document was drafted in accordance with the Attention is drawn to the possibility that some of the elements of this document may be the subject ofIntroduction patent rights. and/or ISO on and the IECISO listshall of patentnot be declarationsheld responsible received for (seeidentifying www .iso any .org/patents or all such). patent rights. Details of any patent rights identified during the development of the document will be in the constitute an endorsement. Any trade name used in this document is information given for the convenience of users and does not as well as informationi aboutTeh ISO's ST adherenceANDA toR theD World PR TradeEV IOrganizationEW (WTO) principles in the ForTechnical an explanation Barriers onto Tradethe meaning (TBT)(s ofseet ISOa then specificd followingard termss. URLit ande hwww expressions.ai .iso) .org/iso/foreword related to conformity .html. assessment, The committee responsible for this document is ISO/IEC JTC 1, Information technology, SC XXX ISO/IEC 18033-3:2010/DAmd 2 https://standards.iteh.ai/catalog/standards/sist/b9d423fe-1fde-4195-82d8- a232c08c09b0/iso-iec-18033-3-2010-damd-2 This second/third/... edition cancels and replaces the first/second/... edition (), [clause(s) / subclause(s) / table(s) / figure(s) / annex(es)] of which [has / have] been technically revised. ISO XXXX consists of the following parts. [Add information as necessary.] © ISO/IEC 2018 – All rights reserved iii iTeh STANDARD PREVIEW (standards.iteh.ai) ISO/IEC 18033-3:2010/DAmd 2 https://standards.iteh.ai/catalog/standards/sist/b9d423fe-1fde-4195-82d8- a232c08c09b0/iso-iec-18033-3-2010-damd-2 ISO/IEC 18033-3:2010/DAM 2:2018(E) Information technology — Security techniques — Encryption algorithms — Part 3: Block ciphers AMENDMENT 2: SM4 — Amendment 2: SM4 AA: Page 1, 1: Change the following sentence of paragraph 1: Ato: total of seven different block ciphers are defined. ABB: total Page of nine1, 1, Tabledifferent 1:iT blockeh ciphers STA areN defined.DARD PREVIEW Replace Table 1 with the following:(standards.iteh.ai) Block lengthISO/IEAlgorithmC 18033-3 :name2010/D (seeAmd #) 2 https://standards.iteh.ai/catalog/TDEAstanda r d s / s is t(4.2)/b9d423fe-1fde128-419 5or-8 1922d8- bits a232c08c09b0/iso-iec-18033-3-2010-damd-2 Key length MISTY (4.3) 64 bits CAST-128 (4.4) 128 bits HIGHT (4.5) AES (5.2) 128, 192 or 256 Camelia (5.3) bits 128 bits SEED (5.4) 128 bits 256 bits SM4 (5.6) 128 bits Kuznyechik (5.5) CC: Page 24, 5.1: Change the following sentence of paragraph 1: Into: this clause, three 128-bit block ciphers are specified; AES in 5.2, Camellia in 5.3, and SEED in 5.4. in 5.5 and SM4 in 5.6. In this clause, five 128-bit block ciphers are specified; AES in 5.2, Camellia in 5.3, SEED in 5.4, Kuznyechik DD: Page 51, After 5.4.5: Add the following new 5.6 to the end of 5.5: 5.6 SM4 5.6.1 The SM4 algorithm © ISO/IEC 2018 – All rights reserved 1 ISO/IEC 18033-3:2010/DAM 2:2018(E) The SM4 algorithm is a symmetric block cipher that can process data blocks of 128 bits, using a cipher key5.6.2 with SM4 length encryption of 128 bits under 32 rounds. A 128-bit block P is transformed into a 128-bit block C using the following procedure. (Xi (i = 0, 1, 2, 3) are variables with 32-bit length, rki (i (1) P = X0 || X1 || X2 || X3 = 0, 1, …, 31) are subkeys with 32-bit length): (2) for i = 0 to 31: Xi+4 = F(Xi, Xi+1, Xi+2, Xi+3, rki) (3) C = X35 || X34 || X33 || X32 5.6.3 SM4 decryption The decryption operation is identical to the encryption operation, except that the rounds (and therefore the subkeys)(1) C = X35 are || Xused34 || inX33 reverse || X32 order: (2) for i = 31 to 0: Xi = F(Xi+4, Xi+1, Xi+2, Xi+3, rki) (3) P = X0 || X1 || X2 || X3 iTeh STANDARD PREVIEW 5.6.4 SM4 functions (standards.iteh.ai) 5.6.4.1 Function F ISO/IEC 18033-3:2010/DAmd 2 https://standards.iteh.ai/catalog/standards/sist/b9d423fe-1fde-4195-82d8- a232c08c09b0/iso-iec-18033-3-2010-damd-2 The F(functionX0, X1, XF2 is, X used3, rk) for= X 0both encryptionX1 X2 X3 andrk decryption.) The function F is defined as follows: where Xi (i = 0, 1, 2, 3) and rk⊕T( ⊕ ⊕ ⊕ 5.6.4.2 Permutation areT and bit T’strings of length 32, T is a permutation defined in 5.6.4.2. 5.6.4.2.1 General The permutation T is used both for encryption and decryption. T is a composition of a nonlinear transformation τ and a linear transformation L, that is T(·) = L(τ(·)). The permutation T’ is used for key schedule. T’ is a composition of a nonlinear transformation τ and a linear transformation L’, that is T’(·) =5.6.4.2.2 L’(τ(·)). T(T’), NonlinearL(L’) and τ aretransformation all transformations τ on 32-bit strings. ai (i in 5.6.4.2.4): The nonlinear transformation τ is defined as follows ( = 0, 1, 2, 3) are bytes and S is a S-box defined a0 || a1 || a2 || a3) = S(a0) || S(a1) || S(a2) || S(a3). 5.6.4.2.3τ( Linear transformation L and L’ B is a variable with 32-bit length): The L(linearB) = transformationB B<<<2 B L<<< is 10definedB<<< as 18followsB <<<( 24). ⊕( )⊕( )⊕( )⊕( B is a variable with 32-bit length): The L’(linearB) = transformationB B<<<13 L’B<<< is defined23). as follows ( ⊕( )⊕( 2 © ISO/IEC 2018 – All rights reserved ISO/IEC 18033-3:2010/DAM 2:2018(E) 5.6.4.2.4 S-box S Table 17. The S-box S used in the transformation τTable is presented 17 — SM4 in hexadecimal S-box form in 0 1 2 3 4 5 6 7 8 9 a b c d e f 0 d6 90 e9 fe cc e1 3d b7 16 b6 14 c2 28 2c 05 1 2b 67 9a 76 2a be 04 c3 aa 44 13 26 49 86 06 99 fb 2 9c 42 50 f4 91 ef 98 7a 33 54 0b 43 ed cf ac 62 3 e4 b3 1c a9 c9 08 e8 95 80 df 94 fa 75 8f 3f a6 4 47 07 a7 fc f3 73 17 ba 83 59 3c 19 e6 85 4f a8 5 68 6b 81 b2 71 64 da 8b f8 eb 0f 4b 70 56 9d 35 6 1e 24 0e 5e 63 58 d1 a2 25 22 7c 3b 01 21 78 87 7 d4 00 46 57 9f d3 27 52 4c 36 02 e7 a0 c4 c8 9e 8 ea bf 8a d2 40 c7 38 b5 a3 f7 f2 ce f9 61 15 a1 9 e0 ae 5d a4 9b 34 1a 55 ad 93 32 30 f5 8c b1 e3 a 1d f6 e2 2e 82 66 ca 60 c0 29 23 ab 0d 53 4e 6f b d5 db 37 45 de fd 8e 2f 03 ff 6a 72 6d 6c 5b 51 c 8d 1b af 92 bb dd bc 7f 11 d9 5c 41 1f 10 5a d8 d 0a c1 31 88 a5 cd 7b bd 2d 74 d0 12 b8 e5 b4 b0 e 89 69iTe97h 4aST0cAN96D77AR7eD 65PRb9EVf1 IE09Wc5 6e c6 84 f 18 f0 7d ec(st3aandcda4drds20.it79eh.eeai)5f 3e d7 cb 39 48 5.6.5 SM4 key schedule ISO/IEC 18033-3:2010/DAmd 2 https://standards.iteh.ai/catalog/standards/sist/b9dMK423=fe -MK1fde0- 4||1 9MK5-812 d||8- MK2 || MK3 a232c08c09b0/iso-iec-18033-3-2010-damd-2 The key scheduling part accepts a 128-bit master key , and yields 32 subkeys,(1) K 0as || shown K1 || K 2below.
Load more

Recommended publications
  • Environmental DNA Reveals the Fine-Grained and Hierarchical
    www.nature.com/scientificreports OPEN Environmental DNA reveals the fne‑grained and hierarchical spatial structure of kelp forest fsh communities Thomas Lamy 1,2*, Kathleen J. Pitz 3, Francisco P. Chavez3, Christie E. Yorke1 & Robert J. Miller1 Biodiversity is changing at an accelerating rate at both local and regional scales. Beta diversity, which quantifes species turnover between these two scales, is emerging as a key driver of ecosystem function that can inform spatial conservation. Yet measuring biodiversity remains a major challenge, especially in aquatic ecosystems. Decoding environmental DNA (eDNA) left behind by organisms ofers the possibility of detecting species sans direct observation, a Rosetta Stone for biodiversity. While eDNA has proven useful to illuminate diversity in aquatic ecosystems, its utility for measuring beta diversity over spatial scales small enough to be relevant to conservation purposes is poorly known. Here we tested how eDNA performs relative to underwater visual census (UVC) to evaluate beta diversity of marine communities. We paired UVC with 12S eDNA metabarcoding and used a spatially structured hierarchical sampling design to assess key spatial metrics of fsh communities on temperate rocky reefs in southern California. eDNA provided a more‑detailed picture of the main sources of spatial variation in both taxonomic richness and community turnover, which primarily arose due to strong species fltering within and among rocky reefs. As expected, eDNA detected more taxa at the regional scale (69 vs. 38) which accumulated quickly with space and plateaued at only ~ 11 samples. Conversely, the discovery rate of new taxa was slower with no sign of saturation for UVC.
    [Show full text]
  • Iso/Iec Jtc 1/Sc 27/Wg 2 N 1804
    ISO/IEC JTC 1/SC 27/WG 2 N 1804 ISO/IEC JTC 1/SC 27/WG 2 Cryptography and security mechanisms Convenorship: JISC (Japan) Document type: Officer's Contribution Title: A Memo on Kuznyechik S-Box Status: Date of document: 2018-09-27 Source: Project Editor (Vasily Shishkin), Project Co-editor (Grigory Marshalko) Expected action: ACT Action due date: 2018-10-04 No. of pages: 1 + 4 Email of convenor: t-chika@ipa.go.jp Committee URL: https://isotc.iso.org/livelink/livelink/open/jtc1sc27wg2 A Memo on Kuznyechik S-Box During ballot on 18033-3 DAmd1 (finished in June 2018) comments from some NB were received concerning issues regarding Kuznyechik design rationale and its parameters origins. The goal of this Memo is to provide all relevant information known to the designers of the algorithm. Kuznyechik has transparent and well studied design. Its design rationale was introduced to WG2 experts in 2016 by presentation (WG2) N1740. Kuznyechik is based on well examined constructions. Each transformation provides certain cryptographic properties. All transformations used as building blocks have transparent origin. The only transformation used in Kuznyechik which origin may be questioned is the S-box π. This S-box was chosen from Streebog hash-function and it was synthesized in 2007. Note that through many years of cryptanalysis no weakness of this S-box was found. The S-box π was obtained by pseudo- random search and the following properties were taken into account. 1. The differential characteristic π pπ = max pα,β; α,β2V8nf0g π where pα,β = Pfπ(x ⊕ α) ⊕ π(x) = βg.
    [Show full text]
  • On the Design and Performance of Chinese OSCCA-Approved Cryptographic Algorithms Louise Bergman Martinkauppi∗, Qiuping He† and Dragos Ilie‡ Dept
    On the Design and Performance of Chinese OSCCA-approved Cryptographic Algorithms Louise Bergman Martinkauppi∗, Qiuping Hey and Dragos Iliez Dept. of Computer Science Blekinge Institute of Technology (BTH), Karlskrona, Sweden ∗louisemartinkauppi@hotmail.com, yping95 @hotmail.com, zdragos.ilie@bth.se Abstract—SM2, SM3, and SM4 are cryptographic standards in transit and at rest [4]. The law, which came into effect authorized to be used in China. To comply with Chinese cryp- on January 1, 2020, divides encryption into three different tography laws, standard cryptographic algorithms in products categories: core, ordinary and commercial. targeting the Chinese market may need to be replaced with the algorithms mentioned above. It is important to know beforehand Core and ordinary encryption are used for protecting if the replaced algorithms impact performance. Bad performance China’s state secrets at different classification levels. Both may degrade user experience and increase future system costs. We present a performance study of the standard cryptographic core and ordinary encryption are considered state secrets and algorithms (RSA, ECDSA, SHA-256, and AES-128) and corre- thus are strictly regulated by the SCA. It is therefore likely sponding Chinese cryptographic algorithms. that these types of encryption will be based on the national Our results indicate that the digital signature algorithms algorithms mentioned above, so that SCA can exercise full SM2 and ECDSA have similar design and also similar perfor- control over standards and implementations. mance. SM2 and RSA have fundamentally different designs. SM2 performs better than RSA when generating keys and Commercial encryption is used to protect information that signatures. Hash algorithms SM3 and SHA-256 have many design similarities, but SHA-256 performs slightly better than SM3.
    [Show full text]
  • State of the Art in Lightweight Symmetric Cryptography
    State of the Art in Lightweight Symmetric Cryptography Alex Biryukov1 and Léo Perrin2 1 SnT, CSC, University of Luxembourg, alex.biryukov@uni.lu 2 SnT, University of Luxembourg, perrin.leo@gmail.com Abstract. Lightweight cryptography has been one of the “hot topics” in symmetric cryptography in the recent years. A huge number of lightweight algorithms have been published, standardized and/or used in commercial products. In this paper, we discuss the different implementation constraints that a “lightweight” algorithm is usually designed to satisfy. We also present an extensive survey of all lightweight symmetric primitives we are aware of. It covers designs from the academic community, from government agencies and proprietary algorithms which were reverse-engineered or leaked. Relevant national (nist...) and international (iso/iec...) standards are listed. We then discuss some trends we identified in the design of lightweight algorithms, namely the designers’ preference for arx-based and bitsliced-S-Box-based designs and simple key schedules. Finally, we argue that lightweight cryptography is too large a field and that it should be split into two related but distinct areas: ultra-lightweight and IoT cryptography. The former deals only with the smallest of devices for which a lower security level may be justified by the very harsh design constraints. The latter corresponds to low-power embedded processors for which the Aes and modern hash function are costly but which have to provide a high level security due to their greater connectivity. Keywords: Lightweight cryptography · Ultra-Lightweight · IoT · Internet of Things · SoK · Survey · Standards · Industry 1 Introduction The Internet of Things (IoT) is one of the foremost buzzwords in computer science and information technology at the time of writing.
    [Show full text]
  • A Framework for Fully-Simulatable H-Out-Of-N Oblivious Transfer
    1 A Framework For Fully-Simulatable h-Out-Of-n Oblivious Transfer Zeng Bing, Tang Xueming, and Chingfang Hsu ✦ Abstract—We present a framework for fully-simulatable h-out-of-n where i1 < i2 <...<ih 6 n. The receiver expects to oblivious transfer (OT n) with security against non-adaptive malicious h get the messages mi1 ,mi2 ,...,mih without leaking any adversaries. The framework costs six communication rounds and costs information about his private input, i.e., the h positive at most 40n public-key operations in computational overhead. Com- integers he holds. The sender expects all new knowledge pared with the known protocols for fully-simulatable oblivious transfer that works in the plain mode (where there is no trusted common learned by the receiver from their interaction is at most reference string available) and proven to be secure under standard h messages. Obviously, the OT most literature refer to is 2 n model (where there is no random oracle available), the instantiation OT1 and can be viewed as a special case of OTh . based on the decisional Diffie-Hellman assumption of the framework is Considering a variety of attack we have to confront the most efficient one, no matter seen from communication rounds or n in real environment, a protocol for OTh with security computational overhead. against malicious adversaries (a malicious adversary Our framework uses three abstract tools, i.e., perfectly binding com- mitment, perfectly hiding commitment and our new smooth projective may act in any arbitrary malicious way to learn as much hash. This allows a simple and intuitive understanding of its security.
    [Show full text]
  • Exponential S-Boxes: a Link Between the S-Boxes of Belt and Kuznyechik/Streebog
    Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog Léo Perrin and Aleksei Udovenko SnT, University of Luxembourg {leo.perrin,aleksei.udovenko}@uni.lu Abstract. The block cipher Kuznyechik and the hash function Streebog were recently standardized by the Russian Federation. These primitives use a common 8-bit S-Box, denoted 휋, which is given only as a look-up table. The rationale behind its design is, for all practical purposes, kept secret by its authors. In a paper presented at Eurocrypt 2016, Biryukov et al. reverse-engineered this S-Box and recovered an unusual Feistel-like structure relying on finite field multiplications. In this paper, we provide a new decomposition of this S-Box and describe how we obtained it. The first step was the analysis of the 8-bit S-Box of the current standard block cipher of Belarus, BelT. This S-Box is a variant of a so-called exponential substitution, a concept we generalize into pseudo-exponential substitution. We derive distinguishers for such permutations based on properties of their linear approximation tables and notice that 휋 shares some of them. We then show that 휋 indeed has a decomposition based on a pseudo-exponential substitution. More precisely, we obtain a simpler structure based on an 8-bit finite field exponentiation, one 4-bit S-Box, a linear layer and a few modular arithmetic operations. We also make several observations which may help cryptanalysts attempting to reverse-engineer other S-Boxes. For example, the visual pattern used in the previous work as a starting point to decompose 휋 is mathematically formalized and the use of differential patterns involving operations other than exclusive-or is explored.
    [Show full text]
  • A Lightweight Encryption Algorithm for Secure Internet of Things
    Pre-Print Version, Original article is available at (IJACSA) International Journal of Advanced Computer Science and Applications, Vol. 8, No. 1, 2017 SIT: A Lightweight Encryption Algorithm for Secure Internet of Things Muhammad Usman∗, Irfan Ahmedy, M. Imran Aslamy, Shujaat Khan∗ and Usman Ali Shahy ∗Faculty of Engineering Science and Technology (FEST), Iqra University, Defence View, Karachi-75500, Pakistan. Email: fmusman, shujaatg@iqra.edu.pk yDepartment of Electronic Engineering, NED University of Engineering and Technology, University Road, Karachi 75270, Pakistan. Email: firfans, iaslamg@neduet.edu.pk, uashah@gmail.com Abstract—The Internet of Things (IoT) being a promising and apply analytics to share the most valuable data with the technology of the future is expected to connect billions of devices. applications. The IoT is taking the conventional internet, sensor The increased number of communication is expected to generate network and mobile network to another level as every thing mountains of data and the security of data can be a threat. The will be connected to the internet. A matter of concern that must devices in the architecture are essentially smaller in size and be kept under consideration is to ensure the issues related to low powered. Conventional encryption algorithms are generally confidentiality, data integrity and authenticity that will emerge computationally expensive due to their complexity and requires many rounds to encrypt, essentially wasting the constrained on account of security and privacy [4]. energy of the gadgets. Less complex algorithm, however, may compromise the desired integrity. In this paper we propose a A. Applications of IoT: lightweight encryption algorithm named as Secure IoT (SIT).
    [Show full text]
  • Provably Secure Counter Mode with Related Key-Based Internal Re-Keying
    Related keys CTRR mode and its security estimation Related-key cryptanalysis of Kuznyechik Provably secure counter mode with related key-based internal re-keying Goncharenko K. Moscow State University, al tair94@mail.ru, Alekseev E. CryptoPro LLC, Ph.D., alekseev@cryptopro.ru, Marshalko G. Technical committee for standardization (TC26), marshalko gb@tc26.ru. May 30,Provably 2018 secure counter mode with related key-based internal re-keying Related keys CTRR mode and its security estimation Related-key cryptanalysis of Kuznyechik It is very important to analyse block ciphers in related-key model! Why? Because situation when a lot of key relations are known can emerge when key generating machine is broken. Or just key generation algorithm is poor (like it was in WEP). Provably secure counter mode with related key-based internal re-keying Related keys CTRR mode and its security estimation Related-key cryptanalysis of Kuznyechik One can consider this motivation to be inconvincing and the problem of related-key analysis to be just an entertaining task. There are much less papers on this topic than on classic methods. As a result we still have no published related-keys analysis on Kuznyechik! Provably secure counter mode with related key-based internal re-keying Related keys CTRR mode and its security estimation Related-key cryptanalysis of Kuznyechik Provably secure counter mode with related key-based internal re-keying I some protocols may use related keys by design to generate key material easier and faster (such a cryptosystem is discussed in our work). Related keys CTRR mode and its security estimation Related-key cryptanalysis of Kuznyechik However the motivation can be adjusted with more real examples, when related keys appear (Razali E., Phan R.C.-W.: On The Existence of Related-Key Oracles in Cryptosystems based on Block Ciphers).
    [Show full text]
  • Trusted Platform Module Library Part 1: Architecture TCG Public Review
    Trusted Platform Module Library Part 1: Architecture Family “2.0” Level 00 Revision 01.50 September 18, 2018 Committee Draft Contact: admin@trustedcomputinggroup.org Work in Progress This document is an intermediate draft for comment only and is subject to change without notice. Readers should not design products based on this document. TCG Public Review Copyright © TCG 2006-2019 TCG Trusted Platform Module Library Part 1: Architecture Licenses and Notices Copyright Licenses: Trusted Computing Group (TCG) grants to the user of the source code in this specification (the “Source Code”) a worldwide, irrevocable, nonexclusive, royalty free, copyright license to reproduce, create derivative works, distribute, display and perform the Source Code and derivative works thereof, and to grant others the rights granted herein. The TCG grants to the user of the other parts of the specification (other than the Source Code) the rights to reproduce, distribute, display, and perform the specification solely for the purpose of developing products based on such documents. Source Code Distribution Conditions: Redistributions of Source Code must retain the above copyright licenses, this list of conditions and the following disclaimers. Redistributions in binary form must reproduce the above copyright licenses, this list of conditions and the following disclaimers in the documentation and/or other materials provided with the distribution. Disclaimers: THE COPYRIGHT LICENSES SET FORTH ABOVE DO NOT REPRESENT ANY FORM OF LICENSE OR WAIVER, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, WITH RESPECT TO PATENT RIGHTS HELD BY TCG MEMBERS (OR OTHER THIRD PARTIES) THAT MAY BE NECESSARY TO IMPLEMENT THIS SPECIFICATION OR OTHERWISE. Contact TCG Administration (admin@trustedcomputinggroup.org) for information on specification licensing rights available through TCG membership agreements.
    [Show full text]
  • International Journal of Computer Engineering and Applications, Volume XII, Special Issue, May 18, ISSN 2321-3469
    International Journal of Computer Engineering and Applications, Volume XII, Special Issue, May 18, www.ijcea.com ISSN 2321-3469 PROVIDING RESTRICTIONS AGAINST ATTACK AND CONGESTION CONTROL IN PUBLICINFRASTRUCTURE CLOUD Nousheen R1, Shanmugapriya M2, Sujatha P3,Dhinakaran D4 Student, Computer Science and Engineering, Peri Institute of Technology, Chennai, India 1,2,3 Assistant professor, Computer Science and Engineering, Peri Institute of Technology, Chennai, India 4 ABSTRACT: Cloud computing is current trend in market .It reduce the cost and complexity of service providers by the means of capital and operational cost.It allows users to access application remotely. This construct directs cloud service provider to handle cost of servers, software updates,etc. If the session tokens are not properly protected, an attacker can hijack an active session and assume the identity of a user. To focusing on session hijacking and broken authenticationOTP is generated it will send user mail.Once the user is authenticatedthey will be split into virtual machine it is initiate to the upload process into the cloud.Thecloud user files are uploaded and stored in domain based .Also in our proposed system encryption keys are maintained outside of the IaaS domain.For encryption, we proposed RSA algorithm .For data owner file encryption, we use camellia algorithm. Finally the files are stored in the public cloud named CloudMe. Keywords: Cloud computing, session hijacking, OTP, Virtual machine, Iaas, CloudMe [1] INTRODUCTION Cloud computing is an information technology(IT) standard that enables universal access to share group of configurable system resource and higher-level services that can be quickly provisioned with minimal management effort, often over the internet.
    [Show full text]
  • The MALICIOUS Framework: Embedding Backdoors Into Tweakable Block Ciphers
    The MALICIOUS Framework: Embedding Backdoors into Tweakable Block Ciphers Thomas Peyrin, Haoyang Wang August 2020 School of Physical and Mathematical Sciences, Nanyang Technological University, Singapore 1 Introduction Backdoors • Most of time, backdoors of an encryption system refer to those weakness intentionally created in the implementation level, such as protocols of key management and key escrow. • The other type is the cryptographic backdoor, which is embedded during the design phase of a cryptographic algorithm. Known examples: Dual EC DBRG. • The suspicious S-box of Kuznyechik and Streebog. • 2 Academic Research Limited number of works focus on the research of cryptographic backdoors. Almost all designs were either broken or can't provide solid security proof. Our contributions • We propose the MALICIOUS framework to embed backdoors into tweakable block ciphers. • We show that our backdoor is efficient. • We provide a concrete security bound for our backdoor. • We provide a cipher example LowMC-M, and give proofs of its backdoor security and classical cipher security. 3 The MALICIOUS Framework Tweakable block ciphers Key Plaintext E Ciphertext Tweak A tweakable block cipher accepts an additional input, so-called tweak, in order to select the permutation computed by the cipher even if the key is fixed. • No need to keep the tweak secret. • An attacker could even have full control over the tweak, i.e., choosing whatever value he wants. 4 Block ciphers with partial non-linear layers Substitution-Permutation Network (SPN) SPN is a method of designing iterated block ciphers, an SPN round consists of a linear layer and a non-linear layer. Partial non-linear layer: the S S non-linear layer (S-boxes) is ··· only applied to a subpart of the internal state.
    [Show full text]
  • Introduction to the Commercial Cryptography Scheme in China
    Introduction to the Commercial Cryptography Scheme in China atsec China Di Li Yan Liu di.li@atsec.com yan@atsec.com +86 138 1022 0119 +86 139 1072 6424 6 November 2015, Washington DC, U.S. © atsec information security, 2015 Disclaimer atsec China is an independent lab specializing in IT security evaluations. The authors do not represent any Chinese government agency or Chinese government-controlled lab. All information used for this presentation is publicly available on the Internet, despite the fact that most of them are in Chinese. 6 November 2015, Washington DC, U.S. 2 Agenda § Background on commercial cryptography in China § Product certification list § Published algorithms and standards § Certification scheme § Conclusions 6 November 2015, Washington DC, U.S. 3 What is “Commercial Cryptography”? 6 November 2015, Washington DC, U.S. 4 OSCCA and Commercial Cryptography − What is “Commercial Cryptography” in China? − “Commercial Cryptography” is a set of algorithms and standards used in the commercial area, e.g. banks, telecommunications, third party payment gateways, enterprises, etc. … − In this area, only “Commercial Cryptography” certified products can be used. − Constituted by the Chinese Academy of Science (CAS) − Issued and regulated by the Office of the State Commercial Cryptography Administration (OSCCA) − Established in 1999 − Testing lab setup in 2005 6 November 2015, Washington DC, U.S. 5 OSCCA Certified Product List Certified product list (1322 items): http://www.oscca.gov.cn/News/201510/News_1310.htm 6 November 2015, Washington DC, U.S. 6 Certified Products and Its Use − Security IC chip − Password keypad − Hardware token including Public Key Infrastructure (PKI), One Time Password (OTP), and its supporting system − Hardware security machine / card − Digital signature and verification system − IPSEC / SSL VPN Gateway − Value Added Tax (VAT) audit system 6 November 2015, Washington DC, U.S.
    [Show full text]