International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395 -0056 Volume: 04 Issue: 04 | Apr -2017 www.irjet.net p-ISSN: 2395-0072 IMPOSSIBLE DIFFERENTIAL CRYPTANALYSIS ON REDUCED ROUND OF TINY AES Mehak Khurana1, Meena Kumari2 1Assistant Prof, Dept of Computer Science, The NorthCap Univerity, Gurugram, India 2Prof, Dept of Computer Science, The NorthCap Univerity, Gurugram, India ---------------------------------------------------------------------***--------------------------------------------------------------------- Abstract - The emerging need of the secure ciphers has number of subkeys differs in each version. NSA analyzed lead to the designing and analysis of many lightweight block security of all three variants of AES thoroughly and ciphers. In this respect, many lightweight block ciphers have declared that none version has any known vulnerability been designed, of which is simple AES, one of the popular and can be used in protecting the storage and proposed secure block ciphers is used in ubiquitous systems. transmission of highly secret digital data. In this paper, we evaluate the security of reduced round of Later on the situation started to change, different authors simple AES (Tiny AES) against impossible differential [4-5] started attacking on AES by recovering key with less cryptanalysis. Firstly the analysis of Tiny AES has been complexity than brute force attack. All the attacks were introduced. Secondly the impossible cryptanalysis on 5 similar attacks and fell in one category of mainly related rounds of Tiny AES has been analyzed which requires data key and subkey attack which had similar concept of key complexity 2110 approximately and 240.memory accesses to characteristic cancelation. This attack was launch on 192 recover the secret key which is better than exhaustive and 256 version of AES. Further many other attacks were search. launched by finding the trails in AES. Key Words: Symmetric key ciphers, block ciphers, Tiny 2. Block cipher: AES, Impossible differential cryptanalysis 1.2 The AES Block Cipher In 2001, AES block cipher was introduced by Joan Daemen, Vincent Rijmen.The AES (Rijndael) has 3 versions which 1. INTRODUCTION have been standardized by the NIST, and Versions are During the recent decade, it has become a challenge to AES-128, AES-192 and AES-256 where the number design cryptographic primitives [1] to provide security corresponds to the key size. The 128 bits AES in the with efficiency when limited hardware resources are available. Many lightweight block ciphers were designed encryption standard version which is also large enough to to be used in devices used for storing and transmitting prevent any exhaustive key search. An encryption information securely. Some of the block cipher [2-3] algorithm performs following operations and stores the having a structure derived from that of the AES are KLEIN, state of 128 bits in 4x4 matrix of 16 bytes LED, Midori, Mysterion, SKINNY, Zorro. Some of the fiestel block ciphers are Hight, LEA, XTEA, Simon and Speck. Some block ciphers which have bit sliced S-Boxes are [ ] PRIDE, Rectangle, Noekeon. Some SPN structured ciphers are PRESENT, PRINCE, mCrypton. Some other two branched block ciphers are DESLX, MISTY, Lblock, KASUMI, SEA, and some Generalized Feistel Networks It consists of subbyte, shiftrow, mix column and add (GFN) ciphers are CLEFIA, Piccolo, TWINE. round key. Advanced Encryption Standard (AES) is an iterated block cipher that was selected in 2000 by NIST as an 1. SubBytes: In parallel each byte in of a 4x4 replacement of Data Encryption standard (DES) after a matrix state is substituted by its corresponding byte three year competition. It was declares as a national and in its defined 8 bit invertible S-box. The S-box is international standard and was and still being used in where represents many applications such as online banking, File transfer, multiplicative inverse, M represents matrix and C voice calls etc. The AES has three versions called AES-128, AES-192, and AES- 256 where each version differ from represents constant and is calculated in another on the basis of the key length i.e. 128, 192, and and is used because of it is highly non-linear. 256 bits and have 10, 12, and 14 rounds respectively. Encryption of data through rounds is same in all three 2. ShiftRows: Each row is shifted to the left by its own versions but the key generation process to generate row no-1. i.e first row of matrix is shifted by zero © 2017, IRJET | Impact Factor value: 5.181 | ISO 9001:2008 Certified Journal Page 1992 International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395 -0056 Volume: 04 Issue: 04 | Apr -2017 www.irjet.net p-ISSN: 2395-0072 towards left which means it is left untouched, second differentials with zero probability). It can be applied to the row is shifted by 1 to the left, third by 2 and those in cipher, whose non-linear round function is bijective. the fourth by 3. This is to ensure diffusion between columns. The new state generated is 3.1 Generalized Impossible Differential Attack To apply impossible differential attack, we need to find impossible differential pair which can be used as distinguisher. The difference after rounds produces [ ] the output difference An impossible differential with miss in middle technique works as a distinguisher to rule out the incorrect keys, where miss in middle technique 3. MixColumns: Each column is multiplied by an uses combination of two differentials both of which hold invertible MDS constant 4x4 matrix over field with probability one and do not meet in middle i.e. for to ensure diffusion between the rows. Last round does rounds of partial encryption becomes and for partial decryption of rounds becomes . If the not include column mixing to improve efficiency in difference after rounds of encryption is decryption. impossible because and ( , is called impossible differential pair. We eliminate or discard keys 4. AddRoundKey: Key schedule algorithm generates for which impossible differential characteristic succession of 128 bits keys using original key. The 128 holds for the subkey of that key. bits for round key is placed into 4x4 matrix Finding the Distinguisher, to obtain impossible each of 16 bytes. The each byte of of subkey differentials and filtering and Key Elimination is XORed with current state i.e. 1. Let the defined structure of set of plaintext with It offers good hardware and software performance and is input differential and where is represented as more efficient and secure than many other known block active bytes of chosen plaintexts, which means it has all fixed values except bytes. ciphers. For cryptographer, if an attacker can attack a 2. Some set of structures are selected randomly, cipher in fewer computations and faster than a brute force attack then it is a cryptographic break. Thus computations encrypt plaintext pairs by rounds to obtain required against 128 bit key of AES are less than 2128 then //differential of the outputs for 3. In those t structures, select only those plaintext it is considered a break of cipher, even though it takes 2112 ciphertext pairs for those, whose ciphertext pairs computations which takes much longer time to be have same bytes in the appointed positions with zero computed. Basic security analysis of AES has been done difference except for fixed bytes of ciphertext, which shows resistance against attacks such as linear, discard the rest of the pairs. differential and their variants. In order to speed up the 4. Create a table of remaining ciphertexts pairs. algorithm we want as few rounds of encryption as possible 5. For active bytes in the last jth round , guess the but there are a minimum number of rounds required to subkeys and store in table . Partially decrypt all assure the security level. ciphertext pairs from table through last round using these guessed key bytes. Select only those 3. Impossible Differential Attacks ciphertext pairs which after partially decryption through round give output difference of non-zero Most known and powerful attacks on block ciphers are bytes only in the guessed key positions in obtained differential cryptanalysis (DC) [6-9] and linear ciphertext pair. cryptanalysis (LC) [10]. These cryptanalytic techniques 6. For each of the remaining ciphertext pairs in table , have attacked many block ciphers. So as to design a block compute their corresponding plaintext pair and cipher, every designer keeps the DC and LC attacks in Check then subkey is invalid. mind to make it secure against these attacks. But now a 7. Eliminate the invalid keys from table that lead to days to secure a block cipher only against DC and LC is not the input difference of the impossible differential in sufficient. There are many other cryptanalysis techniques the input of the 1st round. If a guess for these bytes [11] which can attack block ciphers remains, guess all the remaining key bytes to obtain Biham et.al. in 1998 developed variant of a truncated original key with exhaustive search by checking over differential cryptanalysis called impossible differential pairs and check the guess using trial encryption, cryptanalysis [12-16] by formulating distinguisher based else try above steps for all remaining guessed keys in on the fact that certain differentials never occur (i.e. the . © 2017, IRJET | Impact Factor value: 5.181 | ISO 9001:2008 Certified Journal Page 1993 International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395 -0056 Volume: 04 Issue: 04 | Apr -2017 www.irjet.net p-ISSN: 2395-0072 8. Rejecting the invalid keys, the total key space is 3.4 Example of Impossible Differential Attack on reduced. AES-128 3.2 Probability and Complexity Evaluation 4-round impossible differential for AES is In step 1, Let plaintext set in a structure and in each structure, there are about plaintext pairs.