Analysis of Linear Relationships in Block Ciphers
Total Page：16
File Type：pdf, Size：1020Kb
Analysis of Linear Relationships in Block Ciphers by Muhammad Reza Z’aba Bachelor of Science (Computer) (Universiti Teknologi Malaysia) – 2004 Thesis submitted in accordance with the regulations for the Degree of Doctor of Philosophy Information Security Institute Faculty of Science and Technology Queensland University of Technology May 7, 2010 Keywords Block cipher, stream cipher, symmetric cipher, linear transformation, diffusion, cryptanalysis, fixed points, round function, key scheduling algorithm, integral attack, bit-pattern, algebraic analysis, system of equations, branch number, AES, ARIA, LEX, BES, Noekeon, PRESENT, Serpent, SMS4 i ii Abstract This thesis is devoted to the study of linear relationships in symmetric block ciphers. A block cipher is designed so that the ciphertext is produced as a nonlinear function of the plaintext and secret master key. However, linear re- lationships within the cipher can still exist if the texts and components of the cipher are manipulated in a number of ways, as shown in this thesis. There are four main contributions of this thesis. The first contribution is the extension of the applicability of integral attacks from word-based to bit- based block ciphers. Integral attacks exploit the linear relationship between texts at intermediate stages of encryption. This relationship can be used to recover subkey bits in a key recovery attack. In principle, integral attacks can be applied to bit-based block ciphers. However, specific tools to define the attack on these ciphers are not available. This problem is addressed in this thesis by introducing a refined set of notations to describe the attack. The bit pattern- based integral attack is successfully demonstrated on reduced-round variants of the block ciphers Noekeon, Present and Serpent. The second contribution is the discovery of a very small system of equations that describe the LEX-AES stream cipher. LEX-AES is based heavily on the 128-bit-key (16-byte) Advanced Encryption Standard (AES) block cipher. In one instance, the system contains 21 equations and 17 unknown bytes. This is very close to the upper limit for an exhaustive key search, which is 16 bytes. One only needs to acquire 36 bytes of keystream to generate the equations. Therefore, the security of this cipher depends on the difficulty of solving this small system of equations. The third contribution is the proposal of an alternative method to mea- sure diffusion in the linear transformation of Substitution-Permutation-Network (SPN) block ciphers. Currently, the branch number is widely used for this pur- pose. It is useful for estimating the possible success of differential and linear iii attacks on a particular SPN cipher. However, the measure does not give infor- mation on the number of input bits that are left unchanged by the transformation when producing the output bits. The new measure introduced in this thesis is intended to complement the current branch number technique. The measure is based on fixed points and simple linear relationships between the input and output words of the linear transformation. The measure represents the aver- age fraction of input words to a linear diffusion transformation that are not effectively changed by the transformation. This measure is applied to the block ciphers AES, ARIA, Serpent and Present. It is shown that except for Serpent, the linear transformations used in the block ciphers examined do not behave as expected for a random linear transformation. The fourth contribution is the identification of linear paths in the nonlinear round function of the SMS4 block cipher. The SMS4 block cipher is used as a standard in the Chinese Wireless LAN Wired Authentication and Privacy Infrastructure (WAPI) and hence, the round function should exhibit a high level of nonlinearity. However, the findings in this thesis on the existence of linear relationships show that this is not the case. It is shown that in some exceptional cases, the first four rounds of SMS4 are effectively linear. In these cases, the effective number of rounds for SMS4 is reduced by four, from 32 to 28. The findings raise questions about the security provided by SMS4, and might provide clues on the existence of a flaw in the design of the cipher. iv Contents Front Matter i Keywords .................................. i Abstract................................... iii TableofContents.............................. v ListofFigures................................ xi List of Tables . xiii List of Algorithms . xvii Declaration ................................. xix Previously Published Material . xxi Acknowledgements .............................xxiii 1 Introduction 1 1.1 Linearity in Block Ciphers . 2 1.2 AimsandContributions ....................... 4 1.3 OutlineofThesis ........................... 6 2 Symmetric Ciphers 9 2.1 OverviewofSymmetricCiphers . 10 2.1.1 Notation............................ 11 2.1.2 BlockCipher ......................... 12 Substitution-Permutation-Network . 13 FeistelNetwork ........................ 13 ModesofOperation. .. 14 2.1.3 StreamCipher......................... 15 2.2 Basics of Block Cipher Cryptanalysis . 15 2.2.1 ThreatModel ......................... 15 2.2.2 GenericAttackModel . 16 v DistinguishingPhase . .. .. 17 KeyRecoveryPhase . .. .. 17 2.2.3 Attack Complexities . 17 2.3 Existing Cryptanalysis Techniques . 18 2.3.1 Linear Cryptanalysis . 19 2.3.2 Differential Cryptanalysis . 21 2.3.3 Truncated and Higher-Order Differentials . 23 2.3.4 Impossible Differentials . 23 2.3.5 BoomerangandRectangleAttacks . 23 2.3.6 IntegralAttack ........................ 25 IntegralProperties . 25 TracingtheWordsusingProperties . 26 DistinguishingPhase . .. .. 27 KeyRecoveryPhase . .. .. 28 ApplicationtotheAES ................... 29 2.3.7 SlideAttack.......................... 31 2.3.8 Related-KeyAttacks . 31 2.3.9 Algebraic Cryptanalysis . 32 2.4 AnalyzedBlockCiphers ....................... 33 2.4.1 AES .............................. 33 EncryptionAlgorithm . 33 KeySchedulingAlgorithm . 35 PreviousCryptanalysis . 36 2.4.2 ARIA ............................. 37 PreviousCryptanalysis . 41 2.4.3 Noekeon............................ 41 PreviousCryptanalysis . 43 2.4.4 Serpent ............................ 44 PreviousCryptanalysis . 47 2.4.5 PRESENT........................... 47 PreviousCryptanalysis . 49 2.4.6 SMS4 ............................. 49 EncryptionAlgorithm . 50 KeySchedulingAlgorithm . 51 PreviousCryptanalysis . 52 vi 2.4.7 LEX-AES ........................... 52 Initialization . 54 KeystreamGeneration . 54 PreviousCryptanalysis . 55 2.5 SummaryandConclusion . .. 55 3 Integral Attack on Bit-Based Block Ciphers 57 3.1 Bit-Pattern-BasedIntegralAttack . 59 3.1.1 TheBit-Pattern-BasedNotations . 59 3.1.2 TracingtheBitPatterns . 61 LinearTransformation . 61 NonlinearTransformation . 62 3.1.3 TheGenericAttack...................... 63 DistinguishingPhase . .. 64 KeyRecoveryPhase . .. 64 AttackExtensions ...................... 65 3.2 Applications.............................. 66 3.2.1 Noekeon............................ 66 3.5-roundDistinguisher. 66 4-roundKeyRecoveryAttack . 68 5-roundKeyRecoveryAttack . 69 3.2.2 Serpent ............................ 69 3.5-roundDistinguisher. 69 4-roundKeyRecoveryAttack . 71 5-roundKeyRecoveryAttack . 72 6-roundKeyRecoveryAttack . 73 3.2.3 PRESENT........................... 73 3.5-roundDistinguisher. 74 4-roundKeyRecoveryAttack . 75 5-roundKeyRecoveryAttack . 76 6-roundKeyRecoveryAttack . 76 7-roundKeyRecoveryAttack . 76 3.3 ExperimentalResults. .. .. 77 3.3.1 FormatofExperiments. 77 3.3.2 Discussion of Results . 80 3.4 Discussion............................... 80 vii 3.5 RelatedWork ............................. 81 3.6 SummaryandConclusion . .. .. 82 4 Algebraic Analysis of LEX-AES 85 4.1 Preliminaries . 86 4.2 FormingEquationstoDescribeLEX-AES . 87 4.2.1 KeystreamGenerationEquations . 87 4.2.2 KeyScheduleEquations . 93 4.2.3 Additional Substitutions . 95 4.2.4 TheFinalSystemofEquations . 96 4.2.5 Solving the Equations . 96 4.2.6 Alternative Methods for Obtaining Equations . 98 4.3 Forming Equations in Small Scale Variants of LEX-BES . 99 4.3.1 BES .............................. 99 EncryptionAlgorithm . 101 KeySchedulingAlgorithm . 102 4.3.2 LEX-BES ...........................103 Initialization . 103 KeystreamGeneration . 103 EquationSystemforLEX-BES . 104 4.3.3 SmallScaleLEX-BES . 105 Equation System for Small Scale LEX-BES . 105 4.3.4 ExperimentalResults. 106 4.4 Discussion...............................108 4.5 SummaryandConclusion . 109 5 Diffusion in the Linear Transformations of SPN Block Ciphers 111 5.1 Preliminaries . 112 5.1.1 Fixed Points in Random Permutations . 113 5.1.2 Fixed Points in Linear Transformations . 113 RankofRandomMatrices . 114 Rank of Matrices of the Type A − I .............116 5.1.3 Linear Diffusion Transformations using Nonsingular Matrices117 5.2 MeasureofDiffusionBasedonFixedPoints . 117 5.3 Applications..............................119 5.3.1 AES ..............................120 viii 5.3.2 ARIA .............................121 5.3.3 PRESENT...........................122 5.3.4 Serpent ............................122 5.3.5 Analysis ............................122 5.4 Fixed Points and Existing Design Criteria . 124 5.4.1 AES ..............................125 5.4.2 ARIA .............................127 5.4.3 PRESENT...........................127 5.4.4 Serpent ............................128 5.4.5 Branch Number, Fixed Points and Performance . 129 5.5 CryptographicSignificance . 130 5.6 RelatedWork .............................131