Christophe DE CANNI KATHOLIEKE UNIVERSITEIT LEUVEN FACULTEIT TOEGEPASTE WETENSCHAPPEN DEPARTEMENT ELEKTROTECHNIEK Kasteelpark Arenberg 10, B–3001 Heverlee A ERE ` ANALYSIS AND DESIGN OF SYMMETRIC ENCRYPTION ALGORITHMS ANALYSIS AND DESIGN OF SYMMETRIC ENCRYPTION ALGORITHMS Promotor: Proefschrift voorgedragen tot Prof. dr. ir. Bart Preneel het behalen van het doctoraat in de toegepaste wetenschappen door Christophe DE CANNIERE` Mei 2007 Mei 2007 KATHOLIEKE UNIVERSITEIT LEUVEN FACULTEIT TOEGEPASTE WETENSCHAPPEN DEPARTEMENT ELEKTROTECHNIEK Kasteelpark Arenberg 10, B–3001 Heverlee A ANALYSIS AND DESIGN OF SYMMETRIC ENCRYPTION ALGORITHMS Jury: Proefschrift voorgedragen tot Prof. Y. Willems, voorzitter het behalen van het doctoraat Prof. B. Preneel, promotor in de toegepaste wetenschappen Prof. T. Johansson (Lunds Tekniska H¨ogskola) door Prof. V. Rijmen (Technische Universit¨at Graz) Prof. M. Van Barel Christophe DE CANNIERE` Prof. J. Vandewalle Prof. P. Wambacq U.D.C. 681.3*D46 Mei 2007 i Acknowledgments The years leading to this doctoral dissertation have been for me an exciting period of discovery and growth, made possible by the help and support of numerous people who accompanied me on my journey. I wish to gratefully acknowledge their essential contribution to the results presented here. First of all, I would like to thank my supervisor, Prof. Bart Preneel. Not only did he direct my research all along, he also introduced me to a large cross section of the worldwide cryptographic community, of which he is such a distinguished member. The participation in the ECRYPT projects which he leads has given me the opportunity to meet and work with a lot of em- inent cryptographers; it has also been the direct motivation for part of my work. My very first steps in cryptanalysis, though, were undertaken in the group of Prof. Thomas Johansson of Lunds Tekniska H¨ogskola, where I spent a few months as an undergraduate Erasmus student. I am very grateful for the warm welcome and the precious counseling I received during this mem- orable stay in Sweden. Prof. Joos Vandewalle, head of the ESAT-SCD group, has been a very appreciated mentor for me, giving advice when important choices had to be made, and providing encouragement when needed. Prof. Marc Van Barel is the fourth member of the reading committee. I would like to thank the four of them for their patience while waiting for the “just in time” delivery of the draft of this thesis, and for their useful suggestions to improve the final version. I also would like to express my gratitude to the other members of the jury: Prof. Yves Willems, chairman; Prof. Patrick Wambacq; and Prof. Vincent Rij- men. Prof. Rijmen was my host during my stay at the Technische Universit¨at Graz in 2005–2006. This year yielded a particularly rich experience, both at a professional and a personal level, in great part thanks to Vincent and the other members of the Krypto team: Florian Mendel, Jorge Munilla, Norbert Pramstaller, and Christian Rechberger. I was very lucky that the start of my PhD work coincided with the ar- rival in Leuven of Alex Biryukov. I am grateful to have had this experienced © Katholieke Universiteit Leuven – Faculteit Toegepaste Wetenschappen researcher as my office mate and sparring partner for four years, and our end- Arenbergkasteel, B-3001 Heverlee (Belgium) less discussions have led to quite a few of the ideas discussed in this thesis. There are many more fine crypto professionals with whom I have had Alle rechten voorbehouden. Niets uit deze uitgave mag vermenigvuldigd fruitful interactions during the past years. I cannot mention them all, but I en/of openbaar gemaakt worden door middel van druk, fotocopie, microfilm, do want to thank the people with whom I have co-authored papers: Steve elektronisch of op welke andere wijze ook zonder voorafgaande schriftelijke Babbage, Alex Biryukov, An Braeken, Gustaf Dellkrantz, Joe Lano, Florian toestemming van de uitgever. Mendel, Sıddıka Berna Ors,¨ Bart Preneel, Micha¨el Quisquater, Christian Rech- All rights reserved. No part of the publication may be reproduced in any berger, Joos Vandewalle, Dai Watanabe, and Hirotaka Yoshida. form by print, photoprint, microfilm or any other means without written per- I spent most of my time during this period in the COSIC group of the mission from the publisher. K.U.Leuven. It provided a high quality, challenging yet pleasant environment for research in cryptography. This was the merit of the individual COSIC D/2007/7515/75 members, all colleagues that I highly appreciate. One person deserves a spe- ISBN 978-90-5682-841-7 cial mention for the unique role she played, and still plays, at COSIC: P´ela ii iii No¨e, our valued secretary. She would address all practical questions except Abstract financial ones: these were competently handled by Elvira Wouters. I would also like to acknowledge the Fund for Scientific Research – Flan- Symmetric encryption is the oldest branch in the field of cryptology, and is ders in Belgium (FWO), and the Austrian Science Fund (FWF), whose financial still one of the most important ones today. This thesis covers several aspects support has made this research possible. of the analysis and design of modern symmetric encryption algorithms. Finally, I would like to thank my parents and sisters for their support and The thesis starts with an overview of the different types of encryption al- encouragement throughout all these years. I am especially grateful to my fa- gorithms, pointing out their security requirements and their fundamental dif- ther, for his increasingly frequent reminders of the fact that it was about time ferences in approach. We then focus on block ciphers and explain the basic to finish this PhD, and for his invaluable help in proofreading large parts of strategies and techniques used in modern cryptanalysis. In order to illus- this thesis. trate this, we present some concrete attacks, which are based on a number of new ideas, but still serve as nice examples of the basic approach. One of the Christophe De Canni`ere most generic and powerful analysis techniques is linear cryptanalysis, which May 2007 is why we devote a separate chapter to it. We derive a new theoretical frame- work which allows to rigorously and accurately analyze the performance of this attack, and at the same time extend the attack to simultaneously exploit multiple linear approximations. In the second part of this thesis, we concentrate on design aspects of sym- metric encryption algorithms. We first present tools to analyze and classify substitutions boxes, components which play an important role in the design of block ciphers which resist the attacks discussed in the first part. We then present a new design strategy for stream ciphers based on techniques similar to those used to strengthen block ciphers against linear cryptanalysis. This eventually leads to the specification of a compact and elegant new stream ci- pher called TRIVIUM. iv v Beknopte Samenvatting Symmetrische encryptie is de oudste discipline in het domein van de cryp- tologie, en ze is tot op vandaag nog steeds een van de belangrijkste. Deze thesis behandelt verschillende aspecten die een rol spelen in de analyse en het ontwerp van moderne symmetrische encryptie-algoritmen. De thesis start met een overzicht van de verschillende soorten encryptie- algoritmen. We bestuderen wat hun veiligheidsvereisten zijn, en op welke verschillende manieren ze die trachten te bereiken. Vervolgens spitsen we ons toe op blokcijfers en lichten we de basistechnieken en strategie¨en toe die gebruikt worden in de moderne cryptanalyse. Om dit te illustreren, stellen we twee concrete aanvallen voor die steunen op een aantal nieuwe idee¨en, en tegelijkertijd een goed beeld geven van de gangbare algemene aanpak. Een van de meest algemeen toepasbare en krachtige analysetechnieken is lineaire cryptanalyse, en om die reden besteden we er een afzonderlijk hoofdstuk aan. We ontwikkelen een nieuw theoretisch kader dat toelaat om de effici¨entie van deze aanvallen nauwkeurig te berekenen, en breiden de aanvallen tegelijk ook uit om simultaan gebruik te maken van meerder lineaire benaderingen. In het tweede gedeelte van deze thesis, richten we ons op ontwerpaspecten van symmetrische encryptie-algoritmen. Eerst ontwikkelen we algoritmen om substitutie-boxen (S-boxen) te analyseren en te classificeren. S-boxen spe- len een belangrijke rol in het ontwerp van blokcijfers die bestand zijn tegen de aanvallen besproken in het eerste gedeelte van deze thesis. Vervolgens stellen we een nieuwe ontwerpmethode voor om stroomcijfers te ontwikkelen. De methode is gebaseerd op technieken die gelijkenissen vertonen met degene die gebruikt worden om blokcijfers te wapenen tegen lineaire cryptanalyse. Dit leidt uiteindelijk tot de ontwikkeling van een compact en elegant nieuw stroomcijfer, TRIVIUM. vi Contents 1 Introduction 1 1.1 Cryptology............................... 1 1.2 SymmetricEncryption . .... .... .... .... ... .... 2 1.3 Aboutthisthesis ........................... 3 2 Symmetric Encryption 5 2.1 EncryptionAlgorithms. 5 2.1.1 Symmetric vs. Asymmetric Encryption . 5 2.1.2 Kerckhoffs’Principle . 6 2.1.3 StreamandBlockEncryption . 7 2.1.4 AnatomyofaBlockCipher . 8 2.1.5 ModesofOperation . 10 2.1.6 DedicatedStreamCiphers . 15 2.2 SecurityConsiderations . 19 2.2.1 AttackScenarios .... .... .... .... ... .... 19 2.2.2 MeasuringSecurity. 20 2.2.3 HowSecureShouldaSchemeBe? . 22 2.2.4 GenericAttacksandIdealCiphers . 23 2.3 Conclusions .............................. 26 3 Block Cipher Cryptanalysis