DOCSLIB.ORG

Phd Thesis, Katholieke Universiteit Leuven, FSE 2003, Volume 2887 of Lecture Notes in Computer Science, Pages 274– Mar

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Phd Thesis, Katholieke Universiteit Leuven, FSE 2003, Volume 2887 of Lecture Notes in Computer Science, Pages 274– Mar Christophe DE CANNI KATHOLIEKE UNIVERSITEIT LEUVEN FACULTEIT TOEGEPASTE WETENSCHAPPEN DEPARTEMENT ELEKTROTECHNIEK Kasteelpark Arenberg 10, B–3001 Heverlee A ERE ` ANALYSIS AND DESIGN OF SYMMETRIC ENCRYPTION ALGORITHMS ANALYSIS AND DESIGN OF SYMMETRIC ENCRYPTION ALGORITHMS Promotor: Proefschrift voorgedragen tot Prof. dr. ir. Bart Preneel het behalen van het doctoraat in de toegepaste wetenschappen door Christophe DE CANNIERE` Mei 2007 Mei 2007 KATHOLIEKE UNIVERSITEIT LEUVEN FACULTEIT TOEGEPASTE WETENSCHAPPEN DEPARTEMENT ELEKTROTECHNIEK Kasteelpark Arenberg 10, B–3001 Heverlee A ANALYSIS AND DESIGN OF SYMMETRIC ENCRYPTION ALGORITHMS Jury: Proefschrift voorgedragen tot Prof. Y. Willems, voorzitter het behalen van het doctoraat Prof. B. Preneel, promotor in de toegepaste wetenschappen Prof. T. Johansson (Lunds Tekniska H¨ogskola) door Prof. V. Rijmen (Technische Universit¨at Graz) Prof. M. Van Barel Christophe DE CANNIERE` Prof. J. Vandewalle Prof. P. Wambacq U.D.C. 681.3*D46 Mei 2007 i Acknowledgments The years leading to this doctoral dissertation have been for me an exciting period of discovery and growth, made possible by the help and support of numerous people who accompanied me on my journey. I wish to gratefully acknowledge their essential contribution to the results presented here. First of all, I would like to thank my supervisor, Prof. Bart Preneel. Not only did he direct my research all along, he also introduced me to a large cross section of the worldwide cryptographic community, of which he is such a distinguished member. The participation in the ECRYPT projects which he leads has given me the opportunity to meet and work with a lot of em- inent cryptographers; it has also been the direct motivation for part of my work. My very first steps in cryptanalysis, though, were undertaken in the group of Prof. Thomas Johansson of Lunds Tekniska H¨ogskola, where I spent a few months as an undergraduate Erasmus student. I am very grateful for the warm welcome and the precious counseling I received during this mem- orable stay in Sweden. Prof. Joos Vandewalle, head of the ESAT-SCD group, has been a very appreciated mentor for me, giving advice when important choices had to be made, and providing encouragement when needed. Prof. Marc Van Barel is the fourth member of the reading committee. I would like to thank the four of them for their patience while waiting for the “just in time” delivery of the draft of this thesis, and for their useful suggestions to improve the final version. I also would like to express my gratitude to the other members of the jury: Prof. Yves Willems, chairman; Prof. Patrick Wambacq; and Prof. Vincent Rij- men. Prof. Rijmen was my host during my stay at the Technische Universit¨at Graz in 2005–2006. This year yielded a particularly rich experience, both at a professional and a personal level, in great part thanks to Vincent and the other members of the Krypto team: Florian Mendel, Jorge Munilla, Norbert Pramstaller, and Christian Rechberger. I was very lucky that the start of my PhD work coincided with the ar- rival in Leuven of Alex Biryukov. I am grateful to have had this experienced © Katholieke Universiteit Leuven – Faculteit Toegepaste Wetenschappen researcher as my office mate and sparring partner for four years, and our end- Arenbergkasteel, B-3001 Heverlee (Belgium) less discussions have led to quite a few of the ideas discussed in this thesis. There are many more fine crypto professionals with whom I have had Alle rechten voorbehouden. Niets uit deze uitgave mag vermenigvuldigd fruitful interactions during the past years. I cannot mention them all, but I en/of openbaar gemaakt worden door middel van druk, fotocopie, microfilm, do want to thank the people with whom I have co-authored papers: Steve elektronisch of op welke andere wijze ook zonder voorafgaande schriftelijke Babbage, Alex Biryukov, An Braeken, Gustaf Dellkrantz, Joe Lano, Florian toestemming van de uitgever. Mendel, Sıddıka Berna Ors,¨ Bart Preneel, Micha¨el Quisquater, Christian Rech- All rights reserved. No part of the publication may be reproduced in any berger, Joos Vandewalle, Dai Watanabe, and Hirotaka Yoshida. form by print, photoprint, microfilm or any other means without written per- I spent most of my time during this period in the COSIC group of the mission from the publisher. K.U.Leuven. It provided a high quality, challenging yet pleasant environment for research in cryptography. This was the merit of the individual COSIC D/2007/7515/75 members, all colleagues that I highly appreciate. One person deserves a spe- ISBN 978-90-5682-841-7 cial mention for the unique role she played, and still plays, at COSIC: P´ela ii iii No¨e, our valued secretary. She would address all practical questions except Abstract financial ones: these were competently handled by Elvira Wouters. I would also like to acknowledge the Fund for Scientific Research – Flan- Symmetric encryption is the oldest branch in the field of cryptology, and is ders in Belgium (FWO), and the Austrian Science Fund (FWF), whose financial still one of the most important ones today. This thesis covers several aspects support has made this research possible. of the analysis and design of modern symmetric encryption algorithms. Finally, I would like to thank my parents and sisters for their support and The thesis starts with an overview of the different types of encryption al- encouragement throughout all these years. I am especially grateful to my fa- gorithms, pointing out their security requirements and their fundamental dif- ther, for his increasingly frequent reminders of the fact that it was about time ferences in approach. We then focus on block ciphers and explain the basic to finish this PhD, and for his invaluable help in proofreading large parts of strategies and techniques used in modern cryptanalysis. In order to illus- this thesis. trate this, we present some concrete attacks, which are based on a number of new ideas, but still serve as nice examples of the basic approach. One of the Christophe De Canni`ere most generic and powerful analysis techniques is linear cryptanalysis, which May 2007 is why we devote a separate chapter to it. We derive a new theoretical frame- work which allows to rigorously and accurately analyze the performance of this attack, and at the same time extend the attack to simultaneously exploit multiple linear approximations. In the second part of this thesis, we concentrate on design aspects of sym- metric encryption algorithms. We first present tools to analyze and classify substitutions boxes, components which play an important role in the design of block ciphers which resist the attacks discussed in the first part. We then present a new design strategy for stream ciphers based on techniques similar to those used to strengthen block ciphers against linear cryptanalysis. This eventually leads to the specification of a compact and elegant new stream ci- pher called TRIVIUM. iv v Beknopte Samenvatting Symmetrische encryptie is de oudste discipline in het domein van de cryp- tologie, en ze is tot op vandaag nog steeds een van de belangrijkste. Deze thesis behandelt verschillende aspecten die een rol spelen in de analyse en het ontwerp van moderne symmetrische encryptie-algoritmen. De thesis start met een overzicht van de verschillende soorten encryptie- algoritmen. We bestuderen wat hun veiligheidsvereisten zijn, en op welke verschillende manieren ze die trachten te bereiken. Vervolgens spitsen we ons toe op blokcijfers en lichten we de basistechnieken en strategie¨en toe die gebruikt worden in de moderne cryptanalyse. Om dit te illustreren, stellen we twee concrete aanvallen voor die steunen op een aantal nieuwe idee¨en, en tegelijkertijd een goed beeld geven van de gangbare algemene aanpak. Een van de meest algemeen toepasbare en krachtige analysetechnieken is lineaire cryptanalyse, en om die reden besteden we er een afzonderlijk hoofdstuk aan. We ontwikkelen een nieuw theoretisch kader dat toelaat om de effici¨entie van deze aanvallen nauwkeurig te berekenen, en breiden de aanvallen tegelijk ook uit om simultaan gebruik te maken van meerder lineaire benaderingen. In het tweede gedeelte van deze thesis, richten we ons op ontwerpaspecten van symmetrische encryptie-algoritmen. Eerst ontwikkelen we algoritmen om substitutie-boxen (S-boxen) te analyseren en te classificeren. S-boxen spe- len een belangrijke rol in het ontwerp van blokcijfers die bestand zijn tegen de aanvallen besproken in het eerste gedeelte van deze thesis. Vervolgens stellen we een nieuwe ontwerpmethode voor om stroomcijfers te ontwikkelen. De methode is gebaseerd op technieken die gelijkenissen vertonen met degene die gebruikt worden om blokcijfers te wapenen tegen lineaire cryptanalyse. Dit leidt uiteindelijk tot de ontwikkeling van een compact en elegant nieuw stroomcijfer, TRIVIUM. vi Contents 1 Introduction 1 1.1 Cryptology............................... 1 1.2 SymmetricEncryption . .... .... .... .... ... .... 2 1.3 Aboutthisthesis ........................... 3 2 Symmetric Encryption 5 2.1 EncryptionAlgorithms. 5 2.1.1 Symmetric vs. Asymmetric Encryption . 5 2.1.2 Kerckhoffs’Principle . 6 2.1.3 StreamandBlockEncryption . 7 2.1.4 AnatomyofaBlockCipher . 8 2.1.5 ModesofOperation . 10 2.1.6 DedicatedStreamCiphers . 15 2.2 SecurityConsiderations . 19 2.2.1 AttackScenarios .... .... .... .... ... .... 19 2.2.2 MeasuringSecurity. 20 2.2.3 HowSecureShouldaSchemeBe? . 22 2.2.4 GenericAttacksandIdealCiphers . 23 2.3 Conclusions .............................. 26 3 Block Cipher Cryptanalysis
Load more

Recommended publications
  • Cryptanalysis of Feistel Networks with Secret Round Functions Alex Biryukov, Gaëtan Leurent, Léo Perrin
    Cryptanalysis of Feistel Networks with Secret Round Functions Alex Biryukov, Gaëtan Leurent, Léo Perrin To cite this version: Alex Biryukov, Gaëtan Leurent, Léo Perrin. Cryptanalysis of Feistel Networks with Secret Round Functions. Selected Areas in Cryptography - SAC 2015, Aug 2015, Sackville, Canada. hal-01243130 HAL Id: hal-01243130 https://hal.inria.fr/hal-01243130 Submitted on 14 Dec 2015 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Cryptanalysis of Feistel Networks with Secret Round Functions ? Alex Biryukov1, Gaëtan Leurent2, and Léo Perrin3 1 [email protected], University of Luxembourg 2 [email protected], Inria, France 3 [email protected], SnT,University of Luxembourg Abstract. Generic distinguishers against Feistel Network with up to 5 rounds exist in the regular setting and up to 6 rounds in a multi-key setting. We present new cryptanalyses against Feistel Networks with 5, 6 and 7 rounds which are not simply distinguishers but actually recover completely the unknown Feistel functions. When an exclusive-or is used to combine the output of the round function with the other branch, we use the so-called yoyo game which we improved using a heuristic based on particular cycle structures.
    [Show full text]
  • Integral Cryptanalysis on Full MISTY1⋆
    Integral Cryptanalysis on Full MISTY1? Yosuke Todo NTT Secure Platform Laboratories, Tokyo, Japan [email protected] Abstract. MISTY1 is a block cipher designed by Matsui in 1997. It was well evaluated and standardized by projects, such as CRYPTREC, ISO/IEC, and NESSIE. In this paper, we propose a key recovery attack on the full MISTY1, i.e., we show that 8-round MISTY1 with 5 FL layers does not have 128-bit security. Many attacks against MISTY1 have been proposed, but there is no attack against the full MISTY1. Therefore, our attack is the first cryptanalysis against the full MISTY1. We construct a new integral characteristic by using the propagation characteristic of the division property, which was proposed in 2015. We first improve the division property by optimizing a public S-box and then construct a 6-round integral characteristic on MISTY1. Finally, we recover the secret key of the full MISTY1 with 263:58 chosen plaintexts and 2121 time complexity. Moreover, if we can use 263:994 chosen plaintexts, the time complexity for our attack is reduced to 2107:9. Note that our cryptanalysis is a theoretical attack. Therefore, the practical use of MISTY1 will not be affected by our attack. Keywords: MISTY1, Integral attack, Division property 1 Introduction MISTY [Mat97] is a block cipher designed by Matsui in 1997 and is based on the theory of provable security [Nyb94,NK95] against differential attack [BS90] and linear attack [Mat93]. MISTY has a recursive structure, and the component function has a unique structure, the so-called MISTY structure [Mat96].
    [Show full text]
  • Related-Key Statistical Cryptanalysis
    Related-Key Statistical Cryptanalysis Darakhshan J. Mir∗ Poorvi L. Vora Department of Computer Science, Department of Computer Science, Rutgers, The State University of New Jersey George Washington University July 6, 2007 Abstract This paper presents the Cryptanalytic Channel Model (CCM). The model treats statistical key recovery as communication over a low capacity channel, where the channel and the encoding are determined by the cipher and the specific attack. A new attack, related-key recovery – the use of n related keys generated from k independent ones – is defined for all ciphers vulnera- ble to single-key recovery. Unlike classical related-key attacks such as differential related-key cryptanalysis, this attack does not exploit a special structural weakness in the cipher or key schedule, but amplifies the weakness exploited in the basic single key recovery. The related- key-recovery attack is shown to correspond to the use of a concatenated code over the channel, where the relationship among the keys determines the outer code, and the cipher and the attack the inner code. It is shown that there exists a relationship among keys for which the communi- cation complexity per bit of independent key is finite, for any probability of key recovery error. This may be compared to the unbounded communication complexity per bit of the single-key- recovery attack. The practical implications of this result are demonstrated through experiments on reduced-round DES. Keywords: related keys, concatenated codes, communication channel, statistical cryptanalysis, linear cryptanalysis, DES Communicating Author: Poorvi L. Vora, [email protected] ∗This work was done while the author was in the M.S.
    [Show full text]
  • Statistical Weaknesses in 20 RC4-Like Algorithms and (Probably) the Simplest Algorithm Free from These Weaknesses - VMPC-R
    Statistical weaknesses in 20 RC4-like algorithms and (probably) the simplest algorithm free from these weaknesses - VMPC-R Bartosz Zoltak www.vmpcfunction.com [email protected] Abstract. We find statistical weaknesses in 20 RC4-like algorithms including the original RC4, RC4A, PC-RC4 and others. This is achieved using a simple statistical test. We found only one algorithm which was able to pass the test - VMPC-R. This algorithm, being approximately three times more complex then RC4, is probably the simplest RC4-like cipher capable of producing pseudo-random output. Keywords: PRNG; CSPRNG; RC4; VMPC-R; stream cipher; distinguishing attack 1 Introduction RC4 is a popular and one of the simplest symmetric encryption algorithms. It is also probably one of the easiest to modify. There is a bunch of RC4 modifications out there. But is improving the old RC4 really as simple as it appears to be? To state the contrary we confront 20 candidates (including the original RC4) against a simple statistical test. In doing so we try to support four theses: 1. Modifying RC4 is easy to do but it is hard to do well. 2. Statistical weaknesses in almost all RC4-like algorithms can be easily found using a simple test discussed in this paper. 3. The only RC4-like algorithm which was able to pass the test was VMPC-R. It is approximately three times more complex than RC4. We believe that any algorithm simpler than VMPC-R would most likely fail the test. 4. Before introducing a new RC4-like algorithm it might be a good idea to run the statistical test described in this paper.
    [Show full text]
  • Optimization of Core Components of Block Ciphers Baptiste Lambin
    Optimization of core components of block ciphers Baptiste Lambin To cite this version: Baptiste Lambin. Optimization of core components of block ciphers. Cryptography and Security [cs.CR]. Université Rennes 1, 2019. English. NNT : 2019REN1S036. tel-02380098 HAL Id: tel-02380098 https://tel.archives-ouvertes.fr/tel-02380098 Submitted on 26 Nov 2019 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. THÈSE DE DOCTORAT DE L’UNIVERSITE DE RENNES 1 COMUE UNIVERSITE BRETAGNE LOIRE Ecole Doctorale N°601 Mathématique et Sciences et Technologies de l’Information et de la Communication Spécialité : Informatique Par Baptiste LAMBIN Optimization of Core Components of Block Ciphers Thèse présentée et soutenue à RENNES, le 22/10/2019 Unité de recherche : IRISA Rapporteurs avant soutenance : Marine Minier, Professeur, LORIA, Université de Lorraine Jacques Patarin, Professeur, PRiSM, Université de Versailles Composition du jury : Examinateurs : Marine Minier, Professeur, LORIA, Université de Lorraine Jacques Patarin, Professeur, PRiSM, Université de Versailles Jean-Louis Lanet, INRIA Rennes Virginie Lallemand, Chargée de Recherche, LORIA, CNRS Jérémy Jean, ANSSI Dir. de thèse : Pierre-Alain Fouque, IRISA, Université de Rennes 1 Co-dir. de thèse : Patrick Derbez, IRISA, Université de Rennes 1 Remerciements Je tiens à remercier en premier lieu mes directeurs de thèse, Pierre-Alain et Patrick.
    [Show full text]
  • Security Evaluation of the K2 Stream Cipher
    Security Evaluation of the K2 Stream Cipher Editors: Andrey Bogdanov, Bart Preneel, and Vincent Rijmen Contributors: Andrey Bodganov, Nicky Mouha, Gautham Sekar, Elmar Tischhauser, Deniz Toz, Kerem Varıcı, Vesselin Velichkov, and Meiqin Wang Katholieke Universiteit Leuven Department of Electrical Engineering ESAT/SCD-COSIC Interdisciplinary Institute for BroadBand Technology (IBBT) Kasteelpark Arenberg 10, bus 2446 B-3001 Leuven-Heverlee, Belgium Version 1.1 | 7 March 2011 i Security Evaluation of K2 7 March 2011 Contents 1 Executive Summary 1 2 Linear Attacks 3 2.1 Overview . 3 2.2 Linear Relations for FSR-A and FSR-B . 3 2.3 Linear Approximation of the NLF . 5 2.4 Complexity Estimation . 5 3 Algebraic Attacks 6 4 Correlation Attacks 10 4.1 Introduction . 10 4.2 Combination Generators and Linear Complexity . 10 4.3 Description of the Correlation Attack . 11 4.4 Application of the Correlation Attack to KCipher-2 . 13 4.5 Fast Correlation Attacks . 14 5 Differential Attacks 14 5.1 Properties of Components . 14 5.1.1 Substitution . 15 5.1.2 Linear Permutation . 15 5.2 Key Ideas of the Attacks . 18 5.3 Related-Key Attacks . 19 5.4 Related-IV Attacks . 20 5.5 Related Key/IV Attacks . 21 5.6 Conclusion and Remarks . 21 6 Guess-and-Determine Attacks 25 6.1 Word-Oriented Guess-and-Determine . 25 6.2 Byte-Oriented Guess-and-Determine . 27 7 Period Considerations 28 8 Statistical Properties 29 9 Distinguishing Attacks 31 9.1 Preliminaries . 31 9.2 Mod n Cryptanalysis of Weakened KCipher-2 . 32 9.2.1 Other Reduced Versions of KCipher-2 .
    [Show full text]
  • New Cryptanalysis of Block Ciphers with Low Algebraic Degree
    New Cryptanalysis of Block Ciphers with Low Algebraic Degree Bing Sun1,LongjiangQu1,andChaoLi1,2 1 Department of Mathematics and System Science, Science College of National University of Defense Technology, Changsha, China, 410073 2 State Key Laboratory of Information Security, Graduate University of Chinese Academy of Sciences, China, 10039 happy [email protected], ljqu [email protected] Abstract. Improved interpolation attack and new integral attack are proposed in this paper, and they can be applied to block ciphers using round functions with low algebraic degree. In the new attacks, we can determine not only the degree of the polynomial, but also coefficients of some special terms. Thus instead of guessing the round keys one by one, we can get the round keys by solving some algebraic equations over finite field. The new methods are applied to PURE block cipher successfully. The improved interpolation attacks can recover the first round key of 8-round PURE in less than a second; r-round PURE with r ≤ 21 is breakable with about 3r−2 chosen plaintexts and the time complexity is 3r−2 encryptions; 22-round PURE is breakable with both data and time complexities being about 3 × 320. The new integral attacks can break PURE with rounds up to 21 with 232 encryptions and 22-round with 3 × 232 encryptions. This means that PURE with up to 22 rounds is breakable on a personal computer. Keywords: block cipher, Feistel cipher, interpolation attack, integral attack. 1 Introduction For some ciphers, the round function can be described either by a low degree polynomial or by a quotient of two low degree polynomials over finite field with characteristic 2.
    [Show full text]
  • Distinguishing Attacks on the Stream Cipher Py
    Distinguishing Attacks on the Stream Cipher Py Souradyuti Paul‡, Bart Preneel‡, and Gautham Sekar‡† ‡Katholieke Universiteit Leuven, Dept. ESAT/COSIC, Kasteelpark Arenberg 10, B–3001, Leuven-Heverlee, Belgium †Birla Institute of Technology and Science, Pilani, India, Dept. of Electronics and Instrumentation, Dept. of Physics. {souradyuti.paul, bart.preneel}@esat.kuleuven.be, [email protected] Abstract. The stream cipher Py designed by Biham and Seberry is a submission to the ECRYPT stream cipher competition. The cipher is based on two large arrays (one is 256 bytes and the other is 1040 bytes) and it is designed for high speed software applications (Py is more than 2.5 times faster than the RC4 on Pentium III). The paper shows a statistical bias in the distribution of its output-words at the 1st and 3rd rounds. Exploiting this weakness, a distinguisher with advantage greater than 50% is constructed that requires 284.7 randomly chosen key/IV’s and the first 24 output bytes for each key. The running time and the 84.7 89.2 data required by the distinguisher are tini · 2 and 2 respectively (tini denotes the running time of the key/IV setup). We further show that the data requirement can be reduced by a factor of about 3 with a distinguisher that considers outputs of later rounds. In such case the 84.7 running time is reduced to tr ·2 (tr denotes the time for a single round of Py). The Py specification allows a 256-bit key and a keystream of 264 bytes per key/IV. As an ideally secure stream cipher with the above specifications should be able to resist the attacks described before, our results constitute an academic break of Py.
    [Show full text]
  • Deep Learning-Based Cryptanalysis of Lightweight Block Ciphers
    Hindawi Security and Communication Networks Volume 2020, Article ID 3701067, 11 pages https://doi.org/10.1155/2020/3701067 Research Article Deep Learning-Based Cryptanalysis of Lightweight Block Ciphers Jaewoo So Department of Electronic Engineering, Sogang University, Seoul 04107, Republic of Korea Correspondence should be addressed to Jaewoo So; [email protected] Received 5 February 2020; Revised 21 June 2020; Accepted 26 June 2020; Published 13 July 2020 Academic Editor: Umar M. Khokhar Copyright © 2020 Jaewoo So. +is is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited. Most of the traditional cryptanalytic technologies often require a great amount of time, known plaintexts, and memory. +is paper proposes a generic cryptanalysis model based on deep learning (DL), where the model tries to find the key of block ciphers from known plaintext-ciphertext pairs. We show the feasibility of the DL-based cryptanalysis by attacking on lightweight block ciphers such as simplified DES, Simon, and Speck. +e results show that the DL-based cryptanalysis can successfully recover the key bits when the keyspace is restricted to 64 ASCII characters. +e traditional cryptanalysis is generally performed without the keyspace restriction, but only reduced-round variants of Simon and Speck are successfully attacked. Although a text-based key is applied, the proposed DL-based cryptanalysis can successfully break the full rounds of Simon32/64 and Speck32/64. +e results indicate that the DL technology can be a useful tool for the cryptanalysis of block ciphers when the keyspace is restricted.
    [Show full text]
  • New Developments in Cryptology Outline Outline Block Ciphers AES
    New Developments in Cryptography March 2012 Bart Preneel Outline New developments in cryptology • 1. Cryptology: concepts and algorithms Prof. Bart Preneel • 2. Cryptology: protocols COSIC • 3. Public-Key Infrastructure principles Bart.Preneel(at)esatDOTkuleuven.be • 4. Networking protocols http://homes.esat.kuleuven.be/~preneel • 5. New developments in cryptology March 2012 • 6. Cryptography best practices © Bart Preneel. All rights reserved 1 2 Outline Block ciphers P1 P2 P3 • Block ciphers/stream ciphers • Hash functions/MAC algorithms block block block • Modes of operation and authenticated cipher cipher cipher encryption • How to encrypt/sign using RSA C1 C2 C3 • Multi-party computation • larger data units: 64…128 bits •memoryless • Concluding remarks • repeat simple operation (round) many times 3 3-DES: NIST Spec. Pub. 800-67 AES (2001) (May 2004) S S S S S S S S S S S S S S S S • Single DES abandoned round • two-key triple DES: until 2009 (80 bit security) • three-key triple DES: until 2030 (100 bit security) round MixColumnsS S S S MixColumnsS S S S MixColumnsS S S S MixColumnsS S S S hedule Highly vulnerable to a c round • Block length: 128 bits related key attack • Key length: 128-192-256 . Key S Key . bits round A $ 10M machine that cracks a DES Clear DES DES-1 DES %^C& key in 1 second would take 149 trillion text @&^( years to crack a 128-bit key 1 23 1 New Developments in Cryptography March 2012 Bart Preneel AES variants (2001) AES implementations: • AES-128 • AES-192 • AES-256 efficient/compact • 10 rounds • 12 rounds • 14 rounds • sensitive • classified • secret and top • NIST validation list: 1953 implementations (2008: 879) secret plaintext plaintext plaintext http://csrc.nist.gov/groups/STM/cavp/documents/aes/aesval.html round round.
    [Show full text]
  • Integral Cryptanalysis of the BSPN Block Cipher
    Integral Cryptanalysis of the BSPN Block Cipher Howard Heys Department of Electrical and Computer Engineering Memorial University [email protected] Abstract— In this paper, we investigate the application of inte- and decryption, thereby facilitating efficient implementations gral cryptanalysis to the Byte-oriented Substitution Permutation based on the re-use of components or memory when both Network (BSPN) block cipher. The BSPN block cipher has been encryption and decryption operations are required. In order shown to be an efficient block cipher structure, particularly for environments using 8-bit microcontrollers. In our analysis, to achieve involution, the use of involutory S-boxes and a we are able to show that integral cryptanalysis has limited linear transformation that is an involution are required. For success when applied to BSPN. A first order attack, based on BSPN, as defined in [1], no particular S-box is specified. a deterministic integral, is only applicable to structures with 3 However, the S-box is assumed to be 8 × 8 (where one input or fewer rounds, while higher order attacks and attacks using byte is replaced with an output byte) and must satisfy specific a probabilistic integral were found to be only applicable to structures with 4 or less rounds. Since a typical BSPN block properties, such as involution, small linear bias, and small cipher is recommended to have 8 or more rounds, it is expected maximum differential. that the BSPN structure is resistant to integral cryptanalysis. The BSPN is most notably characterized by its linear transformation, for which a specific function is defined. Let Index Terms— cryptography, block ciphers, cryptanalysis the block size of the cipher be N bytes or 8N bits with Ui = [U ;U ; :::; U ] and V = [V ;V ; :::; V ] representing the I.
    [Show full text]
  • Automated Techniques for Hash Function and Block Cipher Cryptanalysis
    Arenberg Doctoral School of Science, Engineering & Technology Faculty of Engineering Department of Electrical Engineering (ESAT) Automated Techniques for Hash Function and Block Cipher Cryptanalysis Nicky MOUHA Dissertation presented in partial fulfillment of the requirements for the degree of Doctor of Engineering June 2012 Automated Techniques for Hash Function and Block Cipher Cryptanalysis Nicky MOUHA Jury: Dissertation presented in partial Prof. em. dr. ir. Yves D. Willems, chair fulfillment of the requirements for Prof. dr. ir. Bart Preneel, supervisor the degree of Doctor of Engineering Prof. dr. ir. Vincent Rijmen, secretary Prof. dr. ir. Frank Piessens Dr. Svetla Petkova-Nikova Dr. Matt Robshaw (Applied Cryptography Group, Orange Labs, France) June 2012 Our greatest glory is not in never falling, but in rising every time we fall. Confucius c 2012 Nicky Mouha � D/2012/7515/71 ISBN 978-94-6018-535-9 If I have seen further it is only by standing on the shoulders of giants. Isaac Newton Acknowledgments Every research paper is a puzzle piece, linking other pieces together to reveal a bigger picture. As such, research can’t be done in isolation. In the past few years, I’ve been extremely fortunate to meet the world’s best and brightest in thefield of symmetric-key cryptography. Many times, I’ve found myself to be the stupidest and most ignorant person in the room. To me, such experiences have been exciting and humbling, but most of all a great opportunity to learn. Therefore, I would like to personally thank everyone who contributed in one way or another to this thesis.
    [Show full text]