DOCSLIB.ORG

Impossible Differential Cryptanalysis of TEA, XTEA and HIGHT

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Impossible Differential Cryptanalysis of TEA, XTEA and HIGHT Preliminaries Impossible Differential Attacks on TEA and XTEA Impossible Differential Cryptanalysis of HIGHT Conclusion Impossible Differential Cryptanalysis of TEA, XTEA and HIGHT Jiazhe Chen1;2 Meiqin Wang1;2 Bart Preneel2 1Shangdong University, China 2KU Leuven, ESAT/COSIC and IBBT, Belgium AfricaCrypt 2012 July 10, 2012 1 / 27 Preliminaries Impossible Differential Attacks on TEA and XTEA Impossible Differential Cryptanalysis of HIGHT Conclusion Preliminaries Impossible Differential Attack TEA, XTEA and HIGHT Impossible Differential Attacks on TEA and XTEA Deriving Impossible Differentials for TEA and XTEA Key Recovery Attacks on TEA and XTEA Impossible Differential Cryptanalysis of HIGHT Impossible Differential Attacks on HIGHT Conclusion 2 / 27 I Pr(∆A ! ∆B) = 1, Pr(∆G ! ∆F) = 1, ∆B 6= ∆F, Pr(∆A ! ∆G) = 0 I Extend the impossible differential forward and backward to attack a block cipher I Guess subkeys in Part I and Part II, if there is a pair meets ∆A and ∆G, then the subkey guess must be wrong P I A B F G II C Preliminaries Impossible Differential Attacks on TEA and XTEA Impossible Differential Cryptanalysis of HIGHT Conclusion Impossible Differential Attack Impossible Differential Attack 3 / 27 I Pr(∆A ! ∆B) = 1, Pr(∆G ! ∆F) = 1, ∆B 6= ∆F, Pr(∆A ! ∆G) = 0 I Extend the impossible differential forward and backward to attack a block cipher I Guess subkeys in Part I and Part II, if there is a pair meets ∆A and ∆G, then the subkey guess must be wrong P I A B F G II C Preliminaries Impossible Differential Attacks on TEA and XTEA Impossible Differential Cryptanalysis of HIGHT Conclusion Impossible Differential Attack Impossible Differential Attack 3 / 27 P I Pr(∆A ! ∆B) = 1, Pr(∆G ! ∆F) = 1, I ∆B 6= ∆F, A Pr(∆A ! ∆G) = 0 I Extend the impossible differential B forward and backward to attack a block cipher F I Guess subkeys in Part I and Part II, if there is a pair meets ∆A and ∆G, then G the subkey guess must be wrong II C Preliminaries Impossible Differential Attacks on TEA and XTEA Impossible Differential Cryptanalysis of HIGHT Conclusion Impossible Differential Attack Impossible Differential Attack 3 / 27 P I A I Extend the impossible differential B forward and backward to attack a block cipher F I Guess subkeys in Part I and Part II, if there is a pair meets ∆A and ∆G, then G the subkey guess must be wrong II C Preliminaries Impossible Differential Attacks on TEA and XTEA Impossible Differential Cryptanalysis of HIGHT Conclusion Impossible Differential Attack Impossible Differential Attack I Pr(∆A ! ∆B) = 1, Pr(∆G ! ∆F) = 1, ∆B 6= ∆F, Pr(∆A ! ∆G) = 0 3 / 27 P I A B F I Guess subkeys in Part I and Part II, if there is a pair meets ∆A and ∆G, then G the subkey guess must be wrong II C Preliminaries Impossible Differential Attacks on TEA and XTEA Impossible Differential Cryptanalysis of HIGHT Conclusion Impossible Differential Attack Impossible Differential Attack I Pr(∆A ! ∆B) = 1, Pr(∆G ! ∆F) = 1, ∆B 6= ∆F, Pr(∆A ! ∆G) = 0 I Extend the impossible differential forward and backward to attack a block cipher 3 / 27 P I A B F G II C Preliminaries Impossible Differential Attacks on TEA and XTEA Impossible Differential Cryptanalysis of HIGHT Conclusion Impossible Differential Attack Impossible Differential Attack I Pr(∆A ! ∆B) = 1, Pr(∆G ! ∆F) = 1, ∆B 6= ∆F, Pr(∆A ! ∆G) = 0 I Extend the impossible differential forward and backward to attack a block cipher I Guess subkeys in Part I and Part II, if there is a pair meets ∆A and ∆G, then the subkey guess must be wrong 3 / 27 I TEA was used in Microsoft’s Xbox gaming console I Both TEA and XTEA are implemented in the Linux kernel Preliminaries Impossible Differential Attacks on TEA and XTEA Impossible Differential Cryptanalysis of HIGHT Conclusion TEA, XTEA and HIGHT TEA and XTEA Li Ri+1 F Li Ri K[0] F <<4 <<4 i·δ K[(i·δ>>11)&3] δ Ͱ Ͱ Ͱ >>5 K[1] >>5 Li+1 Ri+1 TEA Li+1 Ri+1 XTEA I 64 rounds; block size: 64 bits; key size: 128 bits 4 / 27 I Both TEA and XTEA are implemented in the Linux kernel Preliminaries Impossible Differential Attacks on TEA and XTEA Impossible Differential Cryptanalysis of HIGHT Conclusion TEA, XTEA and HIGHT TEA and XTEA Li Ri+1 F Li Ri K[0] F <<4 <<4 i·δ K[(i·δ>>11)&3] δ Ͱ Ͱ Ͱ >>5 K[1] >>5 Li+1 Ri+1 TEA Li+1 Ri+1 XTEA I 64 rounds; block size: 64 bits; key size: 128 bits I TEA was used in Microsoft’s Xbox gaming console 4 / 27 Preliminaries Impossible Differential Attacks on TEA and XTEA Impossible Differential Cryptanalysis of HIGHT Conclusion TEA, XTEA and HIGHT TEA and XTEA Li Ri+1 F Li Ri K[0] F <<4 <<4 i·δ K[(i·δ>>11)&3] δ Ͱ Ͱ Ͱ >>5 K[1] >>5 Li+1 Ri+1 TEA Li+1 Ri+1 XTEA I 64 rounds; block size: 64 bits; key size: 128 bits I TEA was used in Microsoft’s Xbox gaming console I Both TEA and XTEA are implemented in the Linux kernel 4 / 27 I HIGHT is adopted as an International Standard by ISO/IEC 18033-3 I A common property of TEA, XTEA and HIGHT: the subkeys intervene after the confusion and diffusion Preliminaries Impossible Differential Attacks on TEA and XTEA Impossible Differential Cryptanalysis of HIGHT Conclusion TEA, XTEA and HIGHT HIGHT i i i i i Xi Xi Xi X 7 X 6 X 5 X 4 X 3 2 1 0 SK4( i+1)- 1 SK4(i+1 )-2 SK4(i+1)-3 SK4(i+1)-4 F0 F1 F0 F1 i+1 i+1 i+1 i+1 i+1 i+1 i+1 i+1 X7 X6 X5 X4 X3 X2 X1 X0 F0(x) = (x n 1) ⊕ (x n 2) ⊕ (x n 7), F1(x) = (x n 3) ⊕ (x n 4) ⊕ (x n 6) I 32 rounds; block size: 64 bits; key size: 128 bits 5 / 27 I A common property of TEA, XTEA and HIGHT: the subkeys intervene after the confusion and diffusion Preliminaries Impossible Differential Attacks on TEA and XTEA Impossible Differential Cryptanalysis of HIGHT Conclusion TEA, XTEA and HIGHT HIGHT i i i i i Xi Xi Xi X 7 X 6 X 5 X 4 X 3 2 1 0 SK4( i+1)- 1 SK4(i+1 )-2 SK4(i+1)-3 SK4(i+1)-4 F0 F1 F0 F1 i+1 i+1 i+1 i+1 i+1 i+1 i+1 i+1 X7 X6 X5 X4 X3 X2 X1 X0 F0(x) = (x n 1) ⊕ (x n 2) ⊕ (x n 7), F1(x) = (x n 3) ⊕ (x n 4) ⊕ (x n 6) I 32 rounds; block size: 64 bits; key size: 128 bits I HIGHT is adopted as an International Standard by ISO/IEC 18033-3 5 / 27 Preliminaries Impossible Differential Attacks on TEA and XTEA Impossible Differential Cryptanalysis of HIGHT Conclusion TEA, XTEA and HIGHT HIGHT i i i i i Xi Xi Xi X 7 X 6 X 5 X 4 X 3 2 1 0 SK4( i+1)- 1 SK4(i+1 )-2 SK4(i+1)-3 SK4(i+1)-4 F0 F1 F0 F1 i+1 i+1 i+1 i+1 i+1 i+1 i+1 i+1 X7 X6 X5 X4 X3 X2 X1 X0 F0(x) = (x n 1) ⊕ (x n 2) ⊕ (x n 7), F1(x) = (x n 3) ⊕ (x n 4) ⊕ (x n 6) I 32 rounds; block size: 64 bits; key size: 128 bits I HIGHT is adopted as an International Standard by ISO/IEC 18033-3 I A common property of TEA, XTEA and HIGHT: the subkeys intervene after the confusion and diffusion 5 / 27 I D[i]: a 32-bit difference where the i-th bit is 1, the first to the (i − 1)-th bits are 0, and the (i + 1)-th to 32-th bits are indeterminate. For i < 0, D[i] means that all the 32 bits of the difference are indeterminate. Preliminaries Impossible Differential Attacks on TEA and XTEA Impossible Differential Cryptanalysis of HIGHT Conclusion Deriving Impossible Differentials for TEA and XTEA Some Notations I e0: (???????0)2, e1: (???????1)2, e4: (?????100)2 6 / 27 Preliminaries Impossible Differential Attacks on TEA and XTEA Impossible Differential Cryptanalysis of HIGHT Conclusion Deriving Impossible Differentials for TEA and XTEA Some Notations I e0: (???????0)2, e1: (???????1)2, e4: (?????100)2 I D[i]: a 32-bit difference where the i-th bit is 1, the first to the (i − 1)-th bits are 0, and the (i + 1)-th to 32-th bits are indeterminate. For i < 0, D[i] means that all the 32 bits of the difference are indeterminate. 6 / 27 Property If the input difference of the i-th round of XTEA (TEA) is (D[m]; D[n]), where (m > n − 5), then the output difference is (D[n]; D[n − 5]). Vice versa, if the output difference of the j-th round of XTEA (TEA) is (D[p]; D[q]), where (q > p − 5), then the input difference is (D[p − 5]; D[p]). Preliminaries Impossible Differential Attacks on TEA and XTEA Impossible Differential Cryptanalysis of HIGHT Conclusion Deriving Impossible Differentials for TEA and XTEA Impossible Differential for ARX (ASX) type cipher: looking for one-bit contradiction. Property If the input difference of the i-th round of XTEA (TEA) is (0; D[n]), then the output difference is (D[n]; D[n − 5]).
Load more

Recommended publications
  • Improved Cryptanalysis of the Reduced Grøstl Compression Function, ECHO Permutation and AES Block Cipher
    Improved Cryptanalysis of the Reduced Grøstl Compression Function, ECHO Permutation and AES Block Cipher Florian Mendel1, Thomas Peyrin2, Christian Rechberger1, and Martin Schl¨affer1 1 IAIK, Graz University of Technology, Austria 2 Ingenico, France [email protected],[email protected] Abstract. In this paper, we propose two new ways to mount attacks on the SHA-3 candidates Grøstl, and ECHO, and apply these attacks also to the AES. Our results improve upon and extend the rebound attack. Using the new techniques, we are able to extend the number of rounds in which available degrees of freedom can be used. As a result, we present the first attack on 7 rounds for the Grøstl-256 output transformation3 and improve the semi-free-start collision attack on 6 rounds. Further, we present an improved known-key distinguisher for 7 rounds of the AES block cipher and the internal permutation used in ECHO. Keywords: hash function, block cipher, cryptanalysis, semi-free-start collision, known-key distinguisher 1 Introduction Recently, a new wave of hash function proposals appeared, following a call for submissions to the SHA-3 contest organized by NIST [26]. In order to analyze these proposals, the toolbox which is at the cryptanalysts' disposal needs to be extended. Meet-in-the-middle and differential attacks are commonly used. A recent extension of differential cryptanalysis to hash functions is the rebound attack [22] originally applied to reduced (7.5 rounds) Whirlpool (standardized since 2000 by ISO/IEC 10118-3:2004) and a reduced version (6 rounds) of the SHA-3 candidate Grøstl-256 [14], which both have 10 rounds in total.
    [Show full text]
  • Key-Dependent Approximations in Cryptanalysis. an Application of Multiple Z4 and Non-Linear Approximations
    KEY-DEPENDENT APPROXIMATIONS IN CRYPTANALYSIS. AN APPLICATION OF MULTIPLE Z4 AND NON-LINEAR APPROXIMATIONS. FX Standaert, G Rouvroy, G Piret, JJ Quisquater, JD Legat Universite Catholique de Louvain, UCL Crypto Group, Place du Levant, 3, 1348 Louvain-la-Neuve, standaert,rouvroy,piret,quisquater,[email protected] Linear cryptanalysis is a powerful cryptanalytic technique that makes use of a linear approximation over some rounds of a cipher, combined with one (or two) round(s) of key guess. This key guess is usually performed by a partial decryp- tion over every possible key. In this paper, we investigate a particular class of non-linear boolean functions that allows to mount key-dependent approximations of s-boxes. Replacing the classical key guess by these key-dependent approxima- tions allows to quickly distinguish a set of keys including the correct one. By combining different relations, we can make up a system of equations whose solu- tion is the correct key. The resulting attack allows larger flexibility and improves the success rate in some contexts. We apply it to the block cipher Q. In parallel, we propose a chosen-plaintext attack against Q that reduces the required number of plaintext-ciphertext pairs from 297 to 287. 1. INTRODUCTION In its basic version, linear cryptanalysis is a known-plaintext attack that uses a linear relation between input-bits, output-bits and key-bits of an encryption algorithm that holds with a certain probability. If enough plaintext-ciphertext pairs are provided, this approximation can be used to assign probabilities to the possible keys and to locate the most probable one.
    [Show full text]
  • Related-Key Cryptanalysis of 3-WAY, Biham-DES,CAST, DES-X, Newdes, RC2, and TEA
    Related-Key Cryptanalysis of 3-WAY, Biham-DES,CAST, DES-X, NewDES, RC2, and TEA John Kelsey Bruce Schneier David Wagner Counterpane Systems U.C. Berkeley kelsey,schneier @counterpane.com [email protected] f g Abstract. We present new related-key attacks on the block ciphers 3- WAY, Biham-DES, CAST, DES-X, NewDES, RC2, and TEA. Differen- tial related-key attacks allow both keys and plaintexts to be chosen with specific differences [KSW96]. Our attacks build on the original work, showing how to adapt the general attack to deal with the difficulties of the individual algorithms. We also give specific design principles to protect against these attacks. 1 Introduction Related-key cryptanalysis assumes that the attacker learns the encryption of certain plaintexts not only under the original (unknown) key K, but also under some derived keys K0 = f(K). In a chosen-related-key attack, the attacker specifies how the key is to be changed; known-related-key attacks are those where the key difference is known, but cannot be chosen by the attacker. We emphasize that the attacker knows or chooses the relationship between keys, not the actual key values. These techniques have been developed in [Knu93b, Bih94, KSW96]. Related-key cryptanalysis is a practical attack on key-exchange protocols that do not guarantee key-integrity|an attacker may be able to flip bits in the key without knowing the key|and key-update protocols that update keys using a known function: e.g., K, K + 1, K + 2, etc. Related-key attacks were also used against rotor machines: operators sometimes set rotors incorrectly.
    [Show full text]
  • Polish Mathematicians Finding Patterns in Enigma Messages
    Fall 2006 Chris Christensen MAT/CSC 483 Machine Ciphers Polyalphabetic ciphers are good ways to destroy the usefulness of frequency analysis. Implementation can be a problem, however. The key to a polyalphabetic cipher specifies the order of the ciphers that will be used during encryption. Ideally there would be as many ciphers as there are letters in the plaintext message and the ordering of the ciphers would be random – an one-time pad. More commonly, some rotation among a small number of ciphers is prescribed. But, rotating among a small number of ciphers leads to a period, which a cryptanalyst can exploit. Rotating among a “large” number of ciphers might work, but that is hard to do by hand – there is a high probability of encryption errors. Maybe, a machine. During World War II, all the Allied and Axis countries used machine ciphers. The United States had SIGABA, Britain had TypeX, Japan had “Purple,” and Germany (and Italy) had Enigma. SIGABA http://en.wikipedia.org/wiki/SIGABA 1 A TypeX machine at Bletchley Park. 2 From the 1920s until the 1970s, cryptology was dominated by machine ciphers. What the machine ciphers typically did was provide a mechanical way to rotate among a large number of ciphers. The rotation was not random, but the large number of ciphers that were available could prevent depth from occurring within messages and (if the machines were used properly) among messages. We will examine Enigma, which was broken by Polish mathematicians in the 1930s and by the British during World War II. The Japanese Purple machine, which was used to transmit diplomatic messages, was broken by William Friedman’s cryptanalysts.
    [Show full text]
  • Partly-Pseudo-Linear Cryptanalysis of Reduced-Round SPECK
    cryptography Article Partly-Pseudo-Linear Cryptanalysis of Reduced-Round SPECK Sarah A. Alzakari * and Poorvi L. Vora Department of Computer Science, The George Washington University, 800 22nd St. NW, Washington, DC 20052, USA; [email protected] * Correspondence: [email protected] Abstract: We apply McKay’s pseudo-linear approximation of addition modular 2n to lightweight ARX block ciphers with large words, specifically the SPECK family. We demonstrate that a pseudo- linear approximation can be combined with a linear approximation using the meet-in-the-middle attack technique to recover several key bits. Thus we illustrate improvements to SPECK linear distinguishers based solely on Cho–Pieprzyk approximations by combining them with pseudo-linear approximations, and propose key recovery attacks. Keywords: SPECK; pseudo-linear cryptanalysis; linear cryptanalysis; partly-pseudo-linear attack 1. Introduction ARX block ciphers—which rely on Addition-Rotation-XOR operations performed a number of times—provide a common approach to lightweight cipher design. In June 2013, a group of inventors from the US’s National Security Agency (NSA) proposed two families of lightweight block ciphers, SIMON and SPECK—each of which comes in a variety of widths and key sizes. The SPECK cipher, as an ARX cipher, provides efficient software implementations, while SIMON provides efficient hardware implementations. Moreover, both families perform well in both hardware and software and offer the flexibility across Citation: Alzakari, S.; Vora, P. different platforms that will be required by future applications [1,2]. In this paper, we focus Partly-Pseudo-Linear Cryptanalysis on the SPECK family as an example lightweight ARX block cipher to illustrate our attack.
    [Show full text]
  • Applying Differential Cryptanalysis for XTEA Using a Genetic Algorithm
    Applying Differential Cryptanalysis for XTEA using a Genetic Algorithm Pablo Itaima and Mar´ıa Cristina Riffa aDepartment of Computer Science, Universidad Tecnica´ Federico Santa Mar´ıa, Casilla 110-V, Valpara´ıso, Chile, {pitaim,mcriff}@inf.utfsm.cl Keywords: Cryptanalysis, XTEA, Genetic Algorithms. Abstract. Differential Cryptanalysis is a well-known chosen plaintext attack on block ciphers. One of its components is a search procedure. In this paper we propose a genetic algorithm for this search procedure. We have applied our approach to the Extended Tiny Encryption Algorithm. We have obtained encouraging results for 4, 7 and 13 rounds. 1 Introduction In the Differential Cryptanalysis, Biham and Shamir (1991), we can identify many problems to be solved in order to complete a successful attack. The first problem is to define a differential characteristic, with a high probability, which will guide the attack. The second problem is to generate a set of plaintexts pairs, with a fixed difference, which follows the differential charac- teristic of the algorithm. Other problem is related to the search of the correct subkey during the partial deciphering process made during the attack. For this, many possible subkeys are tested and the algorithm selects the subkey that, most of the time, generates the best results. This is evaluated, in the corresponding round, by the number of plaintext pairs that have the same difference respect to the characteristic. Our aim is to improve this searching process using a ge- netic algorithm. Roughly speaking, the key idea is to quickly find a correct subkey, allowing at the same time to reduce the computational resources required.
    [Show full text]
  • Higher Order Correlation Attacks, XL Algorithm and Cryptanalysis of Toyocrypt
    Higher Order Correlation Attacks, XL Algorithm and Cryptanalysis of Toyocrypt Nicolas T. Courtois Cryptography research, Schlumberger Smart Cards, 36-38 rue de la Princesse, BP 45, 78430 Louveciennes Cedex, France http://www.nicolascourtois.net [email protected] Abstract. Many stream ciphers are built of a linear sequence generator and a non-linear output function f. There is an abundant literature on (fast) correlation attacks, that use linear approximations of f to attack the cipher. In this paper we explore higher degree approximations, much less studied. We reduce the cryptanalysis of a stream cipher to solv- ing a system of multivariate equations that is overdefined (much more equations than unknowns). We adapt the XL method, introduced at Eurocrypt 2000 for overdefined quadratic systems, to solving equations of higher degree. Though the exact complexity of XL remains an open problem, there is no doubt that it works perfectly well for such largely overdefined systems as ours, and we confirm this by computer simula- tions. We show that using XL, it is possible to break stream ciphers that were known to be immune to all previously known attacks. For exam- ple, we cryptanalyse the stream cipher Toyocrypt accepted to the second phase of the Japanese government Cryptrec program. Our best attack on Toyocrypt takes 292 CPU clocks for a 128-bit cipher. The interesting feature of our XL-based higher degree correlation attacks is, their very loose requirements on the known keystream needed. For example they may work knowing ONLY that the ciphertext is in English. Key Words: Algebraic cryptanalysis, multivariate equations, overde- fined equations, Reed-Muller codes, correlation immunity, XL algorithm, Gr¨obner bases, stream ciphers, pseudo-random generators, nonlinear fil- tering, ciphertext-only attacks, Toyocrypt, Cryptrec.
    [Show full text]
  • Applications of Search Techniques to Cryptanalysis and the Construction of Cipher Components. James David Mclaughlin Submitted F
    Applications of search techniques to cryptanalysis and the construction of cipher components. James David McLaughlin Submitted for the degree of Doctor of Philosophy (PhD) University of York Department of Computer Science September 2012 2 Abstract In this dissertation, we investigate the ways in which search techniques, and in particular metaheuristic search techniques, can be used in cryptology. We address the design of simple cryptographic components (Boolean functions), before moving on to more complex entities (S-boxes). The emphasis then shifts from the construction of cryptographic arte- facts to the related area of cryptanalysis, in which we first derive non-linear approximations to S-boxes more powerful than the existing linear approximations, and then exploit these in cryptanalytic attacks against the ciphers DES and Serpent. Contents 1 Introduction. 11 1.1 The Structure of this Thesis . 12 2 A brief history of cryptography and cryptanalysis. 14 3 Literature review 20 3.1 Information on various types of block cipher, and a brief description of the Data Encryption Standard. 20 3.1.1 Feistel ciphers . 21 3.1.2 Other types of block cipher . 23 3.1.3 Confusion and diffusion . 24 3.2 Linear cryptanalysis. 26 3.2.1 The attack. 27 3.3 Differential cryptanalysis. 35 3.3.1 The attack. 39 3.3.2 Variants of the differential cryptanalytic attack . 44 3.4 Stream ciphers based on linear feedback shift registers . 48 3.5 A brief introduction to metaheuristics . 52 3.5.1 Hill-climbing . 55 3.5.2 Simulated annealing . 57 3.5.3 Memetic algorithms . 58 3.5.4 Ant algorithms .
    [Show full text]
  • Impossible Differential Cryptanalysis of the Lightweight Block Ciphers TEA, XTEA and HIGHT
    Impossible Differential Cryptanalysis of the Lightweight Block Ciphers TEA, XTEA and HIGHT Jiazhe Chen1;2;3?, Meiqin Wang1;2;3??, and Bart Preneel2;3 1 Key Laboratory of Cryptologic Technology and Information Security, Ministry of Education, School of Mathematics, Shandong University, Jinan 250100, China 2 Department of Electrical Engineering ESAT/SCD-COSIC, Katholieke Universiteit Leuven, Kasteelpark Arenberg 10, B-3001 Heverlee, Belgium 3 Interdisciplinary Institute for BroadBand Technology (IBBT), Belgium [email protected] Abstract. TEA, XTEA and HIGHT are lightweight block ciphers with 64-bit block sizes and 128-bit keys. The round functions of the three ci- phers are based on the simple operations XOR, modular addition and shift/rotation. TEA and XTEA are Feistel ciphers with 64 rounds de- signed by Needham and Wheeler, where XTEA is a successor of TEA, which was proposed by the same authors as an enhanced version of TEA. HIGHT, which is designed by Hong et al., is a generalized Feistel cipher with 32 rounds. These block ciphers are simple and easy to implement but their diffusion is slow, which allows us to find some impossible prop- erties. This paper proposes a method to identify the impossible differentials for TEA and XTEA by using the weak diffusion, where the impossible differential comes from a bit contradiction. Our method finds a 14-round impossible differential of XTEA and a 13-round impossible differential of TEA, which result in impossible differential attacks on 23-round XTEA and 17-round TEA, respectively. These attacks significantly improve the previous impossible differential attacks on 14-round XTEA and 11-round TEA given by Moon et al.
    [Show full text]
  • Cryptology, Cryptography, Cryptanalysis. Definitions, Meanings, Requirements, and Current Challenges
    Cryptology, cryptography, cryptanalysis. Definitions, meanings, requirements, and current challenges Tanja Lange Technische Universiteit Eindhoven 26 September 2018 ENISA summer school I PGP encrypted email, Signal, Tor, Tails, Qubes OS. Snowden in Reddit AmA Arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say. Cryptographic applications in daily life I Mobile phones connecting to cell towers. I Credit cards, EC-cards, access codes for banks. I Electronic passports; soon ID cards. I Internet commerce, online tax declarations, webmail. I Facebook, Gmail, WhatsApp, iMessage on iPhone. I Any webpage with https. I Encrypted file system on iPhone: see Apple vs. FBI. Tanja Lange https://pqcrypto.eu.org Introduction2 Snowden in Reddit AmA Arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say. Cryptographic applications in daily life I Mobile phones connecting to cell towers. I Credit cards, EC-cards, access codes for banks. I Electronic passports; soon ID cards. I Internet commerce, online tax declarations, webmail. I Facebook, Gmail, WhatsApp, iMessage on iPhone. I Any webpage with https. I Encrypted file system on iPhone: see Apple vs. FBI. I PGP encrypted email, Signal, Tor, Tails, Qubes OS. Tanja Lange https://pqcrypto.eu.org Introduction2 Cryptographic applications in daily life I Mobile phones connecting to cell towers. I Credit cards, EC-cards, access codes for banks.
    [Show full text]
  • Data Encryption Standard (DES)
    6 Data Encryption Standard (DES) Objectives In this chapter, we discuss the Data Encryption Standard (DES), the modern symmetric-key block cipher. The following are our main objectives for this chapter: + To review a short history of DES + To defi ne the basic structure of DES + To describe the details of building elements of DES + To describe the round keys generation process + To analyze DES he emphasis is on how DES uses a Feistel cipher to achieve confusion and diffusion of bits from the Tplaintext to the ciphertext. 6.1 INTRODUCTION The Data Encryption Standard (DES) is a symmetric-key block cipher published by the National Institute of Standards and Technology (NIST). 6.1.1 History In 1973, NIST published a request for proposals for a national symmetric-key cryptosystem. A proposal from IBM, a modifi cation of a project called Lucifer, was accepted as DES. DES was published in the Federal Register in March 1975 as a draft of the Federal Information Processing Standard (FIPS). After the publication, the draft was criticized severely for two reasons. First, critics questioned the small key length (only 56 bits), which could make the cipher vulnerable to brute-force attack. Second, critics were concerned about some hidden design behind the internal structure of DES. They were suspicious that some part of the structure (the S-boxes) may have some hidden trapdoor that would allow the National Security Agency (NSA) to decrypt the messages without the need for the key. Later IBM designers mentioned that the internal structure was designed to prevent differential cryptanalysis.
    [Show full text]
  • Cryptanalysis of the ``Kindle'' Cipher
    Introduction PC1 Known-plaintext key-recovery Ciphertext only key-recovery Conclusion . Cryptanalysis of the “Kindle” Cipher Alex Biryukov, Gaëtan Leurent, Arnab Roy University of Luxembourg SAC 2012 A. Biryukov, G. Leurent, A. Roy (uni.lu) Cryptanalysis of the “Kindle” Cipher SAC 2012 1 / 22 Introduction PC1 Known-plaintext key-recovery Ciphertext only key-recovery Conclusion . Cryptography: theory and practice In theory In practice ▶ Random Oracle ▶ Algorithms ▶ ▶ Ideal Cipher AES ▶ SHA2 ▶ Perfect source of ▶ RSA randomness ▶ Modes of operation ▶ CBC ▶ OAEP ▶ ... ▶ . Random Number Generators ▶ Hardware RNG ▶ PRNG A. Biryukov, G. Leurent, A. Roy (uni.lu) Cryptanalysis of the “Kindle” Cipher SAC 2012 2 / 22 Introduction PC1 Known-plaintext key-recovery Ciphertext only key-recovery Conclusion . Cryptography in the real world Several examples of flaws in industrial cryptography: ▶ Bad random source ▶ SLL with 16bit entropy (Debian) ▶ ECDSA with fixed k (Sony) ▶ Bad key size ▶ RSA512 (TI) ▶ Export restrictions... ▶ Bad mode of operation ▶ CBCMAC with the RC4 streamcipher (Microsoft) ▶ TEA with DaviesMeyer (Microsoft) ▶ Bad (proprietary) algorithm ▶ A5/1 (GSM) ▶ CSS (DVD forum) ▶ Crypto1 (MIFARE/NXP) ▶ KeeLoq (Microchip) A. Biryukov, G. Leurent, A. Roy (uni.lu) Cryptanalysis of the “Kindle” Cipher SAC 2012 3 / 22 Introduction PC1 Known-plaintext key-recovery Ciphertext only key-recovery Conclusion . Amazon Kindle ▶ Ebook reader by Amazon ▶ Most popular ebook reader (≈ 50% share) ▶ 4 generations, 7 devices ▶ Software reader for 7 OS, plus cloud reader ▶ Several million devices sold ▶ Amazon sells more ebooks than paper books ▶ Uses crypto for DRM (Digital Rights Management) A. Biryukov, G. Leurent, A. Roy (uni.lu) Cryptanalysis of the “Kindle” Cipher SAC 2012 4 / 22 Introduction PC1 Known-plaintext key-recovery Ciphertext only key-recovery Conclusion .
    [Show full text]