Security of Cryptosystems Against Power-Analysis Attacks
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
Integral Cryptanalysis on Full MISTY1⋆
Integral Cryptanalysis on Full MISTY1? Yosuke Todo NTT Secure Platform Laboratories, Tokyo, Japan [email protected] Abstract. MISTY1 is a block cipher designed by Matsui in 1997. It was well evaluated and standardized by projects, such as CRYPTREC, ISO/IEC, and NESSIE. In this paper, we propose a key recovery attack on the full MISTY1, i.e., we show that 8-round MISTY1 with 5 FL layers does not have 128-bit security. Many attacks against MISTY1 have been proposed, but there is no attack against the full MISTY1. Therefore, our attack is the first cryptanalysis against the full MISTY1. We construct a new integral characteristic by using the propagation characteristic of the division property, which was proposed in 2015. We first improve the division property by optimizing a public S-box and then construct a 6-round integral characteristic on MISTY1. Finally, we recover the secret key of the full MISTY1 with 263:58 chosen plaintexts and 2121 time complexity. Moreover, if we can use 263:994 chosen plaintexts, the time complexity for our attack is reduced to 2107:9. Note that our cryptanalysis is a theoretical attack. Therefore, the practical use of MISTY1 will not be affected by our attack. Keywords: MISTY1, Integral attack, Division property 1 Introduction MISTY [Mat97] is a block cipher designed by Matsui in 1997 and is based on the theory of provable security [Nyb94,NK95] against differential attack [BS90] and linear attack [Mat93]. MISTY has a recursive structure, and the component function has a unique structure, the so-called MISTY structure [Mat96]. -
SAEB: a Lightweight Blockcipher-Based AEAD Mode of Operation
SAEB: A Lightweight Blockcipher-Based AEAD Mode of Operation Yusuke Naito1, Mitsuru Matsui1, Takeshi Sugawara2 and Daisuke Suzuki1 1 Mitsubishi Electric Corporation, Japan {Naito.Yusuke@ce,Matsui.Mitsuru@ab,Suzuki.Daisuke@bx}.MitsubishiElectric.co.jp 2 The University of Electro-Communications, Japan [email protected] Abstract. Lightweight cryptography in computationally constrained devices is ac- tively studied. In contrast to advances of lightweight blockcipher in the last decade, lightweight mode of operation is seemingly not so mature, yet it has large impact in performance. Therefore, there is a great demand for lightweight mode of oper- ation, especially that for authenticated encryption with associated data (AEAD). Among many known properties of conventional modes of operation, the following four properties are essential for constrained devices: 1. Minimum State Size: the state size equals to a block size of a blockcipher. 2. Inverse Free: no need for a blockcipher decryption. 3. XOR Only: only XOR is needed in addition to a blockcipher encryption. 4. Online: a data block is processed only once. The properties 1 and 4 contribute to small memory usage, and the properties 2 and 3 contribute to small program/circuit footprint. On top of the above properties, the fifth property regarding associated data (AD) is also important for performance: 5. Efficient Handling of Static AD: static AD can be precomputed. We design a lightweight blockcipher-based AEAD mode of operation called SAEB: the first mode of operation that satisfies all the five properties to the best of our knowledge. Performance of SAEB is evaluated in various software and hardware platforms. -
Poster: Proofs of Space
Poster: Proofs of Space Stefan Dziembowski∗, Sebastian Fausty, Vladimir Kolmogorovz, Krzysztof Pietrzakz ∗University of Warsaw and Sapienza University of Rome, faculty yEPFL Lausanne, post-doc zIST Austria, faculty Abstract—Proofs of work (PoW) have been suggested by is secure even against an adversary equipped with special- Dwork and Naor (Crypto’92) as protection to a shared resource. purpose hardware. This may, in some cases, mean that the The basic idea is to ask the service requestor to dedicate some computing effort spent by the honest (software-based) users non-trivial amount of computational work to every request. The becomes high. original applications included prevention of spam and protection against denial of service attacks. More recently, PoWs have been used to prevent double spending in the Bitcoin digital currency II. PROOFS OF SPACE (POS). system. From a more abstract point of view, a proof of work is In this work, we put forward an alternative concept for simply a means of showing that one invested a non-trivial PoWs – so-called proofs of space (PoS), where a service requestor amount of effort related to some statement. This general must dedicate a significant amount of disk space as opposed to principle also works with resources other than computation computation. We construct secure PoS schemes in the random like real money in micropayment systems or human attention oracle model, using graphs with high ”pebbling complexity” and in CAPTCHAs. In this paper we put forward the concept Merkle hash-trees. of proofs of space where the resource in question is the disk space. Some computational work is needed only in the I. -
Improved Meet-In-The-Middle Distinguisher on Feistel Schemes
Improved Meet-in-the-Middle Distinguisher on Feistel Schemes Li Lin1;2 and Wenling Wu1 1 Trusted Computing and Information Assurance Laboratory, Institute of Software, Chinese Academy of Sciences, Beijing 100190, China 2 Graduate University of Chinese Academy of Sciences, Beijing 100190, China flinli, [email protected] Abstract. Improved meet-in-the-middle cryptanalysis with efficient tab- ulation technique has been shown to be a very powerful form of crypt- analysis against SPN block ciphers. However, few literatures show the ef- fectiveness of this cryptanalysis against Balanced-Feistel-Networks (BFN) and Generalized-Feistel-Networks (GFN) ciphers due to the stagger of affected trail and special truncated differential trail. In this paper, we de- scribe a versatile and powerful algorithm for searching the best improved meet-in-the-middle distinguisher with efficient tabulation technique on word-oriented BFN and GFN block ciphers, which is based on recursion and greedy algorithm. To demonstrate the usefulness of our approach, we show key recovery attacks on 14/16-round CLEFIA-192/256 which are the best attacks. We also propose key recovery attacks on 13/15-round Camellia-192/256 (without F L=F L−1). Keywords: Block Ciphers, Improved Meet-in-the-Middle Attack, Effi- cient Tabulation Technique, Automatic Search Tool, Truncated Differ- ential Trail, CLEFIA, Camellia. 1 Introduction The meet-in-the-middle attack was first proposed by Diffie and Hellman to attack DES [7]. In recent years, it was widely researched due to its effectiveness against block cipher AES [4]. For AES, Gilbert and Minier showed in [10] a collision attack on 7-round AES. -
Krzysztof Pietrzak Last Updated November 22, 2018 Professor [email protected] IST Austria
Krzysztof Pietrzak last updated November 22, 2018 Professor [email protected] IST Austria http://pub.ist.ac.at/crypto/ Personal Details Full Name: Krzysztof Pietrzak Citizenship: Swiss & Polish. Languages: German & Swiss-German, English, Polish (fluent), French, Dutch (speak/read), Norwegian (read) Research Interests I have a broad interest in foundational and practical aspects of cryptography. Current Employment Institute of Science and Technology (IST) Austria Vienna, Austria • Professor (Assistant Professor before Aug 2016) Aug 2011-current Previous Employment CWI (Centrum Wiskunde & Informatica) Amsterdam, Netherlands • Scientific staff member in the Crypto Group (Head Ronald Cramer) Jan 2007-Jul 2011 Ecole´ Normale Sup´erieure Paris, France • Postdoc in the Crypto Group (Head David Pointcheval) Jan-Dec 2006 Selected Distinctions ERC Starting Grant (1.12mio e) • Provable Security for Physical Cryptography (PSPC) 2010-2015 ERC Consolidator Grant (1.8mio e) • Teaching Old Crypto New Tricks (TOCNeT) 2016-2021 Best Paper Awards at • Eurocrypt 2011, 2017 and 2018 Education ETH Z¨urich,Switzerland • PhD in Cryptography 2001 - 2005 { Adviser: Prof. Ueli Maurer. { Title: Indistinguishability and Composition of Random Systems. ETH Z¨urich,Switzerland • Dipl.Inf.Ing.ETH (Master Degree in Computer Science) 1996 - 2001 { Minor subject: Quantum Physics. { Diploma thesis done at McGill (see below.) McGill University Montr´eal,Canada • Diploma Thesis autumn 2001 { Advisers: Prof. Michael Hallett (McGill) and Prof. Gaston Gonnet (ETH). { Title: On the -
Eurocrypt'2000 Conference Report
Eurocrypt'2000 Conference Report May 15–18, 2000 Bruges Richard Graveman Telcordia Technologies Morristown, NJ USA [email protected] Welcome This was the nineteenth annual Eurocrypt conference. Thirty-nine out of 150 papers were accepted, and there were two invited talks along with the traditional rump session. About 480 participants from 39 countries were present. Bart Preneel was Program Chair. The Proceedings were published by Springer Verlag as Advances in Cryptology— Eurocrypt'98, Lecture Notes in Computer Science, Volume 1807, Bart Preneel, editor. Session 1: Factoring and Discrete Logarithm, Chair: Bart Preneel Factorization of a 512-bit RSA Modulus, Stefania Cavallar (CWI, The Netherlands), Bruce Dodson (Lehigh University, USA), Arjen K. Lenstra (Citibank, USA), Walter Lioen (CWI, The Netherlands), Peter L. Montgomery (Microsoft Research, USA and CWI, The Netherlands), Brian Murphy (The Australian National University, Australia), Herman te Riele (CWI, The Netherlands), Karen Aardal (Utrecht University, The Netherlands), Jeff Gilchrist (Entrust Technologies Ltd., Canada), Gérard Guillerm (École Polytechnique, France), Paul Leyland (Microsoft Research Ltd., UK), Joël Marchand (École Polytechnique/CNRS, France), François Morain (École Polytechnique, France), Alec Muffett (Sun Microsystems, UK), Chris and Craig Putnam (USA), Paul Zimmermann (Inria Lorraine and Loria, France) The authors factored the RSA challenge number RSA-512 with the general number field sieve (NFS). The algorithm has four steps: polynomial selection, sieving, linear algebra, and square root extraction. For N known to be composite, two irreducible polynomials with a common root mod N are needed. f1 (of degree 5 in this case) should have many roots modulo small primes as well as being as small as possible. -
Parallel Implementations of Masking Schemes and the Bounded Moment
Parallel Implementations of Masking Schemes and the Bounded Moment Leakage Model Gilles Barthe, François Dupressoir, Sebastian Faust, Benjamin Grégoire, François-Xavier Standaert, Pierre-Yves Strub To cite this version: Gilles Barthe, François Dupressoir, Sebastian Faust, Benjamin Grégoire, François-Xavier Standaert, et al.. Parallel Implementations of Masking Schemes and the Bounded Moment Leakage Model. Advances in Cryptology - 2017 - 36th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Apr 2017, Paris, France. pp.535–566. hal-01414009 HAL Id: hal-01414009 https://hal.inria.fr/hal-01414009 Submitted on 12 Dec 2016 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Parallel Implementations of Masking Schemes and the Bounded Moment Leakage Model Gilles Barthe1, Fran¸cois Dupressoir2, Sebastian Faust3, Benjamin Gr´egoire4, Fran¸cois-Xavier Standaert5, and Pierre-Yves Strub6. 1 IMDEA Software Institute, Spain. 2 University of Surrey, UK. 3 Ruhr Universit¨atBochum, Germany. 4 Inria Sophia-Antipolis { M´editerran´ee,France. 5 Universit´eCatholique de Louvain, Belgium. 6 Ecole Polytechnique, France. Abstract. In this paper, we provide a necessary clarification of the good security properties that can be obtained from parallel implementations of masking schemes. -
COMMITEE : an Efficient and Secure Commit-Chain Protocol Using Tees
COMMITEE : An Efficient and Secure Commit-Chain Protocol using TEEs Andreas Erwig Sebastian Faust TU Darmstadt TU Darmstadt [email protected] [email protected] Siavash Riahi Tobias Stöckert TU Darmstadt TU Darmstadt [email protected] [email protected] Abstract 1 Introduction Over the past decade cryptocurrencies such as Bitcoin [31] and Ethereum [38] have gained increasing popularity by intro- ducing a new financial paradigm. Unlike traditional financial Permissionless blockchain systems such as Bitcoin or systems these cryptocurrencies do not rely on a central author- Ethereum are slow and expensive, since transactions are pro- ity for transaction validation and accounting, but instead build cessed in a distributed network by a large set of parties. To upon a decentralized consensus protocol which maintains a improve on these shortcomings, a prominent approach is given distributed ledger that tracks each single transaction. How- by so-called 2nd-layer protocols. In these protocols parties ever, maintaining such a ledger in a distributed fashion comes process transactions off-chain directly between each other, at the cost of poor transaction throughput and confirmation thereby drastically reducing the costly and slow interaction time. For example, in Ethereum the transaction throughput with the blockchain. In particular, in the optimistic case, when is limited to a few dozen transactions per second and final parties behave honestly, no interaction with the blockchain confirmation of a transaction can take up to 6 minutes. On is needed. One of the most popular off-chain solutions are the contrary, traditional centralized payment providers offer Plasma protocols (often also called commit-chains). -
Komplettes Werk
https://doi.org/10.5771/9783968216850, am 29.09.2021, 03:03:45 Open Access - http://www.nomos-elibrary.de/agb Hof manns thal Jahrbuch · Zur europäischen Moderne 25/2017 https://doi.org/10.5771/9783968216850, am 29.09.2021, 03:03:45 Open Access - http://www.nomos-elibrary.de/agb https://doi.org/10.5771/9783968216850, am 29.09.2021, 03:03:45 Open Access - http://www.nomos-elibrary.de/agb HOf MANNSTHAL JAHRBUCH · ZUR EUROPÄISCHEN MODERNE 25/2017 Im Auftrag der Hugo von Hof manns thal-Gesellschaft herausgegeben von Maximilian Bergengruen · Alexander Honold · Gerhard Neumann Ursula Renner · Günter Schnitzler · Gotthart Wunberg Rombach Verlag Freiburg https://doi.org/10.5771/9783968216850, am 29.09.2021, 03:03:45 Open Access - http://www.nomos-elibrary.de/agb © 2017, Rombach Verlag KG, Freiburg im Breisgau 1. Auflage. Alle Rechte vorbehalten Typographie: Friedrich Pfäfflin, Marbach Satz: TIESLED Satz & Service, Köln Herstellung: Rombach Druck- und Verlagshaus GmbH & Co. KG, Freiburg i. Br. Printed in Germany ISBN 978–3–7930–9902–4 https://doi.org/10.5771/9783968216850, am 29.09.2021, 03:03:45 Open Access - http://www.nomos-elibrary.de/agb Inhalt Klaus E. Bohnenkamp »Wir haben diesen Dichter geliebt …« Hugo von Hofmannsthal und Eduard Korrodi Briefe und Dokumente 7 Heinz Rölleke »Und immer weht der Wind« Hofmannsthal und das alttestamentarische Buch »Kohelet« 121 Daniel Hilpert »Mein Fleisch heißt Lulu« Eugenik und Sexualpathologie in Frank Wedekinds »Die Büchse der Pandora. Eine Monstretragödie« (1894) 137 Johannes Ungelenk Rainer Maria Rilkes -
Specification of Camellia | a 128-Bit Block Cipher
Sp eci cation of C amel l ia | a 128-bit Blo ck Cipher y z y Kazumaro AOKI , Tetsuya ICHIKAWA , Masayuki KANDA , z y z z Mitsuru MATSUI , Shiho MORIAI , Junko NAKAJIMA , Toshio TOKITA y z Nipp on Telegraph and Telephone Corp oration, Mitsubishi Electric Corp oration Version 1.0: July 12, 2000 Version 2.0: September 26, 2001 Contents 1 Intro duction 3 2 Notations and Conventions 3 2.1 Radix . 3 2.2 Notations . 3 2.3 List of Symbols . 3 2.4 Bit/Byte Ordering . 3 3 Structure of C amel l ia 5 3.1 List of Functions and Variables . 5 3.2 Encryption Pro cedure . 5 3.2.1 128-bit key . 5 3.2.2 192-bit and 256-bit key . 6 3.3 Decryption Pro cedure . 6 3.3.1 128-bit key . 6 3.3.2 192-bit and 256-bit key . 7 3.4 Key Schedule . 8 4 Comp onents of C amel l ia 10 4.1 F -function . 10 4.2 FL-function . 10 1 4.3 FL -function . 10 4.4 S -function . 10 4.5 s-b oxes . 11 4.6 P -function . 15 A Figures of the Camellia Algorithm 16 B Test Data 22 1 Copyright NTT and Mitsubishi Electric Corp oration 2000-2001 2 C Software Implementation Techniques 22 C.1 Setup . 22 C.1.1 Store All Subkeys . 22 C.1.2 Subkey Generation Order . 23 C.1.3 XOR Cancellation Prop erty in Key Schedule . 23 C.1.4 Rotation Bits for K , K , K ,andK . -
Caltech/Mit Voting Technology Project
CALTECH/MIT VOTING TECHNOLOGY PROJECT A multi-disciplinary, collaborative project of the California Institute of Technology – Pasadena, California 91125 and the Massachusetts Institute of Technology – Cambridge, Massachusetts 02139 ADVANCES IN CRYPTOGRAPHIC VOTING SYSTEMS BEN ADIDA MIT Key words: voting systems, cryptographic, election administration, secret- ballot elections VTP WORKING PAPER #51 September 2006 Advances in Cryptographic Voting Systems by Ben Adida Submitted to the Department of Electrical Engineering and Computer Science in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Computer Science at the MASSACHUSETTS INSTITUTE OF TECHNOLOGY August 2006 c Massachusetts Institute of Technology 2006. All rights reserved. Author . .................................................................. Department of Electrical Engineering and Computer Science August 31st, 2006 Certified by . ............................................................. Ronald L. Rivest Viterbi Professor of Electrical Engineering and Computer Science Thesis Supervisor Accepted by . ............................................................ Arthur C. Smith Chairman, Department Committee on Graduate Students 2 Advances in Cryptographic Voting Systems by Ben Adida Submitted to the Department of Electrical Engineering and Computer Science on August 31st, 2006, in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Computer Science Abstract Democracy depends on the proper administration of popular -
South Florida Gay News Getsocial
local name CHECK OUT THE NEW WMG global coverage BEGINS ON PAGE 33 July 19, 2017 vol. 8 // issue 29 south florida gay news GETSOCIAL From local advocacy to international groups, fi nd your niche in an ever-growing community UNDERWEAR PRODUCES BIG COWBOY REMINISCES ABOUT BUCKS FOR LOCAL CHARITY VILLAGE PEOPLE CAREER PAGE 8 PAGE 47 SOUTHFLORIDAGAYNEWS SOFLAGAYNEWS SFGN.COM 7.19.2017 • 1 NEWS international southFloridaGaynews.com Chechnya. July 19, 2017 • volume 8 • issue 29 2520 n. Dixie highway • wilton Manors, Fl 33305 Phone: 954-530-4970 Fax: 954-530-7943 Publisher • norm Kent [email protected] chief executive offi cer • Pier Angelo Guidugli associate Publisher / executive editor • Jason Parsley [email protected] editorial art Director • Brendon Lies [email protected] Designer • Max Kagno Digital content Director • Brittany Ferrendi [email protected] associate editor • Jillian Melero [email protected] copyeditor • Kerri Covington arts/entertainment editor • JW Arnold [email protected] social Media Manager • Tucker Berardi [email protected] NEWSPAPER RELEASES NAMES OF Food/travel editor • Rick Karlin Gazette news editor • Michael d'Oliveira hiv editor • Sean McShee MURDERED GAY CHECHENS senior Photographer • J.R. Davis [email protected] Brittany Ferrendi senior Features correspondents Jesse Monteagudo • Tony Adams correspondents Dori Zinn • Andrea Richard • Donald Cavanaugh • Christiana Lilly • Denise Royal • ed up with a reportedly insincere shot in the night between January 25 and 26. Russian LGBT Network told International