Design of Stream Ciphers and Cryptographic Properties of Nonlinear Functions
Total Page:16
File Type:pdf, Size:1020Kb

Load more
Recommended publications
-
Cryptanalysis of Sfinks*
Cryptanalysis of Sfinks? Nicolas T. Courtois Axalto Smart Cards Crypto Research, 36-38 rue de la Princesse, BP 45, F-78430 Louveciennes Cedex, France, [email protected] Abstract. Sfinks is an LFSR-based stream cipher submitted to ECRYPT call for stream ciphers by Braeken, Lano, Preneel et al. The designers of Sfinks do not to include any protection against algebraic attacks. They rely on the so called “Algebraic Immunity”, that relates to the complexity of a simple algebraic attack, and ignores other algebraic attacks. As a result, Sfinks is insecure. Key Words: algebraic cryptanalysis, stream ciphers, nonlinear filters, Boolean functions, solving systems of multivariate equations, fast algebraic attacks on stream ciphers. 1 Introduction Sfinks is a new stream cipher that has been submitted in April 2005 to ECRYPT call for stream cipher proposals, by Braeken, Lano, Mentens, Preneel and Varbauwhede [6]. It is a hardware-oriented stream cipher with associated authentication method (Profile 2A in ECRYPT project). Sfinks is a very simple and elegant stream cipher, built following a very classical formula: a single maximum-period LFSR filtered by a Boolean function. Several large families of ciphers of this type (and even much more complex ones) have been in the recent years, quite badly broken by algebraic attacks, see for exemple [12, 13, 1, 14, 15, 2, 18]. Neverthe- less the specialists of these ciphers counter-attacked by defining and applying the concept of Algebraic Immunity [7] to claim that some designs are “secure”. Unfortunately, as we will see later, the notion of Algebraic Immunity protects against only one simple alge- braic attack and ignores other algebraic attacks. -
The WG Stream Cipher
The WG Stream Cipher Yassir Nawaz and Guang Gong Department of Electrical and Computer Engineering University of Waterloo Waterloo, ON, N2L 3G1, CANADA [email protected], [email protected] Abstract. In this paper we propose a new synchronous stream cipher, called WG ci- pher. The cipher is based on WG (Welch-Gong) transformations. The WG cipher has been designed to produce keystream with guaranteed randomness properties, i.e., bal- ance, long period, large and exact linear complexity, 3-level additive autocorrelation, and ideal 2-level multiplicative autocorrelation. It is resistant to Time/Memory/Data tradeoff attacks, algebraic attacks and correlation attacks. The cipher can be imple- mented with a small amount of hardware. 1 Introduction A synchronous stream cipher consists of a keystream generator which produces a sequence of binary digits. This sequence is called the running key or simply the keystream. The keystream is added (XORed) to the plaintext digits to produce the ciphertext. A secret key K is used to initialize the keystream generator and each secret key corresponds to a generator output sequence. Since the secret key is shared between the sender and the receiver, an identical keystream can be generated at the receiving end. The addition of this keystream with the ciphertext recovers the original plaintext. Stream ciphers can be divided into two major categories: bit-oriented stream ci- phers and word-oriented stream ciphers. The bit-oriented stream ciphers are usually based on binary linear feedback shift registors (LFSRs) (regularly clocked or irregu- larly clocked) together with filter or combiner functions. They can be implemented in hardware very efficiently. -
A Somewhat Historic View of Lightweight Cryptography
Intro History KATAN PRINTcipher Summary A Somewhat Historic View of Lightweight Cryptography Orr Dunkelman Department of Computer Science, University of Haifa Faculty of Mathematics and Computer Science Weizmann Institute of Science September 29th, 2011 Orr Dunkelman A Somewhat Historic View of Lightweight Cryptography 1/ 40 Intro History KATAN PRINTcipher Summary Outline 1 Introduction Lightweight Cryptography Lightweight Cryptography Primitives 2 The History of Designing Block Ciphers 3 The KATAN/KTANTAN Family The KATAN/KTANTAN Block Ciphers The Security of the KATAN/KTANTAN Family Attacks on the KTANTAN Family 4 The PRINTcipher The PRINTcipher Family Attacks on PRINTcipher 5 Future of Cryptanalysis for Lightweight Crypto Orr Dunkelman A Somewhat Historic View of Lightweight Cryptography 2/ 40 Intro History KATAN PRINTcipher Summary LWC Primitives Outline 1 Introduction Lightweight Cryptography Lightweight Cryptography Primitives 2 The History of Designing Block Ciphers 3 The KATAN/KTANTAN Family The KATAN/KTANTAN Block Ciphers The Security of the KATAN/KTANTAN Family Attacks on the KTANTAN Family 4 The PRINTcipher The PRINTcipher Family Attacks on PRINTcipher 5 Future of Cryptanalysis for Lightweight Crypto Orr Dunkelman A Somewhat Historic View of Lightweight Cryptography 3/ 40 Intro History KATAN PRINTcipher Summary LWC Primitives Lightweight Cryptography ◮ Targets constrained environments. ◮ Tries to reduce the computational efforts needed to obtain security. ◮ Optimization targets: size, power, energy, time, code size, RAM/ROM consumption, etc. Orr Dunkelman A Somewhat Historic View of Lightweight Cryptography 4/ 40 Intro History KATAN PRINTcipher Summary LWC Primitives Lightweight Cryptography ◮ Targets constrained environments. ◮ Tries to reduce the computational efforts needed to obtain security. ◮ Optimization targets: size, power, energy, time, code size, RAM/ROM consumption, etc. -
Adding MAC Functionality to Edon80
194 IJCSNS International Journal of Computer Science and Network Security, VOL.7 No.1, January 2007 Adding MAC Functionality to Edon80 Danilo Gligoroski and Svein J. Knapskog “Centre for Quantifiable Quality of Service in Communication Systems”, Norwegian University of Science and Technology, Trondheim, Norway Summary VEST. At the time of writing, it seams that for NLS and In this paper we show how the synchronous stream cipher Phelix some weaknesses have been found [11,12]. Edon80 - proposed as a candidate stream cipher in Profile 2 of Although the eSTREAM project does not accept anymore the eSTREAM project, can be efficiently upgraded to a any tweaks or new submissions, we think that the design synchronous stream cipher with authentication. We are achieving of an efficient authentication techniques as a part of the that by simple addition of two-bit registers into the e- internal definition of the remaining unbroken stream transformers of Edon80 core, an additional 160-bit shift register and by putting additional communication logic between ciphers of Phase 2 of eSTREAM project still is an neighboring e-transformers of the Edon80 pipeline core. This important research challenge. upgrade does not change the produced keystream from Edon80 Edon80 is one of the stream ciphers that has been and we project that in total it will need not more then 1500 gates. proposed for hardware based implementations (PROFILE A previous version of the paper with the same title that has been 2) [13]. Its present design does not contain an presented at the Special Workshop “State of the Art of Stream authentication mechanism by its own. -
WAGE: an Authenticated Encryption with a Twist
WAGE: An Authenticated Encryption with a Twist Riham AlTawy1, Guang Gong2, Kalikinkar Mandal2 and Raghvendra Rohit2 1 Department of Electrical and Computer Engineering, University of Victoria, Victoria, Canada [email protected] 2 Department of Electrical and Computer Engineering, University of Waterloo, Waterloo, Canada {ggong,kmandal,rsrohit}@uwaterloo.ca Abstract. This paper presents WAGE, a new lightweight sponge-based authenticated cipher whose underlying permutation is based on a 37-stage Galois NLFSR over F27 . At its core, the round function of the permutation consists of the well-analyzed Welch- Gong permutation (WGP), primitive feedback polynomial, a newly designed 7-bit SB sbox and partial word-wise XORs. The construction of the permutation is carried out such that the design of individual components is highly coupled with cryptanalysis and hardware efficiency. As such, we analyze the security of WAGE against differential, linear, algebraic and meet/miss-in-the-middle attacks. For 128-bit authenticated encryption security, WAGE achieves a throughput of 535 Mbps with hardware area of 2540 GE in ASIC ST Micro 90 nm standard cell library. Additionally, WAGE is designed with a twist where its underlying permutation can be efficiently turned into a pseudorandom bit generator based on the WG transformation (WG-PRBG) whose output bits have theoretically proved randomness properties. Keywords: Authenticated encryption · Pseudorandom bit generators · Welch-Gong permutation · Lightweight cryptography 1 Introduction Designing a lightweight cryptographic primitive requires a comprehensive holistic ap- proach. With the promising ability of providing multiple cryptographic functionalities by the sponge-based constructions, there has been a growing interest in designing cryp- tographic permutations and sponge-variant modes. -
Analysis of Lightweight Stream Ciphers
ANALYSIS OF LIGHTWEIGHT STREAM CIPHERS THÈSE NO 4040 (2008) PRÉSENTÉE LE 18 AVRIL 2008 À LA FACULTÉ INFORMATIQUE ET COMMUNICATIONS LABORATOIRE DE SÉCURITÉ ET DE CRYPTOGRAPHIE PROGRAMME DOCTORAL EN INFORMATIQUE, COMMUNICATIONS ET INFORMATION ÉCOLE POLYTECHNIQUE FÉDÉRALE DE LAUSANNE POUR L'OBTENTION DU GRADE DE DOCTEUR ÈS SCIENCES PAR Simon FISCHER M.Sc. in physics, Université de Berne de nationalité suisse et originaire de Olten (SO) acceptée sur proposition du jury: Prof. M. A. Shokrollahi, président du jury Prof. S. Vaudenay, Dr W. Meier, directeurs de thèse Prof. C. Carlet, rapporteur Prof. A. Lenstra, rapporteur Dr M. Robshaw, rapporteur Suisse 2008 F¨ur Philomena Abstract Stream ciphers are fast cryptographic primitives to provide confidentiality of electronically transmitted data. They can be very suitable in environments with restricted resources, such as mobile devices or embedded systems. Practical examples are cell phones, RFID transponders, smart cards or devices in sensor networks. Besides efficiency, security is the most important property of a stream cipher. In this thesis, we address cryptanalysis of modern lightweight stream ciphers. We derive and improve cryptanalytic methods for dif- ferent building blocks and present dedicated attacks on specific proposals, including some eSTREAM candidates. As a result, we elaborate on the design criteria for the develop- ment of secure and efficient stream ciphers. The best-known building block is the linear feedback shift register (LFSR), which can be combined with a nonlinear Boolean output function. A powerful type of attacks against LFSR-based stream ciphers are the recent algebraic attacks, these exploit the specific structure by deriving low degree equations for recovering the secret key. -
"Analysis and Implementation of RC4 Stream Cipher"
Analysis and Implementation of RC4 Stream Cipher A thesis presented to Indian Statistical Institute in fulfillment of the thesis requirement for the degree of Doctor of Philosophy in Computer Science by Sourav Sen Gupta under the supervision of Professor Subhamoy Maitra Applied Statistics Unit INDIAN STATISTICAL INSTITUTE Kolkata, West Bengal, India, 2013 To the virtually endless periods of sweet procrastination that kept me sane during the strenuous one-night stands with my thesis. i ii Abstract RC4 has been the most popular stream cipher in the history of symmetric key cryptography. Designed in 1987 by Ron Rivest, RC4 is the most widely deployed commercial stream cipher, having applications in network protocols such as SSL, WEP, WPA and in Microsoft Windows, Apple OCE, Secure SQL, etc. The enigmatic appeal of the cipher has roots in its simple design, which is undoubtedly the simplest for any practical cryptographic algorithm to date. In this thesis, we focus on the analysis and implementation of RC4. For the first time in RC4 literature, we report significant keystream bi- ases depending on the length of RC4 secret key. In the process, we prove two empirical biases that were experimentally reported and used in recent attacks against WEP and WPA by Sepehrdad, Vaudenay and Vuagnoux in EUROCRYPT 2011. In addition to this, we present a conclusive proof for the extended keylength dependent biases in RC4, a follow-up problem to our keylength dependent results, identified and partially solved by Isobe, Ohigashi, Watanabe and Morii in FSE 2013. In a recent result by AlFardan, Bernstein, Paterson, Poettering and Schuldt, to appear in USENIX Security Symposium 2013, the authors ob- served a bias of the first output byte towards 129. -
The Dawn of American Cryptology, 1900–1917
United States Cryptologic History The Dawn of American Cryptology, 1900–1917 Special Series | Volume 7 Center for Cryptologic History David Hatch is technical director of the Center for Cryptologic History (CCH) and is also the NSA Historian. He has worked in the CCH since 1990. From October 1988 to February 1990, he was a legislative staff officer in the NSA Legislative Affairs Office. Previously, he served as a Congressional Fellow. He earned a B.A. degree in East Asian languages and literature and an M.A. in East Asian studies, both from Indiana University at Bloomington. Dr. Hatch holds a Ph.D. in international relations from American University. This publication presents a historical perspective for informational and educational purposes, is the result of independent research, and does not necessarily reflect a position of NSA/CSS or any other US government entity. This publication is distributed free by the National Security Agency. If you would like additional copies, please email [email protected] or write to: Center for Cryptologic History National Security Agency 9800 Savage Road, Suite 6886 Fort George G. Meade, MD 20755 Cover: Before and during World War I, the United States Army maintained intercept sites along the Mexican border to monitor the Mexican Revolution. Many of the intercept sites consisted of radio-mounted trucks, known as Radio Tractor Units (RTUs). Here, the staff of RTU 33, commanded by Lieutenant Main, on left, pose for a photograph on the US-Mexican border (n.d.). United States Cryptologic History Special Series | Volume 7 The Dawn of American Cryptology, 1900–1917 David A. -
Secured Data Transmission Using RC4 Algorithm: Encrypting and Decrypting Double Byte Data 1 2 3 SAIPRIYA SAMALA , P.NAVITHA , DR
ISSN 2319-8885 Vol.03,Issue.27 September-2014, Pages:5415-5418 www.ijsetr.com Secured Data Transmission using RC4 Algorithm: Encrypting and Decrypting Double Byte Data 1 2 3 SAIPRIYA SAMALA , P.NAVITHA , DR. M.GURUNADHA BABU Dept of VLSI System Design, CMRIT, Hyderabad, India, Email: [email protected]. Abstract: Cryptography is a science which deals with hiding the data. For hiding the information encryption is done by using encryption algorithm, to retrieve it back decryption is done by decryption algorithm. Cryptography can be performed on two types of ciphers which are stream cipher and block cipher. In stream cipher transmission is performed either bit by bit or byte by byte. Where as in Block cipher transmission is performed block by block. In this paper we deal with stream cipher; and one of the most popular stream ciphers is the RC4 stream cipher. RC4 stream cipher usually generates one byte per clock cycle. Proposed RC4 algorithm generates two bytes per clock cycle. Encryption is performed by using two keys and two blocks of plain texts. Similarly, decryption is performed by using the two keys and two blocks of cipher texts. Keywords: Cryptography, Decryption, Encryption, Loop Unrolling, Pipelining, RC4, Stream Cipher. I. INTRODUCTION II. RC4 STREAM CIPHER In any communication channel, it is important that the The RC4 stream cipher was designed in 1987 by Ron data being transmitted from the sender to the receiver end Rivest for RSA Data Security. RC4 cipher stream is a reaches the receiver without any change in the data which is variable key-size stream cipher with byte-oriented operations. -
Implementation of WG Cipher with High Security
IJISET - International Journal of Innovative Science, Engineering & Technology, Vol. 2 Issue 9, September 2015. www.ijiset.com ISSN 2348 – 7968 Implementation of WG Cipher with High Security Somy Jacob and Jinu Isaac Kuruvilla Mtech student, ECE Department, Mahatma Gandhi University/Mangalam College of Engineering and Technology, Kottayam, Kerala, India Asst.Professor, ECE Department, Mahatma Gandhi University/Mangalam College of Engineering and Technology, Kottayam, Kerala, India Abstract cryptographic algorithms is, however, hard to analyse and, This paper presents hardware designs of the Welch–Gong (WG)- also, some weaknesses have been discovered .The Welch– 128 cipher, one for the multiple output WG (MOWG) version, Gong (WG)(29, 11) corresponds to GF(229) and 11 is the and the other for the single output version WG .The hardware length of the LFSR] is a stream cipher submitted to the implementation of WG Stream cipher is done by using a hardware profile in phase. It has been designed based on substitution block with high security. WG cipher design is used the WG transformations [16] to produce key bit-streams for both encryption and decryption. In the proposed design to increase the security substitution block is added to protect the with mathematically proved randomness aspects. Such data from eavesdropper. Finally the design is implemented properties include balance, long period, ideal tuple using the field-programmable gate array. distribution, large linear complexity, ideal two-level Keywords: linear feedback shift registers, normal basis optimal autocorrelation, cross correlation with an m-sequence has normal basis, pseudorandom key generators, stream ciphers, only three values, high nonlinearity, Boolean function Welch-Gong(WG) transformation with high algebraic degree, and 1-resilient. -
Developing a Hardware Evaluation Method for SHA-3 Candidates
Developing a Hardware Evaluation Method for SHA-3 Candidates Luca Henzen1, Pietro Gendotti2, Patrice Guillet2, Enrico Pargaetzi2, Martin Zoller2, and Frank K. Gürkaynak3 1 Integrated Systems Laboratory, ETH Zurich [email protected] 2 Department of Information Technology and Electrical Enginnering, ETH Zurich {gpietro,pguillet,penrico,mzoller}@ee.ethz.ch 3 Microelectronics Designs Center, ETH Zurich [email protected] Abstract. The U.S. National Institute of Standards and Technology encouraged the publication of works that inves- tigate and evaluate the performances of the second round SHA-3 candidates. Besides the hardware characterization of the 14 candidate algorithms, the main goal of this paper is the description of a reliable methodology to efficiently characterize and compare VLSI circuits of cryptographic primitives. We took the opportunity to apply it on the ongoing SHA-3 competition. To this end, we implemented several architectures in a 90 nm CMOS technology, tar- geting high- and moderate-speed constraints separately. Thanks to this analysis, we were able to present a complete benchmark of the achieved post-layout results of the circuits. 1 Introduction In 2007, the U.S. National Institute of Standards and Technology (NIST) started a public competition aiming at the selection of a new standard for cryptographic hashing [9]. Hash functions are cryptographic primitives that generate a sort of digital fingerprint of an arbitrary-length file, following some fundamental principles. Due to their flexibility, hash functions are used in a wide range of communication protocols where they provide data integrity, user authenti- cation and many other security features. The motivation behind the NIST competition has been the growing concern of the security of two widely deployed hash functions MD5 and SHA-1 following a series of successful attacks [1,2,12]. -
Hardware Accelerator for Stream Cipher Spritz
Hardware Accelerator for Stream Cipher Spritz Debjyoti Bhattacharjee and Anupam Chattopadhyay School of Computer Science and Engineering, Nanyang Technological University, Singapore fdebjyoti001, [email protected] Keywords: Stream Cipher, Hardware Accelerator, Spritz. Abstract: RC4, the dominant stream cipher in e-commerce and communication protocols such as, WEP, TLS, is being considered for replacement due to the series of vulnerabilities that have been pointed out in recent past. After a thorough analysis of the possible weaknesses, Spritz, a new stream cipher is proposed to that effect by the author of RC4. The design of Spritz is based on Cryptographic Sponge construction, which permits Spritz to be used in different modes, and therefore, makes it an attractive design choice for security protocols. Initial software performance analysis of Spritz shows that it fares poorly compared to the state-of-the-art hash functions and stream ciphers. In this paper, we extend the analysis to the hardware performance. We propose a fully customized accelerator design for Spritz and identify the highest achievable runtime performance for ASIC and FPGA technology. Our results show that the Spritz accelerator is significantly faster in encryption compared to the software implementation (32:38× speed-up for the SQUEEZE and 64:07× speed-up for the ABSORB function), though fares weakly against hardware implementation of state-of-the-art hash functions and stream ciphers in terms of area-efficiency. 1 Introduction then gained stronghold with applications in different cryptographic primitives [Bertoni et al., 2010,Bertoni et al., 2011], including the standardization of SHA- Spritz is a new RC4-like stream cipher, proposed 3 [sha, 2015].