Towards a Unifying View of Block Cipher Cryptanalysis

Towards a unifying view of block cipher cryptanalysis David Wagner⋆ University of California, Berkeley Abstract. We introduce commutative diagram cryptanalysis, a framework for expressing certain kinds of attacks on product ciphers. We show that many familiar attacks, including linear cryptanalysis, differential cryptanalysis, differential-linear cryptanalysis, mod n attacks, truncated differential cryptanalysis, impossible differential cryptanalysis, higher- order differential cryptanalysis, and interpolation attacks can be ex- pressed within this framework. Thus, we show that commutative diagram attacks provide a unifying view into the field of block cipher cryptanalysis. Then, we use the language of commutative diagram cryptanalysis to compare the power of many previously known attacks. Finally, we introduce two new attacks, generalized truncated differential cryptanalysis and bivariate interpolation, and we show how these new techniques generalize and unify many previous attack methods. 1 Introduction How do we tell if a block cipher is secure? How do we design good ciphers? These two questions are central to the study of block ciphers, and yet, after decades of research, definitive answers remain elusive. For the moment, the art of cipher evaluation boils down to two key tasks: we strive to identify as many novel cryptanalytic attacks on block ciphers as we can, and we evaluate new designs by how well they resist known attacks. The research community has been very successful at this task. We have accu- mulated a large variety of different attack techniques: differential cryptanalysis, linear cryptanalysis, differential-linear attacks, truncated differential cryptanalysis, higher-order differentials, impossible differentials, mod n attacks, integrals, boomerangs, sliding, interpolation, the yo-yo game, and so on. The list continues to grow. Yet, how do we make sense of this list? Are there any common threads tying these different attacks together? In this paper, we seek unifying themes that can put these attacks on a common foundation. We have by no means accomplished such an ambitious goal; rather, this paper is intended as a first step in that direction. In this paper, we show how a small set of ideas can be used to generate many of today’s known attacks. Then, we show how this viewpoint allows us to compare the strength of different types of attacks, and possibly to discover new attack techniques. We ⋆ This work is supposed by NSF ITR CNS-0113941. g A - X f i ? h ? B - Y Fig. 1. An example of a commutative diagram. The intended meaning of this diagram is that h ◦ f = i ◦ g. hope this perspective will be of some interest, if only to see a different way to think about the known cryptanalytic attacks on block ciphers. 2 Background What is a block cipher? A block cipher is a map E : so that Ek is −1 K×M→M invertible for all keys k , and both Ek and Ek can be efficiently computed. The set is the space∈ of K texts; for instance, for AES, it is = 0, 1 128. M M { } When is a block cipher secure? A block cipher is secure if it behaves as a pseudorandom permutation. In other words, it must be secure against distinguishing attacks: no efficient algorithm A given interactive access to encryption and decryption black boxes should be to distinguish the real cipher (i.e., Ek and −1 −1 Ek ) from a truly random permutation (i.e., π and π , where π is uniformly distributed on the set of all permutations on ) with non-negligible advantage. −1 M E ,E The distinguishing advantage of an attack A is given by Adv A = Pr[A k k = −1 1] Pr[Aπ,π = 1]. − In this paper, we focus exclusively on distinguishing attacks. Usually, once a distinguishing attack is found, a key-recovery attack soon follows; the hard part is in finding a distinguishing attack in the first place, or in building a cipher secure against distinguishing attacks. How are block ciphers built? Most block ciphers are product ciphers. In other words, the cipher is built as the composition of individual round transformations: we choose a round function f : , compute a sequence of round keys M → M k1,...,kn as a function of the key k, and set Ek = fkn fk1 . The function f computes one round of the cipher. ◦···◦ Commutative diagrams. In the discussion to follow, it will be useful to introduce a concept from abstract algebra: that of commutative diagrams. Commutative diagrams are a concise notation for expressing functional composition properties. An example of a commutative diagram can be found in Fig. 1. In this example, the symbols A,B,X,Y represent sets, and the symbols f,g,h,i are functions with signatures f : A B, g : A X, h : B Y , and i : X Y . We say that the diagram “commutes”→ if h f =→i g, or in other→ words, if h(f→(a)) = i(g(a)) for ◦ ◦ all a A. Notice how paths correspond to functions, obtained by composing the maps∈ associated with each edge in the path. In this diagram, there are two paths from A to Y , corresponding to two functions with signature A Y . Informally, the idea is that it doesn’t matter which path we follow from→A to Y ; we will obtain the same map either way. More complicated diagrams can be used to express more complex relationships, and identifying the set of implied identities is merely a matter of chasing arrows through the diagram. Markov processes. Also, we recall the notion of Markov processes. A Markov process is a pair of random variables I,J, and to it we associate a transition matrix M given by Mi,j = Pr[J = j I = i]. We call the sequence of random variables I J K a Markov chain if |K is conditionally independent of I given J. We can− associate− transition matrices M,M ′,M ′′ to the Markov processes I J, J K, and I K, respectively, and if I J K forms a Markov chain, we− will have− M ′′ = M− ′ M. In other words, composition− − of Markov processes corresponds to multiplication· of their associated transition matrices. The maximum advantage of an adversary at distinguishing one Markov process from another can be calculated using decorrelation theory [14]. Let M ∞ || || denote the ℓ∞ norm of the matrix M, i.e., M ∞ = maxi Mi,j . We can || || j | | consider an adversary A who is allowed to choose a single input,P feed it through the Markov process, and observe the corresponding output. The maximum advantage of any such adversary at distinguishing M from M ′ will then be exactly 1 ′ M M ∞. If U denotes the uniform m n transition matrix, i.e., Ui,j = 1/n 2 || − || × for all i, j, then M1M2 U ∞ M1 U ∞ M2 U ∞. The above calculations|| − can|| be≤ extended || − to|| calculate· || − the|| advantage Adv A = ′ Pr[AM = 1] Pr[AM = 1] of an adversary A who can interact repeatedly with − 1 ′ the Markov process. First, if 2 M M ∞ = ǫ denotes the advantage of a single- query adversary, then an adversary|| − making|| q queries has advantage at most q ǫ. In practice, when ǫ is small, the advantage of a q-query adversary often scales· roughly as √q ǫ. Hence, as a rough rule of thumb, Θ(1/ǫ2) queries often are necessary and∼ sufficient· to distinguish M from M ′ with non-trivial probability [3]. We emphasize, though, that this heuristic is not always valid; there are many important exceptions. The advantage of a q-query adversary can be computed more precisely. If M is q q q q a m n matrix, let [M] denote the m n matrix given by ([M] )i,j = Mi1,j1 × × × Mi ,j . Define the matrix norm M a = maxi1 maxi Mi,j . · · · × q q || || j1 · · · q jq | | Then, in an adaptive attack, the maximum advantageP of any q-queryP adver- 1 q ′ q sary is exactly maxA Adv A = 2 [M] [M ] a. In a non-adaptive attack, the || − || 1 q maximum advantage of any q-query non-adaptive adversary is exactly 2 [M] ′ q || − [M ] ∞. || Organization. The rest of this paper studies cryptanalysis of product ciphers. First, we describe commutative diagrams and their relevance to cryptanalysis. Then, we explore statistical attacks, a probabilistic generalization of commutative diagram attacks, and then we further generalize by introducing the notion of higher-order attacks. Finally, we explore algebraic attacks. ρ M - Y fk g ? ′ ? ρ ′ M - Y Fig. 2. A local property of the round function fk. 3 Commutative diagram attacks The basic recipe for analyzing a product cipher is simple: 1. Identify local properties of the cipher’s round functions. 2. Piece these together to obtain a global property of the cipher as a whole. In this way, we seek to exploit the structure of a product cipher—namely, its construction as a composition of round functions—to simplify the cryptanalyst’s task. How do we identify local properties of the round function that are both non-trivial and can be spliced together suitably? This is where commutative diagrams can help. Let fk : denote a round function. Suppose we can find a property of the inputM that → M is preserved by the round function; then this would suffice as a local property. If there is some partial information about x that allows to predict part of the value of fk(x), this indicates a pattern of non-randomness in the round function that might be exploitable. One way to formalize this is using projections. A projection is a function ρ : Y from the text space to a smaller set Y . If we have two projections ρ, ρ′ M →′ so that ρ (fk(x)) can be predicted from ρ(x), then we have a local property of the round function.

Load more