DOCSLIB.ORG

Darxplorer a Toolbox for Cryptanalysis and Cipher Designers

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Darxplorer a Toolbox for Cryptanalysis and Cipher Designers DARXplorer a Toolbox for Cryptanalysis and Cipher Designers Dennis Hoppe Bauhaus-University Weimar 22nd April 2009 Dennis Hoppe (BUW) DARXplorer 22nd April 2009 1 / 31 Agenda 1 Introduction to Hash Functions 2 The ThreeFish Block Cipher 3 Differential Cryptanalysis 4 DARXplorer { DC of ThreeFish 5 Results on ThreeFish 6 Generalization of DARXplorer Dennis Hoppe (BUW) DARXplorer 22nd April 2009 2 / 31 Agenda 1 Introduction to Hash Functions 2 The ThreeFish Block Cipher 3 Differential Cryptanalysis 4 DARXplorer { DC of ThreeFish 5 Results on ThreeFish 6 Generalization of DARXplorer Dennis Hoppe (BUW) DARXplorer 22nd April 2009 3 / 31 Introduction to Hash Functions Hash Functions A hash function H : f0; 1g∗ ! f0; 1gn is used to compute an n-bit fingerprint from an arbitrarily-sized input M 2 f0; 1g∗ Most of them are based on a compression function C : f0; 1gn × f0; 1gm ! f0; 1gn with fixed size input Computation: Hi := C(Hi−1;Mi) C C C H[0] H[1] . H[L-1] H[L] M[1] M[2] . M[L] Dennis Hoppe (BUW) DARXplorer 22nd April 2009 4 / 31 Introduction to Hash Functions { cont'd Compression Functions A crucial building block of iterated hash functions is the compression function C Designer often make use of block ciphers Which properties should be imposed on C to guarantee that the hash function satisfies certain properties? Theorem (Damg˚ard-Merkle) If the compression function C is collision-resistant, then the hash function H is collision-resistant as well. If the compression function C is preimage-resistant, then the hash function H is preimage-resistant as well. Dennis Hoppe (BUW) DARXplorer 22nd April 2009 5 / 31 Introduction to Hash Functions { cont'd Vulnerability of Hash Functions Black-Box attacks on the compression function Exploit the way in which multiple compression functions are combined Joux (2004), Kelsey u. Kohno (2006) Attacks dependent on the internal details of the compression function Make use of cryptanalytical techniques One of the most successful attacks against block ciphers is Differential Cryptanalysis Used to crypt analyze MD4, MD5 [Wang u. a. (2004)] Dennis Hoppe (BUW) DARXplorer 22nd April 2009 6 / 31 Introduction to Hash Functions { cont'd Vulnerability of Hash Functions Black-Box attacks on the compression function Exploit the way in which multiple compression functions are combined Joux (2004), Kelsey u. Kohno (2006) Attacks dependent on the internal details of the compression function Make use of cryptanalytical techniques One of the most successful attacks against block ciphers is Differential Cryptanalysis Used to crypt analyze MD4, MD5 [Wang u. a. (2004)] Dennis Hoppe (BUW) DARXplorer 22nd April 2009 6 / 31 Agenda 1 Introduction to Hash Functions 2 The ThreeFish Block Cipher 3 Differential Cryptanalysis 4 DARXplorer { DC of ThreeFish 5 Results on ThreeFish 6 Generalization of DARXplorer Dennis Hoppe (BUW) DARXplorer 22nd April 2009 7 / 31 Introduction to Block Ciphers One-way compression functions built from block ciphers Hi-1 m i mi E Hi-1 g E Hi Hi Davies-Meyer Matyas-Meyer-Oseas Dennis Hoppe (BUW) DARXplorer 22nd April 2009 8 / 31 The ThreeFish Block Cipher Motivation Tweakable block cipher, designed with the purpose to be used as a building block for a hash function Provides speed, flexibility and the ease of analysis to proof security Supports different block sizes (ThreeFish-n); n = 256; 512; 1024 ThreeFish-n supports n-bit blocks and n-bit keys and a 128-bit tweak Usage (Skein) Skein-n uses ThreeFish-n Hi := C(Hi−1;Ti;Mi) :=ThreefishHi−1;Ti (Mi) ⊕ Mi We have to show, that the probability is below 2−2n−128 by providing an upper bound on the probability of the best exclusive-OR difference Dennis Hoppe (BUW) DARXplorer 22nd April 2009 9 / 31 The ThreeFish Block Cipher Motivation Tweakable block cipher, designed with the purpose to be used as a building block for a hash function Provides speed, flexibility and the ease of analysis to proof security Supports different block sizes (ThreeFish-n); n = 256; 512; 1024 ThreeFish-n supports n-bit blocks and n-bit keys and a 128-bit tweak Usage (Skein) Skein-n uses ThreeFish-n Hi := C(Hi−1;Ti;Mi) :=ThreefishHi−1;Ti (Mi) ⊕ Mi We have to show, that the probability is below 2−2n−128 by providing an upper bound on the probability of the best exclusive-OR difference Dennis Hoppe (BUW) DARXplorer 22nd April 2009 9 / 31 The ThreeFish Block Cipher { cont'd Structure of ThreeFish-256 Non-linear MIX function on two 64-bit words MIX MIX Permutation Input (A, B, C, D) Output (A, D, C, B) A B C D Key Schedule PERMUTE Generates subkeys Injects subkeys each 8th round A D C B Completely omitted in DARXplorer Dennis Hoppe (BUW) DARXplorer 22nd April 2009 10 / 31 The ThreeFish Block Cipher { cont'd A B MIX Operation Primitives Addition mod 264, Word-wise rotation, and Bit-wise exclusive-OR c <<< MIX(A; B; c) = (X; Y ) Y = A + B X = (A n c) ⊕ Y X Y Dennis Hoppe (BUW) DARXplorer 22nd April 2009 11 / 31 Agenda 1 Introduction to Hash Functions 2 The ThreeFish Block Cipher 3 Differential Cryptanalysis 4 DARXplorer { DC of ThreeFish 5 Results on ThreeFish 6 Generalization of DARXplorer Dennis Hoppe (BUW) DARXplorer 22nd April 2009 12 / 31 Differential Cryptanalysis Differential Cryptanalysis [Biham u. Shamir (1990)] Exploits the high probability of certain occurrences by tracing differences through the network In: (X0;X00), ∆X = X0 ⊕ X00 Out: (Y 0;Y 00), ∆Y = Y 0 ⊕ Y 00 Ideally randomizing cipher: the probability that a particular output difference ∆Y occurs given a particular input difference ∆X is 2−n Dennis Hoppe (BUW) DARXplorer 22nd April 2009 13 / 31 Differential Cryptanalysis { cont'd Example (DC) Input Difference: ∆P1 = [0000 1011 0000 0000] Difference-Pair for S-Box: S12 : ∆X = B ! ∆Y = 2 with probability p1 = 1=2 Output Difference: ∆V1 = [0000 0010 0000 0000] Try to find r-round characteristics! Dennis Hoppe (BUW) DARXplorer 22nd April 2009 14 / 31 Differential Cryptanalysis of ThreeFish Differential Cryptanalysis of ThreeFish We need to make assumptions about A B the differential properties of the primitives Differential exclusive-OR δw = δu ⊕ δv P r[δw] = 1:0 c <<< Differential rotations 0 t = u n i; t = (u ⊕ δu) n i 0 δt = t ⊕ t = δu n i P r[δt] = 1:0 Differential addition Evaluating the differential properties of addition with respect to X Y exclusive-OR is hard Dennis Hoppe (BUW) DARXplorer 22nd April 2009 15 / 31 Differential Cryptanalysis of ThreeFish Differential Cryptanalysis of ThreeFish We need to make assumptions about A B the differential properties of the primitives Differential exclusive-OR δw = δu ⊕ δv P r[δw] = 1:0 c <<< Differential rotations 0 t = u n i; t = (u ⊕ δu) n i 0 δt = t ⊕ t = δu n i P r[δt] = 1:0 Differential addition Evaluating the differential properties of addition with respect to X Y exclusive-OR is hard Dennis Hoppe (BUW) DARXplorer 22nd April 2009 15 / 31 Differential Cryptanalysis of ThreeFish Differential Cryptanalysis of ThreeFish We need to make assumptions about A B the differential properties of the primitives Differential exclusive-OR δw = δu ⊕ δv P r[δw] = 1:0 c <<< Differential rotations 0 t = u n i; t = (u ⊕ δu) n i 0 δt = t ⊕ t = δu n i P r[δt] = 1:0 Differential addition Evaluating the differential properties of addition with respect to X Y exclusive-OR is hard Dennis Hoppe (BUW) DARXplorer 22nd April 2009 15 / 31 Differential Cryptanalysis of ThreeFish { cont'd Computing the Differential Properties of Addition [Lipmaa u. Moriai (2001)] Due to the lack of theory it was hard to evaluate the security of ciphers that employ both exclusive-OR and addition Compute the probability that, given input differences δu and δv result in the output difference δs + DP (δu; δv ! δs) Θ(log n) (worst-case), Θ(1) + t (average) Compute all \good" output differentials in a deterministic way + + DPmax(δu; δv) = maxδs fDP (δu; δv ! δs)g Θ(log n) Dennis Hoppe (BUW) DARXplorer 22nd April 2009 16 / 31 Differential Cryptanalysis of ThreeFish { cont'd Computing the Differential Properties of Addition [Lipmaa u. Moriai (2001)] Due to the lack of theory it was hard to evaluate the security of ciphers that employ both exclusive-OR and addition Compute the probability that, given input differences δu and δv result in the output difference δs + DP (δu; δv ! δs) Θ(log n) (worst-case), Θ(1) + t (average) Compute all \good" output differentials in a deterministic way + + DPmax(δu; δv) = maxδs fDP (δu; δv ! δs)g Θ(log n) Dennis Hoppe (BUW) DARXplorer 22nd April 2009 16 / 31 Differential Cryptanalysis of ThreeFish { cont'd Computing the Differential Properties of Addition [Lipmaa u. Moriai (2001)] Due to the lack of theory it was hard to evaluate the security of ciphers that employ both exclusive-OR and addition Compute the probability that, given input differences δu and δv result in the output difference δs + DP (δu; δv ! δs) Θ(log n) (worst-case), Θ(1) + t (average) Compute all \good" output differentials in a deterministic way + + DPmax(δu; δv) = maxδs fDP (δu; δv ! δs)g Θ(log n) Dennis Hoppe (BUW) DARXplorer 22nd April 2009 16 / 31 Differential Cryptanalysis of ThreeFish { cont'd Recap Regard input and output differences MIX MIX of the ThreeFish building blocks MIX operation Permutation A B C D ) A complete round PERMUTE Try to find r-round characteristics A D C B Dennis Hoppe (BUW) DARXplorer 22nd April 2009 17 / 31 Agenda 1 Introduction to Hash Functions 2 The ThreeFish Block Cipher 3 Differential Cryptanalysis 4 DARXplorer { DC of ThreeFish 5 Results on ThreeFish 6 Generalization of DARXplorer Dennis Hoppe (BUW) DARXplorer 22nd April 2009 18 / 31 DARXplorer { An Introduction DARXplorer [Lucks (2008)] Provides automatic
Load more

Recommended publications
  • SHA-3 Conference, March 2012, Skein: More Than Just a Hash Function
    Skein More than just a hash function Third SHA-3 Candidate Conference 23 March 2012 Washington DC 1 Skein is Skein-512 • Confusion is common, partially our fault • Skein has two special-purpose siblings: – Skein-256 for extreme memory constraints – Skein-1024 for the ultra-high security margin • But for SHA-3, Skein is Skein-512 – One hash function for all output sizes 2 Skein Architecture • Mix function is 64-bit ARX • Permutation: relocation of eight 64-bit words • Threefish: tweakable block cipher – Mix + Permutation – Simple key schedule – 72 rounds, subkey injection every four rounds – Tweakable-cipher design key to speed, security • Skein chains Threefish with UBI chaining mode – Tweakable mode based on MMO – Provable properties – Every hashed block is unique • Variable size output means flexible to use! – One function for any size output 3 The Skein/Threefish Mix 4 Four Threefish Rounds 5 Skein and UBI chaining 6 Fastest in Software • 5.5 cycles/byte on 64-bit reference platform • 17.4 cycles/byte on 32-bit reference platform • 4.7 cycles/byte on Itanium • 15.2 cycles/byte on ARM Cortex A8 (ARMv7) – New numbers, best finalist on ARMv7 (iOS, Samsung, etc.) 7 Fast and Compact in Hardware • Fast – Skein-512 at 32 Gbit/s in 32 nm in 58 k gates – (57 Gbit/s if processing two messages in parallel) • To maximize hardware performance: – Use a fast adder, rely on simple control structure, and exploit Threefish's opportunities for pipelining – Do not trust your EDA tool to generate an efficient implementation • Compact design: – Small FPGA
    [Show full text]
  • Future Internet (FI) and Innovative Internet Technologies and Mobile Communication (IITM)
    Chair of Network Architectures and Services Department of Informatics Technical University of Munich Proceedings of the Seminars Future Internet (FI) and Innovative Internet Technologies and Mobile Communication (IITM) Summer Semester 2018 26. 2. 2017 – 19. 8. 2018 Munich, Germany Editors Georg Carle, Daniel Raumer, Stephan Gunther,¨ Benedikt Jaeger Publisher Chair of Network Architectures and Services Network Architectures and Services NET 2018-11-1 Lehrstuhl für Netzarchitekturen und Netzdienste Fakultät für Informatik Technische Universität München Proceedings zu den Seminaren Future Internet (FI) und Innovative Internet-Technologien und Mobilkommunikation (IITM) Sommersemester 2018 München, 26. 2. 2017 – 19. 8. 2018 Editoren: Georg Carle, Daniel Raumer, Stephan Günther, Benedikt Jaeger Network Architectures and Services NET 2018-11-1 Proceedings of the Seminars Future Internet (FI) and Innovative Internet Technologies and Mobile Communication (IITM) Summer Semester 2018 Editors: Georg Carle Lehrstuhl für Netzarchitekturen und Netzdienste (I8) Technische Universität München 85748 Garching b. München, Germany E-mail: [email protected] Internet: https://net.in.tum.de/~carle/ Daniel Raumer Lehrstuhl für Netzarchitekturen und Netzdienste (I8) E-mail: [email protected] Internet: https://net.in.tum.de/~raumer/ Stephan Günther Lehrstuhl für Netzarchitekturen und Netzdienste (I8) E-mail: [email protected] Internet: https://net.in.tum.de/~guenther/ Benedikt Jaeger Lehrstuhl für Netzarchitekturen und Netzdienste (I8) E-mail: [email protected] Internet: https://net.in.tum.de/~jaeger/ Cataloging-in-Publication Data Seminars FI & IITM SS 18 Proceedings zu den Seminaren „Future Internet“ (FI) und „Innovative Internet-Technologien und Mobilkom- munikation“ (IITM) München, Germany, 26. 2. 2017 – 19. 8.
    [Show full text]
  • A Re-Examine on Assorted Digital Image Encryption Algorithm's
    Biostatistics and Biometrics Open Access Journal ISSN: 2573-2633 Review Article Biostat Biometrics Open Acc J Volume 4 Issue 2 - January 2018 Copyright © All rights are reserved by Thippanna G DOI: 10.19080/BBOAJ.2018.04.555633 A Re-Examine on Assorted Digital Image Encryption Algorithm’s Techniques Thippanna G* Assistant Professor, CSSR & SRRM Degree and PG College, India Submission: October 05, 2017; Published: January 17, 2018 *Corresponding author: Thippanna G, Assistant Professor, CSSR & SRRM Degree and PG College, India, Tel: ; Email: Abstract Image Encryption is a wide area epic topic to research. Encryption basically deals with converting data or information from its original form to another unreadable and unrecognizable form that hides the information in it. The protection of information from unauthorized access is important in network/internet communication. The use of Encryption is provides the data security. The Encrypted Image is secure from any kind cryptanalysis. In the proposed dissertation explain the different encryption algorithms and their approaches to encrypt the images. In this paper introduced a case study on assorted digital image encryption techniques, are helpful to gives knowledge on entire digital image encryption techniques. This can offer authentication of users, and integrity, accuracy and safety of images that is roaming over communication. Moreover, associate image based knowledge needs additional effort throughout encoding and cryptography. Keywords : Encryption; Cryptanalysis; Cryptographic; Algorithm; Block ciphers; Stream ciphers; Asymmetric Encryption Abbreviations : AES: Advanced Encryption Standard; DSA: Digital Signature Algorithm; DSS: Digital Signature Standard; ECDSA: Elliptic Curve Digital Signature Algorithm; DSA: Digital Signature Algorithm Introduction Some cryptographic methods rely on the secrecy of the Encryption algorithms encryption algorithms; such algorithms are only of historical Encryption algorithm, or cipher, is a mathematical function interest and are not adequate for real-world needs.
    [Show full text]
  • The Implementation of ”Kuznyechik” Encryption Algorithm Using NVIDIA CUDA Technology
    The implementation of "Kuznyechik" encryption algorithm using NVIDIA CUDA technology A N Borisov1 and E V Myasnikov1 1Samara National Research University, Moskovskoe Shosse 34А, Samara, Russia, 443086 e-mail: [email protected] Abstract. In this paper, we discuss various options for implementing the "Kuznyechik" block encryption algorithm using the NVIDIA CUDA technology. We use lookup tables as a basis for the implementation. In experiments, we study the influence of the size of the block of threads and the location of lookup tables on the encryption speed. We show that the best results are obtained when the lookup tables are stored in the global memory. The peak encryption speed reaches 30.83 Gbps on the NVIDIA GeForce GTX 1070 graphics processor . 1. Introduction Cryptographic protection is an important part of a modern IT infrastructure. Nowadays, both the volume of information and computing power are continually increasing. Accordingly, there are growing demands on both the robustness and speed of cryptographic algorithms. The idea of using graphics processors to speed up encryption algorithms appeared almost simultaneously with the idea of using them for general-purpose computing[1]. As known, the maximum profit from the use of graphics processors can be achieved only with massive parallel tasks. It is not surprising that the most noticeable results in this field were obtained for block encryption in the ECB (electronic code book) and CTR (gamming) modes, since the blocks of plain text are processed independently in this case. At present, there is a lot of papers, which focuses on using graphics processors for encryption. Most of the papers are devoted to the AES encryption algorithm.
    [Show full text]
  • Comparative Analysis of AES, Blowfish, Twofish and Threefish Encryption Algorithms
    JOURNAL OF ANALYSIS OF APPLIED MATHEMATICS Volume 10, 2017 JOURNAL OF ANALYSIS OF APPLIED MATHEMATICS At AAM, we are passionate about matHematics education and devoted to motivating students to expand their knowledge of applied math through research. © Analysis of Applied MatHematics, 2017 ALL RIGHTS RESERVED Analysis of Applied MatHematics ½Volume 10 2 JOURNAL OF ANALYSIS OF APPLIED MATHEMATICS The International Journal of Applied MatHematics for Secondary School Students. AIM AND SCOPE Analysis of Applied MatHematics (AAM) is a journal devoted to the publication of original research papers in applied matHematics for high (secondary) school students. Our mission is to promote academic curiosity in the field of matHematics by encouraging students to produce quality research. AAM provides a unique opportunity for high school students to publisH a matHematics-based research article in a journal. The topics considered for publication can involve any aspect of applied matHematics including topics from the medical, scientific, engineering, finance and business fields. Examples of applied matHematics topics are: • Electronics: televisions, computers, video games, smart pHones, and modern appliances • Transportation: Automobiles, air planes, space sHuttles • Systems and Processes: Traffic ligHt systems, social cHoice tHeory, inventory systems, internet searcH engines, algoritHm improvement There are a number of possible applied matHematics papers that would qualify for the Analysis of Applied MatHematics. For more information, please visit us at analysisofappliedmatHematics.org. If you have any questions about whether your topic is eligible for submission, please contact us at [email protected]. Analysis of Applied MatHematics ½Volume 10 3 Contents Contents ................................................................................................................................. 4 Comparative Analysis of AES, Blowfish, Twofish and Threefish Encryption Algorithms ..........
    [Show full text]
  • Security Policy: Java Crypto Module
    FIPS 140-2 Non-Proprietary Security Policy: Java Crypto Module FIPS 140-2 Non-Proprietary Security Policy Java Crypto Module Software Version 1.0 Document Version 1.1 March 8, 2017 Prepared For: Prepared By: Silent Circle SafeLogic Inc. 4210 Fairfax Corner West Ave. 530 Lytton Ave. Suite 215 Suite 200 Fairfax, VA 22033 Palo Alto, CA 94301 www.silentcircle.com www.safelogic.com Document Version 1.1 © Silent Circle Page 1 of 21 FIPS 140-2 Non-Proprietary Security Policy: Java Crypto Module Abstract This document provides a non-proprietary FIPS 140-2 Security Policy for Java Crypto Module. Document Version 1.1 © Silent Circle Page 2 of 21 FIPS 140-2 Non-Proprietary Security Policy: Java Crypto Module Table of Contents 1 Introduction .................................................................................................................................................. 5 1.1 About FIPS 140 ............................................................................................................................................. 5 1.2 About this Document.................................................................................................................................... 5 1.3 External Resources ....................................................................................................................................... 5 1.4 Notices .......................................................................................................................................................... 5 1.5 Acronyms .....................................................................................................................................................
    [Show full text]
  • An Efficient Implementation of the Blowfish Encryption Algorithm
    An Efficient Implementation of the Blowfish Encryption Algorithm A thesis submitted to the Graduate School of the University of Cincinnati In partial fulfillment of the requirements For the degree of Master of Science In the Department of Electrical and Computer Engineering Of the College of Engineering and Applied Sciences July 2014 By Ramya Krishna Addluri B.E, Electronics and Communications Engineering, University College of Engineering, Osmania University, India, 2011 Thesis Advisor and Committee Chair: Dr. Carla Purdy ABSTRACT Global networking and mobile computing are prevalent today, with the increase of communication methods such as telephones, computers, internet, broadcasting, etc. Because these transmission channels are open, there is no guarantee to avoid unauthorized access of the information through eavesdropping. Thus, several encryption algorithms have been designed for the security of the information being stored or transmitted. Several applications require such high throughputs for encryption and decryption that they cannot be executed on a regular general purpose microprocessor. FPGAs are a great platform for such implementations. We briefly study several cryptographic algorithms designed to prevent eavesdropping and then focus in detail on the Blowfish encryption algorithm. It is widely used in tools for password management, database security, email encryption etc. The algorithm is implemented in VHDL. It is then deployed onto a Nios II soft core processor on Altera DE1 board. Altera Quartus II is used to synthesize the design. Software based Huffman encoding is used to encode the input to the algorithm to reduce redundancy and to achieve lossless data compression. The results are analyzed. ii iii ACKNOWLEDGEMENT First of all, I would like to thank my advisor, Dr.
    [Show full text]
  • The Dblock Family of Block Ciphers
    SCIENCE CHINA Information Sciences . RESEARCH PAPER . March 2015, Vol. 58 032105:1–032105:14 doi: 10.1007/s11432-014-5219-0 The DBlock family of block ciphers WU WenLing1,2 *, ZHANG Lei1 & YU XiaoLi1 1Trusted Computing and Information Assurance Laboratory, Institute of Software, Chinese Academy of Sciences, Beijing 100190,China; 2State Key Laboratory of Computer Science, Institute of Software, Chinese Academy of Sciences, Beijing 100190,China Received March 11, 2014; accepted September 23, 2014 Abstract In this paper, we propose a new family of block ciphers named DBlock. It consists of three variants which are specified as DBlock-128, DBlock-192, and DBlock-256, respectively. DBlock-n has the equal n-bit block length and key length. The structure of DBlock successfully combines the advantages of Feistel and Type-2 generalized Feistel structures together. Also, its design of round function employs different linear transforms operating on various word-sizes, which efficiently improve the diffusion effect. For key schedule of DBlock, it basically employs the same module used in encryption, except the choice of different byte permutations, which can improve its suitability for various implementation environments and also enhance its security against many cryptanalytic techniques. Our preliminary evaluation shows that DBlock can achieve enough security margin against known attacks, and it can also obtain excellent performances on various software and hardware platforms. Keywords block cipher, structure, round function, key scheduling, security, performance. Citation Wu W L, Zhang L, Yu X L. The DBlock family of block ciphers. Sci China Inf Sci, 2015, 58: 032105(14), doi: 10.1007/s11432-014-5219-0 1 Introduction Developments of new cryptanalysis and design techniques are the two most important aspects of the study on block cipher.
    [Show full text]
  • Security of Authenticated Encryption Modes
    Security of Authenticated Encryption Modes Bart Mennink Radboud University (The Netherlands) COST Training School on Symmetric Cryptography and Blockchain February 22, 2018 1 / 57 −−−−−! −−−−− Encryption • No outsider can learn anything about data Authentication • No outsider can manipulate data Authenticated Encryption A −−−−−−−−−−−−−−−−−−−−−−−−−−−−! B 2 / 57 Encryption • No outsider can learn anything about data Authentication • No outsider can manipulate data Authenticated Encryption A −−−−−−−−−−−−−−−−−−−−−−−−−−−−!−−−−−! −−−−− B 2 / 57 Authentication • No outsider can manipulate data Authenticated Encryption A −−−−−−−−−−−−−−−−−−−−−−−−−−−−!−−−−−! −−−−− B Encryption • No outsider can learn anything about data 2 / 57 Authenticated Encryption A −−−−−−−−−−−−−−−−−−−−−−−−−−−−!−−−−−! −−−−− B Encryption • No outsider can learn anything about data Authentication • No outsider can manipulate data 2 / 57 CAESAR Competition 3 / 57 CAESAR Competition Competition for Authenticated Encryption: Security, Applicability, and Robustness Goal: portfolio of authenticated encryption schemes Mar 15, 2014: 57 rst round candidates Jul 7, 2015: 29.5 second round candidates Aug 15, 2016: 16 third round candidates ??: announcement of nalists ??: announcement of nal portfolio 4 / 57 • Nonce N randomizes the scheme Authenticated Encryption 4 AE k A, M AE C, T N • Ciphertext C encryption of message M • Tag T authenticates associated data A and message M 5 / 57 Authenticated Encryption 4 AE k A, M AE C, T N • Ciphertext C encryption of message M • Tag T authenticates
    [Show full text]
  • Understanding How to Prevent Sensitive Data Exposure
    Understanding how to prevent Sensitive Data Exposure Dr Simon Greatrix Just Trust The Internet! • Lots of free advice • Opinions to suit all tastes • Also has pictures of cats! • Not responsible for the collapse of civilization (so far) • Google has excellent branding Top tips for a successful presentation! (according to the internet) • Start with a joke • Imagine the audience naked • Avoid showing emotion • Use images to jazz things up Obligatory famous historical data breaches ● 200,000 BCE to 6000 BCE : Tribal life with no privacy at all ● 600 BCE to 400CE: Ancient City culture view privacy as a bad thing ● 75 CE to 800 CE: There is no word for “privacy” in classical nor medieval“Where Latin people conceal their ways from one another … ● 1215 CE:there Fourth no Council one will Of ever Lateran rightly makes gain neitherconfession their mandatory due honour nor office nor the justice that is befitting” ● 1450 CE: First use of “privacy” in English. Socrates (470 to 399 BCE) ● 1700 CE: Solo beds ● 1890 CE: First use of “Right To Privacy” What are we actually expected to do? ● The Standards – OWASP – PCI-DSS ● The Tools – Ciphers – Hashes An aside: What is “strong encryption”? Source: https://www.keylength.com Is this really a good idea? https://xkcd.com/538/ Your Personal Information Please don’t send us your personal information. We do not want your personal information. We have a hard enough time keeping track of our own personal information, let alone yours. If you tell us your name, or any identifying information, we will forget it immediately.
    [Show full text]
  • Side-Channel Analysis of Keccak and Ascon
    Master Thesis Computing Science Radboud University Nijmegen Side-Channel Analysis of Keccak and Ascon Author: Supervisor: Niels Samwel Prof. dr. Joan Daemen Second Assessor: Dr. Lejla Batina Daily Supervisor: MSc. Kostas Papagiannopoulos August 31, 2016 Abstract This thesis is about side-channel analysis of the SHA-3 competition winner Keccak and a similar algorithm Ascon. During the operation of such an algo- rithm on a device information will leak in many different ways. In this thesis we only look at the information that is leaked by the power consumption of a device. This leakage can be exploited with a technique called DPA. With DPA one tries to obtain a small part of secret data, usually the secret key using a many power traces with random input messages and the key in each trace. We verified a theoretical attack with experiments on an actual chip. We also compared an attack on MAC-Keccak implemented on an FPGA to an ASIC. For Ascon which was implemented on an FPGA we crafted a sim- ilar attack as Keccak. With DPA being a very powerful tool for an attacker hardware needs to be designed with countermeasures against this. Threshold implementations are such countermeasures, we tried to attack an threshold implementation on an FPGA of Ascon to see if it was possible with a feasible amount of power traces. Finally, we look a the noise components in a power trace and how much effect the effect of electrical noise is with Ascon. Acknowledgments I would like to thank my supervisors for their continuous support and feed- back throughout the semester.
    [Show full text]
  • Mcoe: a Family of Almost Foolproof On-Line Authenticated Encryption Schemes
    McOE: A Family of Almost Foolproof On-Line Authenticated Encryption Schemes Ewan Fleischmann, Christian Forler, and Stefan Lucks Bauhaus-University Weimar, Germany {ewan.fleischmann,christian.forler,stefan.lucks}@uni-weimar.de Abstract. On-Line Authenticated Encryption (OAE) combines privacy with data integrity and is on-line computable. Most block cipher-based schemes for Authenticated Encryption can be run on-line and are prov- ably secure against nonce-respecting adversaries. But they fail badly for more general adversaries. This is not a theoretical observation only – in practice, the reuse of nonces is a frequent issue1. In recent years, cryptographers developed misuse-resistant schemes for Authenticated Encryption. These guarantee excellent security even against general adversaries which are allowed to reuse nonces. Their dis- advantage is that encryption can be performed in an off-line way, only. This paper considers OAE schemes dealing both with nonce-respecting and with general adversaries. It introduces McOE,anefficientdesignfor OAE schemes. For this we present in detail one of the family members, McOE-X, which is a design solely based on a standard block cipher. As all the other member of the McOE family, it provably guarantees reasonable security against general adversaries as well as standard security against nonce-respecting adversaries. Keywords: authenticated encryption, on-line encryption, provable se- curity, misuse resistant. 1 Introduction On-Line Authenticated Encryption (OAE). Application software often requires a network channel that guarantees the privacy and authenticity of data be- ing communicated between two parties. Cryptographic schemes able to meet both of these goals are commonly referred to as Authenticated Encryption (AE) schemes.
    [Show full text]