Rain: Reversible Addition with Increased Nonlinearity

International Journal of Network Security, Vol.15, No.4, PP.298-306, July 2013 298 Rain: Reversible Addition with Increased Nonlinearity Jaydeb Bhaumik1, Debdeep Mukhopadhyay2, and Dipanwita Roy Chowdhury2 (Corresponding author: Jaydeb Bhaumik) Dept. of ECE, Haldia Institute of Technology, Haldia, West Bengal, India, Pin-7216571 Dept. of CSE, Indian Institute of Technology Kharagpur, Kharagpur, West Bengal, India, Pin-7213022 (Email: [email protected]) (Received Oct. 12, 2010; revised and accepted Mar. 28, 2011) Abstract dition modulo 2n for key stream generation. In case of block ciphers like IDEA, MARS, FEAL, SEA addition This paper proposes a reversible, balanced and nonlin- mod 2n is used for round key mixing operation. Secure ear vectorial Boolean function called `Rain'. Traditional hash algorithms SHA-0 and SHA-1 also employ addition integer addition modulo 2n has several features like re- modulo 2n to compute hash value. Although addition versibility, balancedness and nonlinearity. However, the modulo 2n has wide range of applications but bias of the bias for the best linear approximation of the output bits best linear approximation of the output bit is quite high. and their linear combinations is quite high. This leads to The bias of the best linear approximation for the output several attacks on stream cipher like NLS, which employs bit of addition mod 2n has been studied in [9, 14] n addition modulo 2 . In this paper, it has been proved Cho and Pieprzyk presented a linear distinguishing mathematically that the bias of the each output bit and attack called Crossword Puzzle Attack (CPA)[2] on the their non-zero linear combinations of the proposed vec- stream cipher NLS [10], which has been submitted to eS- torial Boolean function decreases exponentially with the TREAM project. In [8], MacDoland and Hawkes have bit position. Also as a case study, it has been shown that proposed an improved version of CPA on NLS by exploit- attacks against stream cipher NLS is prevented through ing the internal dependencies between NFSR and NLF. the incorporation of Rain. Linear approximations based on adjacent bits are used Keywords: Boolean function, NLS and crossword puzzle to build a distinguisher for the case Konst = 0 with bias attack, nonlinearity, reversibility 2−19:7 [8]. CPA [2] has been claimed to be prevented in [1] using a vectorial Boolean function Slash instead of addition modulo 2n in the nonlinear filter (NLF) of NLS. The 1 Introduction function Slash [1] is nonlinear, reversible and has a strong resistance against linear cryptanalysis. Also it has been Boolean functions play an important role in the design shown that hardware implementation cost and time delay of symmetric key cryptographic algorithms. In case of of Slash is less compared to addition mod 2n. However like block ciphers like AES and DES, nonlinearity is provided modular addition, Slash has the demerit that the bias [7] by the substitution boxes (S-box) solely. S-boxes are of the XOR of consecutive output bit positions is held con- 1 the most important and complex part of many block ci- stant at 4 . It is shown that NLS can still be attacked by phers. Implementation of S-box in software or hardware the CPA in spite of Slash, because of the property stated requires either significant amount of memory or silicon above which makes Slash virtually equivalent to modular area. Therefore, S-boxes make the block ciphers unsuit- addition. This motivates the study of highly nonlinear, able for light weight cryptography [6]. Also, recent find- reversible and balanced vectorial Boolean function. ings show that look up table based implementation of In this paper, a new vectorial Boolean function called S-boxes are prone to cache-timing and other side channel `Rain'( Reversible Addition with Increased Nonlinearity) attacks [4, 5]. Thus it may be prudent at this point to look has been proposed which is nonlinear, balanced and also into Boolean circuits which provide high nonlinearity. reversible. The nonlinearity of each component function Addition modulo 2n has wide range of applications in has been computed using basic definition of nonlinearity the design of many cryptographic primitives like stream [13]. It provides better resistance against linear crypt- cipher, block cipher and hash function, because it is non- analysis compared to addition and Slash. It has been linear, reversible and balanced function. Stream ciphers shown that the bias of the XOR of consecutive bits po- like HC-128, Rabbit, Salsa20, NLS and Helix employ ad- sition in the output also decreases exponentially with bit International Journal of Network Security, Vol.15, No.4, PP.298-306, July 2013 299 position. Such a strong reversible function may be em- Definition 10. A Boolean function ξ(x) of n variables, ployed to plague cryptanalysis like CPA against NLS ci- where n is even, is called a Bent function if it has a non- pher on dint of the property that XOR of successive terms linearity value 2n−1 − 2n=2−1 [12]. This is the highest have a low bias compared to either modulo addition in the possible nonlinearity for an n variable Boolean function if original NLS [10] proposal or Slash function suggested in n is even. the protection scheme [1]. Theorem 1. The nonlinearity of Boolean function The rest of the paper is organized as follows. Sec- f(x ; :::; x ) ⊕ g(y ; :::; y ) is 2nnl(g) + 2mnl(f) − tion 2 discusses some preliminaries required for this work. n 1 m 1 2nl(f)nl(g), where f(xn; :::; x1) and g(ym; :::; y1) are the The function Rain is elaborated in section 3. Performance two boolean functions of n and m variables respectively, of the proposed function against linear cryptanalysis has fxn; :::; x1g \ fym; :::; y1g = ϕ and nl(f), nl(g) denote the been discussed in section 4. In section 5, hardware and nonlinearity of f and g respectively [12]. time complexity of the scheme is given. Section 6 intro- duces one application of the proposed Boolean function and section 7 concludes the work. 3 Proposed Nonlinear Function In this section, a new nonlinear, reversible and balanced 2 Preliminaries vectorial Boolean function denoted as `Rain' and its inverse function denoted as Ì-Rain' are introduced. Some basic definitions and notations are discussed in this section. Definition 11. Assume X = (xn−1 xn−2 : : : x0) and K = (kn−1 kn−2 : : : k0) are two n−bit inputs and Definition 1. A function y = ξ(x) that maps a Boolean Y = (yn−1 yn−2 : : : y0) is the n−bit output after mix- vector to another Boolean vector is called a vectorial ing X with K, where x0, k0 and y0 denote the LSBs Boolean function, where y is an m-bit output Boolean vec- and xn−1; kn−1 and yn−1 denote the MSBs. The func- tor and x is an n-bit input Boolean vector. tion Rain is denoted by the operator y and is defined as y n ! Y = (X K) = F(X; K), where Definition 2. A Boolean function ξ(x): Z2 Z2 is a mapping from n-bit inputs to one bit output. Mi yi = xi ⊕ ki ⊕ ci−1; ci = xj · ki−j (1) Definition 3. A Boolean function ξ(x), where x is an n- j=0 bit input Boolean vector, can be uniquely written as a sum where ⊕ is modulo-2 sum, · represents AND operation, (XOR) of products (AND). This is known as Algebraic 0 ≤ i ≤ n−1, c− = 0 and c is the carry term propagating Normal Form (ANF). 1 i from i-th bit position to (i + 1)-th bit position. The end ξ(x1; x2; :::; xn) = p0 ⊕ p1x1 ⊕ p2x2 ⊕ pnxn ⊕ p12x1x2 ⊕ carry cn−1 is neglected. ::: ⊕ p12:::nx1x2:::xn, where p0; p1; :::; p12:::n 2 f0; 1g. It is noted that ci−1 is a Boolean function of 2i vari- Definition 4. The Hamming weight of a binary string ables and it is in the form of bent function and obviously x is the number of 1's in the string and it is denoted by it is not balanced. Whereas, yi can be considered as a wt(x). combination of two functions: one linear function xi ⊕ ki Definition 5. The Hamming distance between two binary and a bent function ci−1. Therefore, yi is balanced. strings (say x and y) of equal length is measured by wt(x⊕ Definition 12. Inverse function takes two n-bit inputs y). Y = (yn−1 yn−2 : : : y0) and K = (kn−1 kn−2 : : : k0) and produces an n−bit output X = (x − x − : : : x ). In- Definition 6. An n variables Boolean function ξ(x ; x ; n 1 n 2 0 1 2 verse function I-Rain is defined as X = F−1(Y; K), where :::; xn) is said to be an affine function if the ANF of ξ is i of the form ξ(x1; x2; :::; xn) = p0 ⊕p1x1 ⊕p2x2 ⊕:::⊕pnxn, M ⊕ ⊕ · where p0; p1; :::pn 2 f1; 0g. If p0 is 0 then the function is xi = yi ki di−1; di = xj ki−j (2) said to be linear. j=0 where ⊕ is modulo-2 sum, · represents AND operation, Definition 7. Nonlinearity of an n variable Boolean 0 ≤ i ≤ n − 1, d− = 0 and d is the carry term propa- function ξ is defined as the minimum Hamming distance 1 i gating from i-th bit position to (i + 1)-th bit position. The from the set of all affine function of n variables. end carry dn−1 is neglected. Definition 8. The bias for best linear approximation [13] − 1 is defined as pi 2 , where pi is the probability of best linear 3.1 Analogy Between Rain and Addition approximation.

Load more