Advanced Block Cipher Design My crazy boss asked me to design a new - - PowerPoint PPT Presentation

▶
advanced block cipher design
SMART_READER_LITE
LIVE PREVIEW

Advanced Block Cipher Design My crazy boss asked me to design a new - - PowerPoint PPT Presentation

Aug 12, 2023 344 likes •918 views

Advanced Block Cipher Design My crazy boss asked me to design a new block cipher. Whats next? Pascal Junod University of Applied Sciences Western Switzerland Pascal Junod -- Advanced Block Cipher Design 1 ECRYPT II Summer School - May

slide-1
SLIDE 1

Advanced Block Cipher Design

Pascal Junod

University of Applied Sciences Western Switzerland

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

My crazy boss asked me to design a new block cipher. What’s next?

1

slide-2
SLIDE 2

Outline

  • High-Level Schemes
  • Confusion
  • Diffusion
  • Key-Schedule
  • Beyond the Design

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

2

slide-3
SLIDE 3

Introduction

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

3

slide-4
SLIDE 4

Some Simple Facts

  • As of today, nobody knows how to design a

(mathematically proven) secure block cipher.

  • Problem related to fundamental open

questions in mathematics/computer science

  • A secure block cipher is a block cipher that

nobody can break...

  • A good block cipher is a secure block cipher

that people like to implement.

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

4

slide-5
SLIDE 5

So many Designs in the Wild...

RC2 RC5 RC6 DES Triple DES IDEA FOX Rijndael Mars Blowfish Twofish E0 Camellia Serpent 3-Way Akellare Anubis Aria BassOmatic BEAR LION CAST Present Cipherunicorn CLEFIA Coconut98 CS-Cipher DEAL DFC DES-X E2 FEAL G-DES GOST Misty MESH LOKI Hierocrypt Square Shark Threefish TEA XTEA XXTEA Noekeon Magenta Madryga MacGuffin Skipjack Seed

5

slide-6
SLIDE 6

Designing a New Block Cipher

  • Several good and bad reasons:
  • Faster/smaller than any other one
  • With «better» security guarantees than any
  • ther one
  • My boss crazily asked me to design a new,

secret (!) and patented (!!) block cipher

  • Not enough proposals/diversity in the wild
  • I desperately need to publish something to

finish my PhD thesis !

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

✔ ✔

~

✖ ✖ ✔

6

slide-7
SLIDE 7

Designing a New Block Cipher

  • Claude E. Shannon somewhat defined how to

build a good cipher: Two methods (other than recourse to ideal systems) suggest themselves for frustrating a statistical analysis. These we may call the methods of diffusion and confusion.

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

7

slide-8
SLIDE 8

Designing a New Block Cipher

  • Several decisions to take
  • Platform target
  • Security target
  • High-level scheme
  • Inner confusion/diffusion elements
  • Key-Schedule

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

8

slide-9
SLIDE 9

Designing a New Block Cipher

  • Platform target
  • low-end CPU (4-bit, 8-bit, 16-bit, 32-bit micro-

controller)

  • RAM/ROM/code size
  • high-end CPU (Intel/AMD/...)
  • SIMD instructions / L1 cache size
  • FPGA/ ASIC
  • low/high gate/cells budget (RFID vs. high-

speed encryption card)

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

9

slide-10
SLIDE 10

Designing a New Block Cipher

  • Security target (1)
  • Encryption
  • Authenticated encryption
  • Hashing
  • Key size (..., 64, 80, 128, 256, 512, 1024, ...)
  • Block size (..., 32, 48, 64, 96, 128, 256, 512,

1024, ...)

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

10

slide-11
SLIDE 11

Designing a New Block Cipher

  • Security target (2)
  • Side-channel attacks
  • Fault attacks
  • (Resistance to reverse engineering, software

emulation, ...)

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

It is probably the most powerful way to break a protected implementation as of today !

11

slide-12
SLIDE 12

Designing a New Block Cipher

  • High-Level Scheme
  • None (?)
  • Iterated
  • Feistel
  • Generalized Feistel
  • Substitution-Permutation Network
  • Lai-Massey

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

12

slide-13
SLIDE 13

Designing a New Block Cipher

  • Inner confusion/diffusion elements
  • Substitution boxes
  • Key-dependent non-linear operations
  • (Non-)linear diffusion layers

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

13

slide-14
SLIDE 14

Designing a New Block Cipher

  • Key-schedule algorithm
  • Light
  • Diffusive
  • Diffusive and non-linear
  • One-way
  • Efficient in both directions

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

14

slide-15
SLIDE 15

High-Level Schemes

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

15

slide-16
SLIDE 16

Iterated Schemes

  • Main principle:
  • Take a (rather weak) keyed permutation, i.e., a

round function

  • Iterate this function several times, by adding

new randomness

  • Hopefully get something more secure !
  • Well illustrated e.g. by Vaudenay’s

decorrelation theory (information-theoretic setting) and Tessaro et al. (computational setting) very recent results

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

16

slide-17
SLIDE 17

Iterated Schemes

  • Well-known «Zürcher» cryptographer

joke:

  • «Most ciphers are secure after

sufficiently many rounds» (L. O’Connor)

  • «Most ciphers are too slow after

sufficiently many rounds» (J. Massey)

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

17

slide-18
SLIDE 18

Feistel Scheme

  • Feistel Scheme (aka Feistel

Network, Feistel Cipher, ...)

  • Named after his inventor,

Horst Feistel

  • Scheme behind the DES
  • Allow to transform any

(possibly non-invertible function) in a permutation

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

18

slide-19
SLIDE 19

Feistel Scheme

  • Has «provable security»

properties [LubyRackoff, Patarin,...]

  • PRP after 3 (7) rounds

and less than ( ) queries

  • SPRP after 4 (10) rounds

and less than ( ) queries O(2

n 2 )

O(2

n 2 )

O(2n(1−ε)) O(2n(1−ε))

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

19

slide-20
SLIDE 20

Generalized Feistel Schemes

  • Many, many

different variants (see e.g. [HoangRogaway

  • 2010])
  • Rather slow

diffusion

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

20

slide-21
SLIDE 21

Substitution Permutation Networks

  • Used by AES, Present, Square

and many others.

  • Works on the full cipher width
  • Large body of literature

available on its security towards various attacks (linear, differential, saturation, ...)

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

21

slide-22
SLIDE 22

Lai-Massey Scheme

  • High-level structure behind the

IDEA cipher

  • Recycled e.g. by FOX
  • Has some provable properties (see

e.g. [Vaudenay-1999])

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

22

slide-23
SLIDE 23

Confusion

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

23

slide-24
SLIDE 24

Substitution Boxes

  • Substitution boxes
  • Non-linear mapping bits
  • Usual values:

n − → m 4 − → 4 6 − → 4 8 − → 8 8 − → 32 3 − → 3 7 − → 7 9 − → 9

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

24

slide-25
SLIDE 25

Substitution Boxes

  • Main criteria to look at:
  • DP and LP coefficients
  • Algebraic degree
  • + many, many others...

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

25

slide-26
SLIDE 26

Substitution Boxes

  • Differential (Linear) Probability coefficient
  • Measures the resistance of an S-box to

differential (linear) cryptanalysis

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

26

slide-27
SLIDE 27

Substitution Boxes

  • Algebraic Degree
  • Measures the «complexity» of the Boolean

equations representing the S-box

  • Is equal to the number of variables of the

largest monomial in the polynomial representation of the S-box.

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

27

slide-28
SLIDE 28

Substitution Boxes

  • Other criteria:
  • No single-bit difference
  • Efficient Boolean representation
  • Efficient Boolean representation of the inverse

mapping

  • ...

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

28

slide-29
SLIDE 29

Substitution Boxes

  • How to find «good» S-boxes ?
  • Three main approaches:
  • Random search
  • Algebraic construction
  • Iterated construction

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

29

slide-30
SLIDE 30

Substitution Boxes

  • Random search
  • Plug an AES in counter mode to a Knuth

shuffle

  • Generate random permutations
  • Test for your preferred criteria
  • Repeat the process until you are happy !

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

30

slide-31
SLIDE 31

Substitution Boxes

  • Algebraic approach
  • Proposed by Nyberg in 1993
  • Used by AES, among many others
  • Example: inversion operation in
  • Usually combined with an affine

mapping over bits to break the algebraic structure

  • Might (???) cause troubles with

respect to algebraic attacks GF(28)

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

31

slide-32
SLIDE 32

Key-Dependent Non-Linear Operations

  • Example: IDEA
  • Multiplication in
  • Involves a subkey value
  • Sensitive to weak key

classes

  • Nice down-scaling

properties GF(216 + 1)

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

32

slide-33
SLIDE 33

Iterated Construction

  • Examples: Khazad, FOX
  • Construct a large S-box out of smaller
  • nes
  • A few rounds of Feistel/SPN/Lai-

Massey with smaller «good» S-boxes as round function

  • «Nice» when implemented in

hardware

  • Less GE, more delay

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

33

slide-34
SLIDE 34

Diffusion

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

34

slide-35
SLIDE 35

Strong Diffusion Layers

  • Concept of multipermutation [Vaudenay]

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

35

slide-36
SLIDE 36

Strong Diffusion Layers

  • Concept of branch number of a (diffusive)

mapping [Daemen]

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

36

slide-37
SLIDE 37

Strong Diffusion Layers

  • Maximum Distance Separable (MDS) matrices
  • Square invertible matrix with elements of
  • Every sub-matrix is non-singular
  • Maximum branch number equal to

GF(2n) n + 1

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

37

slide-38
SLIDE 38

Strong Diffusion Layers

  • MDS matrices

constructions

  • Parity-check matrix of

a Reed-Solomon code

  • Circulant matrices
  • Hand-crafted matrices
  • Cauchy matrices
  • ...

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

38

slide-39
SLIDE 39

Lighter Diffusion Layers

  • Perfect diffusion
  • Can be quite heavy

to implement on constrained environments

  • Alternative
  • Use lighter

diffusion, but more rounds

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

39

slide-40
SLIDE 40

Key-Schedule Algorithm

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

40

slide-41
SLIDE 41

Key-Schedule Basics

  • Responsible to derive several subkeys out of the

master key

  • E.g., for AES128, derive eleven 128-bit round

subkeys out of the 128-bit master key.

  • E.g., for IDEA, derive fifty-two 16-bit round

subkeys out of the 128-bit master key.

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

41

slide-42
SLIDE 42

Light Key-Schedule

  • GOST

«Break the 256-bit key into eight 32-bit subkeys, and each subkey is used four times in the algorithm; the first 24 rounds use the key words in order, the last 8 rounds use them in reverse order.»

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

42

slide-43
SLIDE 43

Light Key-Schedule

  • DES
  • Two rotating registers
  • Bit selection

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

43

slide-44
SLIDE 44

Light Key-Schedule

  • IDEA
  • Bit selection through rotation of the key

Round r Z(r)

1

Z(r)

2

Z(r)

3

Z(r)

4

Z(r)

5

Z(r)

6

1 Z[0...15] Z[16...31] Z[32...47] Z[48...63] Z[64...79] Z[80...95] 2 Z[96...111] Z[112...127] Z[25...40] Z[41...56] Z[57...72] Z[73...88] 3 Z[89...104] Z[105...120] Z[121...8] Z[9...24] Z[50...65] Z[66...81] 4 Z[82...97] Z[98...113] Z[114...1] Z[2...17] Z[18...33] Z[34...49] 5 Z[75...90] Z[91...106] Z[107...122] Z[123...10] Z[11...26] Z[27...42] 6 Z[43...58] Z[59...74] Z[100...115] Z[116...3] Z[4...19] Z[20...35] 7 Z[36...51] Z[52...67] Z[68...83] Z[84...99] Z[125...12] Z[13...28] 8 Z[29...44] Z[45...60] Z[61...76] Z[77...92] Z[93...108] Z[109...124] 8.5 Z[22...37] Z[38...53] Z[54...69] Z[70...85]

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

44

slide-45
SLIDE 45

Stronger Key-Schedule

  • AES
  • First subkey is the key
  • Non-linear Feedback Shift

Register

  • Recycling the AES S-box
  • Use of round constants
  • Possible to compute it

sequentially in both directions

  • Cost is less than one cipher

evaluation

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

45

slide-46
SLIDE 46

One-Way Key-Schedule

  • Blowfish
  • Key-schedule is responsible to generate
  • Constants
  • S-boxes
  • Encryption core is recycled
  • Cost is up to 521 Blowfish iterations (!)

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

46

slide-47
SLIDE 47

One-Way Key-Schedule

  • FOX
  • Requirements
  • Bi-directional without key

processing

  • One-way
  • Not very (in-)efficient (the

cost of about 6 encryptions)

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

47

slide-48
SLIDE 48

Perfect Key-Schedule

  • Theoreticians
  • Subkeys decorrelated from the key, statistically

independent subkeys

  • One-way (e.g., leakage-resilient crypto)
  • Implementers
  • Light, fast, small, easy to understand, free
  • Secure in all situations
  • Depends on the cipher’s use, too
  • Encryption vs. compression function

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

48

slide-49
SLIDE 49

Beyond a Design

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

49

slide-50
SLIDE 50

Security Analysis

  • Designer has to provide (some) evidence of

security against every possible known attack...

  • «Provable security» towards
  • Differential cryptanalysis
  • Linear cryptanalysis
  • Out of AES specifications:

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

50

slide-51
SLIDE 51

Security Analysis

  • How not to get broken ?
  • Rely on bullet-proof components
  • High-level scheme
  • Confusion/diffusion elements
  • Double or triple the number of rounds that are

supposed to resist linear and differential cryptanalysis

  • Be somewhat lucky !

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

51

slide-52
SLIDE 52

Research Directions

  • Field of «block ciphers» could/has

become slightly boring...

  • More and more difficult to find

attacks in standard models

  • More and more difficult to find new

attack directions

  • As of today, we know how to

«engineer» a secure, general-purpose block cipher

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

52

slide-53
SLIDE 53

Research Directions

  • Ways to explore
  • Lightweight cryptography
  • More provable security for practical designs

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

53

slide-54
SLIDE 54

Research Directions

  • Other potential ways to explore
  • Efficient, large-block ciphers
  • Finding the perfect key-schedule
  • Intrinsically fault/leakage-resistant designs
  • Designs resistant to reverse-engineering

(white-box cryptography)

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

54

slide-55
SLIDE 55

Fate of a Block Cipher

Novelty Analyzed Implemented Standardized Broken Death Patented Ignored

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

55

Block cipher heaven

slide-56
SLIDE 56

Thank you ! Questions ?

Pascal Junod -- Advanced Block Cipher Design ECRYPT II Summer School - May 31st, 2011, Albena, Bulgaria

56

Credits for pictures: shamelessly stolen from all over the Internet