Algebraic Cryptanalysis of STARK-Friendly Designs: Application to - - PowerPoint PPT Presentation

▶
algebraic cryptanalysis of stark friendly designs
SMART_READER_LITE
LIVE PREVIEW

Algebraic Cryptanalysis of STARK-Friendly Designs: Application to - - PowerPoint PPT Presentation

Jul 04, 2023 275 likes •902 views

S C I E N C E P A S S I O N T E C H N O L O G Y Algebraic Cryptanalysis of STARK-Friendly Designs: Application to MARVELlous and MiMC Martin Albrecht Carlos Cid Lorenzo Grassi Dmitry Khovratovich Reinhard Lfenegger

slide-1
SLIDE 1

S C I E N C E P A S S I O N T E C H N O L O G Y

Algebraic Cryptanalysis of STARK-Friendly Designs: Application to MARVELlous and MiMC

Martin Albrecht – Carlos Cid – Lorenzo Grassi – Dmitry Khovratovich – Reinhard Lüfenegger – Christian Rechberger – Markus Schofnegger Asiacrypt 2019

> www.iaik.tugraz.at

slide-2
SLIDE 2

To Put the Cart Before the Horse...

Our main contribution is a known-plaintext key-recovery attack on the block cipher JARVIS with a single plaintext-ciphertext pair. Rounds Security level (bits) Attack complexity (log2 #ops) 10 (JARVIS-128) 128 72 12 (JARVIS-192) 192 85 14 (JARVIS-256) 256 98 Practically verified up to 6 rounds of JARVIS Extends to a preimage attack on the hash function FRIDAY

1 / 23

slide-3
SLIDE 3

To Put the Cart Before the Horse...

Our main contribution is a known-plaintext key-recovery attack on the block cipher JARVIS with a single plaintext-ciphertext pair. Rounds Security level (bits) Attack complexity (log2 #ops) 10 (JARVIS-128) 128 72 12 (JARVIS-192) 192 85 14 (JARVIS-256) 256 98 Practically verified up to 6 rounds of JARVIS Extends to a preimage attack on the hash function FRIDAY

1 / 23

slide-4
SLIDE 4

Overview

Introduction

Preliminaries The MARVELlous Design

Key-Recovery Attack on JARVIS

Attack Idea Results

2 / 23

slide-5
SLIDE 5

Algebraic Cryptanalysis

Model a cryptographic primitive as a system of multivariate polynomial equations f1(x1, . . . ,xn) = ⋯ = fk(x1, . . . ,xn) = 0 in several variables x1, . . . ,xn over some finite field F → In general, result is a non-linear equation system Solve the system (e.g. for a specific variable) → Several techniques

  • available. Gröbner bases are one of them.

3 / 23

slide-6
SLIDE 6

Algebraic Cryptanalysis

Model a cryptographic primitive as a system of multivariate polynomial equations f1(x1, . . . ,xn) = ⋯ = fk(x1, . . . ,xn) = 0 in several variables x1, . . . ,xn over some finite field F → In general, result is a non-linear equation system Solve the system (e.g. for a specific variable) → Several techniques

  • available. Gröbner bases are one of them.

3 / 23

slide-7
SLIDE 7

Solving Equation Systems with Gröbner Bases

Formally, a Gröbner basis is a special generating set for an ideal in a multivariate polynomial ring Informally, a Gröbner basis is a different representation of an equation system with the same solution set Gröbner bases assist in solving systems of polynomial equations over some (finite) field F Used together with factorisation algorithms for univariate polynomials

4 / 23

slide-8
SLIDE 8

Solving Equation Systems with Gröbner Bases

Formally, a Gröbner basis is a special generating set for an ideal in a multivariate polynomial ring Informally, a Gröbner basis is a different representation of an equation system with the same solution set Gröbner bases assist in solving systems of polynomial equations over some (finite) field F Used together with factorisation algorithms for univariate polynomials

4 / 23

slide-9
SLIDE 9

Solving Equation Systems with Gröbner Bases

Formally, a Gröbner basis is a special generating set for an ideal in a multivariate polynomial ring Informally, a Gröbner basis is a different representation of an equation system with the same solution set Gröbner bases assist in solving systems of polynomial equations over some (finite) field F Used together with factorisation algorithms for univariate polynomials

4 / 23

slide-10
SLIDE 10

Solving Equation Systems with Gröbner Bases

Formally, a Gröbner basis is a special generating set for an ideal in a multivariate polynomial ring Informally, a Gröbner basis is a different representation of an equation system with the same solution set Gröbner bases assist in solving systems of polynomial equations over some (finite) field F Used together with factorisation algorithms for univariate polynomials

4 / 23

slide-11
SLIDE 11

MARVELlous

MARVELlous [AD18] is a family of cryptographic primitives, comprising JARVIS (block cipher) and FRIDAY (hash function) Designed to be efficient in the STARK setting “Algebraic” design that works with low-degree polynomials The hash function FRIDAY is based on the block cipher JARVIS

5 / 23

slide-12
SLIDE 12

MARVELlous

MARVELlous [AD18] is a family of cryptographic primitives, comprising JARVIS (block cipher) and FRIDAY (hash function) Designed to be efficient in the STARK setting “Algebraic” design that works with low-degree polynomials The hash function FRIDAY is based on the block cipher JARVIS

5 / 23

slide-13
SLIDE 13

MARVELlous

MARVELlous [AD18] is a family of cryptographic primitives, comprising JARVIS (block cipher) and FRIDAY (hash function) Designed to be efficient in the STARK setting “Algebraic” design that works with low-degree polynomials The hash function FRIDAY is based on the block cipher JARVIS

5 / 23

slide-14
SLIDE 14

MARVELlous

MARVELlous [AD18] is a family of cryptographic primitives, comprising JARVIS (block cipher) and FRIDAY (hash function) Designed to be efficient in the STARK setting “Algebraic” design that works with low-degree polynomials The hash function FRIDAY is based on the block cipher JARVIS

5 / 23

slide-15
SLIDE 15

STARKs

STARK [BBH+18] Scalable Transparent ARgument of Knowledge General goal: Given a public function f, a private input x and a public value y proof that f(x) = y without revealing x. Features of STARKs Arithmetisation-based Use Merkle-trees

  • → requirement of dedicated hash-function designs for efficiency

6 / 23

slide-16
SLIDE 16

STARKs

STARK [BBH+18] Scalable Transparent ARgument of Knowledge General goal: Given a public function f, a private input x and a public value y proof that f(x) = y without revealing x. Features of STARKs Arithmetisation-based Use Merkle-trees

  • → requirement of dedicated hash-function designs for efficiency

6 / 23

slide-17
SLIDE 17

JARVIS: the Design

JARVIS is similar to MiMC [AGR+16] and works entirely over F2n, with n ∈ {128,160,192,256} MiMC

si si+1 ki x3

JARVIS

si si+1 ki x−1 B−1 C

B,C are affine polynomials of degree 4 and B−1 the compositional inverse of B.

7 / 23

slide-18
SLIDE 18

Key-Recovery Attack on JARVIS I

p

x−1 B−1 C ... x−1 B−1 C

c

JARVIS

k Goal: Given one plaintext p and corresponding ciphertext c = Ek(p) recover the secret key k. Idea: Relate consecutive rounds by low-degree polynomial relations!

8 / 23

slide-19
SLIDE 19

Key-Recovery Attack on JARVIS I

p

x−1 B−1 C ... x−1 B−1 C

c k = k0

k1 kr

Goal: Given one plaintext p and corresponding ciphertext c = Ek(p) recover the secret key k. Idea: Relate consecutive rounds by low-degree polynomial relations!

8 / 23

slide-20
SLIDE 20

Key-Recovery Attack on JARVIS II

x−1 B−1 C ki−1 x−1 B−1 C ki x−1 B−1 C ki+1

Basic strategy Introduce variables xi for intermediate states between B−1 and C in each round Relate each xi to the previous and next intermediate state xi−1 and xi+1 respectively

9 / 23

slide-21
SLIDE 21

Key-Recovery Attack on JARVIS II

x−1 B−1 C ki−1 x−1 B−1 C ki x−1 B−1 C ki+1 xi−1 xi xi+1

Basic strategy Introduce variables xi for intermediate states between B−1 and C in each round Relate each xi to the previous and next intermediate state xi−1 and xi+1 respectively

9 / 23

slide-22
SLIDE 22

Key-Recovery Attack on JARVIS II

x−1 B−1 C ki−1 x−1 B−1 C ki x−1 B−1 C ki+1 xi−1 xi xi+1

Basic strategy Introduce variables xi for intermediate states between B−1 and C in each round Relate each xi to the previous and next intermediate state xi−1 and xi+1 respectively

9 / 23

slide-23
SLIDE 23

Key-Recovery Attack on JARVIS III

si−1 x−1 B−1 xi−1 C ki−1 x−1 B−1 xi C ki x−1 B−1 xi+1 C ki+1 si+1

Basic equations B(xi) = 1 C(xi−1) + ki−1 C(xi) = 1 B(xi+1) + ki

10 / 23

slide-24
SLIDE 24

Key-Recovery Attack on JARVIS III

si−1 x−1 B−1 xi−1 C ki−1 x−1 B−1 xi C ki x−1 B−1 xi+1 C ki+1 si+1

Basic equations B(xi) = 1 C(xi−1) + ki−1 C(xi) = 1 B(xi+1) + ki

10 / 23

slide-25
SLIDE 25

Key-Recovery Attack on JARVIS III

si−1 x−1 B−1 xi−1 C ki−1 x−1 B−1 xi C ki x−1 B−1 xi+1 C ki+1 si+1

Basic equations B(xi) = 1 C(xi−1) + ki−1 C(xi) = 1 B(xi+1) + ki

10 / 23

slide-26
SLIDE 26

Key-Recovery Attack on JARVIS III

si−1 x−1 B−1 xi−1 C ki−1 x−1 B−1 xi C ki x−1 B−1 xi+1 C ki+1 si+1

Basic equations B(xi) = 1 C(xi−1) + ki−1 C(xi) = 1 B(xi+1) + ki

10 / 23

slide-27
SLIDE 27

Key-Recovery Attack on JARVIS III

si−1 x−1 B−1 xi−1 C ki−1 x−1 B−1 xi C ki x−1 B−1 xi+1 C ki+1 si+1

Basic equations B(xi) = 1 C(xi−1) + ki−1 C(xi) = 1 B(xi+1) + ki

10 / 23

slide-28
SLIDE 28

Key-Recovery Attack on JARVIS IV

x−1 B−1 xi−1 C ki−1 x−1 B−1 xi C ki x−1 B−1 xi+1 C ki+1

Idea for improvements: Only use every second intermediate state by finding affine polynomials B′, C′ such that B′ ○ B = C′ ○ C!

11 / 23

slide-29
SLIDE 29

Key-Recovery Attack on JARVIS V

x−1 B−1 xi−1 C ki−1 x−1 B−1 xi C ki x−1 B−1 xi+1 C ki+1

Improved equations

12 / 23

slide-30
SLIDE 30

Key-Recovery Attack on JARVIS V

x−1 B−1 xi−1 C ki−1 x−1 B−1 xi C ki x−1 B−1 xi+1 C ki+1

Improved equations 1 C(xi−1) + ki−1 =

12 / 23

slide-31
SLIDE 31

Key-Recovery Attack on JARVIS V

x−1 B−1 xi−1 C ki−1 x−1 B−1 xi C ki x−1 B−1 xi+1 C ki+1

Improved equations 1 C(xi−1) + ki−1 = B(xi)

12 / 23

slide-32
SLIDE 32

Key-Recovery Attack on JARVIS V

x−1 B−1 xi−1 C ki−1 x−1 B−1 xi C ki x−1 B−1 xi+1 C ki+1

Improved equations 1 C(xi−1) + ki−1 = B(xi) C(xi) =

12 / 23

slide-33
SLIDE 33

Key-Recovery Attack on JARVIS V

x−1 B−1 xi−1 C ki−1 x−1 B−1 xi C ki x−1 B−1 xi+1 C ki+1

Improved equations 1 C(xi−1) + ki−1 = B(xi) C(xi) = 1 B(xi+1) + ki

12 / 23

slide-34
SLIDE 34

Key-Recovery Attack on JARVIS V

x−1 B−1 xi−1 C ki−1 x−1 B−1 xi C ki x−1 B−1 xi+1 C ki+1

Improved equations 1 C(xi−1) + ki−1 = B(xi) C(xi) = 1 B(xi+1) + ki

12 / 23

slide-35
SLIDE 35

Key-Recovery Attack on JARVIS V

x−1 B−1 xi−1 C ki−1 x−1 B−1 xi C ki x−1 B−1 xi+1 C ki+1

Improved equations B′ ( 1 C(xi−1) + ki−1 ) = B′(B(xi)) C(xi) = 1 B(xi+1) + ki

12 / 23

slide-36
SLIDE 36

Key-Recovery Attack on JARVIS V

x−1 B−1 xi−1 C ki−1 x−1 B−1 xi C ki x−1 B−1 xi+1 C ki+1

Improved equations B′ ( 1 C(xi−1) + ki−1 ) = B′(B(xi)) C′(C(xi)) = C′ ( 1 B(xi+1) + ki)

12 / 23

slide-37
SLIDE 37

Key-Recovery Attack on JARVIS V

x−1 B−1 xi−1 C ki−1 x−1 B−1 xi C ki x−1 B−1 xi+1 C ki+1

Improved equations B′ ( 1 C(xi−1) + ki−1 ) = B′(B(xi)) ! = C′(C(xi)) = C′ ( 1 B(xi+1) + ki)

12 / 23

slide-38
SLIDE 38

Relation to Plaintext

p x−1 B−1 x1 C x−1 B−1 x2 C k2 k0 k1

Plaintext equation B′ ( 1 p + k0 ) = C′ ( 1 B(x2) + k1 )

13 / 23

slide-39
SLIDE 39

Relation to Plaintext

p x−1 B−1 x1 C x−1 B−1 x2 C k2 k0 k1

Plaintext equation B′ ( 1 p + k0 ) = C′ ( 1 B(x2) + k1 )

13 / 23

slide-40
SLIDE 40

Relation to Ciphertext

kr−1 x−1 B−1 xr C c kr

Ciphertext equation C(xr) + kr = c

14 / 23

slide-41
SLIDE 41

Relation to Ciphertext

kr−1 x−1 B−1 xr C c kr

Ciphertext equation C(xr) + kr = c

14 / 23

slide-42
SLIDE 42

Exploiting the Key Schedule

k0 x−1 c0 k1 x−1 c1 k2 x−1 c2 k3

The first three round keys are given by k1 = 1 k0 + c0, k2 = 1 k1 + c1 = 1

1 k0 + c0

+ c1, k3 = 1 k2 + c2 = 1

1

1 k0 +c0 + c1

;

more generally and afer simplifying each fraction we have for 1 ≤ i ≤ r ki = αi ⋅ k0 + βi

γi ⋅ k0 + δi

(αi, βi, γi, δi ∈ F2n).

15 / 23

slide-43
SLIDE 43

Exploiting the Key Schedule

k0 x−1 c0 k1 x−1 c1 k2 x−1 c2 k3

The first three round keys are given by k1 = 1 k0 + c0, k2 = 1 k1 + c1 = 1

1 k0 + c0

+ c1, k3 = 1 k2 + c2 = 1

1

1 k0 +c0 + c1

;

more generally and afer simplifying each fraction we have for 1 ≤ i ≤ r ki = αi ⋅ k0 + βi

γi ⋅ k0 + δi

(αi, βi, γi, δi ∈ F2n).

15 / 23

slide-44
SLIDE 44

Exploiting the Key Schedule

k0 x−1 c0 k1 x−1 c1 k2 x−1 c2 k3

The first three round keys are given by k1 = 1 k0 + c0, k2 = 1 k1 + c1 = 1

1 k0 + c0

+ c1, k3 = 1 k2 + c2 = 1

1

1 k0 +c0 + c1

;

more generally and afer simplifying each fraction we have for 1 ≤ i ≤ r ki = αi ⋅ k0 + βi

γi ⋅ k0 + δi

(αi, βi, γi, δi ∈ F2n).

15 / 23

slide-45
SLIDE 45

Exploiting the Key Schedule

k0 x−1 c0 k1 x−1 c1 k2 x−1 c2 k3

The first three round keys are given by k1 = 1 k0 + c0, k2 = 1 k1 + c1 = 1

1 k0 + c0

+ c1, k3 = 1 k2 + c2 = 1

1

1 k0 +c0 + c1

;

more generally and afer simplifying each fraction we have for 1 ≤ i ≤ r ki = αi ⋅ k0 + βi

γi ⋅ k0 + δi

(αi, βi, γi, δi ∈ F2n).

15 / 23

slide-46
SLIDE 46

Exploiting the Key Schedule

k0 x−1 c0 k1 x−1 c1 k2 x−1 c2 k3

The first three round keys are given by k1 = 1 k0 + c0, k2 = 1 k1 + c1 = 1

1 k0 + c0

+ c1, k3 = 1 k2 + c2 = 1

1

1 k0 +c0 + c1

;

more generally and afer simplifying each fraction we have for 1 ≤ i ≤ r ki = αi ⋅ k0 + βi

γi ⋅ k0 + δi

(αi, βi, γi, δi ∈ F2n).

15 / 23

slide-47
SLIDE 47

Exploiting the Key Schedule

k0 x−1 c0 k1 x−1 c1 k2 x−1 c2 k3

The first three round keys are given by k1 = 1 k0 + c0, k2 = 1 k1 + c1 = 1

1 k0 + c0

+ c1, k3 = 1 k2 + c2 = 1

1

1 k0 +c0 + c1

;

more generally and afer simplifying each fraction we have for 1 ≤ i ≤ r ki = αi ⋅ k0 + βi

γi ⋅ k0 + δi

(αi, βi, γi, δi ∈ F2n).

15 / 23

slide-48
SLIDE 48

Final Equation System for JARVIS

Variables

r 2 variables for the intermediate states x2,x4, . . . ,xr

1 variable k0 for the keys Equations

r 2 − 1 equations for relating every second intermediate state

2 equations for relating the plaintext p to x2 and the ciphertext c to xr

  • → Solve this system with the help of Gröbner bases!

16 / 23

slide-49
SLIDE 49

Final Equation System for JARVIS

Variables

r 2 variables for the intermediate states x2,x4, . . . ,xr

1 variable k0 for the keys Equations

r 2 − 1 equations for relating every second intermediate state

2 equations for relating the plaintext p to x2 and the ciphertext c to xr

  • → Solve this system with the help of Gröbner bases!

16 / 23

slide-50
SLIDE 50

Final Equation System for JARVIS

Variables

r 2 variables for the intermediate states x2,x4, . . . ,xr

1 variable k0 for the keys Equations

r 2 − 1 equations for relating every second intermediate state

2 equations for relating the plaintext p to x2 and the ciphertext c to xr

  • → Solve this system with the help of Gröbner bases!

16 / 23

slide-51
SLIDE 51

Final Equation System for JARVIS

Variables

r 2 variables for the intermediate states x2,x4, . . . ,xr

1 variable k0 for the keys Equations

r 2 − 1 equations for relating every second intermediate state

2 equations for relating the plaintext p to x2 and the ciphertext c to xr

  • → Solve this system with the help of Gröbner bases!

16 / 23

slide-52
SLIDE 52

Final Equation System for JARVIS

Variables

r 2 variables for the intermediate states x2,x4, . . . ,xr

1 variable k0 for the keys Equations

r 2 − 1 equations for relating every second intermediate state

2 equations for relating the plaintext p to x2 and the ciphertext c to xr

  • → Solve this system with the help of Gröbner bases!

16 / 23

slide-53
SLIDE 53

Attack complexity

Complexity estimates for Gröbner basis computation:

Rounds Complexity Jarvis Complexity Friday (log2 #ops) (log2 #ops) 6 45 34 8 58 47 10 (JARVIS-128) 72 59 12 (JARVIS-192) 85 72 14 (JARVIS-256) 98 85 16 112 97 18 125 110 20 138 123

17 / 23

slide-54
SLIDE 54

Practical Results

Attack on JARVIS and FRIDAY working over F2128 implemented using SAGE v8.6 with MAGMA v2.20-5 (using one core only).

JARVIS FRIDAY Rounds Complex. Time Complex. Time (log2 #ops) (log2 #ops) 3 20 0.3 s 19 3.6 s 4 31 9.4 s 22 0.5 s 5 34 14.9 min 32 36.5 s 6 45 27.8 h 34 34.9 min

Most of the time, our attacks performed substantially better in practice than the complexity estimates suggest.

18 / 23

slide-55
SLIDE 55

Practical Results

Attack on JARVIS and FRIDAY working over F2128 implemented using SAGE v8.6 with MAGMA v2.20-5 (using one core only).

JARVIS FRIDAY Rounds Complex. Time Complex. Time (log2 #ops) (log2 #ops) 3 20 0.3 s 19 3.6 s 4 31 9.4 s 22 0.5 s 5 34 14.9 min 32 36.5 s 6 45 27.8 h 34 34.9 min

Most of the time, our attacks performed substantially better in practice than the complexity estimates suggest.

18 / 23

slide-56
SLIDE 56

Conclusion

The main reason why MARVELlous is less secure than claimed is the particular usage of two low-degree polynomials as affine layer, together with finite field inversion as non-linear layer. MiMC is immune against the presented attack strategy because factoring the univariate polynomial is prohibitively expensive; although the polynomials representing MiMC are already a Gröbner basis.

19 / 23

slide-57
SLIDE 57

Conclusion

The main reason why MARVELlous is less secure than claimed is the particular usage of two low-degree polynomials as affine layer, together with finite field inversion as non-linear layer. MiMC is immune against the presented attack strategy because factoring the univariate polynomial is prohibitively expensive; although the polynomials representing MiMC are already a Gröbner basis.

19 / 23

slide-58
SLIDE 58

Outlook

Other Designs: GMiMC [AGP+19], Starkad&Poseidon [GKK+19] (based on Hades [GLR+19]), Vision&Rescue [AABS+19] Ongoing Competition: STARK-friendly Hash-Challenge

https://starkware.co/hash-challenge/

20 / 23

slide-59
SLIDE 59

Questions?

21 / 23

slide-60
SLIDE 60

References I

[AABS+19] Abdelrahaman Aly, Tomer Ashur, Eli Ben-Sasson, et al. Design of Symmetric-Key Primitives for Advanced Cryptographic Protocols. Cryptology ePrint Archive, Report 2019/426. https://eprint.iacr.org/2019/426. 2019 (cit. on p. 58). [AD18] Tomer Ashur and Siemen Dhooghe. MARVELlous: a STARK-Friendly Family of Cryptographic

  • Primitives. Cryptology ePrint Archive, Report 2018/1098.

https://eprint.iacr.org/2018/1098. 2018 (cit. on pp. 11–14). [AGP+19] Martin R. Albrecht, Lorenzo Grassi, Léo Perrin, et al. Feistel Structures for MPC, and More. ESORICS 2019: 24th European Symposium on Research in Computer Security. https://eprint.iacr.org/2019/397. 2019 (cit. on p. 58). [AGR+16] Martin R. Albrecht, Lorenzo Grassi, Christian Rechberger, et al. MiMC: Efficient Encryption and Cryptographic Hashing with Minimal Multiplicative Complexity. ASIACRYPT 2016, Part I. Ed. by Jung Hee Cheon and Tsuyoshi Takagi. Vol. 10031. LNCS. Springer, Heidelberg, Dec. 2016,

  • pp. 191–219. DOI: 10.1007/978-3-662-53887-6_7 (cit. on p. 17).

22 / 23

slide-61
SLIDE 61

References II

[BBH+18] Eli Ben-Sasson, Iddo Bentov, Yinon Horesh, et al. Scalable, transparent, and post-quantum secure computational integrity. IACR Cryptology ePrint Archive 2018 (2018), p. 46 (cit. on

  • pp. 15, 16).

[GKK+19] Lorenzo Grassi, Daniel Kales, Dmitry Khovratovich, et al. Starkad and Poseidon: New Hash Functions for Zero Knowledge Proof Systems. Cryptology ePrint Archive, Report 2019/458. https://eprint.iacr.org/2019/458. 2019 (cit. on p. 58). [GLR+19] Lorenzo Grassi, Reinhard Luefenegger, Christian Rechberger, et al. On a Generalization of Substitution-Permutation Networks: The HADES Design Strategy. Cryptology ePrint Archive, Report 2019/1107. https://eprint.iacr.org/2019/1107. 2019 (cit. on p. 58).

23 / 23