Introduction Algebraic Structure Automated Tools Conclusion Automatic Search of Attacks on round-reduced AES and Applications Charles Bouillaguet Patrick Derbez Pierre-Alain Fouque ENS, CNRS, INRIA Cascade August 15, 2011
Introduction Algebraic Structure Automated Tools Conclusion Block-Cipher Cryptanalysis The Object: a Block Cipher E : { 0 , 1 } k × { 0 , 1 } n → { 0 , 1 } n � �� � � �� � � �� � key plaintext ciphertext often k = n , but not always (e.g. AES-256: n = 128 and k = 256) The Subject: an Attacker ◮ Objective: recover the secret key (or maybe distinguish from random) ◮ Resources: ◮ Time: less than 2 k encryptions ◮ Data: less than 2 n plaintext/ciphertext pairs Total Breaks of widely-used block ciphers are relatively rare (in comparison with hash functions/stream ciphers)
Introduction Algebraic Structure Automated Tools Conclusion What to do when block ciphers are too strong for us? ◮ Solution # 1 : ◮ First weaken it ◮ Then break it Plaintext k 0 Round k 1 Round k 2 Round Key Schedule K k r Round Ciphertext
Introduction Algebraic Structure Automated Tools Conclusion What to do when block ciphers are too strong for us? ◮ Solution # 1 : ◮ First weaken it (reduce number of rounds) ◮ Then break it Plaintext k 0 Round k 1 Round k 2 Round Key Schedule K k 3 Round Ciphertext
Introduction Algebraic Structure Automated Tools Conclusion What to do when block ciphers are too strong for us? ◮ Solution # 2 : ◮ First we get stronger ◮ Then break it
Introduction Algebraic Structure Automated Tools Conclusion What to do when block ciphers are too strong for us? ◮ Solution # 2 : ◮ First we get stronger (chosen ciphertexts, ) ◮ Then break it
Introduction Algebraic Structure Automated Tools Conclusion What to do when block ciphers are too strong for us? ◮ Solution # 2 : ◮ First we get stronger (chosen ciphertexts, related keys, etc.) ◮ Then break it
Introduction Algebraic Structure Automated Tools Conclusion Solution #3: Play Another Game In this talk: Low Data Complexity Attacks ◮ Has to be faster than exhaustive search ◮ Only very few plaintext/ciphertext pairs available Why ? ◮ Rather unexplored territory ◮ What is harder in practice? ◮ performing 2 50 elementary operations? ◮ or acquiring 50 Plaintext/Ciphertext pairs? ◮ LDC attacks can sometimes be recycled, and used as sub-components in other attacks ◮ e.g. attack on GOST uses a 2-plaintext attack on 8 rounds
Introduction Algebraic Structure Automated Tools Conclusion Target Block Cipher: the Advanced Encryption Standard ◮ Designed by Rijmen and Daemen for AES competition ◮ Selected as the AES in 2001 ◮ One of the most widely used encryption primitive ◮ AES basic structures : ◮ Substitution-Permutation network ◮ Block size: 16-bytes (128 bits) ◮ key lengths: 128 , 192 or 256 bits ◮ 10 rounds for the 128-bit version
Introduction Algebraic Structure Automated Tools Conclusion Description of the AES z i w i 0 4 8 12 ARK � 1 5 9 13 SB SR MC 2 6 10 14 3 7 11 15 3 7 11 15 15 3 7 11 k i x i y i ShiftRows MixColumns
Introduction Algebraic Structure Automated Tools Conclusion Description of the AES z i w i 0 4 8 12 ARK � 1 5 9 13 SB SR MC 2 6 10 14 3 7 11 15 3 7 11 15 15 3 7 11 k i x i y i ShiftRows MixColumns ◮ Single-key attacks up to : ◮ 8 rounds on AES-128 ◮ 9 rounds on AES-192/256 ◮ Related-subkey attacks on the full AES-256/AES-192 ◮ Complexities just slightly less than the naturals bounds
Introduction Algebraic Structure Automated Tools Conclusion Techniques for Low Data Complexity Attacks The problem with“Usual”attack techniques ◮ Statistical attacks ( e.g. , differential, impossible,linear) ◮ “Golden-plaintext”attacks ( e.g. , reflexion, slide) They require (VERY) LARGE QUANTITY of data What’s left? ◮ Algebraic Attacks/SAT-solvers ? ◮ Guess-and-Determine attacks ◮ Meet-in-the-Middle attacks
Introduction Algebraic Structure Automated Tools Conclusion Techniques for Low Data Complexity Attacks The problem with“Usual”attack techniques ◮ Statistical attacks ( e.g. , differential, impossible,linear) ◮ “Golden-plaintext”attacks ( e.g. , reflexion, slide) They require (VERY) LARGE QUANTITY of data What’s left? ◮ Algebraic Attacks/SAT-solvers ◮ Guess-and-Determine attacks ◮ Meet-in-the-Middle attacks
Introduction Algebraic Structure Automated Tools Conclusion Meet-in-the-Middle Attacks A very bad way to build an AES with 256-bit keys k 1 k 2 AES AES P M C E k 1 , k 2 = AES k 1 ◦ AES k 2
Introduction Algebraic Structure Automated Tools Conclusion Meet-in-the-Middle Attacks A very bad way to build an AES with 256-bit keys k 1 k 2 AES AES P M C E k 1 , k 2 = AES k 1 ◦ AES k 2 ◮ For all k 1 , store AES k 1 ( P ) → k 1 in a hash table
Introduction Algebraic Structure Automated Tools Conclusion Meet-in-the-Middle Attacks A very bad way to build an AES with 256-bit keys k 1 k 2 AES AES P M C E k 1 , k 2 = AES k 1 ◦ AES k 2 ◮ For all k 1 , store AES k 1 ( P ) → k 1 in a hash table ◮ For all k 2 , look-up AES − 1 k 2 ( C ) in the hash table
Introduction Algebraic Structure Automated Tools Conclusion Meet-in-the-Middle Attacks A very bad way to build an AES with 256-bit keys k 1 k 2 AES AES P M C E k 1 , k 2 = AES k 1 ◦ AES k 2 ◮ For all k 1 , store AES k 1 ( P ) → k 1 in a hash table ◮ For all k 2 , look-up AES − 1 k 2 ( C ) in the hash table ◮ We expect ≈ 1 value of k 1 per value of k 2 Time complexity ≈ 2 128 encryptions, with 256-bit keys!
Introduction Algebraic Structure Automated Tools Conclusion Cryptanalytic Tools We want to find Guess-n-determine/Meet-in-the-middle attacks Problems ◮ We are lazy ◮ It is delicate and complicated, and nearly made us crazy Standard Solution: build a tool to do the job for you! We are not alone! E.g. , Tools to find differential paths : DES [Matsui, 93], SHA-1 [de Canni` ere et. al, 06], Grindhal [Peyrin et al., 07], RadioGat` un [Fuhr et al., 09], MD4/MD5 [Leurent et al., 07], AES [Biryukov et al., 10], etc.
Introduction Algebraic Structure Automated Tools Conclusion The AES Has a Clean Description over F 256 Is it a Problem? ◮ Concerns about the AES’s algebraic simplicity have been expressed several times ◮ But so far, no attack directly exploited this property... ...Until now
Introduction Algebraic Structure Automated Tools Conclusion The AES Has a Clean Description over F 256 Round Function z i w i 0 4 8 12 ARK SB SR MC � 1 5 9 13 2 6 10 14 3 7 11 15 3 7 11 15 15 3 7 11 k i x i y i ShiftRows MixColumns y i [ ℓ ] = S ( x i [ ℓ ]) 02 03 01 01 y i [0] y i [4] y i [8] y i [12] 01 02 03 01 y i [5] y i [9] y i [13] y i [1] x i +1 = × + k i 01 01 02 03 y i [10] y i [14] y i [2] y i [6] 03 01 01 02 y i [15] y i [3] y i [7] y i [11]
Introduction Algebraic Structure Automated Tools Conclusion The AES Has a Clean Description over F 256 Key-Schedule ◮ k 0 = K (the master-key) k i k i +1
Introduction Algebraic Structure Automated Tools Conclusion The AES Has a Clean Description over F 256 Key-Schedule ◮ k 0 = K (the master-key) k i ◮ k i +1 [0] = k i [0] + S ( k i [13]) + RCON i + S k i +1
Introduction Algebraic Structure Automated Tools Conclusion The AES Has a Clean Description over F 256 Key-Schedule ◮ k 0 = K (the master-key) k i ◮ k i +1 [0] = k i [0] + S ( k i [13]) + RCON i ◮ k i +1 [1] = k i [1] + S ( k i [14]) + S k i +1
Introduction Algebraic Structure Automated Tools Conclusion The AES Has a Clean Description over F 256 Key-Schedule ◮ k 0 = K (the master-key) k i ◮ k i +1 [0] = k i [0] + S ( k i [13]) + RCON i ◮ k i +1 [1] = k i [1] + S ( k i [14]) ◮ k i +1 [2] = k i [2] + S ( k i [15]) + S k i +1
Introduction Algebraic Structure Automated Tools Conclusion The AES Has a Clean Description over F 256 Key-Schedule ◮ k 0 = K (the master-key) k i ◮ k i +1 [0] = k i [0] + S ( k i [13]) + RCON i ◮ k i +1 [1] = k i [1] + S ( k i [14]) ◮ k i +1 [2] = k i [2] + S ( k i [15]) + S ◮ k i +1 [3] = k i [3] + S ( k i [12]) k i +1
Introduction Algebraic Structure Automated Tools Conclusion The AES Has a Clean Description over F 256 Key-Schedule ◮ k 0 = K (the master-key) k i ◮ k i +1 [0] = k i [0] + S ( k i [13]) + RCON i ◮ k i +1 [1] = k i [1] + S ( k i [14]) ◮ k i +1 [2] = k i [2] + S ( k i [15]) + ◮ k i +1 [3] = k i [3] + S ( k i [12]) ◮ k i +1 [4 .. 7] = k i +1 [4 .. 7] + k i [0 .. 3] k i +1
Introduction Algebraic Structure Automated Tools Conclusion The AES Has a Clean Description over F 256 Key-Schedule ◮ k 0 = K (the master-key) k i ◮ k i +1 [0] = k i [0] + S ( k i [13]) + RCON i ◮ k i +1 [1] = k i [1] + S ( k i [14]) ◮ k i +1 [2] = k i [2] + S ( k i [15]) + ◮ k i +1 [3] = k i [3] + S ( k i [12]) ◮ k i +1 [4 .. 7] = k i +1 [4 .. 7] + k i [0 .. 3] k i +1 ◮ k i +1 [8 .. 11] = k i +1 [8 .. 11] + k i [4 .. 7]
Recommend
More recommend
