Better proofs for rekeying D. J. Bernstein Security of AES-256 key k - - PDF document

▶
better proofs for rekeying d j bernstein security of aes
SMART_READER_LITE
LIVE PREVIEW

Better proofs for rekeying D. J. Bernstein Security of AES-256 key k - - PDF document

Mar 19, 2023 252 likes •578 views

1 Better proofs for rekeying D. J. Bernstein Security of AES-256 key k is far below 2 256 in most protocols: (AES k (0) ; : : : ; AES k ( n 1)) is distinguishable from uniform with probability n ( n 1) = 2 129 , plus tiny key-guessing

slide-1
SLIDE 1

1

Better proofs for rekeying

  • D. J. Bernstein

Security of AES-256 key k is far below 2256 in most protocols: (AESk(0); : : : ; AESk(n − 1)) is distinguishable from uniform with probability n(n − 1)=2129, plus tiny key-guessing probability. Yes, distinguishers matter. Attacker actually has T targets: independent keys k1; : : : ; kT . Success chance ≈ Tn(n − 1)=2129.

slide-2
SLIDE 2

2

“Rekeying” seems less dangerous. Expand k into F(k) = (AESk(0); : : : ; AESk(999999)). Split F(k) into 500000 “subkeys”. Output F(k′) for each subkey k′: i.e., F(AESk(0); AESk(1)); F(AESk(2); AESk(3)); : : : F(AESk(999998); AESk(999999)).

slide-3
SLIDE 3

2

“Rekeying” seems less dangerous. Expand k into F(k) = (AESk(0); : : : ; AESk(999999)). Split F(k) into 500000 “subkeys”. Output F(k′) for each subkey k′: i.e., F(AESk(0); AESk(1)); F(AESk(2); AESk(3)); : : : F(AESk(999998); AESk(999999)). Repeat for k1; : : : ; kT . What is attacker’s success chance pT ?

slide-4
SLIDE 4

2

“Rekeying” seems less dangerous. Expand k into F(k) = (AESk(0); : : : ; AESk(999999)). Split F(k) into 500000 “subkeys”. Output F(k′) for each subkey k′: i.e., F(AESk(0); AESk(1)); F(AESk(2); AESk(3)); : : : F(AESk(999998); AESk(999999)). Repeat for k1; : : : ; kT . What is attacker’s success chance pT ? Intuitively clear that pT ≤ Tp1. So let’s analyze p1.

slide-5
SLIDE 5

3

Attack strategy 1: Attack the master key k. Distinguish F(k) from a uniform random string. Years of cryptanalysis say: hard to distinguish AES outputs from uniform string of distinct blocks. Distinctness loses ≈1=289.

slide-6
SLIDE 6

3

Attack strategy 1: Attack the master key k. Distinguish F(k) from a uniform random string. Years of cryptanalysis say: hard to distinguish AES outputs from uniform string of distinct blocks. Distinctness loses ≈1=289. Attack strategy 2: Attack a subkey k′. Distinguish F(k′) from uniform, assuming k′ is uniform.

slide-7
SLIDE 7

3

Attack strategy 1: Attack the master key k. Distinguish F(k) from a uniform random string. Years of cryptanalysis say: hard to distinguish AES outputs from uniform string of distinct blocks. Distinctness loses ≈1=289. Attack strategy 2: Attack a subkey k′. Distinguish F(k′) from uniform, assuming k′ is uniform. Intuition: No other attacks exist. But where is this proven?

slide-8
SLIDE 8

4

FOCS 1996 Bellare–Canetti– Krawczyk claims to prove security of ‘-level “cascade”. 2-level cascade: key k; input (N1; N2); output S(S(k; N1); N2).

slide-9
SLIDE 9

4

FOCS 1996 Bellare–Canetti– Krawczyk claims to prove security of ‘-level “cascade”. 2-level cascade: key k; input (N1; N2); output S(S(k; N1); N2). Example: Define S(k; N) = (AESk(2N); AESk(2N + 1)), with N ∈ {0; 1; : : : ; 499999}. S expands AES-256 key k into (AESk(0); : : : ; AESk(999999)).

slide-10
SLIDE 10

4

FOCS 1996 Bellare–Canetti– Krawczyk claims to prove security of ‘-level “cascade”. 2-level cascade: key k; input (N1; N2); output S(S(k; N1); N2). Example: Define S(k; N) = (AESk(2N); AESk(2N + 1)), with N ∈ {0; 1; : : : ; 499999}. S expands AES-256 key k into (AESk(0); : : : ; AESk(999999)). Paper credits 1986 Goldwasser– Goldreich–Micali for 1-bit Ni: S expands k into S(k; 0); S(k; 1).

slide-11
SLIDE 11

5

Theorem statement is wrong:

  • mits factor q. Fixed in 2005.

Here q is the number of queries. The intuition didn’t notice q; why does q matter for the proof?

slide-12
SLIDE 12

5

Theorem statement is wrong:

  • mits factor q. Fixed in 2005.

Here q is the number of queries. The intuition didn’t notice q; why does q matter for the proof? Proof outline: Take any cascade attack A using at most q queries. Proof has q + 1 steps.

slide-13
SLIDE 13

5

Theorem statement is wrong:

  • mits factor q. Fixed in 2005.

Here q is the number of queries. The intuition didn’t notice q; why does q matter for the proof? Proof outline: Take any cascade attack A using at most q queries. Proof has q + 1 steps. Step 0: Replace outputs from master key k with independent uniform random outputs. Distinguisher for this step ⇒ attack against S.

slide-14
SLIDE 14

6

Step 1: Replace cascade outputs for first subkey with independent uniform random outputs. Distinguisher for this step ⇒ attack against S.

slide-15
SLIDE 15

6

Step 1: Replace cascade outputs for first subkey with independent uniform random outputs. Distinguisher for this step ⇒ attack against S. Step 2: Replace cascade outputs from next (distinct) subkey. : : : Step q: Replace cascade outputs from qth (distinct) subkey. Could skip steps if q > #{N}.

slide-16
SLIDE 16

6

Step 1: Replace cascade outputs for first subkey with independent uniform random outputs. Distinguisher for this step ⇒ attack against S. Step 2: Replace cascade outputs from next (distinct) subkey. : : : Step q: Replace cascade outputs from qth (distinct) subkey. Could skip steps if q > #{N}. Further complications in proof to monolithically handle ‘ levels. 2011 Bernstein: simpler to compose better 2-level theorem.

slide-17
SLIDE 17

7

Not happy with cascade proofs? A different proof appears in Crypto 1996 Bellare–Canetti– Krawczyk NMAC/HMAC paper.

slide-18
SLIDE 18

7

Not happy with cascade proofs? A different proof appears in Crypto 1996 Bellare–Canetti– Krawczyk NMAC/HMAC paper. Given key k and input (N1; N2), NMAC computes S(S(k; N1); N2), where S is a stream cipher “compression function”. (Tweaks: output is encrypted; no prefix-free requirement.)

slide-19
SLIDE 19

7

Not happy with cascade proofs? A different proof appears in Crypto 1996 Bellare–Canetti– Krawczyk NMAC/HMAC paper. Given key k and input (N1; N2), NMAC computes S(S(k; N1); N2), where S is a stream cipher “compression function”. (Tweaks: output is encrypted; no prefix-free requirement.) Proof has weird assumptions. Crypto 2006 Bellare proof: more reasonable-sounding assumptions.

slide-20
SLIDE 20

8

Complicated; error-prone. 2012 Koblitz–Menezes: Bellare’s assumptions are wrong.

slide-21
SLIDE 21

8

Complicated; error-prone. 2012 Koblitz–Menezes: Bellare’s assumptions are wrong. 2012 Katz–Lindell: public denials.

slide-22
SLIDE 22

8

Complicated; error-prone. 2012 Koblitz–Menezes: Bellare’s assumptions are wrong. 2012 Katz–Lindell: public denials. 2012 Bernstein–Lange: Bellare’s assumptions are wrong.

slide-23
SLIDE 23

8

Complicated; error-prone. 2012 Koblitz–Menezes: Bellare’s assumptions are wrong. 2012 Katz–Lindell: public denials. 2012 Bernstein–Lange: Bellare’s assumptions are wrong. 2013 Pietrzak: fixed theorem from Koblitz–Menezes is wrong.

slide-24
SLIDE 24

8

Complicated; error-prone. 2012 Koblitz–Menezes: Bellare’s assumptions are wrong. 2012 Katz–Lindell: public denials. 2012 Bernstein–Lange: Bellare’s assumptions are wrong. 2013 Pietrzak: fixed theorem from Koblitz–Menezes is wrong. 2013 Pietrzak, 2013 Koblitz– Menezes, 2014 Ga˘ zi–Pietrzak– Ryb´ ar: another NMAC proof, as complicated as cascade proof.

slide-25
SLIDE 25

9

  • Hmmm. CCS 2005 Barak–Halevi

“A model and architecture for pseudo-random generation with applications to /dev/random”? RNG outputs F(k), F(G(k)), etc. Another complicated proof.

slide-26
SLIDE 26

9

  • Hmmm. CCS 2005 Barak–Halevi

“A model and architecture for pseudo-random generation with applications to /dev/random”? RNG outputs F(k), F(G(k)), etc. Another complicated proof. How about 2006 Campagna “Security bounds for the NIST codebook-based deterministic random bit generator”? Doesn’t prove anything about rekeying.

slide-27
SLIDE 27

9

  • Hmmm. CCS 2005 Barak–Halevi

“A model and architecture for pseudo-random generation with applications to /dev/random”? RNG outputs F(k), F(G(k)), etc. Another complicated proof. How about 2006 Campagna “Security bounds for the NIST codebook-based deterministic random bit generator”? Doesn’t prove anything about rekeying. 2017 AES-GCM-SIV bounds? Big errors found by Iwata–Seurin.

slide-28
SLIDE 28

10

A simple tight new proof Remember the goal: analyze pT . There are T keys. Cipher 1: key → many subkeys. Cipher 2: subkey → outputs.

slide-29
SLIDE 29

10

A simple tight new proof Remember the goal: analyze pT . There are T keys. Cipher 1: key → many subkeys. Cipher 2: subkey → outputs. New proof has just two steps.

slide-30
SLIDE 30

10

A simple tight new proof Remember the goal: analyze pT . There are T keys. Cipher 1: key → many subkeys. Cipher 2: subkey → outputs. New proof has just two steps. Step 1. Replace all subkeys. Distinguisher ⇒ T-target attack against cipher 1.

slide-31
SLIDE 31

10

A simple tight new proof Remember the goal: analyze pT . There are T keys. Cipher 1: key → many subkeys. Cipher 2: subkey → outputs. New proof has just two steps. Step 1. Replace all subkeys. Distinguisher ⇒ T-target attack against cipher 1. Step 2. Replace all outputs. Distinguisher ⇒ (T · many)-target attack against cipher 2.

slide-32
SLIDE 32

11

multi-target two-level security single-target two-level security

  • multi-target
  • ne-level

security new, easy

  • induct
  • X
  • single-target
  • ne-level

security

  • harder
  • induct
  • multi-target

many-level security single-target many-level security

  • X: FOCS 1996 Bellare–Canetti–

Krawczyk Lemma 3.2. Harder; not suitable for induction.