Boomerang Switch in Multiple Rounds Application to AES Variants and - - PowerPoint PPT Presentation

▶
boomerang switch in multiple rounds
SMART_READER_LITE
LIVE PREVIEW

Boomerang Switch in Multiple Rounds Application to AES Variants and - - PowerPoint PPT Presentation

Feb 24, 2023 292 likes •596 views

Boomerang Switch in Multiple Rounds Application to AES Variants and Deoxys Haoyang Wang, Thomas Peyrin School of Physical and Mathematical Sciences, Nanyang Technological University, Singapore FSE 2019, Paris March 26, 2019 Outline

slide-1
SLIDE 1

Boomerang Switch in Multiple Rounds

Application to AES Variants and Deoxys

Haoyang Wang, Thomas Peyrin

School of Physical and Mathematical Sciences, Nanyang Technological University, Singapore

FSE 2019, Paris

March 26, 2019

slide-2
SLIDE 2

Outline

  • Background
  • Boomerang Switch
  • Attack on 10-round AES-256
  • Application to Full-round AES-192 and reduced-round Deoxys-BC

2 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-3
SLIDE 3

Background

3 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-4
SLIDE 4

Background

Boomerang Attack

Boomerang attack

  • A cipher E is divided into two sub-ciphers:

E = E1 ◦ E0

  • E0: P[α → β] = p
  • E1: P[γ → δ] = q
  • The two trails are assumed to be independent.
  • Distinguish probability:

Pr[E−1(E(x)⊕δ)⊕E−1(E(x⊕α)⊕δ) = α] = p2q2

α α β β γ γ δ δ E0 E0 E0 E0 E1 E1 E1 E1 P1 P2 P3 P4 C2 C1 C3 C4

4 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-5
SLIDE 5

Background

Dependency Between the Two Sub-Ciphers

  • At the boundary of the two trails, dependency may exist.

Positive effect

  • Middle round S-box trick [BDD03]
  • Ladder switch [BK09]
  • S-box switch [BK09]
  • Feistel switch [BK09]

Negative effect

  • Imcompatibility [Mer09]

5 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-6
SLIDE 6

Background

Sandwich Attack

Sandwich attack

  • E is further divided into three sub-ciphers:

E = E1 ◦ Em ◦ E0

  • Em contains the dependent parts of the two trails,

with probability r

  • r = Pr[E−1

m (Em(x) ⊕ γ) ⊕ E−1 m (Em(x ⊕ β) ⊕ γ) = β]

  • Distinguish probability: p2q2r.

α α β β δ δ γ γ P1 P3 E0 E0 Em Em x3 x1 y1 y3 E1 C1 C3 E1 P2 P4 E0 E0 Em Em x4 x2 y2 y4 E1 C2 C4 E1

6 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-7
SLIDE 7

Background

View of Boomerang Switch in Sandwich Attack

S S ∆0 ∇0 ∇0 y1(=y3) y2(=y4) x1(=x3) x2(=x4)

Ladder switch

1 ∇0 = 0 2 y3 = y1 and y4 = y2 3 x3 = x1 and x4 = x2 4 r = 1 S S ∆0 ∆1 ∇0 y1(=y4) y2(=y3) x1(=x4) x2(=x3)

Sbox switch

1 ∇0 = ∆1 2 y4 = y1, y3 = y2 3 x4 = x1 and x3 = x2 4 r = pr[∆0

Sbox

− − − → ∆1]

7 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-8
SLIDE 8

Background

Boomerang Connectivity Table (BCT)

∆0 ∆0 ∇0 ∇0 ∆1 ∆1 S S S S x1 y1 x2 y2 x3 y3 x4 y4

Construction

  • Focus on a single S-box layer.
  • ∆0 and ∇0 are taken into consideration.
  • The entry for (∆0, ∇0) is computed by

#{x ∈ {0, 1}n|S−1(S(x) ⊕ ∇0) ⊕ S−1(S(x ⊕ ∆0) ⊕ ∇0)}.

8 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-9
SLIDE 9

Background

Boomerang Connectivity Table (BCT)

∆0 ∆0 ∇0 ∇0 ∆1 ∆1 S S S S x1 y1 x2 y2 x3 y3 x4 y4

Advantages

  • It covers the switching effect of ladder switch, S-box switch and incompatibility.
  • New switching effect: Compared to S-box switch where ∇0 = ∆1, BCT does not require

the value of ∆1, which could lead to a higher switching probability.

8 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-10
SLIDE 10

Background

Motivation

Questions

  • Can we extend Em to multiple rounds?
  • If yes, can current switching techniques be applied to the multiple-round case?

9 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-11
SLIDE 11

Boomerang Switch

10 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-12
SLIDE 12

Boomerang Switch

Determining the Number of Rounds in Em

SB,SR MC ARK,SB SB,SR MC ARK,SB

Uppertrail Lowertrail

Figure: Parallel operations of truncated 2-round AES The idea of ladder switch The round function of a cipher can be divided into two independent parts, which can operate in parallel. Extension In Em, if the forward diffusion of the active cells in the upper trail has no interaction with the backward diffusion of the active cells in the lower trail, a right quartet of Em can be generated with probability 1.

11 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-13
SLIDE 13

Boomerang Switch

Determining the Number of Rounds in Em

R R R SubCells R R R SubCells

β γ

Figure: A 4-round Em of SKINNY with probability 1 Observation

  • For SKINNY [BJK+16], Em can be at most four rounds with probability r = 1.
  • Em contains more rounds for those ciphers with slower diffusion layer.

12 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-14
SLIDE 14

Boomerang Switch

Incompatibility in Multiple Rounds

df f1 f9 f1 f1 08 f9 c6 a9 70 b9 99

SB SR,MC AK SR,MC AK SB

BCT(f9,c6)=2 BCT(df,a9)=2 DDT(f9,c6)=2 DDT(df,f1)=2

β γ

Figure: An incompatible 2-round Em of AES Deficiency of BCT

  • BCT detects incompatibility while the entry is zero.
  • The two trails are valid with probability 2−7 respectively: DDT(df,f1)=2, DDT(f9,c6)=2.
  • For the two active S-boxes, the entries of BCT are non-zero: BCT(df,a9)=2,

BCT(f9,c6)=2.

  • However, this example is incompatible: BCT(df,a9) and DDT(df,f1) cannot be non-zero

simultaneously.

13 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-15
SLIDE 15

Boomerang Switch

Observation on S-box in the Boomerang Switch

∆0 ∆0 ∇0 ∇0 ∆1 ∆1 ∇1 ∇1 S S S S x1 y1 x2 y2 x3 y3 x4 y4

Lemma1 For any fixed ∆0 and ∆1, for which the DDT entry is 2l, l being a nonzero integer, the maximum number of nontrivial values of ∇0, for which a right quartet could be generated, is 2 l

2

  • +1.

Lemma2 For any fixed ∆0 and ∇0, for which the BCT entry is 2l and the DDT entry is 2l′, l and l′ being nonzero integers, the maximum number of choices of ∆1, for which a right quartet could be generated, is 1 + (2l − 2l′)/4.

14 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-16
SLIDE 16

Boomerang Switch

Boomerang Difference Table (BDT)

∆0 ∆0 ∇0 ∇0 ∆1 ∆1 ∇1 ∇1 S S S S x1 y1 x2 y2 x3 y3 x4 y4

Construction

  • A combination of BCT and DDT.
  • The entry for (∆0, ∆1, ∇0) is defined by:

#{x ∈ {0, 1}n|S−1(S(x) ⊕ ∇0) ⊕ S−1(S(x ⊕ ∆0) ⊕ ∇0) = ∆0, S(x) ⊕ S(x ⊕ ∆0) = ∆1}, n is the S-box size.

  • The time complexity for the construction is O(22n).

15 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-17
SLIDE 17

Boomerang Switch

Boomerang Difference Table (BDT)

∆0 ∆0 ∇0 ∇0 ∆1 ∆1 ∇1 ∇1 S S S S x1 y1 x2 y2 x3 y3 x4 y4

Properties

  • DDT(∆0, ∆1) = BDT(∆0, ∆1, 0) = BDT(∆0, ∆1, ∆1)
  • BCT(∆0, ∇0) = 2n

∆1=0 BDT(∆0, ∆1, ∇0)

  • BDT(0, 0, ∇0) = 2n
  • (∆0, ∆1, ∇0) is incompatible when the corresponding entry in BDT is 0.

15 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-18
SLIDE 18

Attack on 10-round AES-256

16 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-19
SLIDE 19

Attack on 10-round AES-256

Attack model

Related-key attack

  • The adversary chooses a relation between several keys, e.g., K2 = K1 ⊕ C and is given

access to encryption/decryption oracles with these keys. Related-subkey attack

  • The adversary chooses a relation between subkeys, e.g., K2 = F −1(F(K1) ⊕ C), where F

represents the round function of key schedule.

  • Advantage: easier to obtain a desired related-subkey difference in non-linear key schedule.
  • Disadvantages: complex key access scheme, less practical and even too contrived for

academic interest.

17 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-20
SLIDE 20

Attack on 10-round AES-256

Overview of the Attack

Idea

  • We stick to the related-key attack. Since the key schedule of AES is non-linear, a

related-key differential path is used for the upper trial while a single-key differential path is used for the lower trail.

  • The local collision strategy is used for constructing the upper trail.
  • Apply the boomerang switch in two rounds.

18 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-21
SLIDE 21

Attack on 10-round AES-256

The 10-round Attack

19 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-22
SLIDE 22

Attack on 10-round AES-256

The 2-round Em

SB

∆0 ∆1 ∇0 ∆′ ∇′

1

∇′

SR MC SR MC AK SB

8 9

β γ

Analysis

  • β and γ are fixed.
  • For the S-box at (0,0) in round 8:
  • A fixed value ∆1 is chosen so that there is no overlapped active cell in round 9.
  • With the fixed ∆0 and ∆1, choose the values of ∇0 so that the BDT entries are

non-zero, and the switching probability is obtained accordingly.

  • For the S-box at (0,0) in round 9:
  • ∇′

1 is uniquely determined by ∇0.

  • Since ∆′

0 = 0, the switching probability can be evaluated by DDT with entry (∇′ 1, ∇′ 0)

20 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-23
SLIDE 23

Attack on 10-round AES-256

Result

Scenario # keys Time Data Result Reference Key Diff. 64/256 2172 2114 Full key [KHP07]/[BDK05] Subkey Diff. 2 245(2221) 244 35 subkey bits (full key) [BDK+10] Key Diff. 2 275 275 Full key this paper

21 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-24
SLIDE 24

Application to Full-round AES-192 and reduced-round Deoxys-BC

22 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-25
SLIDE 25

Application to Full-round AES-192 and reduced-round Deoxys-BC

Overview of the Previous Attacks

  • Full-round AES-192 [BN09]: the first related-key boomerang attack on full-round AES-192.
  • Full-round AES-192 [BN10]: the upper trail is different than [BN09], and remains as the

best attack.

  • 10-round Deoxys-BC[CHP+17]: its distinguisher is built with the idea of 2-round

boomerang switch.

23 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-26
SLIDE 26

Application to Full-round AES-192 and reduced-round Deoxys-BC

Improvement of the Attack [BN10]

Idea

  • The original attack [BN10] uses a similar idea of local collision. The boomerang switch is
  • ptimized in one round.
  • With the help of BDT, we managed to extend the boomerang switch to 2-round by

searching a new upper trail.

24 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-27
SLIDE 27

Application to Full-round AES-192 and reduced-round Deoxys-BC

The 2-round Em of the Improved Attack on [BN10]

SB SR MC SR MC SB

∆0 ∆1 ∇0 ∆′ ∇′

1

∇′ round 6 round 7

β γ

Analysis

  • No overlapped active S-box in the two S-box layer.
  • However, specific values of ∆1 and ∇′

1 are required.

  • The switching probabilities of the corresponding two S-boxes are counted.

25 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-28
SLIDE 28

Application to Full-round AES-192 and reduced-round Deoxys-BC

Results

Attacks Improvement(Data&Time) AES-192 [BN10] 21.3 AES-192 [BN09] 24.8 Deoxys-BC-256 [CHP+17] 21.6

26 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-29
SLIDE 29

Application to Full-round AES-192 and reduced-round Deoxys-BC

Conclusion

  • The slower is the diffusion in a cipher, the more rounds will be impacted by the switching

effect.

  • We introduced the BDT to easily evaluate the boomerang switch in multiple rounds.
  • Improved attacks on 10-round AES-256, full-round AES-192 and reduced round

Deoxys-BC-256.

27 NTU Boomerang Switch in Multiple Rounds 26.3.2019

slide-30
SLIDE 30

THANK YOU!

28 NTU Boomerang Switch in Multiple Rounds 26.3.2019