Correlation of Quadratic Boolean Functions: Cryptanalysis of All - PowerPoint PPT Presentation

Correlation and Linear Cryptanalysis Correlation of Quadratic Boolean Functions Cryptanalysis of MORUS Conclusion and Discussion Correlation of Quadratic Boolean Functions: Cryptanalysis of All Versions of Full MORUS Siwei Sun Joint work with: Danping Shi Yu Sasaki Chaoyun Li Lei Hu Chinese Academy of Sciences, China NTT Secure Platform Laboratories, Japan imec-COSIC, Dept. Electrical Engineering (ESAT), KU Leuven, Belgium December 14, 2019 Siwei Sun et. al. Cryptanalysis of All Versions of Full MORUS 1 / 38

Correlation and Linear Cryptanalysis Correlation of Quadratic Boolean Functions Cryptanalysis of MORUS Conclusion and Discussion Outlines Correlation and Linear Cryptanalysis 1 Correlation of Quadratic Boolean Functions 2 Cryptanalysis of MORUS 3 Conclusion and Discussion 4 Siwei Sun et. al. Cryptanalysis of All Versions of Full MORUS 2 / 38

Correlation and Linear Cryptanalysis Correlation of Quadratic Boolean Functions Cryptanalysis of MORUS Conclusion and Discussion Outline Correlation and Linear Cryptanalysis 1 Correlation of Quadratic Boolean Functions 2 Cryptanalysis of MORUS 3 Conclusion and Discussion 4 Siwei Sun et. al. Cryptanalysis of All Versions of Full MORUS 3 / 38

Correlation and Linear Cryptanalysis Correlation of Quadratic Boolean Functions Cryptanalysis of MORUS Conclusion and Discussion Correlation Let f : F n 2 → F 2 be a Boolean function with ANF � f ( ① ) = a ✉ ① ✉ , ✉ ∈ F n 2 where ① = ( x 1 , · · · , x n ) , ✉ = ( u 1 , · · · , u n ) , a ✉ ∈ F 2 , and ① ✉ = � n i =1 x u i i . Definition (Correlation) The correlation of an n -variable Boolean function f is cor ( f ) = 1 2 ( − 1) f ( ① ) , and the weight of the correlation is � ① ∈ F n 2 n defined as − log 2 | cor ( f ) | . Pr ( f = 0) = 1 2 + 1 2 cor ( f ) Siwei Sun et. al. Cryptanalysis of All Versions of Full MORUS 3 / 38

Correlation and Linear Cryptanalysis Correlation of Quadratic Boolean Functions Cryptanalysis of MORUS Conclusion and Discussion Linear Cryptanalysis S U S 0 S 1 S k − 1 S k Init F F · · · F F α 0 α 1 α k − 2 α k − 1 α k β − 1 β 0 β 1 β k − 2 β k − 1 γ 0 γ 1 γ k − 1 γ k G G · · · G G λ k − 1 λ 0 λ 1 λ k Z 0 Z 1 Z k − 1 Z k �� k i =0 λ i Z i � Object: max | cor | i =0 λ i Z i is a Boolean function whose variables are bits Note that � k of S 0 . Siwei Sun et. al. Cryptanalysis of All Versions of Full MORUS 4 / 38

Correlation and Linear Cryptanalysis Correlation of Quadratic Boolean Functions Cryptanalysis of MORUS Conclusion and Discussion Definition (Correlation) The correlation of an n -variable Boolean function f is cor ( f ) = 1 2 ( − 1) f ( ① ) , and the weight of the correlation is � ① ∈ F n 2 n defined as − log 2 | cor ( f ) | . Brute force the input Graph-based method [TIM + 18] ... ... Siwei Sun et. al. Cryptanalysis of All Versions of Full MORUS 5 / 38

Correlation and Linear Cryptanalysis Correlation of Quadratic Boolean Functions Cryptanalysis of MORUS Conclusion and Discussion Outline Correlation and Linear Cryptanalysis 1 Correlation of Quadratic Boolean Functions 2 Cryptanalysis of MORUS 3 Conclusion and Discussion 4 Siwei Sun et. al. Cryptanalysis of All Versions of Full MORUS 6 / 38

Correlation and Linear Cryptanalysis Correlation of Quadratic Boolean Functions Cryptanalysis of MORUS Conclusion and Discussion Definition (Disjoint Quadratic Boolean Function) A quadratic Boolean function f ( x 1 , · · · , x n ) is disjoint if no variable x i appears in more than one quadratic term. Example x 1 x 2 + x 3 x 4 x 1 x 3 + x 2 x 4 + x 2 + x 5 Counter-Example x 1 x 2 + x 2 x 3 Siwei Sun et. al. Cryptanalysis of All Versions of Full MORUS 6 / 38

Correlation and Linear Cryptanalysis Correlation of Quadratic Boolean Functions Cryptanalysis of MORUS Conclusion and Discussion lemma Let f = x i 1 x i 2 + · · · + x i 2 k − 1 x i 2 k + x j 1 + · · · + x j s be a disjoint quadratic Boolean function. Then the correlation of f is � k t =1 Coe f ( x i 2 t − 1 ) Coe f ( x i 2 t ) · 2 − k  ( − 1) { j 1 , · · · , j s } ⊆ { i 1 , · · · , i 2 k }   0 { j 1 , · · · , j s } � { i 1 , · · · , i 2 k }   where Coe f ( ① ✉ ) denotes the coefficient of the monomial ① ✉ in the ANF of f . Examples | cor ( x 1 x 2 + x 3 x 4 ) | = 2 − 2 | cor ( x 1 x 3 + x 2 x 4 + x 2 + x 5 ) | = 0 | cor ( x 1 x 3 + x 2 x 4 + x 2 + x 3 ) | = 2 − 2 Siwei Sun et. al. Cryptanalysis of All Versions of Full MORUS 7 / 38

Correlation and Linear Cryptanalysis Correlation of Quadratic Boolean Functions Cryptanalysis of MORUS Conclusion and Discussion Idea Given a quadratic Boolean function, transform it into a disjoint quadratic Boolean function such that the transformation is correlation invariant (up to a minus sign). Siwei Sun et. al. Cryptanalysis of All Versions of Full MORUS 8 / 38

Correlation and Linear Cryptanalysis Correlation of Quadratic Boolean Functions Cryptanalysis of MORUS Conclusion and Discussion Example f = x 1 x 2 + x 1 x 5 + x 2 x 3 + x 2 x 4 + x 1 + x 2 Siwei Sun et. al. Cryptanalysis of All Versions of Full MORUS 9 / 38

Correlation and Linear Cryptanalysis Correlation of Quadratic Boolean Functions Cryptanalysis of MORUS Conclusion and Discussion Example f = x 1 x 2 + x 1 x 5 + x 2 x 3 + x 2 x 4 + x 1 + x 2 f = x 1 x 2 + x 1 x 5 + x 2 x 3 + x 2 x 4 + x 1 + x 2 Siwei Sun et. al. Cryptanalysis of All Versions of Full MORUS 9 / 38

Correlation and Linear Cryptanalysis Correlation of Quadratic Boolean Functions Cryptanalysis of MORUS Conclusion and Discussion Example f = x 1 x 2 + x 1 x 5 + x 2 x 3 + x 2 x 4 + x 1 + x 2 f = x 1 x 2 + x 1 x 5 + x 2 x 3 + x 2 x 4 + x 1 + x 2 f = x 2 ( x 1 + x 3 + x 4 ) + x 1 x 5 + x 1 + x 2 Siwei Sun et. al. Cryptanalysis of All Versions of Full MORUS 9 / 38

Correlation and Linear Cryptanalysis Correlation of Quadratic Boolean Functions Cryptanalysis of MORUS Conclusion and Discussion Example f = x 1 x 2 + x 1 x 5 + x 2 x 3 + x 2 x 4 + x 1 + x 2 f = x 1 x 2 + x 1 x 5 + x 2 x 3 + x 2 x 4 + x 1 + x 2 f = x 2 ( x 1 + x 3 + x 4 ) + x 1 x 5 + x 1 + x 2 x 1 ← x 1 + x 3 + x 4 x j ← x j , j � = 1 Siwei Sun et. al. Cryptanalysis of All Versions of Full MORUS 9 / 38

Correlation and Linear Cryptanalysis Correlation of Quadratic Boolean Functions Cryptanalysis of MORUS Conclusion and Discussion Example f = x 1 x 2 + x 1 x 5 + x 2 x 3 + x 2 x 4 + x 1 + x 2 f = x 1 x 2 + x 1 x 5 + x 2 x 3 + x 2 x 4 + x 1 + x 2 f = x 2 ( x 1 + x 3 + x 4 ) + x 1 x 5 + x 1 + x 2 x 1 ← x 1 + x 3 + x 4 x j ← x j , j � = 1 f = x 1 x 2 + x 1 x 5 + x 3 x 5 + x 4 x 5 + x 1 + x 3 + x 4 + x 2 Siwei Sun et. al. Cryptanalysis of All Versions of Full MORUS 9 / 38

Correlation and Linear Cryptanalysis Correlation of Quadratic Boolean Functions Cryptanalysis of MORUS Conclusion and Discussion Example f = x 1 x 2 + x 1 x 5 + x 2 x 3 + x 2 x 4 + x 1 + x 2 f = x 1 x 2 + x 1 x 5 + x 2 x 3 + x 2 x 4 + x 1 + x 2 f = x 2 ( x 1 + x 3 + x 4 ) + x 1 x 5 + x 1 + x 2 x 1 ← x 1 + x 3 + x 4 x j ← x j , j � = 1 f = x 1 x 2 + x 1 x 5 + x 3 x 5 + x 4 x 5 + x 1 + x 3 + x 4 + x 2 Siwei Sun et. al. Cryptanalysis of All Versions of Full MORUS 9 / 38

Correlation and Linear Cryptanalysis Correlation of Quadratic Boolean Functions Cryptanalysis of MORUS Conclusion and Discussion Example f = x 1 x 2 + x 1 x 5 + x 2 x 3 + x 2 x 4 + x 1 + x 2 f = x 1 x 2 + x 1 x 5 + x 2 x 3 + x 2 x 4 + x 1 + x 2 f = x 2 ( x 1 + x 3 + x 4 ) + x 1 x 5 + x 1 + x 2 x 1 ← x 1 + x 3 + x 4 x j ← x j , j � = 1 f = x 1 x 2 + x 1 x 5 + x 3 x 5 + x 4 x 5 + x 1 + x 3 + x 4 + x 2 f = x 1 ( x 2 + x 5 ) + x 3 x 5 + x 4 x 5 + x 1 + x 3 + x 4 + x 2 Siwei Sun et. al. Cryptanalysis of All Versions of Full MORUS 9 / 38

Correlation and Linear Cryptanalysis Correlation of Quadratic Boolean Functions Cryptanalysis of MORUS Conclusion and Discussion Example f = x 1 x 2 + x 1 x 5 + x 2 x 3 + x 2 x 4 + x 1 + x 2 f = x 1 x 2 + x 1 x 5 + x 2 x 3 + x 2 x 4 + x 1 + x 2 f = x 2 ( x 1 + x 3 + x 4 ) + x 1 x 5 + x 1 + x 2 x 1 ← x 1 + x 3 + x 4 x j ← x j , j � = 1 f = x 1 x 2 + x 1 x 5 + x 3 x 5 + x 4 x 5 + x 1 + x 3 + x 4 + x 2 f = x 1 ( x 2 + x 5 ) + x 3 x 5 + x 4 x 5 + x 1 + x 3 + x 4 + x 2 x 2 ← x 2 + x 5 x j ← x j , j � = 2 Siwei Sun et. al. Cryptanalysis of All Versions of Full MORUS 9 / 38

Correlation and Linear Cryptanalysis Correlation of Quadratic Boolean Functions Cryptanalysis of MORUS Conclusion and Discussion Example f = x 1 x 2 + x 1 x 5 + x 2 x 3 + x 2 x 4 + x 1 + x 2 f = x 1 x 2 + x 1 x 5 + x 2 x 3 + x 2 x 4 + x 1 + x 2 f = x 2 ( x 1 + x 3 + x 4 ) + x 1 x 5 + x 1 + x 2 x 1 ← x 1 + x 3 + x 4 x j ← x j , j � = 1 f = x 1 x 2 + x 1 x 5 + x 3 x 5 + x 4 x 5 + x 1 + x 3 + x 4 + x 2 f = x 1 ( x 2 + x 5 ) + x 3 x 5 + x 4 x 5 + x 1 + x 3 + x 4 + x 2 x 2 ← x 2 + x 5 x j ← x j , j � = 2 f = x 1 x 2 + x 3 x 5 + x 4 x 5 + x 1 + x 2 + x 3 + x 4 + x 5 Siwei Sun et. al. Cryptanalysis of All Versions of Full MORUS 9 / 38