Cryptanalysis of Round-Reduced LED Ivica Nikoli, Lei Wang and Shuang - - PowerPoint PPT Presentation

▶
cryptanalysis of
SMART_READER_LITE
LIVE PREVIEW

Cryptanalysis of Round-Reduced LED Ivica Nikoli, Lei Wang and Shuang - - PowerPoint PPT Presentation

Jan 27, 2023 316 likes •749 views

Cryptanalysis of Round-Reduced LED Ivica Nikoli, Lei Wang and Shuang Wu FSE 2013 Singapore March 11, 2013 1 Outline Backgrounds Specification Previous Analysis Slidex Attack Application Multicollision Application

slide-1
SLIDE 1

Cryptanalysis of Round-Reduced LED

Ivica Nikolić, Lei Wang and Shuang Wu

FSE 2013 Singapore March 11, 2013

1

slide-2
SLIDE 2

Outline

  • Backgrounds
  • Specification
  • Previous Analysis
  • Slidex Attack Application
  • Multicollision Application
  • Distinguishers
  • Differential Property
  • Random-difference Distinguisher
  • Conclusion

2

slide-3
SLIDE 3

Outline

  • Backgrounds
  • Specification
  • Previous Analysis
  • Slidex Attack Application
  • Multicollision Application
  • Distinguishers
  • Differential Property
  • Random-difference Distinguisher
  • Conclusion

3

slide-4
SLIDE 4

LED

  • Designed by Guo et al. at CHES 2011
  • Light Encryption Device
  • 64-bit block
  • 64- or 128-bit key (primarily)
  • Conservative security, e.g. concerning
  • Related-key attack
  • Distinguishers in hash function setting

4

slide-5
SLIDE 5

Specification (1/2)

  • Extremely simple key schedule
  • Denote the secret key as K
  • LED-64: K as each round key
  • LED-128: K=K0||K1, then K0 and K1 as

round keys alternatively

F0 F1 Ft … K0 K1 Kt P C

5

slide-6
SLIDE 6

Specification (2/2)

  • LED-64: 8 steps; LED-128: 12 steps
  • Step functions
  • AES like
  • 4 rounds and each round as below
  • Differ in round constants.

6

slide-7
SLIDE 7

Timeline of Previous Analysis

  • Guo et al. at CHES 2011
  • Distinguishers on 3.75/6.75-step LED-64/-128
  • Super-Sbox cryptanalysis
  • Isobe and Shibutani at ACISP 2012
  • Key recovery on 2/4-step LED-64/-128
  • Meet-in-the-middle cryptanalysis
  • Mendel et al. at ASIACRYPT 2012
  • Key recovery on 4-step LED-128
  • Related-key key recovery on 4/6-step LED-64/-128
  • Guess-then-recover, local collision, characteristics

and differentials of step functions

7

slide-8
SLIDE 8

Security State of LED

  • The number of attacked steps

Key Recovery Distinguisher

Single-key Related-key LED-64 (8 steps)

2 4 3.75

LED-128 (12 steps)

4 6 6.75

8

slide-9
SLIDE 9

Outline

  • Backgrounds
  • Specification
  • Previous Analysis
  • Slidex Attack Application
  • Multicollision Application
  • Distinguishers
  • Differential Property
  • Random-difference Distinguisher
  • Conclusion

9

slide-10
SLIDE 10

Security State of LED

  • The number of attacked steps

Key Recovery Distinguisher

Single-key Related-key LED-64 (8 steps)

2 4 3.75

LED-128 (12 steps)

4 6 6.75

10

slide-11
SLIDE 11

Slidex Attack

  • Dunkelman et al. at EUROCRYPT 2012
  • Known-plaintext attack
  • Wok for any public permutation E
  • Time*Data=2n
  • K is n bits long

E K K P C

11

slide-12
SLIDE 12

Application to 4-Step LED-128

  • Guess K0
  • Recover K1

F0 K0 P P' F3 K0 C C' K1 K1 C' P' F1 K0 F2 E

12

slide-13
SLIDE 13

Comparison

  • Model
  • Ours: known-plaintext
  • Previous: chosen-plaintext
  • Complexity

Data Time IS12 216 2112 MRT+12 264 296 Ours 232 296

13

slide-14
SLIDE 14

Outline

  • Backgrounds
  • Specification
  • Previous Analysis
  • Slidex Attack Application
  • Multicollision Application
  • Distinguishers
  • Differential Property
  • Random-difference Distinguisher
  • Conclusion

14

slide-15
SLIDE 15

A 2-Step Even-Mansour

  • K is n bits long
  • E0 and E1 are public permutations

E0 K K P E1 K C

15

slide-16
SLIDE 16

A 2-Step Even-Mansour

  • K is n bits long
  • E0 and E1 are public permutations

E0 K K P E1 K C

Can we recover K with a complexity less than 2n?

16

slide-17
SLIDE 17

An Observation (1/7)

  • K = P X
  • K = E0(X) E1
  • 1(Y)
  • K = Y C

E0 K K P E1 K C X Y

17

slide-18
SLIDE 18

An Observation (2/7)

  • K = P X
  • K = E0(X) E1
  • 1(Y)
  • K = Y C

E0 K K P E1 K C X Y

We recover X for some P, which gives us K immediately.

18

slide-19
SLIDE 19

An Observation (3/7)

  • K = P X
  • K = E0(X) E1
  • 1(Y)
  • K = Y C

P = E0(X) E1

  • 1(P

X) C X

19

slide-20
SLIDE 20

An Observation (4/7)

  • K = P X
  • K = E0(X) E1
  • 1(Y)
  • K = Y C

P = E0(X) E1

  • 1(P

X) C X

20

slide-21
SLIDE 21

An Observation (5/7)

  • For a t-multicollision on P C, namely

we get

C1 P1 = Ct Pt = … = const Pi = E0(Xi) E1

  • 1(const

Xi) Xi

21

slide-22
SLIDE 22

An Observation (6/7)

  • For a t-multicollision on P C, namely

we get denoted as

C1 P1 = Ct Pt = … = const Pi = G(Xi) Pi = E0(Xi) E1

  • 1(const

Xi) Xi

22

slide-23
SLIDE 23

An Observation (7/7)

  • For a t-multicollision on P C, namely

we recover a Xi with a complexity 2n/t

  • try 2n/t random values as X, and match

G(X) to {P1, P2, …, Pt}.

C1 P1 = Ct Pt = … = const

23

slide-24
SLIDE 24

Application to 6-Step LED-128

  • Guess K0
  • Recover K1

F0

K0 P P'

F5

K0 C C' K1 K1 C' P' F1 K0 F2 E0 K1 F3 K0 F4 E1

24

slide-25
SLIDE 25

Outline

  • Backgrounds
  • Specification
  • Previous Analysis
  • Slidex Attack Application
  • Multicollision Application
  • Distinguishers
  • Differential Property
  • Random-difference Distinguisher
  • Conclusion

25

slide-26
SLIDE 26

Differential vs Characteristic

  • Differential
  • Characteristic
  • The characteristic probability on an active

step function is upper bounded by 2-50.

∆in ∆out ? ? ? ? ∆in ∆out ∆1 ∆2 ∆3 ∆4

26

slide-27
SLIDE 27

Differential on 2-step LED-64

  • For a differential ∆1, ∆2)→∆3
  • what is the complexity of finding a

solution (P, K)?

F0 F1 ∆1 ∆2 ∆2 ∆2 ∆3

27

slide-28
SLIDE 28

Differential on 2-step LED-64

  • Meet-in-the-middle approach
  • One solution with a birthday complexity
  • Differential multicollision distinguisher

F0 F1 ∆1 ∆2 ∆2 ∆2 ∆3

28

slide-29
SLIDE 29

Extend to 4-Step LED-64

  • Chosen differentials ∆, ∆→∆
  • Complexity of birthday bound to find a

solution (P, K).

∆ ∆ ∆ ∆ F0 F1 F2 F3 ∆ ∆ ∆

prob=1 prob=1

29

slide-30
SLIDE 30

Application to 8-Step LED-128

  • Set a random value to K1 and ∆K1=0
  • Set ∆P=∆K0=∆, and find a solution P, K0)

F2*i F2*i+1 K1

Gi

∆ ∆ ∆ ∆ G0 G1 G2 G3 ∆ ∆ ∆

30

slide-31
SLIDE 31

Application to 8-Step LED-128

  • Set a random value to K1 and ∆K1=0
  • Set ∆P=∆K0=∆, and find a solution P, K0)

F2*i F2*i+1 K1

Gi

∆ ∆ ∆ ∆ G0 G1 G2 G3 ∆ ∆ ∆

Exploit the freedom of both K0 and K1

31

slide-32
SLIDE 32

Random-Difference Distinguisher

  • On a random difference ∆
  • Set ∆K0=∆, ∆K1=0, ∆P=∆ and ∆C=∆
  • The complexity of finding a solution?
  • Ideal case: 2n (n=64)

LED-128 ∆P= ∆ ∆C= ∆ ∆K0= ∆ ∆K1= 0

32

slide-33
SLIDE 33

Distinguisher on 10 Steps

  • Difference propagation
  • Passive step function
  • Active step function

∆ ∆ ∆ ∆ ∆ ∆ ∆ ∆

33

slide-34
SLIDE 34

Attack Procedure (1/3)

  • Phase 1: find solutions for differentials
  • n F2 and F3, and on F6 and F7.
  • Exploit the freedom of K1
  • At Phase 1, the value of K1 is chosen.

∆ ∆ ∆ ∆ ∆ ∆ ∆ ∆

34

slide-35
SLIDE 35

Phase 1

  • Find a set of (K1, Xi, Yi)s such that
  • all K1s are equal
  • (K1, Xi)s follows differential on F2 and F3
  • (K1, Yi)s follows differential on F6 and F7

∆K1=0 ∆ ∆X=∆

F2 F3 F6 F7

∆ ∆Y=∆ ∆K1=0 Find collision on K1

35

slide-36
SLIDE 36

Attack Procedure (2/3)

  • Phase 2: match a solution on F2 and F3

to a solution on F6 and F7

  • Exploit the freedom of K0
  • At Phase 2, the value of K0 is chosen.

∆ ∆ ∆ ∆ ∆ ∆ ∆ ∆

36

slide-37
SLIDE 37

Phase 2

  • Similar with the key-recovery attack
  • n single-key 1-step Even-Mansour
  • Utilize the set {(K1, Xi, Yi)} from Phase 1.

K0 K0 Xi F4 K1 F5 E Yi

37

slide-38
SLIDE 38

Attack Procedure (3/3)

  • Phase 3: compute P to obtain a

solution (P, K0, K1).

∆ ∆ ∆ ∆ ∆ ∆ ∆ ∆ Prob=1 Prob=1

38

slide-39
SLIDE 39

Distinguisher

  • The complexity of our attack is 260.3,

which is smaller than 264

  • 10-step LED-128 is “non-ideal”
  • Irrespective to the specification of

step function.

39

slide-40
SLIDE 40

Outline

  • Backgrounds
  • Specification
  • Previous Analysis
  • Slidex Attack Application
  • Multicollision Application
  • Distinguishers
  • Differential Property
  • Random-difference Distinguisher
  • Conclusion

40

slide-41
SLIDE 41

Updated State of LED

  • The number of attacked steps

Key Recovery Distinguisher

Single-key Related-key LED-64 (8 steps)

2 4 . →

LED-128 (12 steps)

→ 6 . →

41

slide-42
SLIDE 42

Thank you for your attention!