Cube Attacks on Stream Ciphers Based on Division Property Chaoyun - - PowerPoint PPT Presentation

▶

Jun 16, 2023 139 likes •392 views

Cube Attacks on Stream Ciphers Based on Division Property Chaoyun Li ESAT-COSIC, KU Leuven 12-10-2017, Crete Chaoyun Li (ESAT-COSIC, KU Leuven) Cube attacks 12-10-2017, Crete 1 / 23 Plan Cube Attack: An Introduction 1 Cube Attacks with

SLIDE 1

Cube Attacks on Stream Ciphers Based on Division Property

Chaoyun Li

ESAT-COSIC, KU Leuven

12-10-2017, Crete

Chaoyun Li (ESAT-COSIC, KU Leuven) Cube attacks 12-10-2017, Crete 1 / 23

SLIDE 2

Plan

1

Cube Attack: An Introduction

2

Cube Attacks with Division Property

3

Our Results

4

Conclusion and Future work

Chaoyun Li (ESAT-COSIC, KU Leuven) Cube attacks 12-10-2017, Crete 2 / 23

SLIDE 3

Motivation

Symmetric key ciphers for FHE, MPC, ...

Trivium [Canni` ere-Preneel ’07] LowMC [Albrecht et al. ’15] Kreyvium [Canteaut et al. ’16]

Low Multiplicative Complexity (MC) is crucial

Minimize the number of ANDs and multiplicative depth

Our goal

Cube attacks on low MC ciphers

Chaoyun Li (ESAT-COSIC, KU Leuven) Cube attacks 12-10-2017, Crete 3 / 23

SLIDE 4

Low MC stream ciphers

Trivium [Canni` ere-Preneel ’07]

Chaoyun Li (ESAT-COSIC, KU Leuven) Cube attacks 12-10-2017, Crete 4 / 23

SLIDE 5

Low MC stream ciphers

Kreyvium [Canteaut et al. ’16]

Chaoyun Li (ESAT-COSIC, KU Leuven) Cube attacks 12-10-2017, Crete 5 / 23

SLIDE 6

Cube attacks [Dinur-Shamir ’09]

Extension of Higher Order Differential Attack and Algebraic Attacks Chosen plaintext key recovery attack

Keyed hash functions
Stream ciphers
Block ciphers
MAC algorithms

Powerful for primitives with low-degree component

Stream ciphers based on low-degree NFSR
Permutations with only a few XORs and ANDs

Chaoyun Li (ESAT-COSIC, KU Leuven) Cube attacks 12-10-2017, Crete 6 / 23

SLIDE 7

Cube attack in a nutshell

Preprocessing: Sum over outputs of subspaces over chosen public variables Store equations between sums and secret variables Online: Evaluate sums over outputs of chosen plaintexts Recover key bits by solving equations Dinur-Shamir attack only needs blackbox access to the cipher

Chaoyun Li (ESAT-COSIC, KU Leuven) Cube attacks 12-10-2017, Crete 7 / 23

SLIDE 8

Main observation

Cube sum of Boolean functions f (x1, x2, x3, x4) = x1 + x1x2 + x3x4 + x1x2x3 + x1x3x4 = x1 + x1x2 + x3x4(1 + x1) + x1x2x3 Fix x1, x2, sum over all values of (x3, x4)

(x3,x4)∈F2

f (x1, x2, x3, x4) = 4x1 + 4x1x2 + 1 + x1 + 2x1x2 = 1 + x1 The set {(c1, c2, x3, x4) ∈ F4

2} is a cube with dim 2

The resulting sum is the superpoly of the cube

Chaoyun Li (ESAT-COSIC, KU Leuven) Cube attacks 12-10-2017, Crete 8 / 23

SLIDE 9

The attack

Write a cipher by f (x, v) → Output

Public variables v controlled by the attacker, e.g., a message or nonce Secret variables x Output: Ciphertext, keystream, or a hash bit

Preprocessing

Find cubes with simple (eg. linear) superpoly p(x) Reconstruct p(x)

Online

Collect a system of linear equations p(x) = b Recover key bits by solving the equations and exhaustive search for remaining key bits if necessary

Chaoyun Li (ESAT-COSIC, KU Leuven) Cube attacks 12-10-2017, Crete 9 / 23

SLIDE 10

Preprocessing phase

Given cube I of size C

Find cubes with simple (eg. linear) superpoly p(x)

Property test of superpoly Complexity O(N12C), N1 is number of queries

Reconstruct superpoly p(x)

v∈I

f (v, x) = p(x) Superpoly p(x) can be recovered by Moebius Transformation Complexity O(N22C), N2 is number of queries More information on p, smaller N2

Chaoyun Li (ESAT-COSIC, KU Leuven) Cube attacks 12-10-2017, Crete 10 / 23

SLIDE 11

Problems and Progress

How to find the most efficient cube? Random walk heuristic algorithm [Dinur-Shamir’09] Cube variables with conditions [Dinur et al. ’15] Conditional cube attack [Huang et al. ’17]

Chaoyun Li (ESAT-COSIC, KU Leuven) Cube attacks 12-10-2017, Crete 11 / 23

SLIDE 12

Problems and Progress

Attack in blackbox model

Cannot leverage the specific structural properties

Size cube exploitable is limited (≤ 40)

Due to large complexity of testing superpoly
Cannot predict what will happen if bigger cube chosen

Chaoyun Li (ESAT-COSIC, KU Leuven) Cube attacks 12-10-2017, Crete 12 / 23

SLIDE 13

Problems and Progress

Attack in blackbox model

Cannot leverage the specific structural properties

Size cube exploitable is limited (≤ 40)

Due to large complexity of testing superpoly
Cannot predict what will happen if bigger cube chosen

Kill two birds with one stone: Division property

Chaoyun Li (ESAT-COSIC, KU Leuven) Cube attacks 12-10-2017, Crete 12 / 23

SLIDE 14

Division property [Todo ’15]

A method to construct higher order differential/integral distinguisher Successfully used to analyze block ciphers and hash functions Efficient evaluation by MILP [Xiang et al. ’16]

Chaoyun Li (ESAT-COSIC, KU Leuven) Cube attacks 12-10-2017, Crete 13 / 23

SLIDE 15

Cube attacks with division property

Ideas of the new attack [Todo et al. ’17]

Analyze involved variables in the ANF of superpoly by division property + Non-Blackbox attack + Applied to nonlinear superpoly Model and solve the division propagation by MILP + Much more efficient than cube sum + Allow to search large cubes since no need to do cube sum to test the property of superpoly

Chaoyun Li (ESAT-COSIC, KU Leuven) Cube attacks 12-10-2017, Crete 14 / 23

SLIDE 16

What’s new

Apply division property to analyze stream ciphers Exploit large cubes Improve key recovery attacks on stream ciphers, e.g. Trivium Round Complexity Cube size Ref 767 236 30 [Dinur-Shamir ’09] 799 262 40 [Fouque-Vannet ’13] 832 279 72 [Todo et al. ’17]

Chaoyun Li (ESAT-COSIC, KU Leuven) Cube attacks 12-10-2017, Crete 15 / 23

SLIDE 17

Our idea

Investigate higher-degree monomials in the ANF of superpoly by division property Improve the MILP model by removing redundant division trails

Highlights of improved method

Detect more information on superpoly Reduce complexity of superpoly recovery Attack more rounds

Chaoyun Li (ESAT-COSIC, KU Leuven) Cube attacks 12-10-2017, Crete 16 / 23

SLIDE 18

Trivium [Canni` ere-Preneel ’07]

80 bit key and 80 bit IV, 288 bit state 1152 rounds in initialization phase

(s1, s2, . . . , s93) ← (K1, K2, . . . , K80, 0, ..., 0) (s94, s95, . . . , s177) ← (IV1, IV2, . . . , IV80, 0, ..., 0) (s178, s279, . . . , s288) ← (0, ..., 0, 1, 1, 1) t1 ← s66 ⊕ s93 t2 ← s162 ⊕ s177 t3 ← s243 ⊕ s288 z ← t1 ⊕ t2 ⊕ t3 t1 ← t1 ⊕ s91 · s92 ⊕ s171 t2 ← t2 ⊕ s175 · s176 ⊕ s264 t3 ← t3 ⊕ s286 · s287 ⊕ s69 (s1, s2, . . . , s93) ← (t3, s1, . . . , s92) (s94, s95, . . . , s177) ← (t1, s94, . . . , s176) (s178, s279, . . . , s288) ← (t2, s178, . . . , s287)

Chaoyun Li (ESAT-COSIC, KU Leuven) Cube attacks 12-10-2017, Crete 17 / 23

SLIDE 19

Results on reduced-round Trivium

Improved key recovery attack on Trivium Round Complexity Cube size Ref 799 262 40 [Fouque-Vannet ’13] 832 279 72 [Todo et al. ’17] 833 275 74 new Possible to further improve attack rounds!

Chaoyun Li (ESAT-COSIC, KU Leuven) Cube attacks 12-10-2017, Crete 18 / 23

SLIDE 20

Kreyvium [Canteaut et al. ’16]

128-bit variant of Trivium, |K| = |IV | = 128 1152 rounds initialization

(K∗

127, K∗ 126, . . . , K∗ 0 ) ← (K1, K2, . . . , K128)

(IV ∗

127, IV ∗ 126, . . . , IV ∗ 0 ) ← (IV1, IV2, . . . , IV128)

(s1, s2, . . . , s93) ← (K1, K2, . . . , K93) (s94, s95, . . . , s177) ← (IV1, IV2, . . . , IV84) (s178, s279, . . . , s288) ← (IV85, IV86, ..., IV128, 1, ..., 1, 0) t1 ← s66 ⊕ s93 t2 ← s162 ⊕ s177 t3 ← s243 ⊕ s288 ⊕ K∗ z ← t1 ⊕ t2 ⊕ t3 t1 ← t1 ⊕ s91 · s92 ⊕ s171 ⊕ IV ∗ t2 ← t2 ⊕ s175 · s176 ⊕ s264 t3 ← t3 ⊕ s286 · s287 ⊕ s69 (s1, s2, . . . , s93) ← (t3, s1, . . . , s92) (s94, s95, . . . , s177) ← (t1, s94, . . . , s176) (s178, s279, . . . , s288) ← (t2, s178, . . . , s287) (K∗

127, K∗ 126, . . . , K∗ 0 ) ← (K∗ 0 , K∗ 127, K∗ 126, . . . , K∗ 1 )

(IV ∗

127, IV ∗ 126, . . . , IV ∗ 0 ) ← (IV ∗ 0 , IV ∗ 127, IV ∗ 126, . . . , IV ∗ 1 )

Chaoyun Li (ESAT-COSIC, KU Leuven) Cube attacks 12-10-2017, Crete 19 / 23

SLIDE 21

Results on reduced-round Kreyvium

Improved key recovery attack on Kreyvium Round Complexity Cube size Ref 872 2124 85 [Todo et al. ’17] 884 2124 95 new Still no clue on the security margin Lower security margin than Trivium

see also Conditional Differential Cryptanalysis [Watanabe et al. ’17]

Chaoyun Li (ESAT-COSIC, KU Leuven) Cube attacks 12-10-2017, Crete 20 / 23

SLIDE 22

Conclusion

Apply division property to analyze stream cipher Capable to search large cubes Reduce complexity of superpoly recovery Improve key recovery attack on stream ciphers Trivium and Kreyvium

Chaoyun Li (ESAT-COSIC, KU Leuven) Cube attacks 12-10-2017, Crete 21 / 23

SLIDE 23

Future work

Find the most efficient cube for stream ciphers Optimize the complexity of key recovery phase Apply to other designs

Cube attack + structural properties

Chaoyun Li (ESAT-COSIC, KU Leuven) Cube attacks 12-10-2017, Crete 22 / 23

SLIDE 24

Thank you! Questions?

Chaoyun Li (ESAT-COSIC, KU Leuven) Cube attacks 12-10-2017, Crete 23 / 23