Cube-like Attack on Round-Reduced Initialization of Ketje Sr - - PowerPoint PPT Presentation

▶
cube like attack on round reduced initialization of ketje
SMART_READER_LITE
LIVE PREVIEW

Cube-like Attack on Round-Reduced Initialization of Ketje Sr - - PowerPoint PPT Presentation

Apr 01, 2024 171 likes •460 views

Cube-like Attack on Round-Reduced Initialization of Ketje Sr Xiaoyang Dong, Zheng Li, Xiaoyun Wang and Ling Qin Shandong University, Tsinghua University FSE 2017 Tokyo, Japan Outline--divided into 3 parts u Ketje u Related Works u Cube-like

slide-1
SLIDE 1

Xiaoyang Dong, Zheng Li, Xiaoyun Wang and Ling Qin

Cube-like Attack on Round-Reduced Initialization of Ketje Sr

Shandong University, Tsinghua University FSE 2017 Tokyo, Japan

slide-2
SLIDE 2

Outline--divided into 3 parts

u Ketje u Related Works

u Cube-like attack u auxiliary variable u Linear stucture

u Our Attacks

2

slide-3
SLIDE 3

Ketje

u designed by the Keccak Team u one of the 16 survivors of 3rd CAESAR competition u Specification of Ketje

u Keccak-p permutations u MonkeyWrap u Four instances: Ketje Sr, Jr, Minor, Major

3

slide-4
SLIDE 4

Keccak-p permutations

u designed by the Keccak Team u tunable number of rounds u 7 state sizes: b

u b∈{25, 50, 100, 200, 400, 800, 1600}

u round function

4

          R

slide-5
SLIDE 5

Keccak-p* permutations

u a twisted permutation proposed in Ketje v2

5

slide-6
SLIDE 6

MonkeyWrap

u an authenticated encryption mode proposed by the Keccak team

6

Associate date Plaintext Ciphertext Finalization: Tag Note that: When the AD is empty, it is padded to a block, so 13-round is applied until the ciphertext outputs. nstart = 12, nstep = 1, nstride = 6

  • 1. Initialization
  • 2. Proc. Associate
  • 3. Proc. Plaintext
  • 4. Finalization
slide-7
SLIDE 7

MonkeyWrap

u an authenticated encryption mode proposed by the Keccak team

7

Associate date Plaintext Ciphertext Finalization: Tag Note that: When the AD is empty, it is padded to a block, so 13-round is applied until the ciphertext outputs.

  • 1. Initialization
  • 2. Proc. Associate
  • 3. Proc. Plaintext
  • 4. Finalization

The AD and Plaintext are divided in to rho-bit and padded, absorbed successively.

slide-8
SLIDE 8

8

  • Figure. Ketje Sr v1
  • Figure. Ketje Sr v2

u

128-bit key and 254-bit nonce; Pink lanes are key and blue lanes are padding

slide-9
SLIDE 9

Summary for ketje

u Using MonkeyWrap u nstart = 12, nstep = 1, nstride = 6 u Four instances,

9

slide-10
SLIDE 10

ketje

u Using MonkeyWrap u nstart = 12, nstep = 1, nstride = 6 u Four instances, u ρ denotes the block size absorbed in each nstep

10

slide-11
SLIDE 11

Related Works

u Cube Attack

ü

proposed by Dinur and Shamir

ü

they write the ANF of output bit: P = tPt + Q, t is maxterm and Pt is superpoly

ü

exploit the linear superpolys

u Dynamic Cube Attack (Dinur and Shamir) u Cube-like Attack, divide-and-conquer (Dinur et al.) u Conditional Cube Attack (Huang et al.)

u Linear Structure

11

slide-12
SLIDE 12

Cube-like Attack (Dinur et al.)

u In the 1st round, cube bits are not multiplied together u In the 1st round, only a part of key bits multiply with cube bits

u Let ki be the key bits which do not multiply with cube bits {v1,...,v32} u degree of round function is 2 u after 6r, kiv1v2...v32 will not appear

12

slide-13
SLIDE 13

Auxiliary variables (Dinur et al.)

u Auxiliary variables are introduced as follows u Suppose nonce in A[0,1] is equal to key bits in A[0,0] u After θ ρ π, the diffusion of the key in A[0,0] is reduced to pink

  • lanes. Thus, key in A[0,0] will not multiply with cube bits.

13

slide-14
SLIDE 14

Linear Structure

u Proposed by Guo, Liu and Song at ASIACRYPT 2016 u Find ways to get a set of variables that will not multiply together

after the first/second round

14

  • Figure. 1-round Linear Structure
slide-15
SLIDE 15

u Explore the linear structure in small state u Find 32/64-dimension cubes that do not multiply together in the

first round

u The cube do not multiply with as many key bits as possible

15

slide-16
SLIDE 16

u Property 1: In Ketje Sr v1, 32 cube variables do not multiply with 32-

bit keys in A[1, 0] and A[1, 1] in the first round, bits of ci are the cube variables and c1+c2 = const1, c3+c4 = const2, const1 and const2 are constants.

16

slide-17
SLIDE 17

u Property 2: In Ketje Sr v1, without considering the last 2-bit padding

in the nonce3,there are 64 cube variables that do not multiply with 16- bit keys in A[0, 1] in the first round, bits of ciare the cube variables and c1+c2 = const1,c3+c4+c5+c6 =const2, const1and const2 are constants.

17

slide-18
SLIDE 18

u Property 3: In Ketje Sr v2, 32 cube variables do not multiply with 56-

bit keys in A[0, 2],A[3, 0], A[3, 3] and half of A[0, 0] in the first round, bits of ci are the cube variables and c1+c2+c3 = const1, const1 is constant.

18

slide-19
SLIDE 19

u Property 4: In Ketje Sr v2, 64 cube variables do not multiply with 32-

bit keys in A[3, 0] and A[3, 3] in the first round, bits of ci are the cube variables and c1+c2+c3 = const1 and c4+c5+c6 = const2, const1and const2 are constants.

19

slide-20
SLIDE 20

u Explore the linear structure in small state u Dynamic cube variables

u provide the same cube

size with few variable lanes

20

Lower probability to multiply together

slide-21
SLIDE 21

u A[1,0],A[1,1] will not multiply with cube variable according to Pro 1 u the pink lanes are the key that will not multiply with cube variables

under conditions

21

slide-22
SLIDE 22

u So only 40bits key in A[3,0],A[3,1] and A[4,0] will multiply with cube

variables under conditions, hence affect the cube sums after 6- round.

22

slide-23
SLIDE 23

23

slide-24
SLIDE 24

24

slide-25
SLIDE 25

25

slide-26
SLIDE 26

26

slide-27
SLIDE 27

Thank you Q?