Distinguishing Attacks on the Stream Cipher Py (Roo) Speaker: - - PowerPoint PPT Presentation

▶
distinguishing attacks on the stream cipher py roo
SMART_READER_LITE
LIVE PREVIEW

Distinguishing Attacks on the Stream Cipher Py (Roo) Speaker: - - PowerPoint PPT Presentation

Sep 20, 2022 475 likes •655 views

Distinguishing Attacks on the Stream Cipher Py (Roo) Speaker: Souradyuti Paul (work jointly with B.Preneel and G. Sekar) Computer Security and Industrial Cryptography (COSIC) Department of Electrical Engineering-ESAT Katholieke Universiteit

slide-1
SLIDE 1

17th March 2006 FSE 2006 1

Speaker: Souradyuti Paul

(work jointly with B.Preneel and G. Sekar) Computer Security and Industrial Cryptography (COSIC) Department of Electrical Engineering-ESAT Katholieke Universiteit Leuven, Belgium

Email: Souradyuti.Paul@esat.kuleuven.be

Distinguishing Attacks on the Stream Cipher Py (Roo)

slide-2
SLIDE 2

17th March 2006 FSE 2006 2

Outline

Py and a Short History Description of Py Basic Idea of Attack and Assumptions Observation: Input-Output Correlation The Bias and the Distinguisher Complexities of the Attack Biases in other Pairs of Bits Conclusions and Remarks

slide-3
SLIDE 3

17th March 2006 FSE 2006 3

Py and the evolution of RC4

RC4 (1987) by Rivest IA, IB, ISAAC (1996) by Jenkins Jr. RC4A (2004) by Paul and Preneel VMPC (2004) by Zoltak HC-256 (2004) by Wu GGHN (2005) by Gong et al. Py, Py6 (2005) by Biham and Seberry PyPy (2006) by Biham and Seberry

slide-4
SLIDE 4

17th March 2006 FSE 2006 4

Stage I : Key/IV set-up of Py

P Y IV Key

Key/IV set-up Algo (Step 1)

Initialization

s

Y P

256 bits 128 bits 256x8 bits 260x32 bits 32 bits 256x8 bits 260x32 bits

slide-5
SLIDE 5

17th March 2006 FSE 2006 5

Stage II : Keystream bytes generation of Py

. . . mixing mixing Output 1 Output 2 Output 3 XOR Plaintext 1 … Ciphertext 1 …

s Y P s’ Y’ P’ s’’ Y’’ P’’

Ciphertext 2 XOR Plaintext 2 Round 1 Round 2 Round 3 mixing

slide-6
SLIDE 6

17th March 2006 FSE 2006 6

Single round of Py: ith round

000 233 001 113 002 001 … ... 094 093 095 165 096 079 … ... 254 096 255 143

  • 3

X

  • 2

Y

  • 1

Z M … … 094 N 095 P … Q 256 L 255 000 113 001 001 … … 093 093 094 233 095 079 … … 253 096 254 143 255 165

P Y

O(1,i)

  • 3

Y

  • 2

Z

  • 1

M … … 094 P 095 F … … L 256 X’ X’ 233 165 O(2,i)

slide-7
SLIDE 7

17th March 2006 FSE 2006 7

The basic idea of our attacks and assumptions

Assumption: Key/IV set-up is perfect Focus: mixing of bits in a round Identify: a class of internal states

introducing bias in the outputs

Observe: rest of the states do not

cancel bias (reason: rigorous mixing)

Conclude: output is biased on a

randomly chosen internal state

slide-8
SLIDE 8

8

Main observation: A lucky case in the array P

1 … 239 … 208 … 116 … 72 … 26 … Y

  • 18

mod32

X … 239 … 208 … 116 … 72 … 26 … X+1 254

7 mod32

Y+1 … 239 … 208 … 116 … 72 … 26 …

P P P Round 1 Round 2 Round 3

slide-9
SLIDE 9

17th March 2006 FSE 2006 9

G H

Outputs at 1st and 3rd rounds

G H 256 255 254 … … … 1

  • 1
  • 2
  • 3

Y

Round 1 Round 2 Round 3

O(1,1) = (S XOR G) + H O(2,3) = (S XOR H) + G

Bias in the lsb’s. z=O(1,1)[0] XOR O(2,3)[0] P(z=0)=1

slide-10
SLIDE 10

17th March 2006 FSE 2006 10

The lucky case L occurs with prob. 2-41.9 For the lucky case the P(z=0|L)=1 For the rest of the cases, we observe

that P(z=0|L’) =1/2 (see the paper)

The overall prob. P(z=0) =½·(1+ 2-41.9)

Quantifying the bias

slide-11
SLIDE 11

17th March 2006 FSE 2006 11

The distinguisher (I)

Py

… … Key/IV Biased Output z n

Optimal Distinguisher: If # of 0’s ≥ # of 1’s

then Py else Random

The advantage is close to 0% for n=1 If n=284.7 then advantage is more than 50%

slide-12
SLIDE 12

17th March 2006 FSE 2006 12

The distinguisher (II)

Requirements:

# of Key/IV’s = 284.7 key stream per Key/IV=24 bytes time = 284.7 · Tini

The distinguisher works

within Py specifications with less than exhaustive search

slide-13
SLIDE 13

17th March 2006 FSE 2006 13

A variant of the distinguisher works in a

single keystream but takes longer

  • utputs than specified 264

To reduce work load, a hybrid

distinguisher with many key/IV’s and less than 264 output bytes per Key/IV is also possible within the scope of the Py specification

The distinguisher (III)

slide-14
SLIDE 14

17th March 2006 FSE 2006 14

Bias in other pairs of bits

O(1,1) = (S XOR G) + H O(2,3) = (S XOR H) + G

Bias in the ith bits. z=O(1,1)[i] XOR O(2,3)[i] P(z=0)=1/2+µ

slide-15
SLIDE 15

17th March 2006 FSE 2006 15

Conclusion and remarks

Latest News: Paul Crowley reduced the

workload of the distinguisher to 272 by combining all the individual biased bits

The modified version PyPy certainly

does not contain this weakness

A completely unsubstantiated personal

  • pinion: PyPy may come under

distinguishing attack with workload less than exhaustive search

slide-16
SLIDE 16

17th March 2006 FSE 2006 16

Thanks.