Experimentally Verifying a Complex Algebraic Attack on the Grain-128 - - PowerPoint PPT Presentation

▶
experimentally verifying a complex algebraic attack on
SMART_READER_LITE
LIVE PREVIEW

Experimentally Verifying a Complex Algebraic Attack on the Grain-128 - - PowerPoint PPT Presentation

Jan 22, 2024 169 likes •757 views

Experimentally Verifying a Complex Algebraic Attack on the Grain-128 Cipher Using Dedicated Reconfigurable Hardware SHARCS 2012 Washington D.C. Itai Dinur 1 , Tim Gneysu 2 , Christof Paar 2 , Adi Shamir 1 , and Ralf Zimmermann 2 1

slide-1
SLIDE 1

Experimentally Verifying a Complex Algebraic Attack on the Grain-128 Cipher Using Dedicated Reconfigurable Hardware

SHARCS 2012 – Washington D.C.

Itai Dinur1, Tim Güneysu2, Christof Paar2, Adi Shamir1, and Ralf Zimmermann2

1 Computer Science Dept., The Weizmann Institute, Israel 2 Horst Görtz Institute for IT Security, Ruhr-University Bochum

18.03.2012

slide-2
SLIDE 2

2 SHARCS 2012 | Washington D.C. | 18.03.2012

  • Introduction
  • Implementation
  • Problems and Solutions
  • Results and Conclusion

Outline

slide-3
SLIDE 3

3 SHARCS 2012 | Washington D.C. | 18.03.2012

Experimentally Verifying Complex Algebraic Attack Grain-128 Cipher Dedicated Reconfigurable Hardware a

  • n the

Using

Introduction

Experimentally Explaining The Title

slide-4
SLIDE 4

4 SHARCS 2012 | Washington D.C. | 18.03.2012

Grain-128 Cipher Experimentally Verifying Complex Algebraic Attack Dedicated Reconfigurable Hardware a

  • n the

Using

Introduction

Experimentally Explaining The Title

slide-5
SLIDE 5

5 SHARCS 2012 | Washington D.C. | 18.03.2012

Complex Algebraic Attack Experimentally Verifying Grain-128 Cipher Dedicated Reconfigurable Hardware a

  • n the

Using

Introduction

Experimentally Explaining The Title

slide-6
SLIDE 6

6 SHARCS 2012 | Washington D.C. | 18.03.2012

Experimentally Verifying Complex Algebraic Attack Grain-128 Cipher Dedicated Reconfigurable Hardware a

  • n the

Using

Introduction

Experimentally Explaining The Title

slide-7
SLIDE 7

7 SHARCS 2012 | Washington D.C. | 18.03.2012

Dedicated Reconfigurable Hardware Experimentally Verifying Complex Algebraic Attack Grain-128 Cipher a

  • n the

Using

Introduction

Experimentally Explaining The Title

slide-8
SLIDE 8

8 SHARCS 2012 | Washington D.C. | 18.03.2012

  • 128-bit key, 96-bit IV
  • Boolean functions
  • 256 clock cycles

Introduction

Grain-128

slide-9
SLIDE 9

9 SHARCS 2012 | Washington D.C. | 18.03.2012

  • Algebraic Attack
  • Dinur/Shamir (FSE 2011), improved (Asiacrypt 2011)
  • Complexity d*2d+e-10 (d = 50, e = 39)
  • Implication: 2128  285

Introduction

Cube Attack (very brief )

slide-10
SLIDE 10

10 SHARCS 2012 | Washington D.C. | 18.03.2012

  • Algebraic Attack
  • Dinur/Shamir (FSE 2011), improved (Asiacrypt 2011)
  • Complexity d*2d+e-10 (d = 50, e = 39)
  • Implication: 2128  285
  • Uses CubeTesters
  • Aumasson/Dinur/Meier/Shamir (FSE 2009)
  • Related to higher order differential attacks
  • Distinguishes (special) polynomials from random functions

Introduction

Cube Attack (very brief )

slide-11
SLIDE 11

11 SHARCS 2012 | Washington D.C. | 18.03.2012

  • Algebraic Attack
  • Dinur/Shamir (FSE 2011), improved (Asiacrypt 2011)
  • Complexity d*2d+e-10 (d = 50, e = 39)
  • Implication: 2128  285
  • Uses CubeTesters
  • Aumasson/Dinur/Meier/Shamir (FSE 2009)
  • Related to higher order differential attacks
  • Distinguishes (special) polynomials from random functions
  • Multiple Steps
  • Guess and generate scores
  • Determine most likely values of secret expression
  • Recover the key

Introduction

Cube Attack (very brief )

slide-12
SLIDE 12

12 SHARCS 2012 | Washington D.C. | 18.03.2012

  • Motivation:
  • Attack complexity only estimated
  • Theoretical success probability realistic?

Introduction

Cube Attack - Partial Simulation

slide-13
SLIDE 13

13 SHARCS 2012 | Washington D.C. | 18.03.2012

  • Motivation:
  • Attack complexity only estimated
  • Theoretical success probability realistic?
  • Simulate correct guess for known key

1. Compute cube summations 2. Compute score of correct guess 3. Estimate position in sorted guess list

Introduction

Cube Attack - Partial Simulation

slide-14
SLIDE 14

14 SHARCS 2012 | Washington D.C. | 18.03.2012

  • Motivation:
  • Attack complexity only estimated
  • Theoretical success probability realistic?
  • Simulate correct guess for known key

1. Compute cube summations 2. Compute score of correct guess 3. Estimate position in sorted guess list

Details: Dinur et al. (Asiacrypt 2011)

Introduction

Cube Attack - Partial Simulation

slide-15
SLIDE 15

15 SHARCS 2012 | Washington D.C. | 18.03.2012

  • Introduction
  • Implementation
  • Problems and Solutions
  • Results and Conclusion

Outline

slide-16
SLIDE 16

16 SHARCS 2012 | Washington D.C. | 18.03.2012

  • Considerations
  • Flexibility
  • Operability

Implementation

Hardware Design Goals

slide-17
SLIDE 17

17 SHARCS 2012 | Washington D.C. | 18.03.2012

  • Considerations
  • Needs high performance!
  • Data complexity?
  • Bottlenecks?
  • Flexibility
  • Operability

Implementation

Hardware Design Goals

slide-18
SLIDE 18

18 SHARCS 2012 | Washington D.C. | 18.03.2012

  • Considerations
  • Needs high performance!
  • Data complexity?
  • Bottlenecks?
  • Flexibility
  • Adaptable to modified cube attacks
  • Adaptable to modified parameter sets
  • Operability

Implementation

Hardware Design Goals

slide-19
SLIDE 19

19 SHARCS 2012 | Washington D.C. | 18.03.2012

  • Considerations
  • Needs high performance!
  • Data complexity?
  • Bottlenecks?
  • Flexibility
  • Adaptable to modified cube attacks
  • Adaptable to modified parameter sets
  • Operability
  • Fully working post-place and route design
  • Fully working on RIVYERA FPGA Cluster

Implementation

Hardware Design Goals

slide-20
SLIDE 20

20 SHARCS 2012 | Washington D.C. | 18.03.2012

  • 8 Spartan-3 5000 FPGAs

Implementation

RIVYERA Architecture

slide-21
SLIDE 21

21 SHARCS 2012 | Washington D.C. | 18.03.2012

  • 8 Spartan-3 5000 FPGAs
  • 16 Boards

Implementation

RIVYERA Architecture

slide-22
SLIDE 22

22 SHARCS 2012 | Washington D.C. | 18.03.2012

  • 8 Spartan-3 5000 FPGAs
  • 16 Boards
  • i7 Processor

Implementation

RIVYERA Architecture

slide-23
SLIDE 23

23 SHARCS 2012 | Washington D.C. | 18.03.2012

Implementation

The Algorithm - Hands-On

slide-24
SLIDE 24

24 SHARCS 2012 | Washington D.C. | 18.03.2012

Implementation

The Algorithm - Hands-On

slide-25
SLIDE 25

25 SHARCS 2012 | Washington D.C. | 18.03.2012

Implementation

The Algorithm - Hands-On

slide-26
SLIDE 26

26 SHARCS 2012 | Washington D.C. | 18.03.2012

Implementation

The Algorithm - Hands-On

slide-27
SLIDE 27

27 SHARCS 2012 | Washington D.C. | 18.03.2012

Implementation

The Algorithm - Hands-On

  • Focus on time consuming steps

1. Chose random key 2. Generate boolean functions (polynomials to evaluate) 3. Compute 250 times the first output bit (Grain-128 Initialization) 4. XOR the results in some way

slide-28
SLIDE 28

28 SHARCS 2012 | Washington D.C. | 18.03.2012

Implementation

The Algorithm - Hands-On

  • Focus on time consuming steps

1. Chose random key 2. Generate boolean functions (polynomials to evaluate) 3. Compute 250 times the first output bit (Grain-128 Initialization) 4. XOR the results in some way

Sounds easy! Let’s try it in Software…

slide-29
SLIDE 29

29 SHARCS 2012 | Washington D.C. | 18.03.2012

1 1 0 1 1 0 0 1 0 0 1 0 …

  • Prepare IV in an array
  • Unfilled: initial IV (unchanged)
  • Red: cube indices
  • Blue: dynamic variables

Implementation

Software View

Example

1

slide-30
SLIDE 30

30 SHARCS 2012 | Washington D.C. | 18.03.2012

1 1 0 1 1 0 0 1 0 0 1 0 …

  • Prepare IV in an array
  • Unfilled: initial IV (unchanged)
  • Red: cube indices
  • Blue: dynamic variables
  • Update the IV:
  • Increment cube indices by 1

Implementation

Software View

Example

0 0 1

slide-31
SLIDE 31

31 SHARCS 2012 | Washington D.C. | 18.03.2012

1 1 0 1 1 0 0 1 0 0 1 0 …

  • Prepare IV in an array
  • Unfilled: initial IV (unchanged)
  • Red: cube indices
  • Blue: dynamic variables
  • Update the IV:
  • Increment cube indices by 1

Implementation

Software View

Example

0 0 1 1

slide-32
SLIDE 32

32 SHARCS 2012 | Washington D.C. | 18.03.2012

1 1 0 1 1 0 0 1 0 0 1 0 …

  • Prepare IV in an array
  • Unfilled: initial IV (unchanged)
  • Red: cube indices
  • Blue: dynamic variables
  • Update the IV:
  • Increment cube indices by 1

Implementation

Software View

Example

0 0 1 1 1

slide-33
SLIDE 33

33 SHARCS 2012 | Washington D.C. | 18.03.2012

1 1 1 1 0 0 1 0 0 1 0 …

  • Prepare IV in an array
  • Unfilled: initial IV (unchanged)
  • Red: cube indices
  • Blue: dynamic variables
  • Update the IV:
  • Increment cube indices by 1
  • Evaluate polynomials
  • Polynomial Evaluation
  • Loop over all Monomials
  • Simple Array-Lookup

Implementation

Software View

Example

and xor and and

0 0 1 1 1

slide-34
SLIDE 34

34 SHARCS 2012 | Washington D.C. | 18.03.2012

1 1 1 1 0 0 1 0 0 1 0 …

  • Prepare IV in an array
  • Unfilled: initial IV (unchanged)
  • Red: cube indices
  • Blue: dynamic variables
  • Update the IV:
  • Increment cube indices by 1
  • Evaluate polynomials
  • Polynomial Evaluation
  • Loop over all Monomials
  • Simple Array-Lookup
  • But: Very slow in Software (250 Grain iterations per key)

Implementation

Software View

Example

and xor and and

0 0 1 1 1

slide-35
SLIDE 35

35 SHARCS 2012 | Washington D.C. | 18.03.2012

1 1 1 1 0 0 1 0 0 1 0 …

  • Prepare IV in an array
  • Unfilled: initial IV (unchanged)
  • Red: cube indices
  • Blue: dynamic variables
  • Update the IV:
  • Increment cube indices by 1
  • Evaluate polynomials
  • Polynomial Evaluation
  • Loop over all Monomials
  • Simple Array-Lookup
  • But: Very slow in Software (250 Grain iterations per key)

Implementation

Software View

Example

and xor and and

0 0 1 1 1

Let’s try hardware!

slide-36
SLIDE 36

36 SHARCS 2012 | Washington D.C. | 18.03.2012

  • Introduction
  • Implementation
  • Problems and Solutions
  • Results and Conclusion

Outline

slide-37
SLIDE 37

37 SHARCS 2012 | Washington D.C. | 18.03.2012

  • Multiplex Signals to Register Input
  • Unfilled: initial IV (unchanged)
  • Red: cube indices

Problems

Flexibility  Feasibility ?

1 0 1 0 1 0 0 0 1 0 0 1 0 1 …

1

slide-38
SLIDE 38

38 SHARCS 2012 | Washington D.C. | 18.03.2012

  • Multiplex Signals to Register Input
  • Unfilled: initial IV (unchanged)
  • Red: cube indices
  • Blue: dynamic variables

Problems

Flexibility  Feasibility ?

1 0 1 0 1 0 0 0 1 0 0 1 0 1 …

00 01 10 11 p1 p2

slide-39
SLIDE 39

39 SHARCS 2012 | Washington D.C. | 18.03.2012

1 2 3 p1 p2 n pn

  • Multiplex Signals to Register Input
  • Unfilled: initial IV (unchanged)
  • Red: cube indices
  • Blue: dynamic variables

Problems

Flexibility  Feasibility ?

1 0 1 0 1 0 0 0 1 0 0 1 0 1 …

slide-40
SLIDE 40

40 SHARCS 2012 | Washington D.C. | 18.03.2012

1 2 3 p1 p2 n pn

  • Multiplex Signals to Register Input
  • Unfilled: initial IV (unchanged)
  • Red: cube indices
  • Blue: dynamic variables
  • Updating the IV:
  • HW adder to increment on cube indices
  • 96-bit adder
  • Addition constant depends on positions
  • Evaluate polynomials somehow (?)

Problems

Flexibility  Feasibility ?

1 0 1 0 1 0 0 0 1 0 0 1 0 1 …

slide-41
SLIDE 41

41 SHARCS 2012 | Washington D.C. | 18.03.2012

Problems come with polynomials…

  • All possible monomials over d positions

 ∑ d k d k=1 (with d = 50  1015)

Problems

Flexibility  Impossibility

slide-42
SLIDE 42

42 SHARCS 2012 | Washington D.C. | 18.03.2012

Problems come with polynomials…

  • All possible monomials over d positions

 ∑ d k d k=1 (with d = 50  1015)

  • And the d positions are not fixed

Problems

Flexibility  Impossibility

slide-43
SLIDE 43

43 SHARCS 2012 | Washington D.C. | 18.03.2012

Problems come with polynomials…

  • All possible monomials over d positions

 ∑ d k d k=1 (with d = 50  1015)

  • And the d positions are not fixed
  • Polynomials connect multiple monomials

Problems

Flexibility  Impossibility

slide-44
SLIDE 44

44 SHARCS 2012 | Washington D.C. | 18.03.2012

Problems come with polynomials…

  • All possible monomials over d positions

 ∑ d k d k=1 (with d = 50  1015)

  • And the d positions are not fixed
  • Polynomials connect multiple monomials
  • We need up to n different polynomials…

Problems

Flexibility  Impossibility

slide-45
SLIDE 45

45 SHARCS 2012 | Washington D.C. | 18.03.2012

Solution

  • Locally fix the d positions and n polynomials
  •  only needed monomials are computed
  •  no space wasted
  •  no additional multiplexing

Solutions

Flexibility and Feasibility

slide-46
SLIDE 46

46 SHARCS 2012 | Washington D.C. | 18.03.2012

Solution

  • Locally fix the d positions and n polynomials
  •  only needed monomials are computed
  •  no space wasted
  •  no additional multiplexing
  • But: FPGA must be reconfigured for each
  • Parameter-Set
  • Random-Key

Solutions

Flexibility and Feasibility

slide-47
SLIDE 47

47 SHARCS 2012 | Washington D.C. | 18.03.2012

Solution

  • Locally fix the d positions and n polynomials
  •  only needed monomials are computed
  •  no space wasted
  •  no additional multiplexing
  • But: FPGA must be reconfigured for each
  • Parameter-Set
  • Random-Key

Solutions

Flexibility and Feasibility

slide-48
SLIDE 48

48 SHARCS 2012 | Washington D.C. | 18.03.2012

Solution

  • Locally fix the d positions and n polynomials
  •  only needed monomials are computed
  •  no space wasted
  •  no additional multiplexing
  • But: FPGA must be reconfigured for each
  • Parameter-Set
  • Random-Key

Solutions

Flexibility and Feasibility

slide-49
SLIDE 49

49 SHARCS 2012 | Washington D.C. | 18.03.2012

Solution

  • Locally fix the d positions and n polynomials
  •  only needed monomials are computed
  •  no space wasted
  •  no additional multiplexing
  • But: FPGA must be reconfigured for each
  • Parameter-Set
  • Random-Key

Solutions

Flexibility and Feasibility

slide-50
SLIDE 50

50 SHARCS 2012 | Washington D.C. | 18.03.2012

  • Multiple workers per FPGA
  • Each worker generates IVs locally

Solutions

Top-Level Design

slide-51
SLIDE 51

51 SHARCS 2012 | Washington D.C. | 18.03.2012

  • Hardware
  • Divides search space
  • Computes 250 Grain iterations

Solutions

Hardware / Software Process

slide-52
SLIDE 52

52 SHARCS 2012 | Washington D.C. | 18.03.2012

  • Hardware
  • Divides search space
  • Computes 250 Grain iterations
  • Software
  • Generates key-specific VHDL
  • Generates FPGA configuration
  • Reconfigures cluster
  • Fetches results from cluster
  • Computes post-processing

Solutions

Hardware / Software Process

slide-53
SLIDE 53

53 SHARCS 2012 | Washington D.C. | 18.03.2012

  • Introduction
  • Implementation
  • Problems and Solutions
  • Results and Conclusion

Outline

slide-54
SLIDE 54

54 SHARCS 2012 | Washington D.C. | 18.03.2012

  • Experimentally verified the main components of the attack
  • More than 150 tests with randomly-chosen keys
  • Each test requires running the initialization process 250 times

Results and Conclusion

Getting back to the Cube Attack

slide-55
SLIDE 55

55 SHARCS 2012 | Washington D.C. | 18.03.2012

  • Experimentally verified the main components of the attack
  • More than 150 tests with randomly-chosen keys
  • Each test requires running the initialization process 250 times
  • Software vs Hardware

Results and Conclusion

Getting back to the Cube Attack

slide-56
SLIDE 56

56 SHARCS 2012 | Washington D.C. | 18.03.2012

  • Experimentally verified the main components of the attack
  • More than 150 tests with randomly-chosen keys
  • Each test requires running the initialization process 250 times
  • Software vs Hardware

Results and Conclusion

Getting back to the Cube Attack

slide-57
SLIDE 57

Experimentally Verifying a Complex Algebraic Attack on the Grain-128 Cipher Using Dedicated Reconfigurable Hardware

SHARCS 2012 – Washington D.C.

Itai Dinur1, Tim Güneysu2, Christof Paar2, Adi Shamir1, and Ralf Zimmermann2

1 Computer Science Dept., The Weizmann Institute, Israel 2 Horst Görtz Institute for IT Security, Ruhr-University Bochum

18.03.2012

Thank you for your attention! Any Questions?

slide-58
SLIDE 58

58 SHARCS 2012 | Washington D.C. | 18.03.2012

  • Polynomials have high impact
  • Building Time up to 8 hours

Results and Conclusion

Hardware Results