Experimentally Verifying a Complex Algebraic Attack on the Grain-128 - PowerPoint PPT Presentation

Experimentally Verifying a Complex Algebraic Attack on the Grain-128 Cipher Using Dedicated Reconfigurable Hardware SHARCS 2012 – Washington D.C. Itai Dinur 1 , Tim Güneysu 2 , Christof Paar 2 , Adi Shamir 1 , and Ralf Zimmermann 2 1 Computer Science Dept., The Weizmann Institute, Israel 18.03.2012 2 Horst Görtz Institute for IT Security, Ruhr-University Bochum

Outline  Introduction  Implementation  Problems and Solutions  Results and Conclusion SHARCS 2012 | Washington D.C. | 18.03.2012 2

Introduction Experimentally Explaining The Title Experimentally Verifying a Complex Algebraic Attack on the Grain-128 Cipher Using Dedicated Reconfigurable Hardware SHARCS 2012 | Washington D.C. | 18.03.2012 3

Introduction Grain-128  128-bit key, 96-bit IV  Boolean functions  256 clock cycles SHARCS 2012 | Washington D.C. | 18.03.2012 8

Introduction Cube Attack (very brief  )  Algebraic Attack • Dinur/Shamir (FSE 2011), improved (Asiacrypt 2011) Complexity d*2 d+e-10 (d = 50, e = 39) • Implication: 2 128  2 85 • SHARCS 2012 | Washington D.C. | 18.03.2012 9

Introduction Cube Attack (very brief  )  Algebraic Attack • Dinur/Shamir (FSE 2011), improved (Asiacrypt 2011) Complexity d*2 d+e-10 (d = 50, e = 39) • Implication: 2 128  2 85 •  Uses CubeTesters • Aumasson/Dinur/Meier/Shamir (FSE 2009) • Related to higher order differential attacks • Distinguishes (special) polynomials from random functions SHARCS 2012 | Washington D.C. | 18.03.2012 10

Introduction Cube Attack (very brief  )  Algebraic Attack • Dinur/Shamir (FSE 2011), improved (Asiacrypt 2011) Complexity d*2 d+e-10 (d = 50, e = 39) • Implication: 2 128  2 85 •  Uses CubeTesters • Aumasson/Dinur/Meier/Shamir (FSE 2009) • Related to higher order differential attacks • Distinguishes (special) polynomials from random functions  Multiple Steps • Guess and generate scores • Determine most likely values of secret expression • Recover the key SHARCS 2012 | Washington D.C. | 18.03.2012 11

Introduction Cube Attack - Partial Simulation  Motivation : • Attack complexity only estimated • Theoretical success probability realistic? SHARCS 2012 | Washington D.C. | 18.03.2012 12

Introduction Cube Attack - Partial Simulation  Motivation : • Attack complexity only estimated • Theoretical success probability realistic?  Simulate correct guess for known key 1. Compute cube summations 2. Compute score of correct guess 3. Estimate position in sorted guess list SHARCS 2012 | Washington D.C. | 18.03.2012 13

Introduction Cube Attack - Partial Simulation  Motivation : • Attack complexity only estimated • Theoretical success probability realistic?  Simulate correct guess for known key 1. Compute cube summations 2. Compute score of correct guess 3. Estimate position in sorted guess list Details: Dinur et al. (Asiacrypt 2011) SHARCS 2012 | Washington D.C. | 18.03.2012 14

Outline  Introduction  Implementation  Problems and Solutions  Results and Conclusion SHARCS 2012 | Washington D.C. | 18.03.2012 15

Implementation Hardware Design Goals  Considerations  Flexibility  Operability SHARCS 2012 | Washington D.C. | 18.03.2012 16

Implementation Hardware Design Goals  Considerations • Needs high performance! • Data complexity? • Bottlenecks?  Flexibility  Operability SHARCS 2012 | Washington D.C. | 18.03.2012 17

Implementation Hardware Design Goals  Considerations • Needs high performance! • Data complexity? • Bottlenecks?  Flexibility • Adaptable to modified cube attacks • Adaptable to modified parameter sets  Operability SHARCS 2012 | Washington D.C. | 18.03.2012 18

Implementation Hardware Design Goals  Considerations • Needs high performance! • Data complexity? • Bottlenecks?  Flexibility • Adaptable to modified cube attacks • Adaptable to modified parameter sets  Operability • Fully working post-place and route design • Fully working on RIVYERA FPGA Cluster SHARCS 2012 | Washington D.C. | 18.03.2012 19

Implementation RIVYERA Architecture  8 Spartan-3 5000 FPGAs SHARCS 2012 | Washington D.C. | 18.03.2012 20

Implementation RIVYERA Architecture  8 Spartan-3 5000 FPGAs  16 Boards SHARCS 2012 | Washington D.C. | 18.03.2012 21

Implementation RIVYERA Architecture  8 Spartan-3 5000 FPGAs  16 Boards  i7 Processor SHARCS 2012 | Washington D.C. | 18.03.2012 22

Implementation The Algorithm - Hands-On SHARCS 2012 | Washington D.C. | 18.03.2012 23

Implementation The Algorithm - Hands-On  Focus on time consuming steps 1. Chose random key 2. Generate boolean functions (polynomials to evaluate) Compute 2 50 times the first output bit (Grain-128 Initialization) 3. 4. XOR the results in some way SHARCS 2012 | Washington D.C. | 18.03.2012 27

Implementation The Algorithm - Hands-On  Focus on time consuming steps 1. Chose random key 2. Generate boolean functions (polynomials to evaluate) Compute 2 50 times the first output bit (Grain-128 Initialization) 3. 4. XOR the results in some way Sounds easy! Let’s try it in Software… SHARCS 2012 | Washington D.C. | 18.03.2012 28

Implementation Software View  Prepare IV in an array Example • Unfilled: initial IV (unchanged) … 1 0 0 0 1 1 0 1 0 1 0 0 1 0 1 • Red: cube indices • Blue: dynamic variables SHARCS 2012 | Washington D.C. | 18.03.2012 29

Implementation Software View  Prepare IV in an array Example • Unfilled: initial IV (unchanged) … 0 0 1 0 0 0 0 1 1 0 1 0 1 0 0 1 0 1 0 0 • Red: cube indices • Blue: dynamic variables  Update the IV: • Increment cube indices by 1 SHARCS 2012 | Washington D.C. | 18.03.2012 30

Implementation Software View  Prepare IV in an array Example • Unfilled: initial IV (unchanged) … 0 0 1 0 0 0 0 1 1 0 1 0 1 0 0 1 0 0 1 1 0 • Red: cube indices • Blue: dynamic variables  Update the IV: • Increment cube indices by 1 SHARCS 2012 | Washington D.C. | 18.03.2012 31

Implementation Software View  Prepare IV in an array Example • Unfilled: initial IV (unchanged) … 0 0 1 0 0 0 0 1 1 0 1 0 1 0 0 1 0 1 1 0 0 1 0 • Red: cube indices • Blue: dynamic variables  Update the IV: • Increment cube indices by 1 SHARCS 2012 | Washington D.C. | 18.03.2012 32

Implementation Software View  Prepare IV in an array Example • Unfilled: initial IV (unchanged) … 0 0 1 0 0 0 0 1 0 1 0 0 1 0 0 1 0 1 0 • Red: cube indices • Blue: dynamic variables  Update the IV: • Increment cube indices by 1 • Evaluate polynomials 0 and 1 xor 0 and 1 and 1  Polynomial Evaluation • Loop over all Monomials • Simple Array-Lookup SHARCS 2012 | Washington D.C. | 18.03.2012 33

Implementation Software View  Prepare IV in an array Example • Unfilled: initial IV (unchanged) … 0 0 1 0 0 0 0 1 0 1 0 0 1 0 0 1 0 1 0 • Red: cube indices • Blue: dynamic variables  Update the IV: • Increment cube indices by 1 • Evaluate polynomials 0 and 1 xor 0 and 1 and 1  Polynomial Evaluation • Loop over all Monomials • Simple Array-Lookup  But: Very slow in Software (2 50 Grain iterations per key) SHARCS 2012 | Washington D.C. | 18.03.2012 34

Implementation Software View  Prepare IV in an array Example • Unfilled: initial IV (unchanged) … 0 0 1 0 0 0 0 1 0 1 0 0 1 0 0 1 0 1 0 • Red: cube indices • Blue: dynamic variables  Update the IV: Let’s try hardware! • Increment cube indices by 1 • Evaluate polynomials 0 and 1 xor 0 and 1 and 1  Polynomial Evaluation • Loop over all Monomials • Simple Array-Lookup  But: Very slow in Software (2 50 Grain iterations per key) SHARCS 2012 | Washington D.C. | 18.03.2012 35

Experimentally Verifying a Complex Algebraic Attack on the Grain-128 - PowerPoint PPT Presentation

Experimentally Verifying a Complex Algebraic Attack on the Grain-128 Cipher Using Dedicated Reconfigurable Hardware SHARCS 2012 Washington D.C. Itai Dinur 1 , Tim Gneysu 2 , Christof Paar 2 , Adi Shamir 1 , and Ralf Zimmermann 2 1

Algebraic embeddings of complex and almost complex structures Jean-Pierre Demailly (based on

The constant appeared in algebraic and complex geometry Min Ru University of Houston TX, USA

Guess-then-algebraic attack on the Self-Shrinking Generator Blandine Debraize, Louis Goubin

demands for Validating, Verifying and Certifying complex SDR Applications Ken Dingman

Transcendental lattices of complex algebraic surfaces Ichiro Shimada Hiroshima University

Algebraic structure of classical integrability for complex sine-Gordon J. Avan 1 Work in

Examples of non- algebraic classes in the Brown-Peterson tower Institut Mittag-Leffler April 20,

Algebraic and combinatorial methods for bounding the number of the complex embeddings of

Mars Attacks! Revisited. Differential Attack 12 Rounds of the MARS Core and Defeating the Complex

A Brief Comparison: some experimentally verified Generalize the key constraints and

Attack on Traffic Systems These attack examples have happened in the past. We will take an

Verifying filesystems in ACL2 Towards verifying file recovery tools Mihir Mehta Department of

Verifying filesystems in ACL2 Towards verifying file recovery tools Mihir Mehta Department of

Two-dimensional materials from high-throughput computational exfoliation of experimentally known

Algebraic Properties of ln( x ) We can derive algebraic properties of our new function f ( x ) =

Do Now Date: February 9, 2015 Obj: Experimentally confirm (or disconfirm) Boyles Law

Inseparable leaves of polynomial submersions Francisco Braun Departamento de Matem atica

CPSC 490 Graphs+DP Part 4: SCC, 2-SAT; Part 1: Intro Lucca Siaudzionis and Jack

Hodge theory in combinatorics Eric Katz (University of Waterloo) joint with June Huh (IAS) and

Introduction Plethystic substitution Substitution operation in the ring of power series in

HW/SW Codesign GEZEL ECE 495/595 GEZEL: Basics We will capture hardware designs into a language

Chapter 16 Network Flow V - Min-cost flow CS 573: Algorithms, Fall 2013 October 22, 2013 16.1

Right-angled Coxeter groups commensurable to right-angled Artin groups Ivan Levcovitz (Technion)

About the CRT method to compute class Sminaire LFANT 10/05/2012 (Bordeaux) polynomials in