Generating Graphs Packed With Paths Philip Vejre 1 Mathias - PowerPoint PPT Presentation

Generating Graphs Packed With Paths Philip Vejre 1 Mathias Hall-Andersen 2 FSE 2019 1 DTU, Akamai Technologies 2 PLTC @ University of Copenhagen 1

Overview Motivation Linear Cryptanalysis & Graphs Subgraph Heuristics (for SPN) Plots & Results Future Work 2

Motivation

Differential and Linear Distinguishers [BS90] P x [ E k ( x ) + ∇ = E k ( x + ∆)] [Mat93] P x [ � α, x � = � β, E k ( x ) � ] 3

Differential and Linear Distinguishers [BS90] P x [ E k ( x ) + ∇ = E k ( x + ∆)] [Mat93] P x [ � α, x � = � β, E k ( x ) � ] 3

Differential and Linear Distinguishers [BS90] P x [ E k ( x ) + ∇ = E k ( x + ∆)] [Mat93] P x [ � α, x � = � β, E k ( x ) � ] 3

Differential and Linear Distinguishers In this presentation, focus on linear cryptanalysis (differential largely analogous) [MY92], [Mat93] P x [ � α, x � = � β, E k ( x ) � ] 4

Iterated Ciphers and Trails E k = E ( r ) k r ◦ . . . ◦ E (2) k 2 ◦ E (1) k 1 5

Iterated Ciphers and Trails E k = E ( r ) k r ◦ . . . ◦ E (2) k 2 ◦ E (1) k 1 U = ( α = u 0 , . . . , u r = β ) 5

Iterated Ciphers and Trails E k = E ( r ) k r ◦ . . . ◦ E (2) k 2 ◦ E (1) k 1 U = ( α = u 0 , . . . , u r = β ) ( u i , u i +1 ) ( i ) = 2 · P x ∈ F n [ � u i , x � = � u i +1 , E ( i ) C k i k i ( x ) � ] − 1 5

Hull Correlation contribution for linear trail 1 : r C k � C k i U = ( u i , u i +1 ) ( i ) i =0 1 under ‘Markov cipher assumption’ 6

Hull Correlation contribution for linear trail 1 : r C k � C k i U = ( u i , u i +1 ) ( i ) i =0 � C k C k α,β = U U :( u 0 , u r )=( α,β ) 1 under ‘Markov cipher assumption’ 6

Hull; Expected Linear Potential For key-alternating ciphers (key-addition in the field): r U ) 2 = ( C U ) 2 = � ( u i , u i +1 ) ( i )) 2 ∀ k : ( C k ( C k i =0 7

Hull; Expected Linear Potential For key-alternating ciphers (key-addition in the field): r U ) 2 = ( C U ) 2 = ∀ k : ( C k � ( C k ( u i , u i +1 ) ( i )) 2 i =0 E [( C α,β ) 2 ] ≈ � ( C k U ) 2 U :( u 0 , u r )=( α,β ) 7

Hull; Expected Linear Potential For key-alternating ciphers (key-addition in the field): r U ) 2 = ( C U ) 2 = ∀ k : ( C k � ( C k ( u i , u i +1 ) ( i )) 2 i =0 E [( C α,β ) 2 ] ≈ � ( C k U ) 2 U ∈U , ( u 0 , u r )=( α,β ) 7

Hull; Expected Linear Potential For key-alternating ciphers (key-addition in the field): r U ) 2 = ( C U ) 2 = ∀ k : ( C k � ( C k ( u i , u i +1 ) ( i )) 2 i =0 E [( C α,β ) 2 ] ≈ � ( C U ) 2 U ∈U , ( u 0 , u r )=( α,β ) Problem: Current methods usually linear in the number of trails 7

Linear Cryptanalysis & Graphs

Multistage Graph α 0 u 0 v 0 β 0 α 1 u 1 v 1 β 1 α 2 u 2 v 2 β 2 α 3 u 3 v 3 β 3 E (1) E (2) E (3) k 1 k 2 k 3 8

Nodes and Parities α 0 u 0 v 0 β 0 α 1 u 1 v 1 β 1 α 2 u 2 v 2 β 2 α 3 u 3 v 3 β 3 E (1) E (2) E (3) k 1 k 2 k 3 Nodes α ∈ F n represent parities α ∗ for linear cryptanalysis: α ∗ : v �→ � v , α � 9

Edges and Approximations α 0 u 0 v 0 β 0 α 1 u 1 v 1 β 1 α 2 u 2 v 2 β 2 α 3 u 3 v 3 β 3 E (1) E (2) E (3) k 1 k 2 k 3 l ( u → v ) = ( C k ( u , v ) ) 2 10

Paths and Trails α 0 u 0 v 0 β 0 α 1 u 1 v 1 β 1 α 2 u 2 v 2 β 2 α 3 u 3 v 3 β 3 E (1) E (2) E (3) k 1 k 2 k 3 r − 1 � l ( v 0 � v r ) = l ( v i → v i +1 ) i =0 11

Hulls as Sets of Paths α 0 u 0 v 0 β 0 α 1 u 1 v 1 β 1 α 2 u 2 v 2 β 2 α 3 u 3 v 3 β 3 E (1) E (2) E (3) k 1 k 2 k 3 � � w G E ( α β ) = l ( α � β ) = w G E ( α v ) · l ( v → β ) ♦ ♦ v 12

Hulls as Sets of Paths α 0 u 0 v 0 β 0 α 1 u 1 v 1 β 1 α 2 u 2 v 2 β 2 α 3 u 3 v 3 β 3 E (1) E (2) E (3) k 1 k 2 k 3 � � w G E ( α β ) = l ( α � β ) = w G E ( α v ) · l ( v → β ) ♦ ♦ v 13

Hulls as Sets of Paths α 0 u 0 v 0 β 0 α 1 u 1 v 1 β 1 α 2 u 2 v 2 β 2 α 3 u 3 v 3 β 3 E (1) E (2) E (3) k 1 k 2 k 3 � � w G E ( α β ) = l ( α � β ) = w G E ( α v ) · l ( v → β ) ♦ ♦ v 13

Hulls as Sets of Paths α 0 u 0 v 0 β 0 α 1 u 1 v 1 β 1 α 2 u 2 v 2 β 2 α 3 u 3 v 3 β 3 E (1) E (2) E (3) k 1 k 2 k 3 � � w G E ( α β ) = l ( α � β ) = w G E ( α v ) · l ( v → β ) ♦ ♦ v 13

Suitable Subgraphs The full graph G E is too large. (exponential in the block-size) 14

Can we find suitable ¯ G E ⊂ G E , that contains the good trails? i.e. max α,β w ¯ G E ( α β ) is large. ♦ 15

Subgraph Heuristics (for SPN)

Overall Method 1. Pick disjoint ‘families’ of edges 16

Overall Method 1. Pick disjoint ‘families’ of edges 2. Prune the families an ‘approximate’ graph 16

Overall Method 1. Pick disjoint ‘families’ of edges 2. Prune the families an ‘approximate’ graph 3. Expand the families to a full graph 16

Overall Method 1. Pick disjoint ‘families’ of edges 2. Prune the families an ‘approximate’ graph 3. Expand the families to a full graph 4. Remove unneeded vertices & edges in resulting graph 16

Pruning Strip l ( v → u ) = 0 17

Pruning Prune 18

S-Box Patterns / Families of edges Example: 16-bit SPN, with four identical 4-bit S-Boxes. 19

S-Box Patterns / Families of edges Example: 16-bit SPN, with four identical 4-bit S-Boxes. C 2 ( 0x3 , 0xd ) = 2 − 2 C 2 ( 0x7 , 0x4 ) = 2 − 2 19

S-Box Patterns / Families of edges Example: 16-bit SPN, with four identical 4-bit S-Boxes. C 2 ( 0x3 , 0xd ) = 2 − 2 C 2 ( 0x7 , 0x4 ) = 2 − 2 p = (1 , 2 − 2 , 1 , 2 − 2 ) 19

S-Box Patterns / Families of edges Example: 16-bit SPN, with four identical 4-bit S-Boxes. C 2 ( 0x3 , 0xd ) = 2 − 2 C 2 ( 0x7 , 0x4 ) = 2 − 2 p = (1 , 2 − 2 , 1 , 2 − 2 ) Ex( p ) = { ( 0x0303 , 0x0d0d ) , ( 0x0307 , 0x0d04 ) , ( 0x0703 , 0x040d ) , ( 0x0707 , 0x0404 ) } 19

S-Box Patterns / Families of edges Ex( p ) = { ( 0x0303 , 0x0d0d ) , ( 0x0307 , 0x0d04 ) , ( 0x0703 , 0x040d ) , ( 0x0707 , 0x0404 ) } Ex in ( p ) = { 0x0303 , 0x0307 , 0x0703 , 0x0707 } Ex out ( p ) = { 0x0d0d , 0x0d04 , 0x040d , 0x0404 } 20

Graph Defined By S-Box Pattern Set Given a set of S-Box patterns P , the graph defined by P : � E = Ex( P ) = Ex( p ) p ∈P V = Ex in ( P ) ∪ Ex out ( P ) 21

Graph Defined By S-Box Pattern Set Let P be a set of S-Box patterns defining our subgraph. 22

Graph Defined By S-Box Pattern Set Let P be a set of S-Box patterns defining our subgraph. For intermediate stages: v / ∈ Ex in ( P ) ∩ Ex out ( P ) = ⇒ v is pruned 22

Graph Compression Problem: Ex( P ) too large to store explicitly ( | Ex( P ) | ≫ |P| ) 23

Graph Compression Problem: Ex( P ) too large to store explicitly ( | Ex( P ) | ≫ |P| ) Idea: Can we prune P before expanding? 23

Graph Compression Problem: Ex( P ) too large to store explicitly ( | Ex( P ) | ≫ |P| ) Idea: Can we prune P before expanding? Generate an approximation of ¯ G E = Ex( P ), by applying a compression function g j : F n → F n / j to every vertex. u → v ∈ ¯ g j ( ¯ G E = ⇒ ˆ g j ( u ) → ˆ g j ( v ) ∈ ˆ G E ) 23

Graph Compression Iteratively refine the compression: 1. Generate a set of patterns P . 2. Pick a j > 1 such that j is a power of two: g j ( ¯ 2.1 Generate the graph ˆ G E ) from P and prune. g j ( ¯ 2.2 Remove dead patterns from P according to ˆ G E ). 2.3 If j = 2 then stop. Otherwise set j = j / 2 and repeat. 24

Vertex Anchoring S 0 S 1 S 2 S 3 S 4 S 5 S 6 S 7 25

Vertex Anchoring Pruned middle rounds S 0 S 1 S 2 S 3 S 4 S 5 S 6 S 7 26

Vertex Anchoring Pruned middle rounds S 0 S 1 S 2 S 3 S 4 S 5 S 6 S 7 27

Plots & Results

https://gitlab.com/psve/cryptagraph 28

Plots of subgraphs (for small parameters) 29

PRESENT [BKL + 07] 30

GIFT [BPP + 17] 31