How to Analyse an S-box, and, in the Process, Prove the Russian Standardizing Agency Wrong Léo Perrin Based on joint works with Biryukov, Bonnetain, Canteaut, Duval, Tian and Udovenko June 26, 2019 University of Rostock
Introduction: S-Boxes and Standardization TU-Decomposition, a Russian God and a Grasshoper The Final Structure in the Russian S-box Conclusion From ↑ to ↓ → F 2 8 F 2 8 �→ κ ( 0 ) , 0 π : �→ κ ( 2 m − j ) , for 1 ≤ j ≤ 2 m − 1 , ( α 2 m + 1 ) j α 2 m + 1 ) s ( j ) , for 0 < i , 0 ≤ j < 2 m − 1 . �→ κ ( 2 m − i ) ⊕ α i +( 2 m + 1 ) j ( 1 / 33
Introduction: S-Boxes and Standardization TU-Decomposition, a Russian God and a Grasshoper The Final Structure in the Russian S-box Conclusion From Russia with Love , Terence Young et al. (1963). 2 / 33
Introduction: S-Boxes and Standardization TU-Decomposition, a Russian God and a Grasshoper The Final Structure in the Russian S-box Conclusion Outline Introduction: S-Boxes and Standardization 1 TU-Decomposition, a Russian God and a Grasshoper 2 3 The Final Structure in the Russian S-box 4 Conclusion 3 / 33
Introduction: S-Boxes and Standardization Basics of Symmetric Cryptography TU-Decomposition, a Russian God and a Grasshoper Block Cipher Design The Final Structure in the Russian S-box How Standardization (Doesn’t) Work Conclusion Outline Introduction: S-Boxes and Standardization 1 TU-Decomposition, a Russian God and a Grasshoper 2 3 The Final Structure in the Russian S-box 4 Conclusion 3 / 33
Introduction: S-Boxes and Standardization Basics of Symmetric Cryptography TU-Decomposition, a Russian God and a Grasshoper Block Cipher Design The Final Structure in the Russian S-box How Standardization (Doesn’t) Work Conclusion Plan of this Section 1 Introduction: S-Boxes and Standardization Basics of Symmetric Cryptography Block Cipher Design How Standardization (Doesn’t) Work 2 TU-Decomposition, a Russian God and a Grasshoper 3 The Final Structure in the Russian S-box Conclusion 4 3 / 33
Definition (Block Cipher) x Input: n -bit block x Parameter: k -bit key E Output: n -bit block E x 1 use the same E x Symmetry: E and E Properties needed: Diffusion Confusion No cryptanalysis! Introduction: S-Boxes and Standardization Basics of Symmetric Cryptography TU-Decomposition, a Russian God and a Grasshoper Block Cipher Design The Final Structure in the Russian S-box How Standardization (Doesn’t) Work Conclusion Symmetric Cryptography There are many symmetric algorithms! Hash functions, MACs... 4 / 33
Properties needed: Diffusion Confusion No cryptanalysis! Introduction: S-Boxes and Standardization Basics of Symmetric Cryptography TU-Decomposition, a Russian God and a Grasshoper Block Cipher Design The Final Structure in the Russian S-box How Standardization (Doesn’t) Work Conclusion Symmetric Cryptography There are many symmetric algorithms! Hash functions, MACs... Definition (Block Cipher) x Input: n -bit block x Parameter: k -bit key κ κ E Output: n -bit block E κ ( x ) Symmetry: E and E − 1 use the same κ E κ ( x ) 4 / 33
Introduction: S-Boxes and Standardization Basics of Symmetric Cryptography TU-Decomposition, a Russian God and a Grasshoper Block Cipher Design The Final Structure in the Russian S-box How Standardization (Doesn’t) Work Conclusion Symmetric Cryptography There are many symmetric algorithms! Hash functions, MACs... Definition (Block Cipher) x Input: n -bit block x Parameter: k -bit key κ κ E Output: n -bit block E κ ( x ) Symmetry: E and E − 1 use the same κ E κ ( x ) Properties needed: Diffusion Confusion No cryptanalysis! 4 / 33
Introduction: S-Boxes and Standardization Basics of Symmetric Cryptography TU-Decomposition, a Russian God and a Grasshoper Block Cipher Design The Final Structure in the Russian S-box How Standardization (Doesn’t) Work Conclusion No Cryptanalysis? Let us look at a typical cryptanalysis technique: the differential attack. 5 / 33
x x a a E E E x E x a b b Differential Attack If there are many x such that E x E x a b , then the cipher is not secure . 6ec1067e5c5390ae 6ec1067e5c5391ae 7abb3f43c4989a22 0x04d4595257eb06c8 0x7e6f661193739cea Introduction: S-Boxes and Standardization Basics of Symmetric Cryptography TU-Decomposition, a Russian God and a Grasshoper Block Cipher Design The Final Structure in the Russian S-box How Standardization (Doesn’t) Work Conclusion Differential Attacks ⊕ a = 0000000000000100 6 / 33
x x a a E x E x a b b Differential Attack If there are many x such that E x E x a b , then the cipher is not secure . 6ec1067e5c5390ae 6ec1067e5c5391ae 7abb3f43c4989a22 0x04d4595257eb06c8 0x7e6f661193739cea Introduction: S-Boxes and Standardization Basics of Symmetric Cryptography TU-Decomposition, a Russian God and a Grasshoper Block Cipher Design The Final Structure in the Russian S-box How Standardization (Doesn’t) Work Conclusion Differential Attacks ⊕ a = 0000000000000100 E κ E κ 6 / 33
x x a a E x E x a b b Differential Attack If there are many x such that E x E x a b , then the cipher is not secure . 6ec1067e5c5390ae 6ec1067e5c5391ae 7abb3f43c4989a22 0x04d4595257eb06c8 0x7e6f661193739cea Introduction: S-Boxes and Standardization Basics of Symmetric Cryptography TU-Decomposition, a Russian God and a Grasshoper Block Cipher Design The Final Structure in the Russian S-box How Standardization (Doesn’t) Work Conclusion Differential Attacks ⊕ a = 0000000000000100 E κ E κ 6 / 33
x x a a E x E x a b Differential Attack If there are many x such that E x E x a b , then the cipher is not secure . 0x04d4595257eb06c8 0x7e6f661193739cea 6ec1067e5c5391ae 6ec1067e5c5390ae Introduction: S-Boxes and Standardization Basics of Symmetric Cryptography TU-Decomposition, a Russian God and a Grasshoper Block Cipher Design The Final Structure in the Russian S-box How Standardization (Doesn’t) Work Conclusion Differential Attacks ⊕ a = 0000000000000100 E κ E κ ⊕ b = 7abb3f43c4989a22 6 / 33
a 0000000000000100 b Differential Attack If there are many x such that E x E x a b , then the cipher is not secure . 0x7e6f661193739cea 7abb3f43c4989a22 6ec1067e5c5391ae 6ec1067e5c5390ae 0x04d4595257eb06c8 Introduction: S-Boxes and Standardization Basics of Symmetric Cryptography TU-Decomposition, a Russian God and a Grasshoper Block Cipher Design The Final Structure in the Russian S-box How Standardization (Doesn’t) Work Conclusion Differential Attacks ⊕ x ⊕ a x a E κ E κ E κ ( x ) ⊕ E κ ( x ⊕ a ) b 6 / 33
a 0000000000000100 b 0x04d4595257eb06c8 0x7e6f661193739cea 7abb3f43c4989a22 6ec1067e5c5390ae 6ec1067e5c5391ae Introduction: S-Boxes and Standardization Basics of Symmetric Cryptography TU-Decomposition, a Russian God and a Grasshoper Block Cipher Design The Final Structure in the Russian S-box How Standardization (Doesn’t) Work Conclusion Differential Attacks ⊕ x ⊕ a x a E κ E κ E κ ( x ) ⊕ E κ ( x ⊕ a ) b Differential Attack If there are many x such that E κ ( x ) ⊕ E κ ( x ⊕ a ) = b , then the cipher is not secure . 6 / 33
i S S S S S S S S L Substitution-Permutation Network Such a block cipher iterates the round function above several times. S is the S ubstitution B ox (S-Box). Introduction: S-Boxes and Standardization Basics of Symmetric Cryptography TU-Decomposition, a Russian God and a Grasshoper Block Cipher Design The Final Structure in the Russian S-box How Standardization (Doesn’t) Work Conclusion Basic Block Cipher Structure How do we build block ciphers that prevent such attacks (as well as others)? 7 / 33
Substitution-Permutation Network Such a block cipher iterates the round function above several times. S is the S ubstitution B ox (S-Box). Introduction: S-Boxes and Standardization Basics of Symmetric Cryptography TU-Decomposition, a Russian God and a Grasshoper Block Cipher Design The Final Structure in the Russian S-box How Standardization (Doesn’t) Work Conclusion Basic Block Cipher Structure How do we build block ciphers that prevent such attacks (as well as others)? κ i ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ S S S S S S S S L 7 / 33
Introduction: S-Boxes and Standardization Basics of Symmetric Cryptography TU-Decomposition, a Russian God and a Grasshoper Block Cipher Design The Final Structure in the Russian S-box How Standardization (Doesn’t) Work Conclusion Basic Block Cipher Structure How do we build block ciphers that prevent such attacks (as well as others)? κ i ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ S S S S S S S S L Substitution-Permutation Network Such a block cipher iterates the round function above several times. S is the S ubstitution B ox (S-Box). 7 / 33
Introduction: S-Boxes and Standardization Basics of Symmetric Cryptography TU-Decomposition, a Russian God and a Grasshoper Block Cipher Design The Final Structure in the Russian S-box How Standardization (Doesn’t) Work Conclusion The S-Box (1/2) The S-Box π of the latest Russian standards, Kuznyechik (BC) and Streebog (HF). 8 / 33
Recommend
More recommend
