KISS: A Bit Too Simple Greg Rose ggr@qualcomm.com Outline KISS - - PowerPoint PPT Presentation

▶

Nov 28, 2022 378 likes •648 views

KISS: A Bit Too Simple Greg Rose ggr@qualcomm.com Outline KISS random number generator Subgenerators Efficient attack New KISS and attack Conclusion PAGE 2 One approach to PRNG security "A random number generator

SLIDE 1

KISS: A Bit Too Simple

Greg Rose ggr@qualcomm.com

SLIDE 2

PAGE 2

Outline

 KISS – random number generator  Subgenerators  Efficient attack  New KISS and attack  Conclusion

SLIDE 3

PAGE 3

One approach to PRNG security

"A random number generator is like sex: When it's good, its wonderful; And when it's bad, it's still pretty good." Add to that, in line with my recommendations

n combination generators;

"And if it's bad, try a twosome or threesome.”

- George Marsaglia, quoting himself (1999)

SLIDE 4

PAGE 4

KISS – a Pseudo-Random Number Generator

 “Keep it Simple Stupid”  Marsaglia and Zaman, Florida State U, 1993  Marsaglia posts C version to sci.crypt, 1998/99, took off  Never said it was secure!

Good thing, too…
But others seem to think it is.

#define znew (z=36969(z&65535)+(z>>16)) #define wnew (w=18000(w&65535)+(w>>16)) #define MWC ((znew<<16)+wnew ) #define SHR3 (jsr^=(jsr<<17), jsr^=(jsr>>13), jsr^=(jsr<<5)) #define CONG (jcong=69069*jcong+1234567) #define KISS ((MWC^CONG)+SHR3)

SLIDE 5

PAGE 5

KISS diagram

w n e w z n e w M W C S H R 3 C O N G K I S S

+ + + 

SLIDE 6

PAGE 6

Multiply With Carry subgenerator

 znew and wnew  16 bits “random looking”, 32 bits of state  Multiply by constant (18000, 36969 resp), add carry from previous multiplication  Periods about 229.1 and 230.2 – two long cycles each  Two bad values (0 and something else) repeat forever  Large states go into smaller ones after one update  znew only affects high order bits.

SLIDE 7

PAGE 7

Linear Congruential subgenerator

 Well studied, period 232, single long cycle  Low order bits form smaller linear congruential generators  In particular, LSB goes “01010101010…”

SLIDE 8

PAGE 8

3-Shift Register subgenerator

 Linear, but not like LFSR  Authors assume long period, but wrong  LSBs of output form one of 64 LFSRs  Periods range from 1 to 228.2 (not 232-1!)  Can recover initial state from 32 consecutive LSBs easily

Binary matrix multiplication

SLIDE 9

PAGE 9

Attack idea

 Divide and Conquer

Registers are updated independently of each other, then

combined

So try to get rid of effects of one or more registers
One of them is already partly gone!

 Exploit weaknesses (eg. Linearity of SHR3, low order bits

f CONG)

 Guess and Determine

Guess (that is, try all possibilities) for some values, then
Derive other values
Verify whether still consistent

SLIDE 10

PAGE 10

What do we know at the start?

w n e w z n e w M W C S H R 3 C O N G K I S S

+ + + 

Determined Now known Guessed

SLIDE 11

PAGE 11

Guess wnew

w n e w z n e w M W C S H R 3 C O N G K I S S

+ + + 

Determined Now known Guessed

SLIDE 12

PAGE 12

Guess LSB of CONG (01010… or 10101…)

w n e w z n e w M W C S H R 3 C O N G K I S S

+ + + 

Determined Now known Guessed

SLIDE 13

PAGE 13

Determine LSB sequence from SHR3

w n e w z n e w M W C S H R 3 C O N G K I S S

+ + + 

Determined Now known Guessed

SLIDE 14

PAGE 14

Verify LSB sequence from SHR3 is LFSR

w n e w z n e w M W C S H R 3 C O N G K I S S

+ + + 

Determined Now known Guessed

SLIDE 15

PAGE 15

Determine half of CONG

w n e w z n e w M W C S H R 3 C O N G K I S S

+ + + 

Determined Now known Guessed

SLIDE 16

PAGE 16

Guess top half of CONG

w n e w z n e w M W C S H R 3 C O N G K I S S

+ + + 

Determined Now known Guessed

SLIDE 17

PAGE 17

Determine low half of znew

w n e w z n e w M W C S H R 3 C O N G K I S S

+ + + 

Determined Now known Guessed

SLIDE 18

PAGE 18

Determine high half of znew from low half

w n e w z n e w M W C S H R 3 C O N G K I S S

+ + + 

Determined Now known Guessed

SLIDE 19

PAGE 19

And verify…

w n e w z n e w M W C S H R 3 C O N G K I S S

+ + + 

Determined Now known Guessed

SLIDE 20

PAGE 20

How much work?

 Dominated by trying, on average, 589,823,999 values for wnew  And for each one, using Berlekamp-Massey algorithm to check whether the candidate for SHR3 is LFSR

Alternatively, can check parity equations.

 Few hours on laptop.

SLIDE 21

PAGE 21

Newer KISS

 Sci.crypt 2011 posting by Marsaglia  Looking for longer and longer cycles  Period > 1040,000,000  State is ridiculously large (222+3 32-bit words)  Again combines multiple components “for security”

S H R 3

+

C O N G b32MWC (222 words)

SLIDE 22

PAGE 22

New KISS

static unsigned long Q[4194304],carry=0; unsigned long b32MWC(void) {unsigned long t,x; static int j=4194303; j=(j+1)&4194303; x=Q[j]; t=(x<<28)+carry; carry=(x>>4)-(t<x); return (Q[j]=t-x); } #define CNG ( cng=69069*cng+13579 ) #define XS ( xs^=(xs<<13), xs^=(xs>>17), xs^=(xs<<5) ) #define KISS ( b32MWC()+CNG+XS )

SLIDE 23

PAGE 23

Complemented Multiply With Carry

 Large circular buffer with carry variable  Extremely long period  State values are used directly for output  Can be run backward  After one rotation through buffer, can check consistency easily (used in attack)  By itself has no cryptographic strength at all

output is state

SLIDE 24

PAGE 24

Attack on New KISS

 Simple divide and conquer  Guess state of CONG and SHR3  Run generator forward slightly more than a full rotation

f b32MWC’s buffer

 If 3 outputs are mutually consistent, must have guessed correctly  Run backward to recover full initial state  Equivalent to 263 key setup operations

But the key is huge, so is the key setup operation

SLIDE 25

PAGE 25

Conclusion

 M & Z overestimated the period by about a factor of 10  KISS is not secure  Need about 70 words of generated output  Can apply attack to unknown (but biased) plaintext

Replace B-M step with fast correlation attack
Still surprisingly efficient

KISS: A Bit Too Simple

Greg Rose ggr@qualcomm.com

Outline

 KISS – random number generator  Subgenerators  Efficient attack  New KISS and attack  Conclusion

One approach to PRNG security

"A random number generator is like sex: When it's good, its wonderful; And when it's bad, it's still pretty good." Add to that, in line with my recommendations

"And if it's bad, try a twosome or threesome.”

KISS – a Pseudo-Random Number Generator

 “Keep it Simple Stupid”  Marsaglia and Zaman, Florida State U, 1993  Marsaglia posts C version to sci.crypt, 1998/99, took off  Never said it was secure!

#define znew (z=36969*(z&65535)+(z>>16)) #define wnew (w=18000*(w&65535)+(w>>16)) #define MWC ((znew<<16)+wnew ) #define SHR3 (jsr^=(jsr<<17), jsr^=(jsr>>13), jsr^=(jsr<<5)) #define CONG (jcong=69069*jcong+1234567) #define KISS ((MWC^CONG)+SHR3)

KISS diagram

w n e w z n e w M W C S H R 3 C O N G K I S S

+ + + 

Multiply With Carry subgenerator

Linear Congruential subgenerator

 Well studied, period 232, single long cycle  Low order bits form smaller linear congruential generators  In particular, LSB goes “01010101010…”

3-Shift Register subgenerator

 Linear, but not like LFSR  Authors assume long period, but wrong  LSBs of output form one of 64 LFSRs  Periods range from 1 to 228.2 (not 232-1!)  Can recover initial state from 32 consecutive LSBs easily

Attack idea

 Divide and Conquer

combined

 Exploit weaknesses (eg. Linearity of SHR3, low order bits

 Guess and Determine

What do we know at the start?

w n e w z n e w M W C S H R 3 C O N G K I S S

+ + + 

Determined Now known Guessed

Guess wnew

w n e w z n e w M W C S H R 3 C O N G K I S S

+ + + 

Determined Now known Guessed

Guess LSB of CONG (01010… or 10101…)

w n e w z n e w M W C S H R 3 C O N G K I S S

+ + + 

Determined Now known Guessed

Determine LSB sequence from SHR3

w n e w z n e w M W C S H R 3 C O N G K I S S

+ + + 

Determined Now known Guessed

Verify LSB sequence from SHR3 is LFSR

w n e w z n e w M W C S H R 3 C O N G K I S S

+ + + 

Determined Now known Guessed

Determine half of CONG

w n e w z n e w M W C S H R 3 C O N G K I S S

+ + + 

Determined Now known Guessed

Guess top half of CONG

w n e w z n e w M W C S H R 3 C O N G K I S S

+ + + 

Determined Now known Guessed

Determine low half of znew

w n e w z n e w M W C S H R 3 C O N G K I S S

+ + + 

Determined Now known Guessed

Determine high half of znew from low half

w n e w z n e w M W C S H R 3 C O N G K I S S

+ + + 

Determined Now known Guessed

And verify…

w n e w z n e w M W C S H R 3 C O N G K I S S

+ + + 

Determined Now known Guessed

How much work?

 Dominated by trying, on average, 589,823,999 values for wnew  And for each one, using Berlekamp-Massey algorithm to check whether the candidate for SHR3 is LFSR

 Few hours on laptop.

Newer KISS

 Sci.crypt 2011 posting by Marsaglia  Looking for longer and longer cycles  Period > 1040,000,000  State is ridiculously large (222+3 32-bit words)  Again combines multiple components “for security”

S H R 3

+

C O N G b32MWC (222 words)

New KISS

Complemented Multiply With Carry

 Large circular buffer with carry variable  Extremely long period  State values are used directly for output  Can be run backward  After one rotation through buffer, can check consistency easily (used in attack)  By itself has no cryptographic strength at all

Attack on New KISS

 Simple divide and conquer  Guess state of CONG and SHR3  Run generator forward slightly more than a full rotation

 If 3 outputs are mutually consistent, must have guessed correctly  Run backward to recover full initial state  Equivalent to 263 key setup operations

Conclusion

 M & Z overestimated the period by about a factor of 10  KISS is not secure  Need about 70 words of generated output  Can apply attack to unknown (but biased) plaintext

 Don’t use KISS if you need security!

#define znew (z=36969(z&65535)+(z>>16)) #define wnew (w=18000(w&65535)+(w>>16)) #define MWC ((znew<<16)+wnew ) #define SHR3 (jsr^=(jsr<<17), jsr^=(jsr>>13), jsr^=(jsr<<5)) #define CONG (jcong=69069*jcong+1234567) #define KISS ((MWC^CONG)+SHR3)