Linear Biases in AEGIS Keystream Brice Minaud ANSSI, France SAC – August 15, 2014
Plan 1 Blockwise Stream Ciphers 2 Presentation of AEGIS 3 Linear Biases in AEGIS 1/22
Blockwise Stream Ciphers 2/22
Authenticated Encryption Schemes C i +1 C i P i − 1 P i P i +1 F i F i +1 This requires F − 1 for decryption. i 3/22
Authenticated Encryption Schemes C i +1 C i P i − 1 P i P i +1 F i F i +1 This is malleable. 3/22
Authenticated Encryption Schemes C i +1 C i P i − 1 P i P i +1 P i − 1 P i F i F i +1 P i is inserted into the state after C i is output. 3/22
Blockwise Stream Cipher C i +1 C i P i − 1 P i P i +1 K i +1 P i − 1 P i F i F i +1 A single round behaves like a stream cipher. K i + 1 depends on P i , P i − 1 , . . . but not P i + 1 . 3/22
Blockwise Stream Ciphers in CAESAR Duplex constructions behave in this way. So do many CAESAR candidates. AEGIS, Artemia, Ascon, CBEAM, ICEPOLE, Keyak, Ketje, MORUS, PAES, PANDA, π -Cipher, 2/3 PRIMATEs, STRIBOB, Tiaoxin... 3/22
Keystream Biases C i C i +1 C i +2 P i P i +1 P i +2 K i +1 K i +2 K i P i − 1 P i P i +1 F i F i +1 F i +2 4/22
Keystream Biases C i C i +1 C i +2 P i P i +1 P i +2 K i +1 K i +2 K i P i − 1 P i P i +1 F i F i +1 F i +2 Assume we know, say, P i − 1 , P i , P i + 1 , (e.g. headers). We are interested in P i + 2 . 4/22
Keystream Biases C i C i +1 C i +2 P i P i +1 P i +2 K i +1 K i +2 K i P i − 1 P i P i +1 F i F i +1 F i +2 4/22
Keystream Biases C i C i +1 C i +2 P i P i +1 P i +2 K i +1 K i +2 K i P i − 1 P i P i +1 F i F i +1 F i +2 5/22
Keystream Biases C i C i +1 C i +2 P i P i +1 P i +2 K i +1 K i +2 K i P i − 1 P i P i +1 F i F i +1 F i +2 Assume knowing P i − 1 , P i , P i + 1 , there exists a bias on : α i · K i ⊕ α i + 1 · K i + 1 ⊕ α i + 2 · K i + 2 Then α i · C i ⊕ α i + 1 · C i + 1 ⊕ α i + 2 · C i + 2 gives us information on α i + 2 · P i + 2 . 5/22
Keystream Biases C i C i +1 C i +2 P i P i +1 P i +2 K i +1 K i +2 K i P i − 1 P i P i +1 F i F i +1 F i +2 Thus, if P i − 1 , . . . , P i + 2 is encrypted enough times for the bias on α i · K i ⊕ α i + 1 · K i + 1 ⊕ α i + 2 · K i + 2 to be significant, we recover information on P i + 2 . This type of attack is independent of the key or nonce. It is not considered in most security analyses. 6/22
Keystream Biases C i C i +1 C i +2 P i P i +1 P i +2 K i +1 K i +2 K i P i − 1 P i P i +1 F i F i +1 F i +2 In summary, knowing P i − 1 , P i , P i + 1 , we want to find a bias on : α i · K i ⊕ α i + 1 · K i + 1 ⊕ α i + 2 · K i + 2 We call this a “keystream” bias. 7/22
Our Results on AEGIS Cipher (Single) Keystream Bias Data 2 154 (est. 2 140 ) 2 − 77 AEGIS-128 2 − 89 2 178 AEGIS-256 The data requirements are far below a generic attack. However they are also far above any realistic threat. Above security parameters for AEGIS-128. The biases involve only 3 consecutive rounds, while the size of the inner state is 5 (resp. 6) times the size of the output per round. 8/22
Presentation of AEGIS 9/22
AEGIS AEGIS : authenticated cipher introduced at SAC 2013 by Hongjun Wu and Bart Preneel. CAESAR candidate. AES-NI pipeline ⇒ outstanding speed in software. Simple structure. Already inspired other designs : Tiaoxin, PAES. 10/22
AEGIS Three variants : AEGIS-128, AEGIS-128L, AEGIS-256. AEGIS-128 : 128-bit blocks, 128-bit nonce, 128-bit tag, 128-bit key. AEGIS-256 : 128-bit blocks, 128-bit nonce, 128-bit tag, 256-bit key. Process of AEGIS 1 Initialization. 2 Processing of associated data. 3 Encryption. 4 Finalization and tag generation. 11/22
Round function of AEGIS-128 S i ,0 S i ,1 S i ,2 S i ,3 S i ,4 128 128 128 128 128 R R R R R P i * * S i +1,0 S i +1,1 S i +1,2 S i +1,3 S i +1,4 Inner state : 5 × 128 bits in registers S i , 0 , . . ., S i , 4 . R : one round of AES, no key addition. P i : plaintext block number i . 12/22
Round function of AEGIS-128 S i ,0 S i ,1 S i ,2 S i ,3 S i ,4 128 128 128 128 128 R R R R R P i * * S i +1,0 S i +1,1 S i +1,2 S i +1,3 S i +1,4 Output : C i = S i , 1 ⊕ ( S i , 2 & S i , 3 ) ⊕ S i , 4 ⊕ P i where & denotes bitwise AND . 13/22
Round function of AEGIS-256 S i ,0 S i ,1 S i ,2 S i ,3 S i ,4 S i ,5 128 128 128 128 128 128 R R R R R R P i * * S i +1,0 S i +1,1 S i +1,2 S i +1,3 S i +1,4 S i +1,5 Output : C i = S i , 1 ⊕ ( S i , 2 & S i , 3 ) ⊕ S i , 4 ⊕ S i , 5 ⊕ P i 14/22
Linear Biases in AEGIS 15/22
Output at round i K i = S i , 1 ⊕ ( S i , 2 & S i , 3 ) ⊕ S i , 4 α · K i = α · S i , 1 ⊕ α · ( S i , 2 & S i , 3 ) ⊕ α · S i , 4 16/22
Output at round i K i = S i , 1 ⊕ ( S i , 2 & S i , 3 ) ⊕ S i , 4 α · K i = α · S i , 1 ⊕ α · ( S i , 2 & S i , 3 ) ⊕ α · S i , 4 Lemma If X , Y are n -bit uniformly random variables, the events : α · ( X & Y ) = 0 α · ( X & Y ) = α · X α · ( X & Y ) = α · Y α · ( X & Y ) = α · ( X ⊕ Y ) ⊕ 1 all have probability 1 / 2 + 2 − hw ( α ) − 1 . 16/22
Linear approximation of & Hence, with the same probability : α · K i = α · ( S i , 1 ⊕ S i , 4 ) α · K i = α · ( S i , 1 ⊕ S i , 2 ⊕ S i , 4 ) α · K i = α · ( S i , 1 ⊕ S i , 3 ⊕ S i , 4 ) α · K i = α · ( S i , 1 ⊕ S i , 2 ⊕ S i , 3 ⊕ S i , 4 ) ⊕ 1 We write : K i ≈ S i , 1 ⊕ [ S i , 2 ] ⊕ [ S i , 3 ] ⊕ S i , 4 This is our output at round i . 17/22
Output at round i + 1 S i ,0 S i ,1 R R R R R * * S i +1,1 S i + 1 , 1 ⊕ S i , 1 = R ( S i , 0 ) S i +2,2 18/22
Output at round i + 1 S i ,0 S i ,1 R R R R R * * S i +1,1 S i + 1 , 1 ⊕ S i , 1 = R ( S i , 0 ) K i ≈ S i , 1 ⊕ [ S i , 2 ] ⊕ [ S i , 3 ] ⊕ S i , 4 S i +2,2 K i + 1 ⊕ K i ≈ R ( S i , 0 ) ⊕ [ R ( S i , 1 )] ⊕ [ R ( S i , 2 )] ⊕ R ( S i , 3 ) 18/22
Output at round i + 2 S i ,0 S i ,1 S i ,2 R R R R R R * * R R R R R * * S i +2,2 S i + 2 , 2 ⊕ S i , 2 = R ( S i + 1 , 1 ) ⊕ R ( S i + 1 , 1 ⊕ R ( S i , 0 )) 19/22
Output at round i + 2 If we approximate (with a probability cost) : β · R ( X ) = α · X Then : β · ( R ( S i + 1 , 1 ) ⊕ R ( S i + 1 , 1 ⊕ R ( S i , 0 ))) = α · S i + 1 , 1 ⊕ α · S i + 1 , 1 ⊕ α · R ( S i , 0 ) = α · R ( S i , 0 ) Hence we approximate : S i + 2 , 2 ⊕ S i , 2 = R ( S i + 1 , 1 ) ⊕ R ( S i + 1 , 1 ⊕ R ( S i , 0 )) ≈ D ( R ( S i , 0 )) where D ( X ) = R ( U ) ⊕ R ( U ⊕ X ) , U uniformly random. K i + 2 ⊕ K i ≈ D ( R ( S i , 4 )) ⊕ [ D ( R ( S i , 0 ))] ⊕ [ D ( R ( S i , 1 ))] ⊕ D ( R ( S i , 2 )) 20/22
Final bias K i ≈ S 1 ⊕ [ S 2 ] ⊕ [ S 3 ] ⊕ S 4 K i + 1 ⊕ K i ≈ R ( S 0 ) ⊕ [ R ( S 1 )] ⊕ [ R ( S 2 )] ⊕ R ( S 3 ) K i + 2 ⊕ K i ≈ [ D ( R ( S 0 ))] ⊕ [ D ( R ( S 1 ))] ⊕ D ( R ( S 2 )) ⊕ D ( R ( S 4 )) 21/22
Final bias K i ≈ S 1 ⊕ [ S 2 ] ⊕ [ S 3 ] ⊕ S 4 K i + 1 ⊕ K i ≈ R ( S 0 ) ⊕ [ R ( S 1 )] ⊕ [ R ( S 2 )] ⊕ R ( S 3 ) K i + 2 ⊕ K i ≈ [ D ( R ( S 0 ))] ⊕ [ D ( R ( S 1 ))] ⊕ D ( R ( S 2 )) ⊕ D ( R ( S 4 )) Choose masks α , β , γ such that with good probability : α · X = β · R ( X ) β · Y = γ · D ( Y ) and We consider : α · K i ⊕ β · ( K i + 1 ⊕ K i ) ⊕ γ · ( K i + 2 ⊕ K i ) Any two terms in the same column will cancel out. 21/22
Final bias K i ≈ S 1 ⊕ [ S 2 ] ⊕ [ S 3 ] ⊕ S 4 K i + 1 ⊕ K i ≈ R ( S 0 ) ⊕ [ R ( S 1 )] ⊕ [ R ( S 2 )] ⊕ R ( S 3 ) K i + 2 ⊕ K i ≈ [ D ( R ( S 0 ))] ⊕ [ D ( R ( S 1 ))] ⊕ D ( R ( S 2 )) ⊕ D ( R ( S 4 )) 21/22
Final bias K i ≈ S 1 ⊕ [ S 2 ] ⊕ [ S 3 ] ⊕ S 4 K i + 2 ⊕ K i ≈ [ D ( R ( S 0 ))] ⊕ [ D ( R ( S 1 ))] ⊕ D ( R ( S 2 )) ⊕ D ( R ( S 4 )) 21/22
Final bias K i ≈ S 1 ⊕ S 2 ⊕ S 4 K i + 2 ⊕ K i ≈ D ( R ( S 1 )) ⊕ D ( R ( S 2 )) ⊕ D ( R ( S 4 )) 21/22
Final bias K i ≈ S 1 ⊕ S 2 ⊕ S 4 K i + 2 ⊕ K i ≈ D ( R ( S 1 )) ⊕ D ( R ( S 2 )) ⊕ D ( R ( S 4 )) Thus α · K i ⊕ γ · ( K i ⊕ K i + 2 ) is biased. 21/22
Final bias K i ≈ S 1 ⊕ S 2 ⊕ S 4 K i + 2 ⊕ K i ≈ D ( R ( S 1 )) ⊕ D ( R ( S 2 )) ⊕ D ( R ( S 4 )) Thus α · K i ⊕ γ · ( K i ⊕ K i + 2 ) is biased. Probability cost : essentially 3 × the cost of : α · X = β · R ( X ) and β · Y = γ · D ( Y ) Plus the cost of linearizing & in the K i ’s. Total : 3 · ( 12 + 6 ) + 5 + 2 · 9 = 77 ⇒ bias 2 − 77 . AEGIS-256 : bias 2 − 89 . 21/22
Conclusion Attack model rarely taken into account in security analyses. Theoretical cryptanalysis of AEGIS-256 (high data requirements). Further work to be carried out on other authenticated ciphers with similar stream cipher-like behavior. 22/22
Questions Thank you for your attention.
Recommend
More recommend
