New techniques for trail bounds and application to differential - - PowerPoint PPT Presentation
New techniques for trail bounds and application to differential trails in Keccak Silvia Mella 1 , 2 Joan Daemen 1 , 3 Gilles Van Assche 1 1 STMicroelectronics 2 University of Milan 3 Radboud University Fast Software Encryption March 5-8, 2017
1STMicroelectronics 2University of Milan 3Radboud University
New techniques for trail bounds and application to differential trails in Keccak 1 / 31
New techniques for trail bounds and application to differential trails in Keccak 2 / 31
Introduction
New techniques for trail bounds and application to differential trails in Keccak 3 / 31
Introduction Differential trails
◮ Trail: the sequence of differences after each round ◮ DP(Q): fraction of pairs that exhibit qi differences
New techniques for trail bounds and application to differential trails in Keccak 4 / 31
Introduction Differential trails
◮ The weight is the number of binary conditions that a pair must
◮ If independent conditions and w(Q) < b: #pairs(Q) ≈ 2b−w(Q)
New techniques for trail bounds and application to differential trails in Keccak 5 / 31
Introduction Differential trails
◮ forward: iterate over all differences R-compatible with q5 ◮ backward: iterate over all differences R−1-compatible with q1
New techniques for trail bounds and application to differential trails in Keccak 6 / 31
Introduction Differential trails
◮ forward: iterate over all differences R-compatible with q5 ◮ backward: iterate over all differences R−1-compatible with q1
New techniques for trail bounds and application to differential trails in Keccak 6 / 31
Introduction Differential trails
◮ forward: iterate over all differences R-compatible with q5 ◮ backward: iterate over all differences R−1-compatible with q1
New techniques for trail bounds and application to differential trails in Keccak 6 / 31
Introduction Differential trails
◮ forward: iterate over all differences R-compatible with q5 ◮ backward: iterate over all differences R−1-compatible with q1
New techniques for trail bounds and application to differential trails in Keccak 6 / 31
Introduction Differential trails
◮ Minimum reverse weight:
q0 w(q0, q1) ◮ Can be used to lower bound set of trails ◮ Trail core: set of trails with q1, q2, . . . in common
New techniques for trail bounds and application to differential trails in Keccak 7 / 31
Introduction Goals of this work
◮ Present general techniques to generate trails ◮ Improve bounds of differential trails in Keccak-f ◮ By extending the space of trails in Keccak-f that can be
rounds Keccak-f [200] Keccak-f [400] Keccak-f [800] Keccak-f [1600] 2 8 8 8 8 3 20 this work this work 32 4 46 this work this work this work 5 this work this work this work this work 6 this work this work this work this work
New techniques for trail bounds and application to differential trails in Keccak 8 / 31
Generating trails
New techniques for trail bounds and application to differential trails in Keccak 9 / 31
Generating trails Second-order approach
n
n
New techniques for trail bounds and application to differential trails in Keccak 10 / 31
Generating trails Tree traversal
◮ 2-round trails are arranged in a tree ◮ Children are generated by adding groups of active bits without
◮ Pruning by lower bounding the weight of a node and its children
New techniques for trail bounds and application to differential trails in Keccak 11 / 31
Scanning space of trails in Keccak-f
New techniques for trail bounds and application to differential trails in Keccak 12 / 31
Scanning space of trails in Keccak-f Keccak-f
x y z state
◮ (5 × 5)-bit slices ◮ 2ℓ-bit lanes ◮ parameter 0 ≤ ℓ < 7
◮ θ: mixing layer ◮ ρ: inter-slice bit transposition ◮ π: intra-slice bit transposition ◮ χ: non-linear layer ◮ ι: round constants
◮ 12 rounds in Keccak-f [25] ◮ 24 rounds in Keccak-f [1600]
New techniques for trail bounds and application to differential trails in Keccak 13 / 31
Scanning space of trails in Keccak-f Keccak-f
x y z slice
◮ (5 × 5)-bit slices ◮ 2ℓ-bit lanes ◮ parameter 0 ≤ ℓ < 7
◮ θ: mixing layer ◮ ρ: inter-slice bit transposition ◮ π: intra-slice bit transposition ◮ χ: non-linear layer ◮ ι: round constants
◮ 12 rounds in Keccak-f [25] ◮ 24 rounds in Keccak-f [1600]
New techniques for trail bounds and application to differential trails in Keccak 13 / 31
Scanning space of trails in Keccak-f Keccak-f
x y z row
◮ (5 × 5)-bit slices ◮ 2ℓ-bit lanes ◮ parameter 0 ≤ ℓ < 7
◮ θ: mixing layer ◮ ρ: inter-slice bit transposition ◮ π: intra-slice bit transposition ◮ χ: non-linear layer ◮ ι: round constants
◮ 12 rounds in Keccak-f [25] ◮ 24 rounds in Keccak-f [1600]
New techniques for trail bounds and application to differential trails in Keccak 13 / 31
Scanning space of trails in Keccak-f Keccak-f
x y z column
◮ (5 × 5)-bit slices ◮ 2ℓ-bit lanes ◮ parameter 0 ≤ ℓ < 7
◮ θ: mixing layer ◮ ρ: inter-slice bit transposition ◮ π: intra-slice bit transposition ◮ χ: non-linear layer ◮ ι: round constants
◮ 12 rounds in Keccak-f [25] ◮ 24 rounds in Keccak-f [1600]
New techniques for trail bounds and application to differential trails in Keccak 13 / 31
Scanning space of trails in Keccak-f Keccak-f
column parity θ effect combine
◮ The θ map adds a pattern, that depends on the parity, to the state. ◮ Affected columns are complemented ◮ Unaffected columns are not changed
New techniques for trail bounds and application to differential trails in Keccak 14 / 31
Scanning space of trails in Keccak-f Keccak-f
column parity θ effect combine
◮ θ acts as the identity if parity is zero ◮ A state with parity zero is in the kernel (or in |K|) ◮ A state with parity non-zero is outside the kernel (or in |N|)
New techniques for trail bounds and application to differential trails in Keccak 15 / 31
Scanning space of trails in Keccak-f Trails in Keccak-f
◮ ai fully determines bi = λ(ai) ◮ χ has degree 2: w(bi−1) independent of ai ◮ Minimum reverse weight:
b0 w(b0)
New techniques for trail bounds and application to differential trails in Keccak 16 / 31
Scanning space of trails in Keccak-f Trails in Keccak-f
◮ ai fully determines bi = λ(ai) ◮ χ has degree 2: w(bi−1) independent of ai ◮ Minimum reverse weight:
b0 w(b0)
New techniques for trail bounds and application to differential trails in Keccak 16 / 31
Scanning space of trails in Keccak-f Trails in Keccak-f
◮ ai fully determines bi = λ(ai) ◮ χ has degree 2: w(bi−1) independent of ai ◮ Minimum reverse weight:
b0 w(b0)
New techniques for trail bounds and application to differential trails in Keccak 16 / 31
Scanning space of trails in Keccak-f Generating 3-round trail cores
◮ Space split based on parity of ai ◮ Four classes: |K|K|, |K|N|, |N|K| and |N|N|
New techniques for trail bounds and application to differential trails in Keccak 17 / 31
Scanning space of trails in Keccak-f Generating 3-round trail cores
◮ Generating (a1, b1) ◮ Extending forward by one round
New techniques for trail bounds and application to differential trails in Keccak 17 / 31
Scanning space of trails in Keccak-f Generating 3-round trail cores
◮ Generating (a1, b1) ◮ Extending forward by one round
New techniques for trail bounds and application to differential trails in Keccak 17 / 31
Scanning space of trails in Keccak-f Generating 3-round trail cores
◮ Generating (a2, b2) ◮ Extending backward by one round
New techniques for trail bounds and application to differential trails in Keccak 17 / 31
Scanning space of trails in Keccak-f Generating 3-round trail cores
◮ Generating (a2, b2) ◮ Extending backward by one round
New techniques for trail bounds and application to differential trails in Keccak 17 / 31
Scanning space of trails in Keccak-f Generating trail cores in |K| as tree traversal
◮ To stay in |K| units are orbitals = pairs of active bits in the same
◮ A state a is a set of orbitals a = {ui}i=1,...,n ◮ In the tree: the children of a node a are a ∪ {un+1}
New techniques for trail bounds and application to differential trails in Keccak 18 / 31
Scanning space of trails in Keccak-f Generating trail cores in |K| as tree traversal
◮ A total order relation over units allows avoiding duplicates ◮ With a total order ≺ over units, a state is an ordered list of units:
◮ In the tree: the children of a node a are
◮ For orbitals: the lexicographic order [z, x, y1, y2]
New techniques for trail bounds and application to differential trails in Keccak 19 / 31
Scanning space of trails in Keccak-f Generating trail cores in |K| as tree traversal
◮ The weight is monotonic in the addition of orbitals ◮ The weight of a lower bounds the weight of all descendants of a ◮ As soon as the search encounters a with weight above the limit, a
New techniques for trail bounds and application to differential trails in Keccak 20 / 31
Scanning space of trails in Keccak-f Generating trail cores in |N| as tree traversal
◮ 0 active bits in unaffected even columns ◮ 1 active bit in unaffected odd column ◮ 5 active bits in affected column either before or after θ
New techniques for trail bounds and application to differential trails in Keccak 21 / 31
Scanning space of trails in Keccak-f Generating trail cores in |N| as tree traversal
New techniques for trail bounds and application to differential trails in Keccak 22 / 31
Scanning space of trails in Keccak-f Generating trail cores in |N| as tree traversal
New techniques for trail bounds and application to differential trails in Keccak 22 / 31
Scanning space of trails in Keccak-f Generating trail cores in |N| as tree traversal
◮ Root: a parity-bare state ◮ Units: orbitals in unaffected columns ◮ Order: the lexicographic order on [z, x, y1, y2] ◮ Bound: weight of the trail itself
New techniques for trail bounds and application to differential trails in Keccak 23 / 31
Scanning space of trails in Keccak-f Generating trail cores in |N| as tree traversal
◮ Root: the empty state ◮ Units: column assignments ◮ Bound: by estimating maximum weight lost due to addition of new
New techniques for trail bounds and application to differential trails in Keccak 24 / 31
Scanning space of trails in Keccak-f Extending trails
◮ forward: iterate a4 over all differences χ-compatible with b3 ◮ backward: iterate b−1 over all differences χ−1-compatible with a0 ◮ in the kernel: restrict to differences with parity zero ◮ outside the kernel: restrict to differences with parity non-zero
New techniques for trail bounds and application to differential trails in Keccak 25 / 31
Scanning space of trails in Keccak-f Extending trails
◮ Set of compatible states is an affine space A(br) = e + V ◮ Basis transformation: V = VK + VN ◮ Extension in |K| by scanning eK + VK ◮ possible ⇔ eK exists ◮ Extension in |N| by scanning e + VK + VN ◮ Scanning as a tree traversal ◮ root: is the offset ◮ children: by incrementally adding basis vectors ◮ bound: by estimating the maximum weight lost due to
New techniques for trail bounds and application to differential trails in Keccak 26 / 31
Experimental results
New techniques for trail bounds and application to differential trails in Keccak 27 / 31
Experimental results
◮ All 3-round trail cores with weight ≤ 45
20 22 24 26 28 30 32 34 36 38 40 42 44 1 10 102 103 104 T3 # cores Keccak-f [200] Keccak-f [400] Keccak-f [800] Keccak-f [1600]
◮ No 6-round trail with weight ≤ 91
New techniques for trail bounds and application to differential trails in Keccak 28 / 31
Conclusions
New techniques for trail bounds and application to differential trails in Keccak 29 / 31
Conclusions
◮ General formalism to generate differential patterns as simple and
◮ New bounds for Keccak-f and new trails with the lowest known
New techniques for trail bounds and application to differential trails in Keccak 30 / 31
Conclusions
New techniques for trail bounds and application to differential trails in Keccak 31 / 31