On The Distribution of Linear Biases: Three Instructive Examples Mohamed Ahmed Abdelraheem 1 , Martin ˚ Agren 2 , Peter Beelen 1 , and Gregor Leander 1 1 Technical University of Denmark 2 Lund University, Sweden 120820 / Santa Barbara
Outline 1 Introduction 2 The Problem 3 The Examples The Cube Cipher PRESENT with identical round-keys PRINTcipher , Invariant Subspaces, and Eigenvectors 4 Conclusion M. ˚ Agren, Lund University, Sweden
Outline 1 Introduction 2 The Problem 3 The Examples The Cube Cipher PRESENT with identical round-keys PRINTcipher , Invariant Subspaces, and Eigenvectors 4 Conclusion M. ˚ Agren, Lund University, Sweden
Setting We are analyzing/constructing/breaking block ciphers. . . Fix the (unknown) key and consider the permutation F : F n 2 → F n 2 . M. ˚ Agren, Lund University, Sweden
Linear Approximation Given F : F n 2 → F n 2 , a linear approximation is an equation like � α , x � = � β , F ( x ) � . (Input mask α , output mask β .) M. ˚ Agren, Lund University, Sweden
Linear Approximation Given F : F n 2 → F n 2 , a linear approximation is an equation like � α , x � = � β , F ( x ) � . (Input mask α , output mask β .) The bias ǫ F ( α , β ): Pr [ � α , x � = � β , F ( x ) � ] = 1 2 + ǫ F ( α , β ) The correlation c F ( α , β ): c F ( α , β ) = 2 ǫ F ( α , β ) M. ˚ Agren, Lund University, Sweden
Linear Approximation of a Composite Function x F 1 F 2 F r F ( x ) θ 0 θ 1 θ r A linear trail θ is a collection of all intermediate masks θ = ( θ 0 = α , . . . , θ r = β ) . M. ˚ Agren, Lund University, Sweden
Linear Approximation of a Composite Function x F 1 F 2 F r F ( x ) θ 0 θ 1 θ r A linear trail θ is a collection of all intermediate masks θ = ( θ 0 = α , . . . , θ r = β ) . The correlation of a trail is � C θ = c F i ( θ i , θ i +1 ) . i Theorem � c F ( α , β ) = C θ . θ : θ 0 = α , θ r = β M. ˚ Agren, Lund University, Sweden
Linear Approximation of a Composite Function k 0 k 1 k r x F 1 F 2 F r F ( x ) θ 0 θ 1 θ r A linear trail θ is a collection of all intermediate masks θ = ( θ 0 = α , . . . , θ r = β ) . The correlation of a trail is C θ = ( − 1) � θ , k � � c F i ( θ i , θ i +1 ) . i Theorem (Linear Hull) � ( − 1) � θ , k � C θ . c F ( α , β ) = θ : θ 0 = α , θ r = β M. ˚ Agren, Lund University, Sweden
Outline 1 Introduction 2 The Problem 3 The Examples The Cube Cipher PRESENT with identical round-keys PRINTcipher , Invariant Subspaces, and Eigenvectors 4 Conclusion M. ˚ Agren, Lund University, Sweden
The Problem We can: bound the correlation of single linear trails. We cannot: bound the correlation of a linear approximation. Because: Many linear trails interact in a key dependent way. Each key gives a different correlation. We need to understand the distribution. M. ˚ Agren, Lund University, Sweden
Some Approaches I: Deal with single trails. M. ˚ Agren, Lund University, Sweden
Some Approaches I: Deal with single trails. II: Model the situation – make assumptions. (Possible assumption: Different trails are independent.) M. ˚ Agren, Lund University, Sweden
Some Approaches I: Deal with single trails. II: Model the situation – make assumptions. (Possible assumption: Different trails are independent.) III: Perform experiments to validate the model/assumptions. M. ˚ Agren, Lund University, Sweden
Some Approaches I: Deal with single trails. II: Model the situation – make assumptions. (Possible assumption: Different trails are independent.) III: Perform experiments to validate the model/assumptions. Todo: Develop a sound framework. Why has it not been done before? ◮ it’s difficult ◮ we didn’t try very hard M. ˚ Agren, Lund University, Sweden
Our Contribution Three interesting examples of what can happen. ◮ Counterexample to earlier “theorem”. ◮ Give an idea what you can/cannot hope to prove. ◮ Serve as inspiration for future work. M. ˚ Agren, Lund University, Sweden
Outline 1 Introduction 2 The Problem 3 The Examples The Cube Cipher PRESENT with identical round-keys PRINTcipher , Invariant Subspaces, and Eigenvectors 4 Conclusion M. ˚ Agren, Lund University, Sweden
Normal Distribution? Consider an n -bit block cipher and assume ◮ independent round keys, ◮ (exponentially in n ) many non-zero trails, ◮ all with the same absolute correlation. If we pick a key, what bias do we get? Theorem (Daemen and Rijmen, ePrint 2005/212) The bias distribution tends to a normal distribution as n → ∞ . M. ˚ Agren, Lund University, Sweden
Normal Distribution? Number of keys Theorem (Linear Hull) � ( − 1) � θ , k � C θ . c F ( α , β ) = θ Bias M. ˚ Agren, Lund University, Sweden
The Cube Cipher k 0 k 1 k 2 F ( x ) x x 3 x 3 ◮ independent round keys, � ◮ (exponentially in n ) many non-zero trails, � ◮ all with the same absolute correlation, � ◮ toy cipher. M. ˚ Agren, Lund University, Sweden
Normal Distribution? Number of keys Bias Cube cipher vs. the normal distribution. Only 5 values — for any n ! M. ˚ Agren, Lund University, Sweden
The Role of Key-Scheduling Common analysis: Assume independent round keys and hope that the key-scheduling does not influence the distribution. Two counter-examples: ◮ PRESENT with identical round-keys ◮ PRINTcipher M. ˚ Agren, Lund University, Sweden
PRESENT k i S S S S S S S S S S S S S S S S k i +1 S S S S S S S S S S S S S S S S ◮ many linear trails with one active Sbox per round ◮ distribution is close to normal M. ˚ Agren, Lund University, Sweden
PRESENT Number of keys Bias Distribution for 17 rounds of PRESENT . M. ˚ Agren, Lund University, Sweden
PRESENT with Identical Round-Keys k ⊕ RC i S S S S S S S S S S S S S S S S k ⊕ RC i +1 S S S S S S S S S S S S S S S S Modification: ◮ identical round-keys ◮ round constants M. ˚ Agren, Lund University, Sweden
PRESENT With Identical Round-Keys Number of keys Bias Identical vs. original round-keys. M. ˚ Agren, Lund University, Sweden
PRESENT -Conclusions ◮ PRESENT -const is not secure. ◮ SPONGENT does not have the PRESENT Sbox. ◮ More rounds help. M. ˚ Agren, Lund University, Sweden
PRINTcipher , Invariant Subspaces, and Eigenvectors ⊕ k ⊕ RC i π 15 π 14 π 13 π 12 π 11 π 10 π 9 π 8 π 7 π 6 π 5 π 4 π 3 π 2 π 1 π 0 S S S S S S S S S S S S S S S S Last year at CRYPTO: invariant subspaces: Let U ⊆ F n 2 be a subspace and d ∈ F n 2 . Assume a weak key. F k ( U + d ) = U + d . M. ˚ Agren, Lund University, Sweden
PRINTcipher , Invariant Subspaces, and Eigenvectors ⊕ k ⊕ RC i π 15 π 14 π 13 π 12 π 11 π 10 π 9 π 8 π 7 π 6 π 5 π 4 π 3 π 2 π 1 π 0 S S S S S S S S S S S S S S S S Last year at CRYPTO: invariant subspaces: Let U ⊆ F n 2 be a subspace and d ∈ F n 2 . Assume a weak key. F k ( U + d ) = U + d . ⇓ F ( U + d ) = U + d . M. ˚ Agren, Lund University, Sweden
Linear Biases in PRINTcipher Number of keys “ PRINTcipher -24:” Bias M. ˚ Agren, Lund University, Sweden
Linear Biases in PRINTcipher Number of keys “ PRINTcipher -24:” Bias M. ˚ Agren, Lund University, Sweden
Linear Biases in PRINTcipher Number of keys “ PRINTcipher -24:” Number of keys Bias Precisely those keys that yield an invariant subspace! Bias 2 − 9 . 0 M. ˚ Agren, Lund University, Sweden
Correlation Matrices; an Eigenvector Correlation matrix C = ( c F ( α, β )) α,β . Theorem Invariant subspace ⇒ A sub-matrix (A) of the correlation matrix has an eigenvector with a special ± -structure and eigenvalue 1 . The matrix has a nonzero limit. We have trail-clustering! M. ˚ Agren, Lund University, Sweden
The Matrix Power Limit The eigenvector is � � const · +1 +1 − 1 − 1 +1 +1 − 1 . . . . M. ˚ Agren, Lund University, Sweden
The Matrix Power Limit The eigenvector is � � const · +1 +1 − 1 − 1 +1 +1 − 1 . . . , so +1 +1 − 1 − 1 +1 +1 − 1 . . . +1 +1 − 1 − 1 +1 +1 − 1 . . . − 1 − 1 +1 +1 − 1 − 1 +1 . . . − 1 − 1 +1 +1 − 1 − 1 +1 . . . A r → const 2 · . +1 +1 − 1 − 1 +1 +1 − 1 . . . +1 +1 − 1 − 1 +1 +1 − 1 . . . − 1 − 1 +1 +1 − 1 − 1 +1 . . . . . . . . . . ... . . . . . . . . . . . . . . M. ˚ Agren, Lund University, Sweden
The Matrix Power Limit The eigenvector is � � const · +1 +1 − 1 − 1 +1 +1 − 1 . . . , so +1 +1 − 1 − 1 +1 +1 − 1 . . . +1 +1 − 1 − 1 +1 +1 − 1 . . . − 1 − 1 +1 +1 − 1 − 1 +1 . . . − 1 − 1 +1 +1 − 1 − 1 +1 . . . 1 A r → 2 16 − 1 · . +1 +1 − 1 − 1 +1 +1 − 1 . . . +1 +1 − 1 − 1 +1 +1 − 1 . . . − 1 − 1 +1 +1 − 1 − 1 +1 . . . . . . . . . . ... . . . . . . . . . . . . . . Indeed, experimentally, c F ( α, β ) ≈ ± 2 − 16 ( PRINTcipher -48). M. ˚ Agren, Lund University, Sweden
Recommend
More recommend
