On the Provable Security of the Iterated Even-Mansour Cipher against - - PowerPoint PPT Presentation

▶
on the provable security of the iterated even mansour
SMART_READER_LITE
LIVE PREVIEW

On the Provable Security of the Iterated Even-Mansour Cipher against - - PowerPoint PPT Presentation

Sep 11, 2023 271 likes •1.23k views

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion On the Provable Security of the Iterated Even-Mansour Cipher against Related-Key and Chosen-Key Attacks Benot Cogliati 1 and Yannick Seurin 2 1 Versailles University, France 2

slide-1
SLIDE 1

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

On the Provable Security of the Iterated Even-Mansour Cipher against Related-Key and Chosen-Key Attacks

Benoît Cogliati1 and Yannick Seurin2

1Versailles University, France 2ANSSI, France

April 29, 2015 — EUROCRYPT 2015

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 1 / 29

slide-2
SLIDE 2

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Outline

Introduction: Key-Alternating Ciphers in the Random Permutation Model Security Against Related-Key Attacks Security Against Chosen-Key Attacks

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 2 / 29

slide-3
SLIDE 3

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Outline

Introduction: Key-Alternating Ciphers in the Random Permutation Model Security Against Related-Key Attacks Security Against Chosen-Key Attacks

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 3 / 29

slide-4
SLIDE 4

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Key-Alternating Cipher (KAC): Definition

x n P1 P2 Pr y k0 k1 kr k f0 f1 fr

An r-round key-alternating cipher:

  • plaintext x ∈ {0, 1}n, ciphertext y ∈ {0, 1}n
  • master key k ∈ {0, 1}κ
  • the Pi’s are public permutations on {0, 1}n
  • the fi’s are key derivation functions mapping k to n-bit “round keys”
  • examples: most SPNs (AES, SERPENT, PRESENT, LED, . . . )
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 4 / 29

slide-5
SLIDE 5

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Key-Alternating Cipher (KAC): Definition

x n P1 P2 Pr y k0 k1 kr k f0 f1 fr

An r-round key-alternating cipher:

  • plaintext x ∈ {0, 1}n, ciphertext y ∈ {0, 1}n
  • master key k ∈ {0, 1}κ
  • the Pi’s are public permutations on {0, 1}n
  • the fi’s are key derivation functions mapping k to n-bit “round keys”
  • examples: most SPNs (AES, SERPENT, PRESENT, LED, . . . )
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 4 / 29

slide-6
SLIDE 6

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Various Key-Schedule Types

x n P1 P2 Pr y k0 k1 kr

Round keys can be:

  • independent (total key-length κ = (r + 1)n)
  • derived from an n-bit master key (κ = n), e.g.
  • trivial key-schedule: (k, k, . . . , k)
  • more complex: (f0(k), f1(k), . . . , fr(k))
  • anything else (e.g. 2n-bit master key (k0, k1) and round keys

(k0, k1, k0, k1, . . .) as in LED-128)

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 5 / 29

slide-7
SLIDE 7

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Various Key-Schedule Types

x n P1 P2 Pr y k0 k1 kr

Round keys can be:

  • independent (total key-length κ = (r + 1)n)
  • derived from an n-bit master key (κ = n), e.g.
  • trivial key-schedule: (k, k, . . . , k)
  • more complex: (f0(k), f1(k), . . . , fr(k))
  • anything else (e.g. 2n-bit master key (k0, k1) and round keys

(k0, k1, k0, k1, . . .) as in LED-128)

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 5 / 29

slide-8
SLIDE 8

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Various Key-Schedule Types

x n P1 P2 Pr y k0 k1 kr

Round keys can be:

  • independent (total key-length κ = (r + 1)n)
  • derived from an n-bit master key (κ = n), e.g.
  • trivial key-schedule: (k, k, . . . , k)
  • more complex: (f0(k), f1(k), . . . , fr(k))
  • anything else (e.g. 2n-bit master key (k0, k1) and round keys

(k0, k1, k0, k1, . . .) as in LED-128)

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 5 / 29

slide-9
SLIDE 9

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Various Key-Schedule Types

x n P1 P2 Pr y k k k

Round keys can be:

  • independent (total key-length κ = (r + 1)n)
  • derived from an n-bit master key (κ = n), e.g.
  • trivial key-schedule: (k, k, . . . , k)
  • more complex: (f0(k), f1(k), . . . , fr(k))
  • anything else (e.g. 2n-bit master key (k0, k1) and round keys

(k0, k1, k0, k1, . . .) as in LED-128)

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 5 / 29

slide-10
SLIDE 10

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Various Key-Schedule Types

x n P1 P2 Pr y k0 k1 kr k n f0 f1 fr

Round keys can be:

  • independent (total key-length κ = (r + 1)n)
  • derived from an n-bit master key (κ = n), e.g.
  • trivial key-schedule: (k, k, . . . , k)
  • more complex: (f0(k), f1(k), . . . , fr(k))
  • anything else (e.g. 2n-bit master key (k0, k1) and round keys

(k0, k1, k0, k1, . . .) as in LED-128)

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 5 / 29

slide-11
SLIDE 11

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Various Key-Schedule Types

x n P1 P2 Pr y k0 k1 kr k n f0 f1 fr

Round keys can be:

  • independent (total key-length κ = (r + 1)n)
  • derived from an n-bit master key (κ = n), e.g.
  • trivial key-schedule: (k, k, . . . , k)
  • more complex: (f0(k), f1(k), . . . , fr(k))
  • anything else (e.g. 2n-bit master key (k0, k1) and round keys

(k0, k1, k0, k1, . . .) as in LED-128)

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 5 / 29

slide-12
SLIDE 12

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Proving the Security of KACs

x k n n P1 f0 P2 f1 Pr y fr

Question

How can we “prove” security?

  • against a general adversary:

⇒ too hard (unconditional complexity lower bound!)

  • against specific attacks (differential, linear. . . ):

⇒ use specific design of P1, . . . , Pr (count active S-boxes, etc.)

  • against generic attacks:

⇒ Random Permutation Model for P1, . . . , Pr

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 6 / 29

slide-13
SLIDE 13

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Proving the Security of KACs

x k n n P1 f0 P2 f1 Pr y fr

Question

How can we “prove” security?

  • against a general adversary:

⇒ too hard (unconditional complexity lower bound!)

  • against specific attacks (differential, linear. . . ):

⇒ use specific design of P1, . . . , Pr (count active S-boxes, etc.)

  • against generic attacks:

⇒ Random Permutation Model for P1, . . . , Pr

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 6 / 29

slide-14
SLIDE 14

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Proving the Security of KACs

x k n n P1 f0 P2 f1 Pr y fr

Question

How can we “prove” security?

  • against a general adversary:

⇒ too hard (unconditional complexity lower bound!)

  • against specific attacks (differential, linear. . . ):

⇒ use specific design of P1, . . . , Pr (count active S-boxes, etc.)

  • against generic attacks:

⇒ Random Permutation Model for P1, . . . , Pr

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 6 / 29

slide-15
SLIDE 15

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Proving the Security of KACs

x k n n P1 f0 P2 f1 Pr y fr

Question

How can we “prove” security?

  • against a general adversary:

⇒ too hard (unconditional complexity lower bound!)

  • against specific attacks (differential, linear. . . ):

⇒ use specific design of P1, . . . , Pr (count active S-boxes, etc.)

  • against generic attacks:

⇒ Random Permutation Model for P1, . . . , Pr

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 6 / 29

slide-16
SLIDE 16

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Analyzing KACs in the Random Permutation Model

qc

x k P1 f0 P2 f1 Pr y fr

P1 · · · Pr qp qp

  • the Pi’s are modeled as public random permutation oracles to which

the adversary can only make black-box queries (both to Pi and P−1

i

)

  • adversary cannot exploit any weakness of the Pi’s ⇒ generic attacks
  • trades complexity for randomness (≃ Random Oracle Model)
  • complexity measure of the adversary:
  • qc = # queries to the cipher = plaintext/ciphertext pairs (data D)
  • qp = # queries to each internal permutation oracle (time T)
  • but otherwise computationally unbounded
  • ⇒ information-theoretic proof of security
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 7 / 29

slide-17
SLIDE 17

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Analyzing KACs in the Random Permutation Model

qc

x k P1 f0 P2 f1 Pr y fr

P1 · · · Pr qp qp

  • the Pi’s are modeled as public random permutation oracles to which

the adversary can only make black-box queries (both to Pi and P−1

i

)

  • adversary cannot exploit any weakness of the Pi’s ⇒ generic attacks
  • trades complexity for randomness (≃ Random Oracle Model)
  • complexity measure of the adversary:
  • qc = # queries to the cipher = plaintext/ciphertext pairs (data D)
  • qp = # queries to each internal permutation oracle (time T)
  • but otherwise computationally unbounded
  • ⇒ information-theoretic proof of security
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 7 / 29

slide-18
SLIDE 18

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Analyzing KACs in the Random Permutation Model

qc

x k P1 f0 P2 f1 Pr y fr

P1 · · · Pr qp qp

  • the Pi’s are modeled as public random permutation oracles to which

the adversary can only make black-box queries (both to Pi and P−1

i

)

  • adversary cannot exploit any weakness of the Pi’s ⇒ generic attacks
  • trades complexity for randomness (≃ Random Oracle Model)
  • complexity measure of the adversary:
  • qc = # queries to the cipher = plaintext/ciphertext pairs (data D)
  • qp = # queries to each internal permutation oracle (time T)
  • but otherwise computationally unbounded
  • ⇒ information-theoretic proof of security
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 7 / 29

slide-19
SLIDE 19

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Analyzing KACs in the Random Permutation Model

qc

x k P1 f0 P2 f1 Pr y fr

P1 · · · Pr qp qp

  • the Pi’s are modeled as public random permutation oracles to which

the adversary can only make black-box queries (both to Pi and P−1

i

)

  • adversary cannot exploit any weakness of the Pi’s ⇒ generic attacks
  • trades complexity for randomness (≃ Random Oracle Model)
  • complexity measure of the adversary:
  • qc = # queries to the cipher = plaintext/ciphertext pairs (data D)
  • qp = # queries to each internal permutation oracle (time T)
  • but otherwise computationally unbounded
  • ⇒ information-theoretic proof of security
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 7 / 29

slide-20
SLIDE 20

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Analyzing KACs in the Random Permutation Model

qc

x k P1 f0 P2 f1 Pr y fr

P1 · · · Pr qp qp

  • the Pi’s are modeled as public random permutation oracles to which

the adversary can only make black-box queries (both to Pi and P−1

i

)

  • adversary cannot exploit any weakness of the Pi’s ⇒ generic attacks
  • trades complexity for randomness (≃ Random Oracle Model)
  • complexity measure of the adversary:
  • qc = # queries to the cipher = plaintext/ciphertext pairs (data D)
  • qp = # queries to each internal permutation oracle (time T)
  • but otherwise computationally unbounded
  • ⇒ information-theoretic proof of security
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 7 / 29

slide-21
SLIDE 21

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Analyzing KACs in the Random Permutation Model

Even and Mansour seminal work:

  • this model was first proposed by Even and Mansour at

ASIACRYPT ’91 for r = 1 round

  • they showed that the simple cipher k1 ⊕ P(k0 ⊕ x) is a secure PRP

up to ∼ 2

n 2 queries of the adversary to P and to the cipher

  • similar result when k0 = k1 [KR01, DKS12]

x P k0 y k1

  • EMP
  • improved bound as r increases: PRP up to ∼ 2

rn r+1 queries [CS14]

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 8 / 29

slide-22
SLIDE 22

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Analyzing KACs in the Random Permutation Model

Even and Mansour seminal work:

  • this model was first proposed by Even and Mansour at

ASIACRYPT ’91 for r = 1 round

  • they showed that the simple cipher k1 ⊕ P(k0 ⊕ x) is a secure PRP

up to ∼ 2

n 2 queries of the adversary to P and to the cipher

  • similar result when k0 = k1 [KR01, DKS12]

x P k0 y k1

  • EMP
  • improved bound as r increases: PRP up to ∼ 2

rn r+1 queries [CS14]

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 8 / 29

slide-23
SLIDE 23

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Analyzing KACs in the Random Permutation Model

Even and Mansour seminal work:

  • this model was first proposed by Even and Mansour at

ASIACRYPT ’91 for r = 1 round

  • they showed that the simple cipher k1 ⊕ P(k0 ⊕ x) is a secure PRP

up to ∼ 2

n 2 queries of the adversary to P and to the cipher

  • similar result when k0 = k1 [KR01, DKS12]

x P k y k

  • EMP
  • improved bound as r increases: PRP up to ∼ 2

rn r+1 queries [CS14]

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 8 / 29

slide-24
SLIDE 24

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Analyzing KACs in the Random Permutation Model

Even and Mansour seminal work:

  • this model was first proposed by Even and Mansour at

ASIACRYPT ’91 for r = 1 round

  • they showed that the simple cipher k1 ⊕ P(k0 ⊕ x) is a secure PRP

up to ∼ 2

n 2 queries of the adversary to P and to the cipher

  • similar result when k0 = k1 [KR01, DKS12]

x P k y k

  • EMP
  • improved bound as r increases: PRP up to ∼ 2

rn r+1 queries [CS14]

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 8 / 29

slide-25
SLIDE 25

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Outline

Introduction: Key-Alternating Ciphers in the Random Permutation Model Security Against Related-Key Attacks Security Against Chosen-Key Attacks

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 9 / 29

slide-26
SLIDE 26

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Related-Key Attacks

The Related-Key Attack Model [BK03]:

  • stronger adversarial model: the adversary can specify Related-Key

Deriving (RKD) functions φ and receive Eφ(k)(x) and/or E −1

φ(k)(y)

  • the block cipher should behave as an ideal cipher (an independent

random permutation for each key)

  • impossibility results for too “large” sets of RKDs
  • positive results for limited sets of RKDs or using number-theoretic

constructions

  • we will consider XOR-RKAs: the set of RKD functions is

{φ∆ : k → k ⊕ ∆, ∆ ∈ {0, 1}κ}

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 10 / 29

slide-27
SLIDE 27

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Related-Key Attacks

The Related-Key Attack Model [BK03]:

  • stronger adversarial model: the adversary can specify Related-Key

Deriving (RKD) functions φ and receive Eφ(k)(x) and/or E −1

φ(k)(y)

  • the block cipher should behave as an ideal cipher (an independent

random permutation for each key)

  • impossibility results for too “large” sets of RKDs
  • positive results for limited sets of RKDs or using number-theoretic

constructions

  • we will consider XOR-RKAs: the set of RKD functions is

{φ∆ : k → k ⊕ ∆, ∆ ∈ {0, 1}κ}

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 10 / 29

slide-28
SLIDE 28

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Related-Key Attacks

The Related-Key Attack Model [BK03]:

  • stronger adversarial model: the adversary can specify Related-Key

Deriving (RKD) functions φ and receive Eφ(k)(x) and/or E −1

φ(k)(y)

  • the block cipher should behave as an ideal cipher (an independent

random permutation for each key)

  • impossibility results for too “large” sets of RKDs
  • positive results for limited sets of RKDs or using number-theoretic

constructions

  • we will consider XOR-RKAs: the set of RKD functions is

{φ∆ : k → k ⊕ ∆, ∆ ∈ {0, 1}κ}

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 10 / 29

slide-29
SLIDE 29

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Related-Key Attacks

The Related-Key Attack Model [BK03]:

  • stronger adversarial model: the adversary can specify Related-Key

Deriving (RKD) functions φ and receive Eφ(k)(x) and/or E −1

φ(k)(y)

  • the block cipher should behave as an ideal cipher (an independent

random permutation for each key)

  • impossibility results for too “large” sets of RKDs
  • positive results for limited sets of RKDs or using number-theoretic

constructions

  • we will consider XOR-RKAs: the set of RKD functions is

{φ∆ : k → k ⊕ ∆, ∆ ∈ {0, 1}κ}

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 10 / 29

slide-30
SLIDE 30

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Related-Key Attacks

The Related-Key Attack Model [BK03]:

  • stronger adversarial model: the adversary can specify Related-Key

Deriving (RKD) functions φ and receive Eφ(k)(x) and/or E −1

φ(k)(y)

  • the block cipher should behave as an ideal cipher (an independent

random permutation for each key)

  • impossibility results for too “large” sets of RKDs
  • positive results for limited sets of RKDs or using number-theoretic

constructions

  • we will consider XOR-RKAs: the set of RKD functions is

{φ∆ : k → k ⊕ ∆, ∆ ∈ {0, 1}κ}

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 10 / 29

slide-31
SLIDE 31

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

XOR-RKAs against the IEM Cipher: Formalization

Real world 0/1 (∆, x) EMk⊕∆(x)

x k P1 f0 P2 f1 Pr y fr

P1, . . . , Pr qp Ideal world 0/1 IC (∆, x) ICk⊕∆(x) P1, . . . , Pr qp

  • real world: IEM cipher with a random key k ←$ {0, 1}κ
  • ideal world: ideal cipher IC independent from P1, . . . , Pr
  • Rand. Perm. Model: D has oracle access to P1, . . . , Pr in both worlds
  • qc queries to the IEM/IC and qp queries to each inner perm.
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 11 / 29

slide-32
SLIDE 32

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

XOR-RKAs against the IEM Cipher: Formalization

Real world 0/1 (∆, x) EMk⊕∆(x)

x k P1 f0 P2 f1 Pr y fr

P1, . . . , Pr qp Ideal world 0/1 IC (∆, x) ICk⊕∆(x) P1, . . . , Pr qp

  • real world: IEM cipher with a random key k ←$ {0, 1}κ
  • ideal world: ideal cipher IC independent from P1, . . . , Pr
  • Rand. Perm. Model: D has oracle access to P1, . . . , Pr in both worlds
  • qc queries to the IEM/IC and qp queries to each inner perm.
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 11 / 29

slide-33
SLIDE 33

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

XOR-RKAs against the IEM Cipher: Formalization

Real world 0/1 (∆, x) EMk⊕∆(x)

x k P1 f0 P2 f1 Pr y fr

P1, . . . , Pr qp Ideal world 0/1 IC (∆, x) ICk⊕∆(x) P1, . . . , Pr qp

  • real world: IEM cipher with a random key k ←$ {0, 1}κ
  • ideal world: ideal cipher IC independent from P1, . . . , Pr
  • Rand. Perm. Model: D has oracle access to P1, . . . , Pr in both worlds
  • qc queries to the IEM/IC and qp queries to each inner perm.
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 11 / 29

slide-34
SLIDE 34

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

First Observation: Independent Round Keys Fails

P1 x x ′ k0 ⊕ ∆0 k0 ⊕ ∆′ P2 Pr y k1 kr

RK Distinguisher for independent round keys:

  • query ((∆0, 0, . . . , 0), x) and ((∆′

0, 0, . . . , 0), x′) such that

x ⊕ ∆0 = x′ ⊕ ∆′

  • check that the outputs are equal
  • holds with proba. 1 for the IEM cipher
  • holds with proba. 2−n for an ideal cipher
  • ⇒ we will consider “dependent” round keys (in part. (k, k, . . . , k))
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 12 / 29

slide-35
SLIDE 35

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

First Observation: Independent Round Keys Fails

P1 x x ′ k0 ⊕ ∆0 k0 ⊕ ∆′ P2 Pr y k1 kr

RK Distinguisher for independent round keys:

  • query ((∆0, 0, . . . , 0), x) and ((∆′

0, 0, . . . , 0), x′) such that

x ⊕ ∆0 = x′ ⊕ ∆′

  • check that the outputs are equal
  • holds with proba. 1 for the IEM cipher
  • holds with proba. 2−n for an ideal cipher
  • ⇒ we will consider “dependent” round keys (in part. (k, k, . . . , k))
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 12 / 29

slide-36
SLIDE 36

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

First Observation: Independent Round Keys Fails

P1 x x ′ k0 ⊕ ∆0 k0 ⊕ ∆′ P2 Pr y k1 kr

RK Distinguisher for independent round keys:

  • query ((∆0, 0, . . . , 0), x) and ((∆′

0, 0, . . . , 0), x′) such that

x ⊕ ∆0 = x′ ⊕ ∆′

  • check that the outputs are equal
  • holds with proba. 1 for the IEM cipher
  • holds with proba. 2−n for an ideal cipher
  • ⇒ we will consider “dependent” round keys (in part. (k, k, . . . , k))
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 12 / 29

slide-37
SLIDE 37

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

First Observation: Independent Round Keys Fails

P1 x x ′ k0 ⊕ ∆0 k0 ⊕ ∆′ P2 Pr y k1 kr

RK Distinguisher for independent round keys:

  • query ((∆0, 0, . . . , 0), x) and ((∆′

0, 0, . . . , 0), x′) such that

x ⊕ ∆0 = x′ ⊕ ∆′

  • check that the outputs are equal
  • holds with proba. 1 for the IEM cipher
  • holds with proba. 2−n for an ideal cipher
  • ⇒ we will consider “dependent” round keys (in part. (k, k, . . . , k))
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 12 / 29

slide-38
SLIDE 38

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

First Observation: Independent Round Keys Fails

P1 x x ′ k0 ⊕ ∆0 k0 ⊕ ∆′ P2 Pr y k1 kr

RK Distinguisher for independent round keys:

  • query ((∆0, 0, . . . , 0), x) and ((∆′

0, 0, . . . , 0), x′) such that

x ⊕ ∆0 = x′ ⊕ ∆′

  • check that the outputs are equal
  • holds with proba. 1 for the IEM cipher
  • holds with proba. 2−n for an ideal cipher
  • ⇒ we will consider “dependent” round keys (in part. (k, k, . . . , k))
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 12 / 29

slide-39
SLIDE 39

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

An Attack for Two Rounds, Trivial Key-Schedule

P1 P2

  • 4 queries to the RK oracle, 0 queries to P1, P2
  • (∗) holds with proba. 1 for the 2-round IEM cipher
  • (∗) holds with proba. 2−n for an ideal cipher
  • works for any linear key-schedule
  • has been extended to a key-recovery attack (using a modular addition

RKA instead of a XOR-RKA)[Kar15]

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 13 / 29

slide-40
SLIDE 40

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

An Attack for Two Rounds, Trivial Key-Schedule

P1 P2 (∆1, x1) y1 u1 v1 u2 v2 k ⊕ ∆1

  • 4 queries to the RK oracle, 0 queries to P1, P2
  • (∗) holds with proba. 1 for the 2-round IEM cipher
  • (∗) holds with proba. 2−n for an ideal cipher
  • works for any linear key-schedule
  • has been extended to a key-recovery attack (using a modular addition

RKA instead of a XOR-RKA)[Kar15]

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 13 / 29

slide-41
SLIDE 41

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

An Attack for Two Rounds, Trivial Key-Schedule

P1 P2 (∆1, x1) y1 u1 v1 u2 v2 k ⊕ ∆1 (∆2, x2) y2 u′

2

v ′

2

k ⊕ ∆2

  • 4 queries to the RK oracle, 0 queries to P1, P2
  • (∗) holds with proba. 1 for the 2-round IEM cipher
  • (∗) holds with proba. 2−n for an ideal cipher
  • works for any linear key-schedule
  • has been extended to a key-recovery attack (using a modular addition

RKA instead of a XOR-RKA)[Kar15]

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 13 / 29

slide-42
SLIDE 42

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

An Attack for Two Rounds, Trivial Key-Schedule

P1 P2 (∆1, x1) y1 u1 v1 u2 v2 k ⊕ ∆1 (∆2, x2) y2 u′

2

v ′

2

k ⊕ ∆2 x3 (∆3, y3) u′

1

v ′

1

k ⊕ ∆3

  • 4 queries to the RK oracle, 0 queries to P1, P2
  • (∗) holds with proba. 1 for the 2-round IEM cipher
  • (∗) holds with proba. 2−n for an ideal cipher
  • works for any linear key-schedule
  • has been extended to a key-recovery attack (using a modular addition

RKA instead of a XOR-RKA)[Kar15]

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 13 / 29

slide-43
SLIDE 43

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

An Attack for Two Rounds, Trivial Key-Schedule

P1 P2 (∆1, x1) y1 u1 v1 u2 v2 k ⊕ ∆1 (∆2, x2) y2 u′

2

v ′

2

k ⊕ ∆2 x3 (∆3, y3) u′

1

v ′

1

k ⊕ ∆3 (∆4, y4) k ⊕ ∆4 ∆1 ⊕ ∆2 ⊕ ∆3 ⊕ ∆4 = 0

  • 4 queries to the RK oracle, 0 queries to P1, P2
  • (∗) holds with proba. 1 for the 2-round IEM cipher
  • (∗) holds with proba. 2−n for an ideal cipher
  • works for any linear key-schedule
  • has been extended to a key-recovery attack (using a modular addition

RKA instead of a XOR-RKA)[Kar15]

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 13 / 29

slide-44
SLIDE 44

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

An Attack for Two Rounds, Trivial Key-Schedule

P1 P2 (∆1, x1) y1 u1 v1 u2 v2 k ⊕ ∆1 (∆2, x2) y2 u′

2

v ′

2

k ⊕ ∆2 x3 (∆3, y3) u′

1

v ′

1

k ⊕ ∆3 (∆4, y4) k ⊕ ∆4 ∆1 ⊕ ∆2 ⊕ ∆3 ⊕ ∆4 = 0 x4 Check that x3 ⊕ x4 = ∆3 ⊕ ∆4 (∗)

  • 4 queries to the RK oracle, 0 queries to P1, P2
  • (∗) holds with proba. 1 for the 2-round IEM cipher
  • (∗) holds with proba. 2−n for an ideal cipher
  • works for any linear key-schedule
  • has been extended to a key-recovery attack (using a modular addition

RKA instead of a XOR-RKA)[Kar15]

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 13 / 29

slide-45
SLIDE 45

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

An Attack for Two Rounds, Trivial Key-Schedule

P1 P2 (∆1, x1) y1 u1 v1 u2 v2 k ⊕ ∆1 (∆2, x2) y2 u′

2

v ′

2

k ⊕ ∆2 x3 (∆3, y3) u′

1

v ′

1

k ⊕ ∆3 (∆4, y4) k ⊕ ∆4 ∆1 ⊕ ∆2 ⊕ ∆3 ⊕ ∆4 = 0 x4 Check that x3 ⊕ x4 = ∆3 ⊕ ∆4 (∗)

  • 4 queries to the RK oracle, 0 queries to P1, P2
  • (∗) holds with proba. 1 for the 2-round IEM cipher
  • (∗) holds with proba. 2−n for an ideal cipher
  • works for any linear key-schedule
  • has been extended to a key-recovery attack (using a modular addition

RKA instead of a XOR-RKA)[Kar15]

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 13 / 29

slide-46
SLIDE 46

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

An Attack for Two Rounds, Trivial Key-Schedule

P1 P2 (∆1, x1) y1 u1 v1 u2 v2 k ⊕ ∆1 (∆2, x2) y2 u′

2

v ′

2

k ⊕ ∆2 x3 (∆3, y3) u′

1

v ′

1

k ⊕ ∆3 (∆4, y4) k ⊕ ∆4 ∆1 ⊕ ∆2 ⊕ ∆3 ⊕ ∆4 = 0 x4 Check that x3 ⊕ x4 = ∆3 ⊕ ∆4 (∗)

  • 4 queries to the RK oracle, 0 queries to P1, P2
  • (∗) holds with proba. 1 for the 2-round IEM cipher
  • (∗) holds with proba. 2−n for an ideal cipher
  • works for any linear key-schedule
  • has been extended to a key-recovery attack (using a modular addition

RKA instead of a XOR-RKA)[Kar15]

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 13 / 29

slide-47
SLIDE 47

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

An Attack for Two Rounds, Trivial Key-Schedule

P1 P2 (∆1, x1) y1 u1 v1 u2 v2 k ⊕ ∆1 (∆2, x2) y2 u′

2

v ′

2

k ⊕ ∆2 x3 (∆3, y3) u′

1

v ′

1

k ⊕ ∆3 (∆4, y4) k ⊕ ∆4 ∆1 ⊕ ∆2 ⊕ ∆3 ⊕ ∆4 = 0 x4 Check that x3 ⊕ x4 = ∆3 ⊕ ∆4 (∗)

  • 4 queries to the RK oracle, 0 queries to P1, P2
  • (∗) holds with proba. 1 for the 2-round IEM cipher
  • (∗) holds with proba. 2−n for an ideal cipher
  • works for any linear key-schedule
  • has been extended to a key-recovery attack (using a modular addition

RKA instead of a XOR-RKA)[Kar15]

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 13 / 29

slide-48
SLIDE 48

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

An Attack for Two Rounds, Trivial Key-Schedule

P1 P2 (∆1, x1) y1 u1 v1 u2 v2 k ⊕ ∆1 (∆2, x2) y2 u′

2

v ′

2

k ⊕ ∆2 x3 (∆3, y3) u′

1

v ′

1

k ⊕ ∆3 (∆4, y4) k ⊕ ∆4 ∆1 ⊕ ∆2 ⊕ ∆3 ⊕ ∆4 = 0 x4 Check that x3 ⊕ x4 = ∆3 ⊕ ∆4 (∗)

  • 4 queries to the RK oracle, 0 queries to P1, P2
  • (∗) holds with proba. 1 for the 2-round IEM cipher
  • (∗) holds with proba. 2−n for an ideal cipher
  • works for any linear key-schedule
  • has been extended to a key-recovery attack (using a modular addition

RKA instead of a XOR-RKA)[Kar15]

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 13 / 29

slide-49
SLIDE 49

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

An Attack for Two Rounds, Trivial Key-Schedule

P1 P2 (∆1, x1) y1 u1 v1 u2 v2 k ⊕ ∆1 (∆2, x2) y2 u′

2

v ′

2

k ⊕ ∆2 x3 (∆3, y3) u′

1

v ′

1

k ⊕ ∆3 (∆4, y4) k ⊕ ∆4 ∆1 ⊕ ∆2 ⊕ ∆3 ⊕ ∆4 = 0 x4 Check that x3 ⊕ x4 = ∆3 ⊕ ∆4 (∗)

  • 4 queries to the RK oracle, 0 queries to P1, P2
  • (∗) holds with proba. 1 for the 2-round IEM cipher
  • (∗) holds with proba. 2−n for an ideal cipher
  • works for any linear key-schedule
  • has been extended to a key-recovery attack (using a modular addition

RKA instead of a XOR-RKA)[Kar15]

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 13 / 29

slide-50
SLIDE 50

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Security for Three Rounds, Trivial Key-Schedule

x P1 k P2 k P3 k y k

Theorem (Cogliati-Seurin [CS15])

For the 3-round IEM cipher with the trivial key-schedule: Advxor-rka

EM[n,3](qc, qp) ≤ 6qcqp

2n + 4q2

c

2n .

Proof sketch:

  • D can create forward collisions at P1 or backward collisions at P3
  • but proba. to create a collision at P2 is q2

c/2n

  • no collision at P2

⇒ ∼ single-key security of 1-round EM qcqp/2n

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 14 / 29

slide-51
SLIDE 51

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Security for Three Rounds, Trivial Key-Schedule

x P1 k P2 k P3 k y k

Theorem (Cogliati-Seurin [CS15])

For the 3-round IEM cipher with the trivial key-schedule: Advxor-rka

EM[n,3](qc, qp) ≤ 6qcqp

2n + 4q2

c

2n .

Proof sketch:

  • D can create forward collisions at P1 or backward collisions at P3
  • but proba. to create a collision at P2 is q2

c/2n

  • no collision at P2

⇒ ∼ single-key security of 1-round EM qcqp/2n

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 14 / 29

slide-52
SLIDE 52

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Security for Three Rounds, Trivial Key-Schedule

x P1 k P2 k P3 k y k

Theorem (Cogliati-Seurin [CS15])

For the 3-round IEM cipher with the trivial key-schedule: Advxor-rka

EM[n,3](qc, qp) ≤ 6qcqp

2n + 4q2

c

2n .

Proof sketch:

  • D can create forward collisions at P1 or backward collisions at P3
  • but proba. to create a collision at P2 is q2

c/2n

  • no collision at P2

⇒ ∼ single-key security of 1-round EM qcqp/2n

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 14 / 29

slide-53
SLIDE 53

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Security for Three Rounds, Trivial Key-Schedule

x P1 k P2 k P3 k y k

Theorem (Cogliati-Seurin [CS15])

For the 3-round IEM cipher with the trivial key-schedule: Advxor-rka

EM[n,3](qc, qp) ≤ 6qcqp

2n + 4q2

c

2n .

Proof sketch:

  • D can create forward collisions at P1 or backward collisions at P3
  • but proba. to create a collision at P2 is q2

c/2n

  • no collision at P2

⇒ ∼ single-key security of 1-round EM qcqp/2n

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 14 / 29

slide-54
SLIDE 54

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Security for One Round and a Nonlinear Key-Schedule

x k n n P1 f y f

Theorem (Cogliati-Seurin [CS15])

For the 1-round EM cipher with key-schedule f = (f0, f1): Advxor-rka

EM[n,1,f ](qc, qp) ≤ 2qcqp

2n + δ(f )q2

c

2n , where δ(f ) = maxa,b∈{0,1}n,a=0 |{x ∈ {0, 1}n : f (x ⊕ a) ⊕ f (x) = b}|. (δ(f ) = 2 for an APN permutation.)

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 15 / 29

slide-55
SLIDE 55

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Some Observations

Application to tweakable block ciphers:

  • from any XOR-RKA secure block cipher E, one can construct a

tweakable block cipher [LRW02, BK03]

x P1 k ⊕ t P2 k ⊕ t P3 k ⊕ t y k ⊕ t

  • Similar in spirit to the TWEAKEY framework from Jean et al

[JNP14].

Independent work by Farshim and Procter at FSE 2015 [FP15]:

  • similar result for 3 rounds (slightly worse bound, game-based proof)
  • 2 rounds: XOR-RKA security against chosen-plaintext attacks
  • 1 round: RKA-security for more limited sets of RKDs
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 16 / 29

slide-56
SLIDE 56

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Some Observations

Application to tweakable block ciphers:

  • from any XOR-RKA secure block cipher E, one can construct a

tweakable block cipher [LRW02, BK03]

x P1 k ⊕ t P2 k ⊕ t P3 k ⊕ t y k ⊕ t

  • Similar in spirit to the TWEAKEY framework from Jean et al

[JNP14].

Independent work by Farshim and Procter at FSE 2015 [FP15]:

  • similar result for 3 rounds (slightly worse bound, game-based proof)
  • 2 rounds: XOR-RKA security against chosen-plaintext attacks
  • 1 round: RKA-security for more limited sets of RKDs
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 16 / 29

slide-57
SLIDE 57

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Some Observations

Application to tweakable block ciphers:

  • from any XOR-RKA secure block cipher E, one can construct a

tweakable block cipher [LRW02, BK03]

x P1 k ⊕ t P2 k ⊕ t P3 k ⊕ t y k ⊕ t

  • Similar in spirit to the TWEAKEY framework from Jean et al

[JNP14].

Independent work by Farshim and Procter at FSE 2015 [FP15]:

  • similar result for 3 rounds (slightly worse bound, game-based proof)
  • 2 rounds: XOR-RKA security against chosen-plaintext attacks
  • 1 round: RKA-security for more limited sets of RKDs
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 16 / 29

slide-58
SLIDE 58

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Some Observations

Application to tweakable block ciphers:

  • from any XOR-RKA secure block cipher E, one can construct a

tweakable block cipher [LRW02, BK03]

x P1 k ⊕ t P2 k ⊕ t P3 k ⊕ t y k ⊕ t

  • Similar in spirit to the TWEAKEY framework from Jean et al

[JNP14].

Independent work by Farshim and Procter at FSE 2015 [FP15]:

  • similar result for 3 rounds (slightly worse bound, game-based proof)
  • 2 rounds: XOR-RKA security against chosen-plaintext attacks
  • 1 round: RKA-security for more limited sets of RKDs
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 16 / 29

slide-59
SLIDE 59

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Outline

Introduction: Key-Alternating Ciphers in the Random Permutation Model Security Against Related-Key Attacks Security Against Chosen-Key Attacks

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 17 / 29

slide-60
SLIDE 60

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Formalizing Chosen-Key Attacks

  • informal goal: find tuples of key/pt/ct (ki, xi, yi) with a property which

is hard to satisfy for an ideal cipher

  • no formal definition for a single, completely instantiated block cipher E
  • simply because, e.g., E0(0) has a specific, non-random value. . .
  • OK this does not count
  • but what counts as a chosen-key attack exactly?
  • rigorous definition possible for a family of block ciphers based on some

underlying ideal primitive

  • e.g., IEM cipher based on a tuple of random permutations!
  • our definitions are adapted from [CGH98]
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 18 / 29

slide-61
SLIDE 61

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Formalizing Chosen-Key Attacks

  • informal goal: find tuples of key/pt/ct (ki, xi, yi) with a property which

is hard to satisfy for an ideal cipher

  • no formal definition for a single, completely instantiated block cipher E
  • simply because, e.g., E0(0) has a specific, non-random value. . .
  • OK this does not count
  • but what counts as a chosen-key attack exactly?
  • rigorous definition possible for a family of block ciphers based on some

underlying ideal primitive

  • e.g., IEM cipher based on a tuple of random permutations!
  • our definitions are adapted from [CGH98]
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 18 / 29

slide-62
SLIDE 62

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Formalizing Chosen-Key Attacks

  • informal goal: find tuples of key/pt/ct (ki, xi, yi) with a property which

is hard to satisfy for an ideal cipher

  • no formal definition for a single, completely instantiated block cipher E
  • simply because, e.g., E0(0) has a specific, non-random value. . .
  • OK this does not count
  • but what counts as a chosen-key attack exactly?
  • rigorous definition possible for a family of block ciphers based on some

underlying ideal primitive

  • e.g., IEM cipher based on a tuple of random permutations!
  • our definitions are adapted from [CGH98]
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 18 / 29

slide-63
SLIDE 63

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Formalizing Chosen-Key Attacks

  • informal goal: find tuples of key/pt/ct (ki, xi, yi) with a property which

is hard to satisfy for an ideal cipher

  • no formal definition for a single, completely instantiated block cipher E
  • simply because, e.g., E0(0) has a specific, non-random value. . .
  • OK this does not count
  • but what counts as a chosen-key attack exactly?
  • rigorous definition possible for a family of block ciphers based on some

underlying ideal primitive

  • e.g., IEM cipher based on a tuple of random permutations!
  • our definitions are adapted from [CGH98]
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 18 / 29

slide-64
SLIDE 64

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Formalizing Chosen-Key Attacks

  • informal goal: find tuples of key/pt/ct (ki, xi, yi) with a property which

is hard to satisfy for an ideal cipher

  • no formal definition for a single, completely instantiated block cipher E
  • simply because, e.g., E0(0) has a specific, non-random value. . .
  • OK this does not count
  • but what counts as a chosen-key attack exactly?
  • rigorous definition possible for a family of block ciphers based on some

underlying ideal primitive

  • e.g., IEM cipher based on a tuple of random permutations!
  • our definitions are adapted from [CGH98]
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 18 / 29

slide-65
SLIDE 65

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Formalizing Chosen-Key Attacks

  • informal goal: find tuples of key/pt/ct (ki, xi, yi) with a property which

is hard to satisfy for an ideal cipher

  • no formal definition for a single, completely instantiated block cipher E
  • simply because, e.g., E0(0) has a specific, non-random value. . .
  • OK this does not count
  • but what counts as a chosen-key attack exactly?
  • rigorous definition possible for a family of block ciphers based on some

underlying ideal primitive

  • e.g., IEM cipher based on a tuple of random permutations!
  • our definitions are adapted from [CGH98]
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 18 / 29

slide-66
SLIDE 66

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Formalizing Chosen-Key Attacks

  • informal goal: find tuples of key/pt/ct (ki, xi, yi) with a property which

is hard to satisfy for an ideal cipher

  • no formal definition for a single, completely instantiated block cipher E
  • simply because, e.g., E0(0) has a specific, non-random value. . .
  • OK this does not count
  • but what counts as a chosen-key attack exactly?
  • rigorous definition possible for a family of block ciphers based on some

underlying ideal primitive

  • e.g., IEM cipher based on a tuple of random permutations!
  • our definitions are adapted from [CGH98]
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 18 / 29

slide-67
SLIDE 67

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Formalizing Chosen-Key Attacks

  • informal goal: find tuples of key/pt/ct (ki, xi, yi) with a property which

is hard to satisfy for an ideal cipher

  • no formal definition for a single, completely instantiated block cipher E
  • simply because, e.g., E0(0) has a specific, non-random value. . .
  • OK this does not count
  • but what counts as a chosen-key attack exactly?
  • rigorous definition possible for a family of block ciphers based on some

underlying ideal primitive

  • e.g., IEM cipher based on a tuple of random permutations!
  • our definitions are adapted from [CGH98]
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 18 / 29

slide-68
SLIDE 68

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Formalizing Chosen-Key Attacks

Definition (Evasive relation)

An m-ary relation R is (q, ε)-evasive (w.r.t. an ideal cipher E) if any adversary A making at most q queries to E finds triples (k1, x1, y1), . . . , (km, xm, ym) (with Eki(xi) = yi) satisfying R with probability at most ε.

Example

  • consider E in Davies-Meyer mode f (k, x) := Ek(x) ⊕ x
  • finding a preimage of 0 for f is a unary

q, O( q

2n )

  • evasive relation

for E [BRS02]

  • finding a collision for f is a binary
  • q, O(q2

2n )

  • evasive relation for

E [BRS02]

  • for BC-based hashing, most hash function security notions can be

recast as evasive relations for the underlying BC

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 19 / 29

slide-69
SLIDE 69

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Formalizing Chosen-Key Attacks

Definition (Evasive relation)

An m-ary relation R is (q, ε)-evasive (w.r.t. an ideal cipher E) if any adversary A making at most q queries to E finds triples (k1, x1, y1), . . . , (km, xm, ym) (with Eki(xi) = yi) satisfying R with probability at most ε.

Example

  • consider E in Davies-Meyer mode f (k, x) := Ek(x) ⊕ x
  • finding a preimage of 0 for f is a unary

q, O( q

2n )

  • evasive relation

for E [BRS02]

  • finding a collision for f is a binary
  • q, O(q2

2n )

  • evasive relation for

E [BRS02]

  • for BC-based hashing, most hash function security notions can be

recast as evasive relations for the underlying BC

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 19 / 29

slide-70
SLIDE 70

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Formalizing Chosen-Key Attacks

Definition (Evasive relation)

An m-ary relation R is (q, ε)-evasive (w.r.t. an ideal cipher E) if any adversary A making at most q queries to E finds triples (k1, x1, y1), . . . , (km, xm, ym) (with Eki(xi) = yi) satisfying R with probability at most ε.

Example

  • consider E in Davies-Meyer mode f (k, x) := Ek(x) ⊕ x
  • finding a preimage of 0 for f is a unary

q, O( q

2n )

  • evasive relation

for E [BRS02]

  • finding a collision for f is a binary
  • q, O(q2

2n )

  • evasive relation for

E [BRS02]

  • for BC-based hashing, most hash function security notions can be

recast as evasive relations for the underlying BC

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 19 / 29

slide-71
SLIDE 71

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Formalizing Chosen-Key Attacks

Definition (Evasive relation)

An m-ary relation R is (q, ε)-evasive (w.r.t. an ideal cipher E) if any adversary A making at most q queries to E finds triples (k1, x1, y1), . . . , (km, xm, ym) (with Eki(xi) = yi) satisfying R with probability at most ε.

Example

  • consider E in Davies-Meyer mode f (k, x) := Ek(x) ⊕ x
  • finding a preimage of 0 for f is a unary

q, O( q

2n )

  • evasive relation

for E [BRS02]

  • finding a collision for f is a binary
  • q, O(q2

2n )

  • evasive relation for

E [BRS02]

  • for BC-based hashing, most hash function security notions can be

recast as evasive relations for the underlying BC

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 19 / 29

slide-72
SLIDE 72

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Formalizing Chosen-Key Attacks

Definition (Evasive relation)

An m-ary relation R is (q, ε)-evasive (w.r.t. an ideal cipher E) if any adversary A making at most q queries to E finds triples (k1, x1, y1), . . . , (km, xm, ym) (with Eki(xi) = yi) satisfying R with probability at most ε.

Example

  • consider E in Davies-Meyer mode f (k, x) := Ek(x) ⊕ x
  • finding a preimage of 0 for f is a unary

q, O( q

2n )

  • evasive relation

for E [BRS02]

  • finding a collision for f is a binary
  • q, O(q2

2n )

  • evasive relation for

E [BRS02]

  • for BC-based hashing, most hash function security notions can be

recast as evasive relations for the underlying BC

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 19 / 29

slide-73
SLIDE 73

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Formalizing Chosen-Key Attacks

Definition (Correlation Intractability)

A block cipher construction CF based on some underlying primitive F is said to be (q, ε)-correlation intractable w.r.t. an m-ary relation R if any adversary A making at most q queries to F finds triples (k1, x1, y1), . . . , (km, xm, ym) (with CF

ki(xi) = yi) satisfying R with probability at most ε.

Definition (Resistance to Chosen-Key Attacks)

Informally, a block cipher construction CF is said resistant to chosen-key attacks if for any (q, ε)-evasive relation R, CF is (q′, ε′)-correlation intractable w.r.t. R with q′ ≃ q and ε′ ≃ ε.

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 20 / 29

slide-74
SLIDE 74

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Formalizing Chosen-Key Attacks

Definition (Correlation Intractability)

A block cipher construction CF based on some underlying primitive F is said to be (q, ε)-correlation intractable w.r.t. an m-ary relation R if any adversary A making at most q queries to F finds triples (k1, x1, y1), . . . , (km, xm, ym) (with CF

ki(xi) = yi) satisfying R with probability at most ε.

Definition (Resistance to Chosen-Key Attacks)

Informally, a block cipher construction CF is said resistant to chosen-key attacks if for any (q, ε)-evasive relation R, CF is (q′, ε′)-correlation intractable w.r.t. R with q′ ≃ q and ε′ ≃ ε.

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 20 / 29

slide-75
SLIDE 75

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Formalizing Chosen-Key Attacks

Definition (Correlation Intractability)

A block cipher construction CF based on some underlying primitive F is said to be (q, ε)-correlation intractable w.r.t. an m-ary relation R if any adversary A making at most q queries to F finds triples (k1, x1, y1), . . . , (km, xm, ym) (with CF

ki(xi) = yi) satisfying R with probability at most ε.

Definition (Resistance to Chosen-Key Attacks)

Informally, a block cipher construction CF is said resistant to chosen-key attacks if for any (q, ε)-evasive relation R, CF is (q′, ε′)-correlation intractable w.r.t. R with q′ ≃ q and ε′ ≃ ε. For any relation R, finding triplets (k

i

, x

i

, y

i

) satisfying R should be “almost as hard” for the construction C

F

as for an ideal cipher.

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 20 / 29

slide-76
SLIDE 76

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Formalizing Chosen-Key Attacks

How do we prove prove resistance to chosen-key attacks?

  • we use a weaker variant of indifferentiability called sequential

indifferentiability

  • 12 rounds provide full indifferentiability [LS13] which implies

sequential indifferentiability

  • is it possible to reduce the number of rounds to get resistance to

chosen-key attacks?

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 21 / 29

slide-77
SLIDE 77

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Formalizing Chosen-Key Attacks

How do we prove prove resistance to chosen-key attacks?

  • we use a weaker variant of indifferentiability called sequential

indifferentiability

  • 12 rounds provide full indifferentiability [LS13] which implies

sequential indifferentiability

  • is it possible to reduce the number of rounds to get resistance to

chosen-key attacks?

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 21 / 29

slide-78
SLIDE 78

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Formalizing Chosen-Key Attacks

How do we prove prove resistance to chosen-key attacks?

  • we use a weaker variant of indifferentiability called sequential

indifferentiability

  • 12 rounds provide full indifferentiability [LS13] which implies

sequential indifferentiability

  • is it possible to reduce the number of rounds to get resistance to

chosen-key attacks?

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 21 / 29

slide-79
SLIDE 79

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Formalizing Chosen-Key Attacks

How do we prove prove resistance to chosen-key attacks?

  • we use a weaker variant of indifferentiability called sequential

indifferentiability

  • 12 rounds provide full indifferentiability [LS13] which implies

sequential indifferentiability

  • is it possible to reduce the number of rounds to get resistance to

chosen-key attacks?

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 21 / 29

slide-80
SLIDE 80

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Formalizing Chosen-Key Attacks

3 rounds are not enough [LS13]

P1 P2 P3 u1 v1 x1 u2 v2 u3 v3 y1 k1 x2 u′

2

v ′

2

u′

3

v ′

3

y2 k2 k3 k4 y3 y4 u′

1

v ′

1

x3 x4

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 22 / 29

slide-81
SLIDE 81

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Formalizing Chosen-Key Attacks

3 rounds are not enough [LS13]

P1 P2 P3 u1 v1 x1 u2 v2 u3 v3 y1 k1 x2 u′

2

v ′

2

u′

3

v ′

3

y2 k2 k3 k4 y3 y4 u′

1

v ′

1

x3 x4

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 22 / 29

slide-82
SLIDE 82

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Formalizing Chosen-Key Attacks

3 rounds are not enough [LS13]

P1 P2 P3 u1 v1 x1 u2 v2 u3 v3 y1 k1 x2 u′

2

v ′

2

u′

3

v ′

3

y2 k2 k3 k4 y3 y4 u′

1

v ′

1

x3 x4

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 22 / 29

slide-83
SLIDE 83

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

CKA Resistance for the 4-Round IEM Cipher

Theorem

Let R be a (q2, εic)-evasive relation w.r.t. an ideal cipher. Then the 4-round IEM with the trivial key-schedule is

  • q, εic + O(q4

2n )

  • correlation

intractable w.r.t. R.

Example

Consider f = 4-round IEM cipher in Davies-Meyer mode. Then

  • f is
  • q, O(q4

2n )

  • preimage resistant
  • f is
  • q, O(q4

2n )

  • collision resistant

(in the Random Permutation Model)

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 23 / 29

slide-84
SLIDE 84

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

CKA Resistance for the 4-Round IEM Cipher

Theorem

Let R be a (q2, εic)-evasive relation w.r.t. an ideal cipher. Then the 4-round IEM with the trivial key-schedule is

  • q, εic + O(q4

2n )

  • correlation

intractable w.r.t. R.

Example

Consider f = 4-round IEM cipher in Davies-Meyer mode. Then

  • f is
  • q, O(q4

2n )

  • preimage resistant
  • f is
  • q, O(q4

2n )

  • collision resistant

(in the Random Permutation Model)

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 23 / 29

slide-85
SLIDE 85

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Conclusion

x n P1 P2 Pr y k k k

1 round: PRP 3 rounds: XOR-Related-Key-Attacks PRP 4 rounds: Chosen-Key-Attacks Resistance 12 rounds: Full indifferentiability from an ideal cipher

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 24 / 29

slide-86
SLIDE 86

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Conclusion

x n P1 P2 Pr y k k k

1 round: PRP 3 rounds: XOR-Related-Key-Attacks PRP 4 rounds: Chosen-Key-Attacks Resistance 12 rounds: Full indifferentiability from an ideal cipher

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 24 / 29

slide-87
SLIDE 87

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Conclusion

Morality:

  • idealized models can be fruitful
  • practical meaning of the results is debatable:
  • the high-level structure of SPNs is sound (and may even yield

something close to an ideal cipher)

  • says little about concrete block ciphers (inner permutations of, say,

AES are too simple)

Open problems:

  • RKA security beyond the birthday bound (4 rounds → 2

2n 3 -security?)

  • a matching xor-rka in O(2

n 2 ) queries against 3 rounds

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 25 / 29

slide-88
SLIDE 88

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Conclusion

Morality:

  • idealized models can be fruitful
  • practical meaning of the results is debatable:
  • the high-level structure of SPNs is sound (and may even yield

something close to an ideal cipher)

  • says little about concrete block ciphers (inner permutations of, say,

AES are too simple)

Open problems:

  • RKA security beyond the birthday bound (4 rounds → 2

2n 3 -security?)

  • a matching xor-rka in O(2

n 2 ) queries against 3 rounds

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 25 / 29

slide-89
SLIDE 89

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Conclusion

Morality:

  • idealized models can be fruitful
  • practical meaning of the results is debatable:
  • the high-level structure of SPNs is sound (and may even yield

something close to an ideal cipher)

  • says little about concrete block ciphers (inner permutations of, say,

AES are too simple)

Open problems:

  • RKA security beyond the birthday bound (4 rounds → 2

2n 3 -security?)

  • a matching xor-rka in O(2

n 2 ) queries against 3 rounds

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 25 / 29

slide-90
SLIDE 90

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

Conclusion

Morality:

  • idealized models can be fruitful
  • practical meaning of the results is debatable:
  • the high-level structure of SPNs is sound (and may even yield

something close to an ideal cipher)

  • says little about concrete block ciphers (inner permutations of, say,

AES are too simple)

Open problems:

  • RKA security beyond the birthday bound (4 rounds → 2

2n 3 -security?)

  • a matching xor-rka in O(2

n 2 ) queries against 3 rounds

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 25 / 29

slide-91
SLIDE 91

Introduction Related-Key Attacks Chosen-Key Attacks Conclusion

The End. . .

Thanks for your attention! Comments or questions?

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 26 / 29

slide-92
SLIDE 92

References

References I

Mihir Bellare and Tadayoshi Kohno. A Theoretical Treatment of Related-Key Attacks: RKA-PRPs, RKA-PRFs, and Applications. In Eli Biham, editor, Advances in Cryptology - EUROCRYPT 2003, volume 2656 of LNCS, pages 491–506. Springer, 2003. John Black, Phillip Rogaway, and Thomas Shrimpton. Black-Box Analysis of the Block-Cipher-Based Hash-Function Constructions from PGV. In Moti Yung, editor, Advances in Cryptology - CRYPTO 2002, volume 2442 of LNCS, pages 320–335. Springer, 2002. Ran Canetti, Oded Goldreich, and Shai Halevi. The Random Oracle Methodology, Revisited (Preliminary Version). In Symposium on Theory of Computing - STOC ’98, pages 209–218. ACM, 1998. Full version available at http://arxiv.org/abs/cs.CR/0010019. Shan Chen and John Steinberger. Tight Security Bounds for Key-Alternating

  • Ciphers. In Phong Q. Nguyen and Elisabeth Oswald, editors, Advances in

Cryptology - EUROCRYPT 2014, volume 8441 of LNCS, pages 327–350. Springer, 2014. Full version available at http://eprint.iacr.org/2013/222.

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 27 / 29

slide-93
SLIDE 93

References

References II

Benoît Cogliati and Yannick Seurin. On the Provable Security of the Iterated Even-Mansour Cipher against Related-Key and Chosen-Key Attacks. In EUROCRYPT 2015, 2015. To appear. Full version available at http://eprint.iacr.org/2015/069. Orr Dunkelman, Nathan Keller, and Adi Shamir. Minimalism in Cryptography: The Even-Mansour Scheme Revisited. In David Pointcheval and Thomas Johansson, editors, Advances in Cryptology - EUROCRYPT 2012, volume 7237

  • f LNCS, pages 336–354. Springer, 2012.

Pooya Farshim and Gordon Procter. The Related-Key Security of Iterated Even-Mansour Ciphers. In Fast Software Encryption - FSE 2015, 2015. To

  • appear. Full version available at http://eprint.iacr.org/2014/953.

Jérémy Jean, Ivica Nikolic, and Thomas Peyrin. Tweaks and Keys for Block Ciphers: The TWEAKEY Framework. In Palash Sarkar and Tetsu Iwata, editors, Advances in Cryptology - ASIACRYPT 2014 - Proceedings, Part II, volume 8874

  • f LNCS, pages 274–288. Springer, 2014.
  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 28 / 29

slide-94
SLIDE 94

References

References III

Pierre Karpman. From Related-Key Distinguishers to Related-Key-Recovery on Even-Mansour Constructions. ePrint Archive, Report 2015/134, 2015. Available at http://eprint.iacr.org/2015/134.pdf. Joe Kilian and Phillip Rogaway. How to Protect DES Against Exhaustive Key Search (an Analysis of DESX). Journal of Cryptology, 14(1):17–35, 2001. Moses Liskov, Ronald L. Rivest, and David Wagner. Tweakable Block Ciphers. In Moti Yung, editor, Advances in Cryptology - CRYPTO 2002, volume 2442 of LNCS, pages 31–46. Springer, 2002. Rodolphe Lampe and Yannick Seurin. How to Construct an Ideal Cipher from a Small Set of Public Permutations. In Kazue Sako and Palash Sarkar, editors, Advances in Cryptology - ASIACRYPT 2013 (Proceedings, Part I), volume 8269

  • f LNCS, pages 444–463. Springer, 2013. Full version available at

http://eprint.iacr.org/2013/255.

  • B. Cogliati and Y. Seurin

RKA and CKA security for the IEM April 29, 2015 — EC 2015 29 / 29