Permutation-based symmetric cryptography and Keccak Joan Daemen 1 - PowerPoint PPT Presentation

. .. . .. . . .. . . .. . . .. . . . .. . .. . . .. . . .. . Permutation-based symmetric cryptography and Keccak Permutation-based symmetric cryptography and Keccak Joan Daemen 1 joint work with . .. . . . . .. . . .. . . .. . . .. . . .. . . .. . . .. . . .. . . .. . . .. Ecrypt II, Crypto for 2020, Tenerife, January 22 to 24, 2013 Guido Bertoni 1 , Michaël Peeters 2 and Gilles Van Assche 1 1 STMicroelectronics 2 NXP Semiconductors

. . . . .. . . .. . . .. . . .. . . .. .. . . 3 6 Keccak 5 Requirements for the permutation 4 On the efficiency of permutation-based cryptography Permutation-based cryptography .. 2 Mainstream symmetric cryptography 1 Outline Mainstream symmetric cryptography Permutation-based symmetric cryptography and Keccak . . .. .. .. .. . . .. . . . . . .. . . .. . . . .. . . . .. . . .. . .. . . . .. . . .. . Conclusions

. .. .. . . .. . . . . . .. . . .. . . .. .. Block ciphers Keyed: MAC functions Non-keyed Hash functions Self-synchronizing Synchronous Stream ciphers Symmetric cryptographic primitives: . Symmetric crypto: what textbooks and intro’s say Mainstream symmetric cryptography Permutation-based symmetric cryptography and Keccak . .. . . . .. . . . .. . . .. . . .. . . .. . . .. . . .. .. . . .. . . . .. . .. . . .. . . And their modes-of-use

. . . . .. . . .. . . .. . . .. . .. . . . .. . . .. . . .. . Permutation-based symmetric cryptography and Keccak Mainstream symmetric cryptography The hash function cliché .. . .. . . . .. . . .. . . .. . . .. . .. .. . . .. . . .. . . .. . . .. . . Hash functions:

. . . . .. . . .. . . .. . . .. . .. . . . .. . . .. . . .. . Permutation-based symmetric cryptography and Keccak Mainstream symmetric cryptography The hash function cliché Hash functions: .. . .. . . . .. . . .. . . .. . . .. . .. .. . . .. . . .. . . .. . . .. . . But MD5, SHA-1, etc.: just block ciphers in some mode

. .. . . .. . . .. . . .. . . .. . . . . You can do everything with a block cipher Hashing and its modes HMAC, MGF1, … MAC computation: CBC-MAC, C-MAC, … self-synchronizing: CFB synchronous: counter mode, OFB, … Stream encryption: Block encryption: ECB, CBC, … Mainstream symmetric cryptography . Permutation-based symmetric cryptography and Keccak . .. . . .. .. . .. . . . .. . . .. . . .. . . .. . . .. . .. . . . .. . . .. . .. .. . . .. . . Authenticated encryption: OCB, GCM, CCM …

. . . . .. . . .. . . .. . . .. . .. . . . .. . . .. . . .. . Permutation-based symmetric cryptography and Keccak Mainstream symmetric cryptography Seems like this is closer to the truth nowadays .. . .. . . . .. . . .. . . .. . . .. . .. .. . . .. . . .. . . .. . . .. . . Block cipher:

. . .. . . .. . . .. . . .. . . .. . . .. . . .. . . .. . . .. . Permutation-based symmetric cryptography and Keccak Mainstream symmetric cryptography . .. .. . . . .. . . .. . . .. . . .. . .. . . . .. . . .. . . .. . . .. . Block cipher operation

. . .. . . .. . . .. . . .. . . .. . . .. . . .. . . .. . . .. . Permutation-based symmetric cryptography and Keccak Mainstream symmetric cryptography . .. .. . . . .. . . .. . . .. . . .. . .. . . . .. . . .. . . .. . . .. . Block cipher operation: the inverse

. .. .. . . .. . . . . . .. . . .. . . .. .. Block encryption: ECB, CBC, … Most schemes with misuse-resistant claims Authenticated encryption: OCB, GCM, CCM … MAC computation: CBC-MAC, C-MAC, … self-synchronizing: CFB synchronous: counter mode, OFB, … Stream encryption: Hashing and its modes HMAC, MGF1, … . Indicated in red: When do you need the inverse? Mainstream symmetric cryptography Permutation-based symmetric cryptography and Keccak . .. . . . .. . . . .. . . .. . . .. . . .. . . .. . . .. .. . . .. . . . .. . .. . . .. . . So for most uses you don’t need the inverse!

. . .. . . .. . . .. . . .. . . .. . . .. . . .. . . .. . . .. . Permutation-based symmetric cryptography and Keccak Mainstream symmetric cryptography . .. .. . . . .. . . .. . . .. . . .. . .. . . . .. . . .. . . .. . . .. . Internals of a typical block cipher

. . .. . . .. . . .. . . .. . . .. . . .. . . .. . . .. . . .. . Permutation-based symmetric cryptography and Keccak Mainstream symmetric cryptography . .. .. . . . .. . . .. . . .. . . .. . .. . . . .. . . .. . . .. . . .. . Hashing use case: Davies-Meyer compression function

. . .. . . .. . . .. . . .. . . .. . . .. . . .. . . .. . . .. . Permutation-based symmetric cryptography and Keccak Mainstream symmetric cryptography . .. .. . . . .. . . .. . . .. . . .. . .. . . . .. . . .. . . .. . . .. . Removing unnecessary diffusion restriction

. . .. . . .. . . .. . . .. . . .. . . .. . . .. . . .. . . .. . Permutation-based symmetric cryptography and Keccak Mainstream symmetric cryptography . .. .. . . . .. . . .. . . .. . . .. . .. . . . .. . . .. . . .. . . .. . Simplifying the view: iterated permutation

. .. .. . . .. . . . . . .. . . .. . . .. .. Hashing and its modes HMAC, MGF1, … Authenticated encryption: OCB, GCM, CCM … MAC computation: CBC-MAC, C-MAC, … self-synchronizing: CFB synchronous: counter mode, OFB, … Stream encryption: Block encryption: ECB, CBC, … In all modes but those in red: . Where can you plug in a permutation? Mainstream symmetric cryptography Permutation-based symmetric cryptography and Keccak . .. . . . .. . . . .. . . .. . . .. . . .. . . .. . . .. .. . . .. . . . .. . .. . . .. . . But also nice opportunity to clean up the modes!

. . . . .. . . .. . . .. . . .. . . .. .. . . 3 6 Keccak 5 Requirements for the permutation 4 On the efficiency of permutation-based cryptography Permutation-based cryptography .. 2 Mainstream symmetric cryptography 1 Outline Permutation-based cryptography Permutation-based symmetric cryptography and Keccak . . .. .. .. .. . . .. . . . . . .. . . .. . . . .. . . . .. . . .. . .. . . . .. . . .. . Conclusions

. . . . .. . . .. . . .. . . .. . .. .. . . .. . . .. . . .. . Permutation-based symmetric cryptography and Keccak Permutation-based cryptography The sponge construction efficiency: processes r bits per call to f .. . . .. . . .. . . .. . . .. . . .. . . .. . . . .. . . .. . . .. . . .. . Flexibility in trading rate r for capacity c or vice versa f : a b -bit permutation with b = r + c security: provably resists generic attacks up to 2 c / 2

. . . . .. . . .. . . .. . . .. . . .. .. . . Security for a specific choice of f Hermetic Sponge Strategy tight claim: no attacks better than generic attacks Security claim: target for attacks assurance by absence of attacks despite public scrutiny design f with attacks in mind security proof is infeasible limitation: inner collisions in c -bit inner part .. tight: as sound as theoretically possible assuming f has been chosen randomly Proof of security against generic attacks: What can we say about sponge security Permutation-based cryptography Permutation-based symmetric cryptography and Keccak . . .. .. .. .. . . .. . . . . . .. . . .. . . . .. . . . .. . . .. . .. . . . .. . . .. . weaker claims relax conditions on f

. . .. . . .. . . .. . . .. . . .. . .. . . . .. . . .. . Permutation-based symmetric cryptography and Keccak Permutation-based cryptography Regular hashing Pre-sponge permutation-based hash functions Truncated permutation as compression function: Snefru [Merkle ’90] , FFT-Hash [Schnorr ’90] , …MD6 [Rivest et al. 2007] Streaming-mode: Subterranean , Panama , RadioGatún , . .. .. .. . . .. . . .. . . .. . . .. . . . . . . .. . . .. . . .. . . .. . . .. , Thomsen, 2007] , … Grindahl [Knudsen, Rechberger

. . . . .. . . .. . . .. . . .. . .. . . . .. . . .. . . .. . Permutation-based symmetric cryptography and Keccak Permutation-based cryptography Message authentication codes Pre-sponge (partially) permutation-based MAC function: .. . .. . . . .. . . .. . . .. . . .. . .. .. . . .. . . .. . . .. . . .. . . Pelican-MAC [Daemen, Rijmen 2005]

. . .. . . .. . . .. . . .. . . .. . .. . . . .. . . .. . Permutation-based symmetric cryptography and Keccak Permutation-based cryptography Stream encryption Similar to block cipher modes: Long keystream per IV: like OFB Short keystream per IV: like counter mode Independent permutation-based stream ciphers: Salsa and . .. .. .. . . .. . . .. . . .. . . .. . . . . . . .. . . .. . .. . . . .. . . .. ChaCha [Bernstein 2007]