Practical Seed-Recovery for the PCG Pseudo-Random Number Generator - - PowerPoint PPT Presentation

▶
practical seed recovery for the pcg pseudo random number
SMART_READER_LITE
LIVE PREVIEW

Practical Seed-Recovery for the PCG Pseudo-Random Number Generator - - PowerPoint PPT Presentation

Jul 23, 2023 13 likes •538 views

Practical Seed-Recovery for the PCG Pseudo-Random Number Generator Charles Bouillaguet, Florette Martinez and Julia Sauvage November 2, 2020 Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 1 / 31 Introduction

slide-1
SLIDE 1

Practical Seed-Recovery for the PCG Pseudo-Random Number Generator

Charles Bouillaguet, Florette Martinez and Julia Sauvage November 2, 2020

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 1 / 31

slide-2
SLIDE 2

Introduction

What?

Cryptanalysis of the Permuted Congruential Generator (PCG).

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 2 / 31

slide-3
SLIDE 3

Why?

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 3 / 31

slide-4
SLIDE 4

Why?

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 4 / 31

slide-5
SLIDE 5

Why?

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 5 / 31

slide-6
SLIDE 6

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 6 / 31

slide-7
SLIDE 7

Introduction

What?

Cryptanalysis of the Permuted Congruential Generator (PCG).

Results

Practical seed-recovery / prediction.

How?

"Guess-and-Determine" attack. Most expensive part : many small CVP problems. Actually done in ≤ 20 000 CPU-hours.

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 7 / 31

slide-8
SLIDE 8

Permuted Congruencial Generators (PCG)

Conventional (non-crypto) pseudo-random generators Designed in 2014 by Melissa O’Neil PCG64

Internal state : 128-bit state and 128-bit increment 64-bit outputs 256-bit seed (or 128-bit with default increment) Default pseudo-random generator in NumPy

128

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 8 / 31

slide-9
SLIDE 9

Permuted Congruencial Generators (PCG)

Conventional (non-crypto) pseudo-random generators Designed in 2014 by Melissa O’Neil PCG64

Internal state : 128-bit state and 128-bit increment 64-bit outputs 256-bit seed (or 128-bit with default increment) Default pseudo-random generator in NumPy

×a + c mod 2128 Si 128 Si+1 128

128

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 8 / 31

slide-10
SLIDE 10

Permuted Congruencial Generators (PCG)

Conventional (non-crypto) pseudo-random generators Designed in 2014 by Melissa O’Neil PCG64

Internal state : 128-bit state and 128-bit increment 64-bit outputs 256-bit seed (or 128-bit with default increment) Default pseudo-random generator in NumPy

×a + c mod 2128 Si 128 Si+1 128

128

  • 64

64

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 8 / 31

slide-11
SLIDE 11

Permuted Congruencial Generators (PCG)

Conventional (non-crypto) pseudo-random generators Designed in 2014 by Melissa O’Neil PCG64

Internal state : 128-bit state and 128-bit increment 64-bit outputs 256-bit seed (or 128-bit with default increment) Default pseudo-random generator in NumPy

×a + c mod 2128 Si 128 Si+1 128

122 128

  • 64

64 ≫ ri 6 Xi 64

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 8 / 31

slide-12
SLIDE 12

Attack Outline

Guess some bits in a few successive states.

Least-significant bits Rotations

⇒ Turn it into a (regular) truncated congruential generator. Reconstruct hidden information using lattice techniques. Discard bad guesses.

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 9 / 31

slide-13
SLIDE 13

Attack Outline

Guess some bits in a few successive states.

Least-significant bits Rotations

⇒ Turn it into a (regular) truncated congruential generator. Reconstruct hidden information using lattice techniques.

Easy case (c known): full state Hard case (c unknown): only partial information

Discard bad guesses.

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 9 / 31

slide-14
SLIDE 14

Easy Case: Known increment

If the increment (c) is known...

... Get rid of it!

S′

0 ← S0

S′

1 ← S1 − c

S′

2 ← S2 − (a + 1)c

S′

3 ← S3 − (a2 + a + 1)c

. . . Yields S′ : sequence of states with c = 0 → Geometric sequence.

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 10 / 31

slide-15
SLIDE 15

Attack Details

S0 64 bits 64 bits S1 S2

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 11 / 31

slide-16
SLIDE 16

Attack Details

r0 w S0 ℓ bits 6 r1 S1 r2 S2

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 11 / 31

slide-17
SLIDE 17

Attack Details

r0 w S0 ℓ bits 6 r1 w1 S1 r2 w2 S2 ×a + c mod 2ℓ ×a + c mod 2ℓ

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 11 / 31

slide-18
SLIDE 18

Attack Details

r0 w S0 ℓ bits 6 r1 w1 S1 r2 w2 S2

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 11 / 31

slide-19
SLIDE 19

Attack Details

r0 w S0 ℓ bits 6 ????????????????? r1 w1 S1 ????????????????? r2 w2 S2 ????????????????? ℓ bits 6

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 11 / 31

slide-20
SLIDE 20

Attack Details

????????????????? ????????????????? ????????????????? ℓ bits 6 64 bits

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 11 / 31

slide-21
SLIDE 21

Remove the “Constant Component”

????????????????? T0 − ????????????????? T1 c − ????????????????? T2 (a + 1)c − ×a mod 264 ×a mod 264

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 12 / 31

slide-22
SLIDE 22

Truncated Linear Congruential Generators

Internal state : 2k-bit state. Multiplier a: known constant. Initial state: unknown 2k-bit seed. ×a mod 2k

k

Ti discarded

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 13 / 31

slide-23
SLIDE 23

Reconstructing Truncated Geometric Sequences

Sequence ui+1 = a × ui mod 2k. T = Truncated version (low-order bits unknown). L = lattice spawned by the rows of ui Ti ?????????       1 a a2 . . . an−1 2k . . . 2k . . . . . . . . . . . . . . . . . . . . . 2k      

Main Idea

u = (u0, u1, . . . , un−1) belongs to the lattice L. T (truncated geometric series) is an approximation of u. ⇒ T is close to a point of L. ⇒ Closest point to T in L u.

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 14 / 31

slide-24
SLIDE 24

Lattices and Basis reduction

Lattice : subgroup of Rn isomorphic to Zm

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 15 / 31

slide-25
SLIDE 25

Lattices and Basis reduction

Lattice : subgroup of Rn isomorphic to Zm

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 15 / 31

slide-26
SLIDE 26

CVP problem and Babai rounding

Closest Vector Problem

Standard NP-hard problem on lattices. Given arbitrary x ∈ Zn, find closest lattice point.

Babai Rounding Algorithm

Approximately solves CVP. BabaiRounding(x, L) = H × round

  • H−1 × x
  • Where H is a “good” (LLL-reduced) basis of the lattice L.

FAST (two matrix-vector products + rounding) Exponentially bad approximation (in the lattice dimension). → Often exact in small dimension though.

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 16 / 31

slide-27
SLIDE 27

Lattices and Basis reduction

Lattice : subgroup of Rn isomorphic to Zm

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 17 / 31

slide-28
SLIDE 28

Lattices and Basis reduction

Lattice : subgroup of Rn isomorphic to Zm

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 17 / 31

slide-29
SLIDE 29

Implementation (Easy case, known increment)

Summary

Observe 3 outputs X0, X1, X2 (192 bits). Guess 37 bits:

n = 3 successive rotations (6 bits each), ℓ = 19 least significant bits of S0,

Solve 237 instances of CVP in dimension 3 (Babai Rounding). Reconstruct initial state, check outputs.

Caveat

Attack proved correct for ℓ = 20, works fine for ℓ = 19...

Concretely...

25 CPU cycles per guess, 23 CPU-minutes in total.

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 18 / 31

slide-30
SLIDE 30

Issue with c unknown

Summary so far (the Easy Case)

The increment (c) is known:

Remove it, get truncated geometric sequence, CVP.

Now the Hard Case

The increment (c) is unknown:

How to get truncated geometric sequence? Use ∆Si = Si+1 − Si (∆Si+1 = a × ∆Si mod 2128).

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 19 / 31

slide-31
SLIDE 31

Issue with c unknown

Summary so far (the Easy Case)

The increment (c) is known:

Remove it, get truncated geometric sequence, CVP.

Now the Hard Case

The increment (c) is unknown:

How to get truncated geometric sequence? Use ∆Si = Si+1 − Si (∆Si+1 = a × ∆Si mod 2128).

Same attack as before, but...

Must guess one more rotation. Must guess least-significant bits of c.

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 19 / 31

slide-32
SLIDE 32

Attack Details

S0 S1 S2 S3 S4

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 20 / 31

slide-33
SLIDE 33

Attack Details

r0 w S0 ℓ bits 6 r1 S1 r2 S2 r3 S3 r4 S4

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 20 / 31

slide-34
SLIDE 34

Attack Details

r0 w S0 ℓ bits 6 r1 w1 S1 r2 w2 S2 r3 w3 S3 r4 w4 S4 ×a + c mod 2ℓ ×a + c mod 2ℓ ×a + c mod 2ℓ ×a + c mod 2ℓ

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 20 / 31

slide-35
SLIDE 35

Attack Details

r0 w S0 ℓ bits 6 r1 w1 S1 r2 w2 S2 r3 w3 S3 r4 w4 S4

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 20 / 31

slide-36
SLIDE 36

Attack Details

r0 w S0 ℓ bits 6 ????????????????? r1 w1 S1 ????????????????? r2 w2 S2 ????????????????? r3 w3 S3 ????????????????? r4 w4 S4 ?????????????????

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 20 / 31

slide-37
SLIDE 37

Attack Details

????????????????? ????????????????? ????????????????? ????????????????? ????????????????? ∆S0 ∆S1 ∆S2 ∆S3 ×a mod 264 ×a mod 264 ×a mod 264

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 20 / 31

slide-38
SLIDE 38

Attack Details (cont’d)

Summary so far

Guess parts of the states (Si). Attack state differences (∆Si). CVP in dim. 4 reconstruct partial ∆Si (for all i).

Problem

How to check if guesses are valid?

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 21 / 31

slide-39
SLIDE 39

Consistency Check

Si

64 64 + ℓ

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 22 / 31

slide-40
SLIDE 40

Consistency Check

S0 ∆Si Si

64 64 + ℓ

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 22 / 31

slide-41
SLIDE 41

Consistency Check

S0 ∆Si

⊞

Si

64 64 + ℓ

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 22 / 31

slide-42
SLIDE 42

Consistency Check

S0 ∆Si

⊞

Si

64 64 + ℓ

Xi ≪ ri

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 22 / 31

slide-43
SLIDE 43

Consistency Check

S0 ∆Si

⊞

Si

64 64 + ℓ

  • Xi ≪ ri

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 22 / 31

slide-44
SLIDE 44

Attack Details (cont’d)

Summary so far

Guess parts of the states (Si). Attack state differences (∆Si). CVP in dim. 4 reconstruct partial ∆Si (for all i).

Problem

How to check if guesses are valid?

Solution

Si[64 : 64 + ℓ] from guesses + Xi (output) + ri (rotation). Si[64 : 64 + ℓ] from guesses + partial ∆Si. ⇒ Try all possible ri’s. No match bad guess.

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 23 / 31

slide-45
SLIDE 45

Finishing it Off

Summary so far

Guessed parts of the states (Si). Isolated correct guess correct partial differences ∆Si.

Problem

How to get full initial state S0?

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 24 / 31

slide-46
SLIDE 46

Consistency Check

S0 ∆Si

⊞

Si

64 64 + ℓ

  • Xi ≪ ri

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 25 / 31

slide-47
SLIDE 47

Finishing it Off

Summary so far

Guessed parts of the states (Si). Isolated correct guess correct partial differences ∆Si.

Problem

How to get full initial state S0?

Solution

Correct partial ∆Si + consistency check all rotations ri. ⇒ MSB of all Si MSB of all ∆Si. ⇒ CVP in dim. 64 full ∆S0.

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 26 / 31

slide-48
SLIDE 48

Reconstructing the Full Differences (CVP in dim. 64)

????????????????????????????????????????

∆S0

????????????????????????????????????????

∆S1

????????????????????????????????????????

∆S2

????????????????????????????????????????

∆S3

????????????????????????????????????????

∆S4

????????????????????????????????????????

∆S5

????????????????????????????????????????

∆S6

????????????????????????????????????????

∆S7

????????????????????????????????????????

∆S8

????????????????????????????????????????

∆S9

×a ×a ×a ×a ×a ×a ×a ×a ×a

128

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 27 / 31

slide-49
SLIDE 49

Finishing it Off

Summary so far

Guessed parts of the states (Si). Isolated correct guess correct partial differences ∆Si.

Problem

How to get full initial state S0?

Solution

Correct partial ∆Si + consistency check all rotations ri. ⇒ MSB of all Si MSB of all ∆Si. ⇒ CVP in dim. 64 full ∆S0. The rest is easy.

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 28 / 31

slide-50
SLIDE 50

Implementation (Hard case, unknown increment)

Summary

Observe 64 outputs (4096 bits). Guess k =51–55 bits:

n = 5 successive rotations (6 bits each), ℓ = 11–13 least significant bits of S0 and c.

Solve 2k instances of CVP in dimension 4 (Babai Rounding). Consistency Check.

Caveat

Attack proved correct for ℓ = 14 (works fine for ℓ = 13). Succeeds with p = 0.66 with ℓ = 11.

Concretely...

55 CPU cycles per guess, 12.5k–20k CPU-hours in total.

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 29 / 31

slide-51
SLIDE 51

Doing it for Real

Used 512 nodes

2×20-core Xeon Gold 6248 @ 2.5Ghz

Running time: 35 minutes.

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 30 / 31

slide-52
SLIDE 52

Conclusion

Reconstructing the seed for PCG is practical. PCG is not cryptographically secure (never claimed to be). Don’t use Numpy to generate nonces...

Bouillaguet, Martinez, Sauvage (SU) Seed-Recovery for PCG November 2, 2020 31 / 31