Rotational Cryptanalysis in the Presence of Constants Tomer Ashur - PowerPoint PPT Presentation

Rotational Cryptanalysis in the Presence of Constants Tomer Ashur Yunwen Liu ESAT/COSIC, KU Leuven, and imec, Belgium FSE, March 2017 1

Table of Contents ARX & Rotational Cryptanalysis Rotational cryptanalysis with constants Experiment Verification Conclusion 2

ARX 3

ARX • Symmetric-key designs 3

ARX • Symmetric-key designs • Addition + Rotation + XOR 3

ARX • Symmetric-key designs • Addition + Rotation + XOR • Differential cryptanalysis and linear cryptanalysis 3

ARX • Symmetric-key designs • Addition + Rotation + XOR • Differential cryptanalysis and linear cryptanalysis • Rotational cryptanalysis 3

Differences 4

Differences XOR difference x ⊕ δ x E k E k y y ⊕ ∆ 4

Differences Modular difference XOR difference x x ⊞ δ x ⊕ δ x E k E k E k E k y y ⊞ ∆ y y ⊕ ∆ 4

Differences Modular difference Rotational difference XOR difference x x ⊞ δ x x ≪ r x ⊕ δ x E k E k E k E k E k E k y y y ≪ r y ⊞ ∆ y y ⊕ ∆ 4

Rotational Cryptanalysis 5

Rotational Cryptanalysis Circular Rotation ( x ≪ r ) ≪ s = x ≪ ( r + s ) 5

Rotational Cryptanalysis Circular Rotation ( x ≪ r ) ≪ s = x ≪ ( r + s ) XOR ( x ≪ r ) ⊕ ( y ≪ r ) = ( x ⊕ y ) ≪ r 5

Rotational Cryptanalysis Circular Rotation ( x ≪ r ) ≪ s = x ≪ ( r + s ) XOR ( x ≪ r ) ⊕ ( y ≪ r ) = ( x ⊕ y ) ≪ r Modular Addition ( x ≪ r ) ⊞ ( y ≪ r ) = ( x ⊞ y ) ≪ r with probability p 5

Rotational Cryptanalysis Modular Addition ( x ≪ r ) ⊞ ( y ≪ r ) = ( x ⊞ y ) ≪ r with probability p 6

Rotational Cryptanalysis Modular Addition ( x ≪ r ) ⊞ ( y ≪ r ) = ( x ⊞ y ) ≪ r with probability p When r = 1 , p achieves the maximum. p = 2 − 1 . 415 6

Rotational Cryptanalysis Modular Addition ( x ≪ r ) ⊞ ( y ≪ r ) = ( x ⊞ y ) ≪ r with probability p When r = 1 , p achieves the maximum. p = 2 − 1 . 415 Denote x ≪ 1 by ← − x for simplicity. 6

Rotational Cryptanalysis Rotational Cryptanalysis (v1), [KN10] The probability that a rotational distinguisher holds for an ARX primitive is determined by the number of modular additions. Pr = (2 − 1 . 415 ) # ⊞ [KN10]: D. Khovratovich, I. Nikolic: Rotational Cryptanalysis of ARX, FSE 2010 7

Rotational Cryptanalysis Rotational Cryptanalysis (v2), [KNP+15] The probability that a rotational distinguisher holds for an ARX primitive is dependent with the chained modular additions. 8

Rotational Cryptanalysis Rotational Cryptanalysis (v2), [KNP+15] The probability that a rotational distinguisher holds for an ARX primitive is dependent with the chained modular additions. ( x ≪ r ) ⊞ ( y ≪ r ) = ( x ⊞ y ) ≪ r ( x ≪ r ) ⊞ ( y ≪ r ) ⊞ ( z ≪ r ) = ( x ⊞ y ⊞ z ) ≪ r [KNP+15]: D. Khovratovich, I. Nikolic, J. Pieprzyk, P. Sokolowski, R. Steinfeld: Rotational Cryptanalysis of ARX Revisited. FSE 2015 8

Table of Contents ARX & Rotational Cryptanalysis Rotational cryptanalysis with constants Experiment Verification Conclusion 9

ARX with constants 10

ARX with constants • Complete system ARX-C 10

ARX with constants • Complete system ARX-C • Constants come with keys and round constants 10

ARX with constants • Complete system ARX-C • Constants come with keys and round constants XOR with a rotational variable ( x ≪ r ) ⊕ ( y ≪ r ) = ( x ⊕ y ) ≪ r 10

ARX with constants • Complete system ARX-C • Constants come with keys and round constants XOR with a rotational variable ( x ≪ r ) ⊕ ( y ≪ r ) = ( x ⊕ y ) ≪ r XOR with a constant ( x ≪ r ) ⊕ k 10

ARX with constants • Complete system ARX-C • Constants come with keys and round constants XOR with a rotational variable ( x ≪ r ) ⊕ ( y ≪ r ) = ( x ⊕ y ) ≪ r XOR with a constant ( x ≪ r ) ⊕ k • Previous analyses: experiment 10

Rotational cryptanalysis on ARX-C 11

Rotational cryptanalysis on ARX-C x ≪ r x E k E k y y ≪ r 11

Rotational cryptanalysis on ARX-C x ′ = x ≪ r x x ≪ r x E k E k E k E k y y ≪ r y y ′ ⊕ δ = y ≪ r 11

Rotational-XOR difference Combine rotational difference with XOR difference ( x, ( x ≪ γ ) 12

Rotational-XOR difference Combine rotational difference with XOR difference ( x, ( x ≪ γ ) ⊕ a ) 12

Rotational-XOR difference Combine rotational difference with XOR difference ( x, ( x ≪ γ ) ⊕ a ) (( a 1 , a 2 ) , γ ) -Rotational-XOR difference (RX-difference) ( x ⊕ a 1 , ( x ≪ γ ) ⊕ a 2 ) 12

Rotational-XOR difference Combine rotational difference with XOR difference ( x, ( x ≪ γ ) ⊕ a ) (( a 1 , a 2 ) , γ ) -Rotational-XOR difference (RX-difference) ( x ⊕ a 1 , ( x ≪ γ ) ⊕ a 2 ) equivalent to (˜ x, (˜ x ≪ γ ) ⊕ ( a 1 ≪ γ ) ⊕ a 2 ) 12

Rotational-XOR difference through ARX 13

Rotational-XOR difference through ARX Rotation ≪ γ x → x ≪ γ − − − ≪ γ → ← − − − − ← − x ⊕ a x ≪ γ ⊕ ( a ≪ γ ) − − − ≪ γ ⇒ ((0 , a ) , 1) → ((0 , a ≪ γ ) , 1) − − − 13

Rotational-XOR difference through ARX Rotation ≪ γ x → x ≪ γ − − − ≪ γ → ← − − − − ← − x ⊕ a x ≪ γ ⊕ ( a ≪ γ ) − − − ≪ γ ⇒ ((0 , a ) , 1) → ((0 , a ≪ γ ) , 1) − − − XOR ⊕ x, y → x ⊕ y − − → ← − − − ← x ⊕ a, ← − − ⊕ y ⊕ b x ⊕ y ⊕ ( a ⊕ b ) − − ⊕ ⇒ ((0 , a ) , 1) , ((0 , b ) , 1) → ((0 , a ⊕ b ) , 1) − − 13

Rotational-XOR difference through ARX Modular addition 14

Rotational-XOR difference through ARX Modular addition ← − − − − − − − − − − − − − − − − − − ( x ⊕ a 1 ) ⊞ ( y ⊕ b 1 ) ⊕ ∆ 1 = ( ← − x ⊕ a 2 ) ⊞ ( ← − y ⊕ b 2 ) ⊕ ∆ 2 14

Rotational-XOR difference through ARX Modular addition ← − − − − − − − − − − − − − − − − − − ( x ⊕ a 1 ) ⊞ ( y ⊕ b 1 ) ⊕ ∆ 1 = ( ← − x ⊕ a 2 ) ⊞ ( ← − y ⊕ b 2 ) ⊕ ∆ 2 Sketch of proof: 14

Rotational-XOR difference through ARX Modular addition ← − − − − − − − − − − − − − − − − − − ( x ⊕ a 1 ) ⊞ ( y ⊕ b 1 ) ⊕ ∆ 1 = ( ← − x ⊕ a 2 ) ⊞ ( ← − y ⊕ b 2 ) ⊕ ∆ 2 Sketch of proof: x = L ( x ) R ( x ) = L 0 ( x ) R 0 ( x ) γ bits γ bits 14

Rotational-XOR difference through ARX Modular addition ← − − − − − − − − − − − − − − − − − − ( x ⊕ a 1 ) ⊞ ( y ⊕ b 1 ) ⊕ ∆ 1 = ( ← x ⊕ a 2 ) ⊞ ( ← − − y ⊕ b 2 ) ⊕ ∆ 2 Sketch of proof: x = L ( x ) R ( x ) = L 0 ( x ) R 0 ( x ) γ bits γ bits The addition of two variables: L ( x ) R ( x ) L ( y ) R ( y ) x one bit of carry � L ( x ) � L ( y ) � C 1 R ( x ) � R ( y ) n − γ 14

proof continued LHS: ← − − − − − − − − − − − − − − − − − − ( x ⊕ a 1 ) ⊞ ( y ⊕ b 1 ) ⊕ ∆ 1 ← − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − (( L ( x ) ⊕ L ( a 1 )) ⊞ ( L ( y ) ⊕ L ( b 1 )) ⊞ C 1 = n − γ ) ⊕ L (∆ 1 ) || (( R ( x ) ⊕ R ( a 1 )) ⊞ ( R ( y ) ⊕ R ( b 1 ))) ⊕ R (∆ 1 ) 15

proof continued LHS: ← − − − − − − − − − − − − − − − − − − ( x ⊕ a 1 ) ⊞ ( y ⊕ b 1 ) ⊕ ∆ 1 ← − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − (( L ( x ) ⊕ L ( a 1 )) ⊞ ( L ( y ) ⊕ L ( b 1 )) ⊞ C 1 = n − γ ) ⊕ L (∆ 1 ) || (( R ( x ) ⊕ R ( a 1 )) ⊞ ( R ( y ) ⊕ R ( b 1 ))) ⊕ R (∆ 1 ) = (( R ( x ) ⊕ R ( a 1 )) ⊞ ( R ( y ) ⊕ R ( b 1 ))) ⊕ R (∆ 1 ) || (( L ( x ) ⊕ L ( a 1 )) ⊞ ( L ( y ) ⊕ L ( b 1 )) ⊞ C 1 n − γ ) ⊕ L (∆ 1 ) . 15

proof continued LHS: ← − − − − − − − − − − − − − − − − − − ( x ⊕ a 1 ) ⊞ ( y ⊕ b 1 ) ⊕ ∆ 1 ← − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − (( L ( x ) ⊕ L ( a 1 )) ⊞ ( L ( y ) ⊕ L ( b 1 )) ⊞ C 1 = n − γ ) ⊕ L (∆ 1 ) || (( R ( x ) ⊕ R ( a 1 )) ⊞ ( R ( y ) ⊕ R ( b 1 ))) ⊕ R (∆ 1 ) = (( R ( x ) ⊕ R ( a 1 )) ⊞ ( R ( y ) ⊕ R ( b 1 ))) ⊕ R (∆ 1 ) || (( L ( x ) ⊕ L ( a 1 )) ⊞ ( L ( y ) ⊕ L ( b 1 )) ⊞ C 1 n − γ ) ⊕ L (∆ 1 ) . RHS: ( ← − x ⊕ a 2 ) ⊞ ( ← − y ⊕ b 2 ) ⊕ ∆ 2 ′ ( a 2 )) ⊞ ( R ( y ) ⊕ L ′ ( b 2 )) ⊞ C 2 ′ (∆ 2 ) || = (( R ( x ) ⊕ L γ ) ⊕ L ′ ( a 2 )) ⊞ ( L ( y ) ⊕ R ′ ( b 2 ))) ⊕ R ′ (∆ 2 ) . (( L ( x ) ⊕ R 15