Skinny A Family of Lightweight Tweakable Block Ciphers for the IoT - PowerPoint PPT Presentation

Skinny – A Family of Lightweight Tweakable Block Ciphers for the IoT C. Beierle, J. Jean, S. Kölbl, G. Leander, A. Moradi, T. Peyrin, Y. Sasaki, P. Sasdrich, S.M. Sim Horst Görtz Institute for IT-Security, Ruhr University Bochum, Germany Cryptography for the Internet of Things and Cloud November 6, 2017 C. Beierle (HGI) The Skinny Family of Block Ciphers November 6, 2017 1 / 26

Introduction to Skinny Skinny is a family of lightweight block ciphers presented at CRYPTO 2016. Its main features are: flexible tweakable cipher allowing several block- and tweak/key sizes an academic design that competes with the lightweight NSA cipher SIMON in terms of performance and efficiency (e.g., area in hardware) having strong security arguments against common attacks C. Beierle (HGI) The Skinny Family of Block Ciphers November 6, 2017 2 / 26

Introduction to Skinny Skinny is a family of lightweight block ciphers presented at CRYPTO 2016. Its main features are: flexible tweakable cipher allowing several block- and tweak/key sizes an academic design that competes with the lightweight NSA cipher SIMON in terms of performance and efficiency (e.g., area in hardware) having strong security arguments against common attacks A Tweakable Block Cipher and a Possible Application IV IV + 1 IV + n P P 0 P 1 P n . . . K E T K E K E K E C 0 C 1 C n C C. Beierle (HGI) The Skinny Family of Block Ciphers November 6, 2017 2 / 26

Table of Contents Introduction to Skinny 1 The Design 2 Implementation Results 3 Best Cryptanalysis so far 4 Skinny Cryptanalysis Competition (announced at FSE 2017) 5 C. Beierle (HGI) The Skinny Family of Block Ciphers November 6, 2017 3 / 26

Common Block Cipher Design - A Key-Alternating Cipher . . . K A A A . . . P R R R C Most common block ciphers iterate an unkeyed round function R Round keys are added in between The round keys are derived from the intial key K using a key-scheduling algorithm (here: a key-update function A ) C. Beierle (HGI) The Skinny Family of Block Ciphers November 6, 2017 4 / 26

Common Block Cipher Design - A Key-Alternating Cipher . . . K A A A . . . P R R R C Most common block ciphers iterate an unkeyed round function R Round keys are added in between The round keys are derived from the intial key K using a key-scheduling algorithm (here: a key-update function A ) What to do? In order to build a block cipher, one has to design a proper round function R that is efficient to implement a key schedule for deriving the round keys C. Beierle (HGI) The Skinny Family of Block Ciphers November 6, 2017 4 / 26

Designing a Round Function - Two Extremes Common block ciphers iterate a round function R several times. One can imagine two extremes: C. Beierle (HGI) The Skinny Family of Block Ciphers November 6, 2017 5 / 26

Designing a Round Function - Two Extremes Common block ciphers iterate a round function R several times. One can imagine two extremes: Employing very strong (but also very expensive) operations For instance, use very large S-boxes and a very strong diffusion layer. The number of rounds needed would be very low. C. Beierle (HGI) The Skinny Family of Block Ciphers November 6, 2017 5 / 26

Designing a Round Function - Two Extremes Common block ciphers iterate a round function R several times. One can imagine two extremes: Employing very strong (but also very expensive) operations For instance, use very large S-boxes and a very strong diffusion layer. The number of rounds needed would be very low. An extreme lightweight round function For instance, apply a single AND operation on two bits and permute the bits. The number of rounds needed would be extremely high. C. Beierle (HGI) The Skinny Family of Block Ciphers November 6, 2017 5 / 26

Designing a Round Function - Two Extremes Common block ciphers iterate a round function R several times. One can imagine two extremes: Employing very strong (but also very expensive) operations For instance, use very large S-boxes and a very strong diffusion layer. The number of rounds needed would be very low. An extreme lightweight round function For instance, apply a single AND operation on two bits and permute the bits. The number of rounds needed would be extremely high. Skinny is designed to achieve one of the best possible trade-offs! C. Beierle (HGI) The Skinny Family of Block Ciphers November 6, 2017 5 / 26

The Design Strategy the basis design is inspired by the well-known AES each of the building blocks is tailored to achieve an optimal trade-off the idea: removing any operation will lead to a much more insecure cipher the design should allow for strong security arguments against known attacks (e.g. differential and linear attacks) even in the related-key/related-tweak model C. Beierle (HGI) The Skinny Family of Block Ciphers November 6, 2017 6 / 26

Specifications and Initialization Specifications Skinny supports block sizes of either n = 64 or n = 128 bits. The tweak/key size t can be t = n , t = 2 n or t = 3 n We denote Skinny with n -bit blocks and t -bit tweak/key by Skinny-n-t C. Beierle (HGI) The Skinny Family of Block Ciphers November 6, 2017 7 / 26

Specifications and Initialization Specifications Skinny supports block sizes of either n = 64 or n = 128 bits. The tweak/key size t can be t = n , t = 2 n or t = 3 n We denote Skinny with n -bit blocks and t -bit tweak/key by Skinny-n-t The Internal State The internal state of Skinny is represented by a 4 × 4 matrix of b -bit elements: n = 64 → b = 4 n = 128 → b = 8 The plaintext P = m 0 m 1 . . . m 15 is mapped to the cipher’s initial state   m 0 m 1 m 2 m 3 m 4 m 5 m 6 m 7 IS =   m 8 m 9 m 10 m 11 m 12 m 13 m 14 m 15 C. Beierle (HGI) The Skinny Family of Block Ciphers November 6, 2017 7 / 26

The Round Function The Round Function of Skinny The following ( AES -like) function is iterated on the cipher’s internal state: ART ShiftRows MixColumns >>> 1 SC AC >>> 2 >>> 3 Number of rounds for Skinny- n - t , with n -bit internal state, t -bit tweakey state. Tweakey size t Block size n n 2 n 3 n 64 32 rounds 36 rounds 40 rounds 128 40 rounds 48 rounds 56 rounds C. Beierle (HGI) The Skinny Family of Block Ciphers November 6, 2017 8 / 26

The Round Function The Round Function of Skinny The following ( AES -like) function is iterated on the cipher’s internal state: ART ShiftRows MixColumns >>> 1 SC AC >>> 2 >>> 3 Number of rounds for Skinny- n - t , with n -bit internal state, t -bit tweakey state. Tweakey size t Block size n n 2 n 3 n 64 32 rounds 36 rounds 40 rounds 128 40 rounds 48 rounds 56 rounds Number of Rounds in AES AES -128 applies 10 rounds , but uses more expensive components! C. Beierle (HGI) The Skinny Family of Block Ciphers November 6, 2017 8 / 26

The SubCells Layer Skinny SubCells The value in each cell is substituted according to the b -bit S-box S b . S b S 4 = [( x 3 , x 2 , x 1 , x 0 ) → ( x 2 , x 1 , x 0 ⊕ ( x 3 ∨ x 2 ) , x 3 )] 4 ≫ 1. (12 GE) S 8 employs a similar, very lightweight construction. (24 GE) C. Beierle (HGI) The Skinny Family of Block Ciphers November 6, 2017 9 / 26

The SubCells Layer Skinny SubCells The value in each cell is substituted according to the b -bit S-box S b . S b S 4 = [( x 3 , x 2 , x 1 , x 0 ) → ( x 2 , x 1 , x 0 ⊕ ( x 3 ∨ x 2 ) , x 3 )] 4 ≫ 1. (12 GE) S 8 employs a similar, very lightweight construction. (24 GE) AES SubBytes Each byte is substituted according to the AES S-box. It is affine equivalent to inversion in the finite field F 2 8 . x �→ L ( x 2 n − 2 ) + c (198 GE) C. Beierle (HGI) The Skinny Family of Block Ciphers November 6, 2017 9 / 26

The AddConstants Layer The Constant Addition in Skinny Round-specific constants c 0 , c 1 , c 2 are XORed to the first column of the state. They are derived c 0 from the 6-bit affine LFSR c 1 c 2 ( r 5 || r 4 || r 3 || r 2 || r 1 || r 0 ) → ( r 4 || r 3 || r 2 || r 1 || r 0 || r 5 ⊕ r 4 ⊕ 1 ) c 0 = ( r 3 || r 2 || r 1 || r 0 ) c 1 = ( 0 || 0 || r 5 || r 4 ) c 2 = 0x2 C. Beierle (HGI) The Skinny Family of Block Ciphers November 6, 2017 10 / 26

The AddConstants Layer The Constant Addition in Skinny Round-specific constants c 0 , c 1 , c 2 are XORed to the first column of the state. They are derived c 0 from the 6-bit affine LFSR c 1 c 2 ( r 5 || r 4 || r 3 || r 2 || r 1 || r 0 ) → ( r 4 || r 3 || r 2 || r 1 || r 0 || r 5 ⊕ r 4 ⊕ 1 ) c 0 = ( r 3 || r 2 || r 1 || r 0 ) c 1 = ( 0 || 0 || r 5 || r 4 ) c 2 = 0x2 ART ShiftRows MixColumns >>> 1 SC AC >>> 2 >>> 3 C. Beierle (HGI) The Skinny Family of Block Ciphers November 6, 2017 10 / 26

Introducing Tweaks - The TWEAKEY Framework 1 A Block Cipher vs. a Tweakable Block Cipher P P K E K E T C C 1 Jérémy Jean, Ivica Nikolić, and Thomas Peyrin. Tweaks and keys for block ciphers: the TWEAKEY framework . ASIACRYPT 2014. 2014. C. Beierle (HGI) The Skinny Family of Block Ciphers November 6, 2017 11 / 26

Introducing Tweaks - The TWEAKEY Framework 1 A Block Cipher vs. a Tweakable Block Cipher P P K E K E T C C The TWEAKEY Framework Tweak and key material should be handled in the same way by the tweakey schedule! tk 1 tk r − 1 tk r tk 0 . . . h h h g g g g . . . P = s 0 s r +1 = C R R s 1 s r 1 Jérémy Jean, Ivica Nikolić, and Thomas Peyrin. Tweaks and keys for block ciphers: the TWEAKEY framework . ASIACRYPT 2014. 2014. C. Beierle (HGI) The Skinny Family of Block Ciphers November 6, 2017 11 / 26