Some rst b ounds on the degree A b ound on the degree of - - PowerPoint PPT Presentation

▶
some rst b ounds on the degree a b ound on the degree of
SMART_READER_LITE
LIVE PREVIEW

Some rst b ounds on the degree A b ound on the degree of - - PowerPoint PPT Presentation

Sep 26, 2022 204 likes •812 views

Some rst b ounds on the degree A b ound on the degree of SPN onstrutions Inuene of the inverse p ermutation Bounds on the algeb rai degree of iterated onstrutions Christina Boura DTU Compute June 10,

slide-1
SLIDE 1 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Bounds
  • n
the algeb rai degree
  • f
iterated
  • nstru tions
Christina Boura DTU Compute June 10, 2013 1 / 43
slide-2
SLIDE 2 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Algeb rai degree
  • f
a ve to rial fun tion F : Fn

2 → Fn 2

Example (ANF
  • f
a p ermutation F
  • f F4

2

)

(y0, y1, y2, y3) = F(x0, x1, x2, x3) y0 = x0x2 + x1 + x2 + x3 y1 = x0x1x2 + x0x1x3 + x0x2x3 + x1x2 + x0x3 + x2x3 + x0 + x2 y2 = x0x1x3 + x0x2x3 + x1x2 + x1x3 + x2x3 + x0 + x1 + x3 y3 = x0x1x2 + x1x3 + x0 + x1 + x2 + 1.

The algeb rai degree
  • f F
is 3 . 2 / 43
slide-3
SLIDE 3 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Iterated p ermutations Most
  • f
the symmetri
  • nstru tions
(hash fun tions, blo k iphers) a re based
  • n
a p ermutation iterated a high numb er
  • f
times. Imp
  • rtant
to estimate the algeb rai degree
  • f
su h iterated p ermutations. F un tions with a lo w degree a re vulnerable to:
  • Algeb
rai atta ks
  • Higher-o
rder dierential atta ks and distinguishers
  • Cub
e atta ks 3 / 43
slide-4
SLIDE 4 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Higher-o rder derivatives Let F : Fn

2 → Fm 2

. Derivative
  • f F
at a ∈ Fn

2

: Da(x) = F(x) ⊕ F(x + a) . Denition. F
  • r
any k
  • dimensional
subspa e V
  • f Fn

2

, the k
  • th
  • rder
derivative
  • f F
with resp e t to V is the fun tion dened b y

DV F(x) = Da1 . . . Dak(x) =

  • v∈V

F(x+v),

fo r every

x ∈ Fn

2.

where (a1, . . . , ak) is a basis
  • f V
. Example: (k = 2 , V = a, b )

DV (x) = DaDb(x) = Da(F(x) ⊕ F(x + b)) = F(x) ⊕ F(x + a) ⊕ F(x + b) ⊕ F(x + a + b)

4 / 43
slide-5
SLIDE 5 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Higher-o rder dierential ryptanalysis Intro du ed b y Knudsen in 1994. Based
  • n
the follo wing p rop erties: Let F : Fn

2 → Fm 2

  • f
degree d . Prop
  • sition.
F
  • r
every a ∈ Fn

2

w e have

DaF ≤ d − 1.

Prop
  • sition.
[Lai 94℄ F
  • r
every V ⊂ Fn

2

, with dim V > d

DV (x) = 0,

fo r every x ∈ Fn

2.

5 / 43
slide-6
SLIDE 6 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation The KN ipher [Knudsen
  • Nyb
erg 95℄

6

  • round
F eistel ipher
  • E : F32

2 → F33 2

linea r
  • T : F33

2 → F32 2

linea r
  • ki
: 33
  • bit
subk ey
  • S : x → x3
  • ver F33

2

Algeb rai degree
  • f S
: 2

S T E

ki

xi−1 yi−1 xi yi

6 / 43
slide-7
SLIDE 7 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Higher-o rder dierential atta k
  • n KN
[Jak
  • bsen
  • Knudsen
97℄

y0(x) = c y1(x) = x + Fk1(c) := x + c′ y2(x) = Fk2(x + c′) + c y3(x) = Fk3(Fk2(x + c′) + c) + x + c′ y4(x) = Fk4(Fk3(Fk2(x + c′) + c) + x + c′) + Fk2(x + c′) + c G = Fk4 ◦ Fk3 ◦ Fk2. deg(G) ≤ 23

Fk6 Fk1 Fk2 Fk3 Fk4 Fk5 d = 1 d = 2 d = 4 d = 8 y4 x6 y6 x0 = x y0 = c

7 / 43
slide-8
SLIDE 8 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation If V ⊂ F32

2

with dim(V ) = 9 , then:

DV y4(x) = 0,

fo r all x ∈ F32

2 .

By denition:
  • v∈V

y4(v + w) = 0,

fo r all w ∈ F32

2 .

(1) W e an see that:

x6(x) = Fk6(y6(x)) + y4(x),

and b y inverting the terms:

y4(x) = x6(x) + Fk6(y6(x)).

(2) 8 / 43
slide-9
SLIDE 9 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Key re overy By
  • mbining
equations (1 ) and (2), w e
  • btain
the atta k equation:
  • v∈V

Fk6(y6(v + w)) +

  • v∈V

x6(v + w) = 0.

The right subk ey k6 is the
  • ne
fo r whi h the equation is veried. Complexit y
  • f
the atta k:
  • Data
Complexit y:

29

plaintexts.
  • Time
Complexit y:

233+8

. Distinguisher fo r 4 and 5 rounds with data
  • mplexit
y 25 and 29 resp e tively . 9 / 43
slide-10
SLIDE 10 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation SHA-3 [Bertoni
  • Daemen
  • P
eeters
  • V
anAss he 08℄ Sp
  • nge
  • nstru tion
Ke ak-f P ermutation
  • 1600
  • bit
state, seen as a 3
  • dimensional

5 × 5 × 64

matrix
  • 24
rounds R
  • Nonlinea
r la y er: 320 pa rallel appli ations
  • f
a 5 × 5 S-b
  • x χ
  • deg χ = 2
, deg χ−1 = 3 10 / 43
slide-11
SLIDE 11 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Outline Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation 11 / 43
slide-12
SLIDE 12 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Outline Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation 12 / 43
slide-13
SLIDE 13 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation A trivial b
  • und
Prop
  • sition:
Let F b e a fun tion from Fn

2

into Fn

2

and G a fun tion from Fn

2

into Fm

2

. Then

deg(G ◦ F) ≤ deg(G) deg(F).

Example: Round fun tion R
  • f
AES is
  • f
degree 7 . Then

deg(R2) = deg(R◦R) ≤ 72 = 49.

13 / 43
slide-14
SLIDE 14 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation A b
  • und
based
  • n
the W alsh sp e trum [Canteaut
  • Videau
'02℄ Denition (W alsh sp e trum
  • f F : Fn

2 → Fn 2

)

{F(ϕb ◦ F + ϕα) =

  • x∈Fn

2

(−1)b·F (x)+a·x, a, b ∈ Fn

2, b = 0}.

Theo rem: If all the values in the W alsh sp e trum
  • f F
a re divisible b y 2ℓ , then fo r every G : Fn

2 → Fn 2

deg(G ◦ F) ≤ n − ℓ + deg(G).

14 / 43
slide-15
SLIDE 15 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Appli ation to SHA-3 It an b e
  • mputed
that:
  • The
W alsh sp e tra
  • f χ
and χ−1 a re divisible b y 23 . As there a re 320 pa rallel appli ations
  • f χ
in a round w e have:
  • The
W alsh sp e tra
  • f R
and R−1 a re divisible b y 23·320 = 2960 . Bound fo r the degree
  • f R−7

deg(R−7) = deg(R−6 ◦R−1) ≤ 1600−960+deg(R−6) ≤ 1369.

15 / 43
slide-16
SLIDE 16 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Appli ation to SHA-3 It an b e
  • mputed
that:
  • The
W alsh sp e tra
  • f χ
and χ−1 a re divisible b y 23 . As there a re 320 pa rallel appli ations
  • f χ
in a round w e have:
  • The
W alsh sp e tra
  • f R
and R−1 a re divisible b y 23·320 = 2960 . Bound fo r the degree
  • f R−7

deg(R−7) = deg(R−6 ◦R−1) ≤ 1600−960+deg(R−6) ≤ 1369. deg(R7) ≤ min(1599, 2187)

15 / 43
slide-17
SLIDE 17 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Outline Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation 16 / 43
slide-18
SLIDE 18 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Substitution P ermutation Net w
  • rks

S S S S S S Linear Layer S S S S S S Linear Layer S S S S S S Linear Layer

Ho w to estimate the evolution
  • f
the degree
  • f
su h
  • nstru tions?
17 / 43
slide-19
SLIDE 19 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation

x0 x1 x3 x4 x5 x6 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15

S1 S2 S3 S4

y0 y1 y2 y3 y4 y5 y6 y7 y8 y9 y10 y11 y12 y13 y14 y15

After several rounds, all
  • rdinates
an b e exp ressed as a sum
  • f
monomials. Ea h monomial is a p ro du t
  • f
va riables in X = {x0, . . . , x15} . 18 / 43
slide-20
SLIDE 20 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation

x0 x1 x3 x4 x5 x6 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15

S1 S2 S3 S4

y0 y1 y2 y3 y4 y5 y6 y7 y8 y9 y10 y11 y12 y13 y14 y15

After several rounds, all
  • rdinates
an b e exp ressed as a sum
  • f
monomials. Ea h monomial is a p ro du t
  • f
va riables in Y = {y0, . . . , y15} . The
  • rdinates y0 − y3
a re
  • utputs
  • f
the same Sb
  • x
(equally fo r the
  • thers).
What is the
  • nsequen e
  • n
the degree
  • f
the p ro du t ? 18 / 43
slide-21
SLIDE 21 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation The notion
  • f δk
Denition : F
  • r
a p ermutation S dene δk (S) as the maximum degree
  • f
the p ro du t
  • f k
  • rdinates
  • f S
.

→ δ1(S) :=

algeb rai degree
  • f S
Example:

deg S = 3

S

k δk

1 3 19 / 43
slide-22
SLIDE 22 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation The notion
  • f δk
Denition : F
  • r
a p ermutation S dene δk (S) as the maximum degree
  • f
the p ro du t
  • f k
  • rdinates
  • f S
.

→ δ1(S) :=

algeb rai degree
  • f S
Example:

deg S = 3

S

k δk

1 3 2 3 3 3 19 / 43
slide-23
SLIDE 23 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation The notion
  • f δk
Denition : F
  • r
a p ermutation S dene δk (S) as the maximum degree
  • f
the p ro du t
  • f k
  • rdinates
  • f S
.

→ δ1(S) :=

algeb rai degree
  • f S
Example:

deg S = 3

S

k δk

1 3 2 3 3 3 4 4

S

p ermutation
  • f Fn

2

:

δk(S) = n

i k = n . 19 / 43
slide-24
SLIDE 24 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Example: Pro du t
  • f 6
  • rdinates.

S1 S2 S3 S4

y0 y1 y2 y3 y4 y5 y6 y7 y8 y9 y10 y11 y12 y13 y14 y15

π = y0y1y3y8y9y10. deg(π) ≤ δ3(S1) + δ3(S3) = 6.

20 / 43
slide-25
SLIDE 25 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Example: Pro du t
  • f 6
  • rdinates.

S1 S2 S3 S4

y0 y1 y2 y3 y4 y5 y6 y7 y8 y9 y10 y11 y12 y13 y14 y15

π = y0y5y8y10y13y15. deg(π) ≤ δ1(S1) + δ1(S2) + δ2(S3) + δ2(S4) = 12.

The degree
  • f
the p ro du t is relatively lo w if many
  • rdinates
  • ming
from the same Sb
  • x
a re involved!!! 20 / 43
slide-26
SLIDE 26 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation T
  • w
a rds the b
  • und

S S S S

Find the maximal degree
  • f
the p ro du t π
  • f d
  • utputs.

xi = #

Sb
  • xes
fo r whi h exa tly i
  • rdinates
a re involved in π . 21 / 43
slide-27
SLIDE 27 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation T
  • w
a rds the b
  • und

S S S S

Find the maximal degree
  • f
the p ro du t π
  • f d
  • utputs.

xi = #

Sb
  • xes
fo r whi h exa tly i
  • rdinates
a re involved in π . Example (d = 13 )
  • x4 = 1
, x3 = 3 :

deg(π) ≤ δ3x3+δ4x4 = 3·3+4·1 = 13.

21 / 43
slide-28
SLIDE 28 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation T
  • w
a rds the b
  • und

S S S S

Find the maximal degree
  • f
the p ro du t π
  • f d
  • utputs.

xi = #

Sb
  • xes
fo r whi h exa tly i
  • rdinates
a re involved in π . Example (d = 13 )
  • x4 = 2
, x3 = 1 , x2 = 1 :

deg(π) ≤ δ2x2 +δ3x3 +δ4x4 = 3·1+3·1+4·2 = 14.

21 / 43
slide-29
SLIDE 29 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation T
  • w
a rds the b
  • und

S S S S

Find the maximal degree
  • f
the p ro du t π
  • f d
  • utputs.

xi = #

Sb
  • xes
fo r whi h exa tly i
  • rdinates
a re involved in π . Example (d = 13 )
  • x4 = 3
, x1 = 1 :

deg(π) ≤ δ1x1+δ4x4 = 3·1+4·3 = 15.

21 / 43
slide-30
SLIDE 30 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation T
  • w
a rds the b
  • und

S S S S

Find the maximal degree
  • f
the p ro du t π
  • f d
  • utputs.

xi = #

Sb
  • xes
fo r whi h exa tly i
  • rdinates
a re involved in π .

deg(π) ≤ max

(x1,x2,x3,x4)(δ1x1 + δ2x2 + δ3x3 + δ4x4)

with x1 + 2x2 + 3x3 + 4x4 = d . 21 / 43
slide-31
SLIDE 31 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation

d x4 x3 x2 x1 deg(π) 16

4
  • 16

15

3 1
  • 15

14

3
  • 1
  • 15

13

3
  • 1
15

12

2 1
  • 1
14

11

2
  • 1
1 14

10

2
  • 2
14

9

1 1
  • 2
13 . . . . . . . . . . . . . . . . . .

16 − deg(π) ≥ 16 − d 3

22 / 43
slide-32
SLIDE 32 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation

d x4 x3 x2 x1 deg(π) 16

4
  • 16

15

3 1
  • 15

14

3
  • 1
  • 15

13

3
  • 1
15

12

2 1
  • 1
14

11

2
  • 1
1 14

10

2
  • 2
14

9

1 1
  • 2
13 . . . . . . . . . . . . . . . . . .

deg(π) ≤ 16 − 16 − d 3

22 / 43
slide-33
SLIDE 33 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
[Boura
  • Canteaut
  • De
Cannire
  • FSE
2011℄ Theo rem. Let F b e a fun tion from Fn

2

into Fn

2

  • rresp
  • nding
to the pa rallel appli ation
  • f
an Sb
  • x, S
, dened
  • ver Fn0

2

. Then, fo r any G from Fn

2

into Fℓ

2

, w e have

deg(G ◦ F) ≤ n − n − deg G γ(S) ,

where

γ(S) = max

1≤i≤n0−1

n0 − i n0 − δi .

23 / 43
slide-34
SLIDE 34 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Appli ation to SHA-3 Non-linea r la y er: P a rallel appli ation
  • f
a 5 × 5 Sb
  • x χ ,
with

deg(χ) = 2

.

γ(χ) = max

1≤k≤4

5 − k 5 − δk(χ) k 1 2 3 4 5 δk 2 4 4 4 5 γ(χ) = max 4 3, 3 1, 2 1, 1 1

  • = 3
W e dedu e

deg(G ◦ F) ≤ 1600 − 1600 − deg(G) 3

24 / 43
slide-35
SLIDE 35 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation

R

: Round fun tion
  • f
Ke ak-f F
  • r r = 11, . . . , 16 :

deg(Rr) ≤ 1600 − 1600 − deg(Rr−1) 3

Example : r = 11

deg(R11) ≤ 1600 − 1600 − deg(R10) 3 = 1600 − 1600 − 1024 3 = 1408. r deg(Rr)

1 2 2 4 3 8 4 16 5 32 6 64 7 128 8 256 9 512 10 1024 11 1408 12 1536 13 1578 14 1592 15 1597 16 1599 25 / 43
slide-36
SLIDE 36 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation SPN Bound vs. T rivial Bound

5 10 15 500 1,000 1,500

Rounds

deg(F)

26 / 43
slide-37
SLIDE 37 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation SPN Bound vs. T rivial Bound

5 10 15 500 1,000 1,500

Rounds

deg(F)

26 / 43
slide-38
SLIDE 38 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Appli ation to AES One round:

MC ◦ SR ◦ SB ◦ AK.

  • AK
: AddRoundKey
  • SB
: SubBytes (Sb
  • xes
  • f
degree 7 )
  • SR
: ShiftRows
  • MC
: MixColumns 27 / 43
slide-39
SLIDE 39 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation The Sup er Sb
  • x
te hnique T w
  • rounds:

R2 = MC ◦ SR ◦ SB ◦ AK ◦ MC ◦ SR ◦ SB ◦ AK.

Equivalently:

R2 = MC ◦ SR ◦ SB ◦ AK ◦ MC ◦ SB ◦ SR ◦ AK.

Denote:

SuperSbox = SB ◦ AK ◦ MC ◦ SB.

Then:

R2 = MC ◦ SR ◦ SuperSbox ◦ SR ◦ AK.

28 / 43
slide-40
SLIDE 40 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Bound
  • n
up to 4 rounds

SuperSbox

: F32

2 → F32 2

: T w
  • non-linea
r la y ers
  • mp
  • sed
  • f
Sb
  • xes
  • f
degree 7 , sepa rated b y a linea r la y er.

deg(SuperSbox) ≤ 32 − 32 − 7 7 ≤ 28.

(T rivial Bound: deg(R2) ≤ 72 = 49 !!!) Bound fo r r rounds:

deg(Rr) = deg(Rr−1 ◦ R) ≤ 128 − 128 − deg(Rr−1) 7 .

  • r = 3
: deg(R3) ≤ 113
  • r = 4
: deg(R4) ≤ 125 29 / 43
slide-41
SLIDE 41 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Exer i e (JH hash fun tion [W u 08℄) 42 rounds
  • f
a 1024-bit p ermutation R

S

: P ermutation
  • ver F4

2

  • f
degree 3 . What is the degree after 2 rounds? 30 / 43
slide-42
SLIDE 42 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Outline Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation 31 / 43
slide-43
SLIDE 43 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation An
  • bservation
  • n
SHA-3

χ−1(x0, . . . , x4) = (x0 + x2 + x4 + x1x2 + x1x4 + x3x4 + x1x3x4, x0 + x1 + x3 + x0x2 + x0x4 + x2x3 + x0x2x4, x1 + x2 + x4 + x0x1 + x1x3 + x3x4 + x0x1x3, x0 + x2 + x3 + x0x4 + x1x2 + x2x4 + x1x2x4, x1 + x3 + x4 + x0x1 + x0x3 + x2x3 + x0x2x3).

Observation
  • f
[DuanLai 11℄: δ2(χ−1) = 3 . 32 / 43
slide-44
SLIDE 44 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation An interesting p rop ert y Question: Is δ2(χ−1) related to deg(χ) ? 33 / 43
slide-45
SLIDE 45 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation An interesting p rop ert y Question: Is δ2(χ−1) related to deg(χ) ? Theo rem: Let F b e a p ermutation
  • n Fn

2

. Then, fo r any integers k and ℓ ,

δℓ(F) < n − k

if and
  • nly
if δk(F −1) < n − ℓ. 33 / 43
slide-46
SLIDE 46 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Pro
  • f:
W e sho w that if

δℓ(F −1) < n − k

then δk(F) < n − ℓ. Let π(x) =

i∈K Fi(x)

, with |K| = k . The
  • e ient a
  • f
  • j∈L xj
in the ANF
  • f π
fo r |L| = ℓ ,

a =

  • x∈Fn

2

xj=0,j∈L

π(x) mod 2 = #{x ∈ Fn

2 : xj = 0, j ∈ L

and Fi(x) = 1, i ∈ K} mod 2

= #{y ∈ Fn

2 : yi = 1, i ∈ K

and F −1

j

(y) = 0, j ∈ L} mod 2 = #{y ∈ Fn

2 : yi = 1, i ∈ K

and
  • j∈L

(1 + F −1

j

(y)) = 1} mod 2 =

sin e, deg

j∈L(1 + F −1 j

(y)) < n − k.

34 / 43
slide-47
SLIDE 47 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Appli ation to SHA-3 Co rolla ry: Let F b e a p ermutation
  • n Fn

2

. Then, fo r any integer ℓ

δℓ(F) < n − 1

if and
  • nly
if deg(F −1) < n − ℓ. Case
  • f
SHA-3: F
  • r F = χ−1
and ℓ = 2 ,

δ2(χ−1) < 5 − 1

i deg(χ) < 5 − 2 35 / 43
slide-48
SLIDE 48 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation A new b
  • und
  • n
the degree [Boura
  • Canteaut
IEEE-IT 13℄ Co rolla ry: Let F b e a p ermutation
  • f Fn

2

and let G b e a fun tion from Fn

2

into Fm

2

. Then, w e have

deg(G ◦ F) < n − n − 1 − deg G deg(F −1)

  • .
36 / 43
slide-49
SLIDE 49 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Consequen e
  • n
the b
  • und
  • n
SPN
  • nstru tions
Re all the b
  • und:

deg(G ◦ F) ≤ n − n − deg(G) γ(S) ,

where

γ(S) = max

1≤i≤n0−1

n0 − i n0 − δi(S).

W e an sho w that

γ(S) ≤ max

  • n0 − 1

n0 − deg S , n0 2 − 1, deg S−1

  • .
F
  • r
the inverse
  • f
Ke ak-f :

γ(χ−1) ≤ 2

37 / 43
slide-50
SLIDE 50 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Bound
  • n
the degree
  • f
the inverse
  • f
Ke ak-f

5 10 15 500 1,000 1,500

Rounds

deg(F)

38 / 43
slide-51
SLIDE 51 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Appli ation to KN Higher-o rder dierential atta k due to the lo w degree
  • f
the round p ermutation. Ho w to repair the ipher? [Nyb erg 93℄: Repla e S b y the inverse
  • f
a quadrati p ermutation.
  • The
quadrati p ermutation and its inverse will have the same p rop erties rega rding dierential and linea r atta ks.
  • The
quadrati p ermutation is not involved neither in the en ryption, no r in the de ryption. 39 / 43
slide-52
SLIDE 52 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation The KN ′ ipher
  • σ :

F8

2

→ F8

2

x → t ◦ σ (e(x))) e : F8

2 → F9 2

ane expansion

t : F9

2 → F8 2

trun ation

x : σ(x) = x171

(the inverse
  • f x3
  • ver F29
)

deg( S) = 5

L′ L

ki

xi−1 yi−1 xi yi

σ σ σ σ e e e e t t t t

˜ S

˜ σ

F32

2 × F32 2

→ F32

2 × F32 2

(x, y) → (y, x + L′ ◦ S (L(x) + ki))

40 / 43
slide-53
SLIDE 53 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation A tta king KN ′ Jak
  • bsen-Knudsen
atta k:

deg(y4) ≤ 5 × 5 × 5

41 / 43
slide-54
SLIDE 54 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation A tta king KN ′ Jak
  • bsen-Knudsen
atta k:

deg(y4) ≤ 5 × 5 × 5

unfeasible 41 / 43
slide-55
SLIDE 55 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation A tta king KN ′ Jak
  • bsen-Knudsen
atta k:

deg(y4) ≤ 5 × 5 × 5

unfeasible Set,

Fk(x) = L′ ◦ S (L(x) + k) .

Then,

y0 = c y1 = x + Fk1(y0) := x + c′ y2 = Fk2

  • x + c′

+ c y3 = Fk3

  • Fk2
  • x + c′

+ c′ + x + c′ y4 = y2 + Fk4(y3)

41 / 43
slide-56
SLIDE 56 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Appli ation
  • f
the new b
  • und

y4 + y2 = G ◦ S(x)

Using the b
  • und
with the inverse :

deg(G ◦ S) < 36 − 35 − deg(G) 2

  • ,
F rom a p revious Co rolla ry: (deg(G) ≤ 22) , thus

deg(y4) ≤ deg(G ◦ S) ≤ 29

42 / 43
slide-57
SLIDE 57 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Appli ation
  • f
the new b
  • und

y4 + y2 = G ◦ S(x)

Using the b
  • und
with the inverse :

deg(G ◦ S) < 36 − 35 − deg(G) 2

  • ,
F rom a p revious Co rolla ry: (deg(G) ≤ 22) , thus

deg(y4) ≤ deg(G ◦ S) ≤ 29

Distinguisher
  • n
5 rounds
  • f KN ′
with data
  • mplexit
y 230 that imp roves the generi distinguisher. 42 / 43
slide-58
SLIDE 58 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Generalization to balan ed fun tions (not p ermutations) DES: Eight dierent 6 × 4 Sb
  • xes.
Can the b
  • und
b e generalized to balan ed fun tions from Fn

2

to Fm

2

, with m < n ? 43 / 43
slide-59
SLIDE 59 Some rst b
  • unds
  • n
the degree A b
  • und
  • n
the degree
  • f
SPN
  • nstru tions
Inuen e
  • f
the inverse p ermutation Generalization to balan ed fun tions (not p ermutations) DES: Eight dierent 6 × 4 Sb
  • xes.
Can the b
  • und
b e generalized to balan ed fun tions from Fn

2

to Fm

2

, with m < n ? Co rolla ry: Let F b e a balan ed fun tion from Fn

2

into Fm

2

and G b e a fun tion from Fm

2

into Fk

2

. F
  • r
any p ermutation

F ∗

expanding F , w e have

deg(G ◦ F) < n − n − 1 − deg G deg(F ∗−1)

  • .
43 / 43