The Additive Differential Probability of ARX V. Velichkov N. Mouha - PowerPoint PPT Presentation

Introduction ARX S-functions adp ARX Experiments The Additive Differential Probability of ARX V. Velichkov N. Mouha C. De Cannière B. Preneel ESAT/COSIC, K.U.Leuven; IBBT FSE 2011, February 14-16, Lyngby, Denmark 1 / 47

Introduction ARX S-functions adp ARX Experiments Outline Introduction ARX S-functions adp ARX Experiments 2 / 47

Introduction ARX S-functions adp ARX Experiments Outline Introduction ARX S-functions adp ARX Experiments 3 / 47

Introduction ARX S-functions adp ARX Experiments Differential Cryptanalysis p 1 ∆ p p 2 a 1 a 2 ∆ a b 1 ∆ b b 2 c 1 ∆ c c 2 P (∆ p → ∆ c ) =? 4 / 47

Introduction ARX S-functions adp ARX Experiments Addition, Rotation, XOR Combining ⊞ , ≪ , ⊕ improves resistance to differential cryptanalysis a 1 ◮ Addition ( ⊞ ) : non-linearity ◮ Rotation ( ≪ ) : diffusion within a ARX single word ◮ XOR ( ⊕ ): diffusion between words b 1 5 / 47

Introduction ARX S-functions adp ARX Experiments Differential Properties of Addition, Rotation, XOR: Previous Work P ARX ⊞ ≪ ⊕ adp ≪ adp ⊕ adp ARX ∆ + 1 xdp ARX ⇔ xdp + xdp + ∆ ⊕ 1 1 adp : additive differential probability xdp : xor differential probability 6 / 47

Introduction ARX S-functions adp ARX Experiments Outline Introduction ARX S-functions adp ARX Experiments 7 / 47

Introduction ARX S-functions adp ARX Experiments The ARX Operation ARX ( a , b , d , r ) = (( a + b ) ≪ r ) ⊕ d = e a b d ≪ r e 8 / 47

Introduction ARX S-functions adp ARX Experiments adp ARX : the Additive Differential Probability of ARX → ∆ e ) � |{ ( c 1 , d 1 ) : e 2 − e 1 = ∆ e }| r adp ARX (∆ c , ∆ d − |{ ( c 1 , d 1 ) }| ( a 1 , a 1 + ∆ a ) ( b 1 , b 1 + ∆ b ) ( d 1 , d 1 + ∆ d ) ≪ r ( c 1 , c 1 + ∆ c ) ( e 1 , e 2 ) : ∆ e 9 / 47

Introduction ARX S-functions adp ARX Experiments Estimation of adp ARX using adp ≪ and adp ⊕ r r adp ARX (∆ c , ∆ d → ∆ e ) ≈ adp ≪ (∆ c → ∆ q i ) · adp ⊕ (∆ q i , ∆ d → ∆ e ) � − − i ∆ a ∆ b ∆ d adp ≪ ≪ r ∆ c ∆ q i ∆ e adp ⊕ 10/ 47

Introduction ARX S-functions adp ARX Experiments 4-bit Example: adp ARX � = � adp ≪ · adp ⊕ ∆ a = 8 ∆ b = 0 ∆ d = 0 ≪ 1 ∆ e = 1 11/ 47

Introduction ARX S-functions adp ARX Experiments 4-bit Example: adp ARX � = � adp ≪ · adp ⊕ ∆ a = 8 ∆ b = 0 ∆ d = 0 1 ≪ 1 ∆ c = 8 ∆ e = 1 12/ 47

Introduction ARX S-functions adp ARX Experiments 4-bit Example: adp ARX � = � adp ≪ · adp ⊕ ∆ a = 8 ∆ b = 0 ∆ d = 0 2 − 1 1 ≪ 1 ∆ c = 8 ∆ q 1 = 1 ∆ e = 1 13/ 47

Introduction ARX S-functions adp ARX Experiments 4-bit Example: adp ARX � = � adp ≪ · adp ⊕ ∆ a = 8 ∆ b = 0 ∆ d = 0 2 − 1 2 − 1 1 ≪ 1 ∆ c = 8 ∆ q 1 = 1 , ∆ q 2 = 15 ∆ e = 1 14/ 47

Introduction ARX S-functions adp ARX Experiments 4-bit Example: adp ARX � = � adp ≪ · adp ⊕ ∆ a = 8 ∆ b = 0 ∆ d = 0 2 − 1 2 − 1 1 ≪ 1 ∆ c = 8 ∆ q 1 = 1 , ∆ q 2 = 15 2 − 1 . 54 ∆ e = 1 2 − 1 . 54 15/ 47

Introduction ARX S-functions adp ARX Experiments 4-bit Example: adp ARX � = � adp ≪ · adp ⊕ adp ≪ · adp ⊕ = 2 − 1 · 2 − 1 . 54 + 2 − 1 · 2 − 1 . 54 = 2 − 1 . 54 � � = adp ARX = 2 − 1 16/ 47

Introduction ARX S-functions adp ARX Experiments 4-bit Example: adp ARX � = � adp ≪ · adp ⊕ ∆ a = 8 ∆ b = 0 ∆ d = 0 ∆ q = 1 ≪ 1 ∆ c = 8 ( q 1 , q 2 ) = ( 1 , 2 ) ∆ e = 1 17/ 47

Introduction ARX S-functions adp ARX Experiments 4-bit Example: adp ARX � = � adp ≪ · adp ⊕ ∆ a = 8 ∆ b = 0 ∆ d = 0 ∆ q = 1 ≪ 1 ∆ c = 8 ( q 1 , q 2 ) = ( 1 , 2 ) ∆ e = 1 18/ 47

Introduction ARX S-functions adp ARX Experiments 4-bit Example: adp ARX � = � adp ≪ · adp ⊕ ∆ a = 8 ∆ b = 0 ∆ d = 0 ∆ q = 1 ≪ 1 ∆ c = 8 � = ∆ c ′ = 9 ( q 1 , q 2 ) = ( 1 , 2 ) ≫ 1 ∆ e = 1 19/ 47

Introduction ARX S-functions adp ARX Experiments ARX as a Single Operation ∆ a ∆ b ∆ d ≪ r ∆ c ∆ q ∆ e 20/ 47

Introduction ARX S-functions adp ARX Experiments Outline Introduction ARX S-functions adp ARX Experiments 21/ 47

Introduction ARX S-functions adp ARX Experiments S-function [Mouha et al.,SAC 2010] Simple 4-bit example: a + b = c ( c [ i ] , S [ i + 1 ]) = f ( a [ i ] , b [ i ] , S [ i ]) , 0 ≤ i < 4 . a [ 3 ] b [ 3 ] a [ 2 ] b [ 2 ] a [ 1 ] b [ 1 ] a [ 0 ] b [ 0 ] S [ 4 ] S [ 3 ] S [ 2 ] S [ 1 ] S [ 0 ] c [ 3 ] c [ 2 ] c [ 1 ] c [ 0 ] 22/ 47

Introduction ARX S-functions adp ARX Experiments S-functions: General Case An S-function accepts n -bit words a 1 , a 2 , . . . , a k and an n -digit input state S , and produces an n -bit output word b : ( b [ i ] , S [ i + 1 ]) = f ( a 1 [ i ] , a 2 [ i ] , . . . , a k [ i ] , S [ i ]) , 0 ≤ i < n . a 1 [ n − 1] a 2 [ n − 1] a k [ n − 1] a 1 [1] a 2 [1] a k [1] a 1 [0] a 2 [0] a k [0] . . . . . . . . . S [ n ] S [ n − 1] S [2] S [1] S [0] f f f . . . b [ n − 1] b [1] b [0] 23/ 47

Introduction ARX S-functions adp ARX Experiments S-function for adp ⊕ (∆ e [ i ] , S [ i + 1 ]) = f ( c 1 [ i ] , d 1 [ i ] , ∆ c [ i ] , ∆ d [ i ] , S [ i ]) , 0 ≤ i < n ∆ c ∆ d c 2 ← c 1 + ∆ c ,    d 2 ← d 1 + ∆ d ,      e 1 ← c 1 ⊕ d 1 , e 2 ← c 2 ⊕ d 2 ,      ∆ e ← e 2 − e 1   ∆ e 24/ 47

Introduction ARX S-functions adp ARX Experiments The State S The state S [ i + 1 ] at time i + 1 is composed of two carries and one borrow : S [ i + 1 ] ← ( s 1 [ i + 1 ] , s 2 [ i + 1 ] , s 3 [ i + 1 ]) , where s 1 [ i + 1 ] ← ( c 1 [ i ] + ∆ c [ i ] + s 1 [ i ]) ≫ 1 , s 2 [ i + 1 ] ← ( d 1 [ i ] + ∆ d [ i ] + s 2 [ i ]) ≫ 1 , s 3 [ i + 1 ] ← ( e 2 [ i ] − e 1 [ i ] + s 3 [ i ]) ≫ 1 . The initial state is S [ 0 ] = ( 0 , 0 , 0 ) 25/ 47

Introduction ARX S-functions adp ARX Experiments All States S [ i ] has fixed size of 3 bits. There are 8 states in total: S [ i ] 0 1 2 3 4 5 6 7 s 1 [ i ] , s 2 [ i ] , s 3 [ i ] 0,0,-1 1,0,-1 0,1,-1 1,1,-1 0,0,0 1,0,0 0,1,0 1,1,0 ◮ One adjacency matrix describes ◮ all transitions S [ i ] → S [ i + 1 ] for fixed (∆ c [ i ] , ∆ d [ i ] , ∆ e [ i ]) ◮ Eight adjacency matrices in total ◮ one for each 3-tuple (∆ c [ i ] , ∆ d [ i ] , ∆ e [ i ]) ◮ computed using the S-function for adp ⊕ 26/ 47

Introduction ARX S-functions adp ARX Experiments The Adjacency Matrices (∆ c [ i ] , ∆ d [ i ] , ∆ e [ i ]) = ( 0 , 1 , 1 ) S [ i ] Interpretation: 0 1 2 3 4 5 6 7 There are 4 pairs   0 0 1 0 0 1 0 0 0 ( c 1 [ i ] , d 1 [ i ]) 1 0 1 0 0 0 0 0 0   for which   2 0 1 4 0 1 0 0 1   (∆ c [ i ] , ∆ d [ i ] → ∆ e [ i ]) ,   3 0 1 0 0 0 0 0 1 S [ i + 1 ]     and 4 0 0 0 0 1 0 0 0   S [ i ] = 2 → S [ i + 1 ] = 2   5 0 0 0 0 0 0 0 0     6 0 0 0 0 1 0 0 1   7 0 0 0 0 0 0 0 1 A 011 27/ 47

Introduction ARX S-functions adp ARX Experiments Example: adp ⊕ (∆ c , ∆ d → ∆ e ) MSB LSB 0 0 0 1 ∆ c 0 0 0 0 ∆ d 0 0 0 1 ∆ e 28/ 47

Introduction ARX S-functions adp ARX Experiments Example: adp ⊕ (∆ c , ∆ d → ∆ e ) MSB LSB 0 0 0 1 ∆ c 0 0 0 0 ∆ d 0 0 0 1 ∆ e 0 2 3 0 6 7 0 6 7 6 7 A 101 0 6 7 6 7 ← S [ 0 ] = ( 0 , 0 , 0 ) 1 6 7 6 7 0 6 7 6 7 0 4 5 0 29/ 47

Introduction ARX S-functions adp ARX Experiments Example: adp ⊕ (∆ c , ∆ d → ∆ e ) MSB LSB 0 0 0 1 ∆ c 0 0 0 0 ∆ d 0 0 0 1 ∆ e 0 2 3 0 6 7 0 6 7 6 7 A 000 A 101 0 6 7 6 7 ← S [ 0 ] = ( 0 , 0 , 0 ) 1 6 7 6 7 0 6 7 6 7 0 4 5 0 30/ 47

Introduction ARX S-functions adp ARX Experiments Example: adp ⊕ (∆ c , ∆ d → ∆ e ) MSB LSB 0 0 0 1 ∆ c 0 0 0 0 ∆ d 0 0 0 1 ∆ e 0 2 3 0 6 7 0 6 7 6 7 A 000 A 000 A 101 0 6 7 6 7 ← S [ 0 ] = ( 0 , 0 , 0 ) 1 6 7 6 7 0 6 7 6 7 0 4 5 0 31/ 47

Introduction ARX S-functions adp ARX Experiments Example: adp ⊕ (∆ c , ∆ d → ∆ e ) MSB LSB 0 0 0 1 ∆ c 0 0 0 0 ∆ d 0 0 0 1 ∆ e T 0 1 2 3 2 3 0 1 6 7 6 7 1 0 6 7 6 7 6 7 6 7 � 4 A 000 A 000 A 000 A 101 0 2 − 1 . 54 = 1 6 7 6 7 � 1 6 7 ← S [ 0 ] = ( 0 , 0 , 0 ) 6 7 1 1 4 6 7 6 7 6 7 6 7 0 1 6 7 6 7 6 7 6 7 0 1 4 5 4 5 0 1 32/ 47

Introduction ARX S-functions adp ARX Experiments Outline Introduction ARX S-functions adp ARX Experiments 33/ 47

Introduction ARX S-functions adp ARX Experiments ARX : Circumventing the Intermediate Values a 1 [ i ] b 1 [ i ] d 1 [ i ] ≪ r c 1 [ i ] q 1 [ i ]= c 1 [ i − r ] e 1 [ i ] 34/ 47

Introduction ARX S-functions adp ARX Experiments ARX : Circumventing the Intermediate Values a 1 [ i ] b 1 [ i ] d 1 [ i + r ] ≪ r c 1 [ i ] q 1 [ i + r ]= c 1 [ i ] e 1 [ i + r ] 35/ 47

Introduction ARX S-functions adp ARX Experiments ARX : Circumventing the Intermediate Values a 1 [ i ] b 1 [ i ] d 1 [ i + r ] ≪ r c 1 [ i ] q 1 [ i + r ]= c 1 [ i ] e 1 [ i + r ] 36/ 47