[PPT] - The Subterranean 2.0 Cipher Suite Joan Daemen 1 , Pedro Maat Costa PowerPoint Presentation

SLIDE 1

The Subterranean 2.0 Cipher Suite

Joan Daemen1, Pedro Maat Costa Massolino3, Alireza Mehrdad1, Yann Rotella2

1Radboud University NL, 3PQShield UK, 2UVSQ, LMV, Universit´

e Paris-Saclay FR Fast Software Encryption Workshop November 9, 2020

1/22

SLIDE 2

Subterranean [JDA 1992]: a stream/hash module

control

• C
❄

state a C

•

✲ ❄

R

✻ C

✲

shift register b

2/22

SLIDE 3

Subterranean [JDA 1992]: a stream/hash module

control

• C
❄

state a C

•

✲ ❄

R

✻ C

✲

shift register b

Subhash:

M → h

2/22

SLIDE 4

Subterranean [JDA 1992]: a stream/hash module

control

• C
❄

state a C

•

✲ ❄

R

✻ C

✲

shift register b

Subhash:

M → h Substream: (K; D) → Z

2/22

SLIDE 5

Subterranean [JDA 1992]: a stream/hash module

absorb here control

• C
❄

state a C

•

✲ ❄

R

✻ C

✲

shift register b

Subhash:

M → h Substream: (K; D) → Z

2/22

SLIDE 6

Subterranean [JDA 1992]: a stream/hash module

absorb here blank rounds control

• C
❄

state a C

•

✲ ❄

R

✻ C

✲

shift register b

Subhash:

M → h Substream: (K; D) → Z

2/22

SLIDE 7

Subterranean [JDA 1992]: a stream/hash module

absorb here blank rounds squeeze here control

• C
❄

state a C

•

✲ ❄

R

✻ C

✲

shift register b

Subhash:

M → h Substream: (K; D) → Z

2/22

SLIDE 8

Subterranean’s round function R

b: 256-bit shift register with 32-bit stages

3/22

SLIDE 9

Subterranean’s round function R

b: 256-bit shift register with 32-bit stages a: 257-bit state: a ← R(a, b)

a0 . . . a76 a77 a78 a79 a80 a81 a82 a83 a84 a85 a86 . . . t π σ[b] θ ς γ ❄

✛

▽

✁

✁ ☛ ✟ ✟ ✙ ❄

❄
❄

✡✠

✛

❄

✡✠
✛

❄

✡✠
✛

✁ ✁ ☛ ✟ ✟ ✙ b3

10

✛

64

88 100 112 124 136 P P P P P ❍ ❍ ❍ ❍ ❅ ❅

✟✟✟

✟ ✏✏✏✏ ✏ ✘✘✘ ✘ ✥ ✥ a0 . . . a91 a92 a93 . . . t + 1

3/22

SLIDE 10

Could Subterranean 1992 compete in the lightweight competition 2020?

4/22

SLIDE 11

Could Subterranean 1992 compete in the lightweight competition 2020?

In 1992 it was not intended as lightweight
257-bit CV (the state)
compare with 128-bit CVs in MD4 and MD5

4/22

SLIDE 12

Could Subterranean 1992 compete in the lightweight competition 2020?

In 1992 it was not intended as lightweight
257-bit CV (the state)
compare with 128-bit CVs in MD4 and MD5
R is hardware-oriented and unsuitable for software

4/22

SLIDE 13

Could Subterranean 1992 compete in the lightweight competition 2020?

In 1992 it was not intended as lightweight
257-bit CV (the state)
compare with 128-bit CVs in MD4 and MD5
R is hardware-oriented and unsuitable for software
but we would go for low energy and that implies ASIC anyway

4/22

SLIDE 14

Could Subterranean 1992 compete in the lightweight competition 2020?

In 1992 it was not intended as lightweight
257-bit CV (the state)
compare with 128-bit CVs in MD4 and MD5
R is hardware-oriented and unsuitable for software
but we would go for low energy and that implies ASIC anyway
Low energy?
R takes 4 XOR, 1 NAND, 1 NOT per bit and is shallow
absorbing: 32 bits per round → 32 XOR, 8 NAND, 8 NOT per bit
squeezing: 16 bits per round → 64 XOR, 16 NAND, 16 NOT per bit

4/22

SLIDE 15

Could Subterranean 1992 compete in the lightweight competition 2020?

In 1992 it was not intended as lightweight
257-bit CV (the state)
compare with 128-bit CVs in MD4 and MD5
R is hardware-oriented and unsuitable for software
but we would go for low energy and that implies ASIC anyway
Low energy?
R takes 4 XOR, 1 NAND, 1 NOT per bit and is shallow
absorbing: 32 bits per round → 32 XOR, 8 NAND, 8 NOT per bit
squeezing: 16 bits per round → 64 XOR, 16 NAND, 16 NOT per bit
Not bad, so let’s give it a shot!

4/22

SLIDE 16

Subterranean 2.0 is Subterranean 1992 refurbished

Three primitives XOF: unkeyed hashing with arbitrary-length output & input strings Deck: keyed function with arbitrary-length output & input strings SAE: session-supporting nonce-based authentication encryption

5/22

SLIDE 17

Subterranean 2.0 is Subterranean 1992 refurbished

Three primitives XOF: unkeyed hashing with arbitrary-length output & input strings Deck: keyed function with arbitrary-length output & input strings SAE: session-supporting nonce-based authentication encryption Refactoring into two levels

5/22

SLIDE 18

Subterranean 2.0 is Subterranean 1992 refurbished

Three primitives XOF: unkeyed hashing with arbitrary-length output & input strings Deck: keyed function with arbitrary-length output & input strings SAE: session-supporting nonce-based authentication encryption Refactoring into two levels

Duplex
Mode

5/22

SLIDE 19

Subterranean 2.0 is Subterranean 1992 refurbished

Three primitives XOF: unkeyed hashing with arbitrary-length output & input strings Deck: keyed function with arbitrary-length output & input strings SAE: session-supporting nonce-based authentication encryption Refactoring into two levels

Duplex
r = 32 in squeezing and keyed absorbing
Mode

5/22

SLIDE 20

Subterranean 2.0 is Subterranean 1992 refurbished

Three primitives XOF: unkeyed hashing with arbitrary-length output & input strings Deck: keyed function with arbitrary-length output & input strings SAE: session-supporting nonce-based authentication encryption Refactoring into two levels

Duplex
r = 32 in squeezing and keyed absorbing
r = 8 per 2 rounds in unkeyed absorbing (for 112 bits of security)
Mode

5/22

SLIDE 21

Subterranean 2.0 is Subterranean 1992 refurbished

Three primitives XOF: unkeyed hashing with arbitrary-length output & input strings Deck: keyed function with arbitrary-length output & input strings SAE: session-supporting nonce-based authentication encryption Refactoring into two levels

Duplex
r = 32 in squeezing and keyed absorbing
r = 8 per 2 rounds in unkeyed absorbing (for 112 bits of security)
delete shift register b and just absorb in, and squeeze from a
Mode

5/22

SLIDE 22

Subterranean 2.0 is Subterranean 1992 refurbished

Three primitives XOF: unkeyed hashing with arbitrary-length output & input strings Deck: keyed function with arbitrary-length output & input strings SAE: session-supporting nonce-based authentication encryption Refactoring into two levels

Duplex
r = 32 in squeezing and keyed absorbing
r = 8 per 2 rounds in unkeyed absorbing (for 112 bits of security)
delete shift register b and just absorb in, and squeeze from a
Mode
8 blank rounds between absorbing and squeezing

5/22

SLIDE 23

Subterranean 2.0 is Subterranean 1992 refurbished

Three primitives XOF: unkeyed hashing with arbitrary-length output & input strings Deck: keyed function with arbitrary-length output & input strings SAE: session-supporting nonce-based authentication encryption Refactoring into two levels

Duplex
r = 32 in squeezing and keyed absorbing
r = 8 per 2 rounds in unkeyed absorbing (for 112 bits of security)
delete shift register b and just absorb in, and squeeze from a
Mode
8 blank rounds between absorbing and squeezing
except for encryption/decryption in SAE that relies on nonce uniqueness

5/22

SLIDE 24

And now to Subterranean 2.0 and its rationale in more detail!

6/22

SLIDE 25

Subterranean-XOF

R2 M0 R2 M1 R2 Mi

R8

Z0 R Z1 R Z2 R Z7

|Mj|: one byte
|Zj|: 4 bytes

7/22

SLIDE 26

Subterranean-Deck

R K0 R K1 R M0 R M1

R8

Z0 R Z1 R Z2 R Zi

|Mj|, |Zj|, |Kj| : 4 bytes

8/22

SLIDE 27

Subterranean-SAE

R K0 R N2

R8

R A0 R Aia Z0 R Z1 P0 R Zi+1 Pi

R8

R T0 T1 R T3

|Kj|, |Nj|, |Aj|, |Zj|, |Pj|, |Tj|: 4 bytes

9/22

SLIDE 28

The Subterranean 2.0 round function

s0 . . . s76s77s78s79s80s81s82s83s84s85s86. . . t π θ ι χ

❄

✛

▽

✁

✁ ☛ ✟ ✟ ✙ ❄

❄
❄

✝ ✆

✛

❄

✝ ✆
✛

❄

✝ ✆
✛

✁ ✁ ☛ ✟ ✟ ✙

64

88 100 112 124 136 P P P P P ❍ ❍ ❍ ❅ ❅

✟✟

✟ ✏✏✏✏ ✏ ✘✘ ✘ ✥ ✥

s0 . . . s91s92s93. . . t + 1 χ : si ← si + (si+1 + 1)si+2 ι : si ← si + δi θ : si ← si + si+3 + si+8 π : si ← s12i

10/22

SLIDE 29

Absorb and Squeeze

✲

s0 . . . s76s77s78s79s80s81s82s83s84s85s86. . . t π θ ι χ

❄

✛

▽

✁

✁ ☛ ✟ ✟ ✙ ❄

❄
❄

✝ ✆

✛

❄

✝ ✆
✛

❄

✝ ✆
✛

✁ ✁ ☛ ✟ ✟ ✙

64

88 100 112 124 136 P P P P P ❍ ❍ ❍ ❅ ❅

✟✟

✟ ✏✏✏✏ ✏ ✘✘ ✘ ✥ ✥

s0 . . . s91s92s93. . . t + 1 124 = 176 G64 = {1, 176, 136, . . . , 92} ≺ Z/257Z∗ zi = s176i + s176−i s176i = s176i + pi

11/22

SLIDE 30

Design Rationale in a nutshell

The choice of G64:

non-consecutive bits (State-Recovery attacks on Ketje Jr [Fuhr, Naya-Plasencia,

Rotella, ToSC 2018])

consistent with π dispersion

12/22

SLIDE 31

Design Rationale in a nutshell

The choice of G64:

non-consecutive bits (State-Recovery attacks on Ketje Jr [Fuhr, Naya-Plasencia,

Rotella, ToSC 2018])

consistent with π dispersion

The number of rounds:

Separator: 8 blank rounds
Unkeyed mode: 2 rounds (8 + 1 bits absorbed)
Keyed mode: 1 round (32 + 1 bits absorbed)

12/22

SLIDE 32

Third Party Cryptanalysis

Fukang Liu, Takanori Isobe and Willi Meier, Cube-Based Cryptanalysis of Subterranean-SAE, ToSC 2020

key recovery from Subterranean-SAE in nonce-misuse scenario
reduced-round scenario: 4 blank rounds out of 8

13/22

SLIDE 33

Third Party Cryptanalysis

Fukang Liu, Takanori Isobe and Willi Meier, Cube-Based Cryptanalysis of Subterranean-SAE, ToSC 2020

key recovery from Subterranean-SAE in nonce-misuse scenario
reduced-round scenario: 4 blank rounds out of 8

Ling Song, Yi Tu, Danping Shi and Lei Hu, Security Analysis of Subterranean 2.0, eprint 2020, report 1133

size-reduced versions
no observable biases
nonce-misuse scenario

13/22

SLIDE 34

Third Party Cryptanalysis

Fukang Liu, Takanori Isobe and Willi Meier, Cube-Based Cryptanalysis of Subterranean-SAE, ToSC 2020

key recovery from Subterranean-SAE in nonce-misuse scenario
reduced-round scenario: 4 blank rounds out of 8

Ling Song, Yi Tu, Danping Shi and Lei Hu, Security Analysis of Subterranean 2.0, eprint 2020, report 1133

size-reduced versions
no observable biases
nonce-misuse scenario

More work is welcome

13/22

SLIDE 35

Difference propagation

m0 Rr c0 m1 Rr c1 ∆0 ∆r

Security: max DP(∆0 → ∆r)

14/22

SLIDE 36

Difference propagation

m0 Rr c0 m1 Rr c1 ∆0 ∆r

Security: max DP(∆0 → ∆r)

It is hard to determine

14/22

SLIDE 37

Difference propagation

. . . m0 R R R c0 . . . m1 R R R c1 ∆0 b1 b2 br−1 ∆r

Security: max DP(∆0 → ∆r)

It is hard to determine

max DP(∆0 → ∆r) ≈ maxQr DP(Qr)
Qr is a differential trail
∆0 → b1 → b2 → · · · → br−1 → ∆r

14/22

SLIDE 38

Difference propagation

. . . m0 R R R c0 . . . m1 R R R c1 ∆0 b1 b2 br−1 ∆r

Security: max DP(∆0 → ∆r)

It is hard to determine

max DP(∆0 → ∆r) ≈ maxQr DP(Qr)
Qr is a differential trail
∆0 → b1 → b2 → · · · → br−1 → ∆r
Trail weight: w(Q) = − log2(DP)

14/22

SLIDE 39

Differential trail core

. . . R R R ∆0 b1 b2 br−1 ∆r

15/22

SLIDE 40

Differential trail core

. . . R R R ∆0 b1 b2 br−1 ∆r . . . χ λ χ λ χ λ ∆0 ∆r b1 b2 br−1

15/22

SLIDE 41

Differential trail core

. . . R R R ∆0 b1 b2 br−1 ∆r . . . χ λ χ λ χ λ ∆0 ∆r b1 b2 br−1 a1 a2 ar

15/22

SLIDE 42

Differential trail core

. . . R R R ∆0 b1 b2 br−1 ∆r . . . χ λ χ λ χ λ ∆0 ∆r b1 b2 br−1 a1 a2 ar w(Qr) = w(∆0 → a1) +

r−1

i=1

w(bi → ai+1)

15/22

SLIDE 43

Differential trail core

. . . R R R ∆0 b1 b2 br−1 ∆r . . . χ λ χ λ χ λ ∆0 ∆r b1 b2 br−1 a1 a2 ar w(Qr) = w(∆0 → a1) +

r−1

i=1

w(bi → ai+1) = min w−1(a1) +

r−1

i=1

w(bi)

15/22

SLIDE 44

Lower bound on the weight of differential trail cores

# rounds: 1 2 3 4 5 6 7 8 lower bound: ? ? ? ? ? ? ? ?

16/22

SLIDE 45

Lower bound on the weight of differential trail cores

# rounds: 1 2 3 4 5 6 7 8 lower bound: 2 8 ? ? ? ? ? ?

16/22

SLIDE 46

Lower bound on the weight of differential trail cores

# rounds: 1 2 3 4 5 6 7 8 lower bound: 2 8 ? ? ? ? ? ?

We generated all 3-round trails cores up to weight 39

The same method as introduced in [Mella, Daemen, Van Assche, ToSC 2016]

16/22

SLIDE 47

Lower bound on the weight of differential trail cores

# rounds: 1 2 3 4 5 6 7 8 lower bound: 2 8 25 ? ? ? ? ?

We generated all 3-round trails cores up to weight 39

The same method as introduced in [Mella, Daemen, Van Assche, ToSC 2016]

weight 25 28 29 30 32 33 34 35 36 37 38 39 # trail cores ( mod rotation) 1 1 2 3 2 1 5 6 4 9 12 17

16/22

SLIDE 48

Lower bound on the weight of differential trail cores

# rounds: 1 2 3 4 5 6 7 8 lower bound: 2 8 25 ? ? ? ? ?

We generated all 3-round trails cores up to weight 39

The same method as introduced in [Mella, Daemen, Van Assche, ToSC 2016]

weight 25 28 29 30 32 33 34 35 36 37 38 39 # trail cores ( mod rotation) 1 1 2 3 2 1 5 6 4 9 12 17

3-round trail core with the lowest weight

state weight # active bits active bit positions a1 2 1 {0} b1 6 3 {0, 64, 85} b2 17 9 {0, 64, 85, 91, 155, 157, 176, 221, 242}

16/22

SLIDE 49

Lower bound for 4-round differential trail cores

We searched the space of all 4-round trail cores up to weight 48

17/22

SLIDE 50

Lower bound for 4-round differential trail cores

We searched the space of all 4-round trail cores up to weight 48
there are no trail cores with weight 48 or less

17/22

SLIDE 51

Lower bound for 4-round differential trail cores

We searched the space of all 4-round trail cores up to weight 48
there are no trail cores with weight 48 or less
we did find 4-round trail core with weight 58

17/22

SLIDE 52

Lower bound for 4-round differential trail cores

We searched the space of all 4-round trail cores up to weight 48
there are no trail cores with weight 48 or less
we did find 4-round trail core with weight 58
so 49 ≤ min w(Q4) ≤ 58

17/22

SLIDE 53

Lower bound for 4-round differential trail cores

We searched the space of all 4-round trail cores up to weight 48
there are no trail cores with weight 48 or less
we did find 4-round trail core with weight 58
so 49 ≤ min w(Q4) ≤ 58
The 4-round trail core with weight 58:

state weight # active bits active bit positions a1 12 9 {0, 5, 8, 10, 12, 15, 16, 18, 21} b1 7 5 {65, 66, 85, 86, 87} b2 11 6 {7, 28, 134, 198, 200, 219} b3 28 15 {16, 18, 22, 39, 54, 86, 88, 107, 118, 139, 152, 173, 188, 211, 252}

17/22

SLIDE 54

Lower bounds on differential trails

# rounds: 1 2 3 4 5 6 7 8 lower bound: 2 8 25 [49, 58] ? ? ? ?

18/22

SLIDE 55

Lower bounds on differential trails

# rounds: 1 2 3 4 5 6 7 8 lower bound: 2 8 25 [49, 58] ? ? ? ?

An 8-round trail Q8 can be divided into two 4-round trails Q4 | Q′

4 18/22

SLIDE 56

Lower bounds on differential trails

# rounds: 1 2 3 4 5 6 7 8 lower bound: 2 8 25 [49, 58] ? ? ? ?

An 8-round trail Q8 can be divided into two 4-round trails Q4 | Q′

4

If w(Q8) ≤ (2 × 48) + 1 = 97 then w(Q4) ≤ 48 or w(Q′

4) ≤ 48 18/22

SLIDE 57

Lower bounds on differential trails

# rounds: 1 2 3 4 5 6 7 8 lower bound: 2 8 25 [49, 58] ? ? ? ≥ 98

An 8-round trail Q8 can be divided into two 4-round trails Q4 | Q′

4

If w(Q8) ≤ (2 × 48) + 1 = 97 then w(Q4) ≤ 48 or w(Q′

4) ≤ 48 18/22

SLIDE 58

Lower bounds on differential trails

# rounds: 1 2 3 4 5 6 7 8 lower bound: 2 8 25 [49, 58] ≥ 54 ≥ 65 ≥ 70 ≥ 98

An 8-round trail Q8 can be divided into two 4-round trails Q4 | Q′

4

If w(Q8) ≤ (2 × 48) + 1 = 97 then w(Q4) ≤ 48 or w(Q′

4) ≤ 48

Different methods to find the lower bound on the weight of other trails

18/22

SLIDE 59

Hardware LWC architecture

Streaming based architecture - high throughput
Separate buffers for public and secret data in (PDI/SDI)
Flow controlled by main state machine

19/22

SLIDE 60

FPGA Results

Mohajerani et al. “FPGA Benchmarking of Round 2 Candidates in the NIST Lightweight Cryptography Standardization Process: Methodology, Metrics, Tools, and Results”. https://eprint.iacr.org/2020/1207

1st AEAD throughput for messages of 64 bytes or more in Artix 7
6th Hash throughput for long messages in Artix 7

AEAD Throughput LUT Subterranean 2.0 6 Gbps 915 Xoodyak 3 Gbps 2040 Hash Throughput LUT Gimli 1.9 Gbps 1900 Xoodyak 1.8 Gbps 2040 Saturnin 1.6 Gbps 2414 DryGascon 1.5 Gbps 2074 Ascon 987 Mbps 1723 Subterranean 2.0 744 Mbps 915

20/22

SLIDE 61

ASIC Results

Khairallah et al. “Preliminary Hardware Benchmarking of a Group of Round 2 NIST Lightweight AEAD Candidates”. https://github.com/mustafam001/lwc-aead-rtl

AEAD for ASIC cells TSMC TSBN 65nm 9-track
1st in Throughput and Energy
Results for 64 bytes messages:

AEAD Throughput Area (GE) Energy (pJ) Clock period (ns) Subterranean 2.0 17 Gbps 7050 16 0.47 Romulus 8 Gbps 14218 44 0.88 Xoodyak 12 Gbps 17898 51 0.50

21/22

SLIDE 62

Conclusion

Subterranean 2.0 in a nutshell:

22/22

SLIDE 63

Conclusion

Subterranean 2.0 in a nutshell:

Target security strength
128 bits for keyed modes: Deck and SAE
112 bits for unkeyed mode: XOF

22/22

SLIDE 64

Conclusion

Subterranean 2.0 in a nutshell:

Target security strength
128 bits for keyed modes: Deck and SAE
112 bits for unkeyed mode: XOF
Safety margin is comfortable, per our analysis and two 3rd-party papers

22/22

SLIDE 65

Conclusion

Subterranean 2.0 in a nutshell:

Target security strength
128 bits for keyed modes: Deck and SAE
112 bits for unkeyed mode: XOF
Safety margin is comfortable, per our analysis and two 3rd-party papers
more 3rd party cryptanalysis is welcome!

22/22

SLIDE 66

Conclusion

Subterranean 2.0 in a nutshell:

Target security strength
128 bits for keyed modes: Deck and SAE
112 bits for unkeyed mode: XOF
Safety margin is comfortable, per our analysis and two 3rd-party papers
more 3rd party cryptanalysis is welcome!
Lightweight

22/22

SLIDE 67

Conclusion

Subterranean 2.0 in a nutshell:

Target security strength
128 bits for keyed modes: Deck and SAE
112 bits for unkeyed mode: XOF
Safety margin is comfortable, per our analysis and two 3rd-party papers
more 3rd party cryptanalysis is welcome!
Lightweight
total storage in SAE and XOF: 257-bit state and some 32-bit I/O buffers

22/22

SLIDE 68

Conclusion

Subterranean 2.0 in a nutshell:

Target security strength
128 bits for keyed modes: Deck and SAE
112 bits for unkeyed mode: XOF
Safety margin is comfortable, per our analysis and two 3rd-party papers
more 3rd party cryptanalysis is welcome!
Lightweight
total storage in SAE and XOF: 257-bit state and some 32-bit I/O buffers
# operations per absorbed/squeezed bit very low

22/22

SLIDE 69

Conclusion

Subterranean 2.0 in a nutshell:

Target security strength
128 bits for keyed modes: Deck and SAE
112 bits for unkeyed mode: XOF
Safety margin is comfortable, per our analysis and two 3rd-party papers
more 3rd party cryptanalysis is welcome!
Lightweight
total storage in SAE and XOF: 257-bit state and some 32-bit I/O buffers
# operations per absorbed/squeezed bit very low
especially non-linear operations → suitable for masking

22/22

SLIDE 70

Conclusion

Subterranean 2.0 in a nutshell:

Target security strength
128 bits for keyed modes: Deck and SAE
112 bits for unkeyed mode: XOF
Safety margin is comfortable, per our analysis and two 3rd-party papers
more 3rd party cryptanalysis is welcome!
Lightweight
total storage in SAE and XOF: 257-bit state and some 32-bit I/O buffers
# operations per absorbed/squeezed bit very low
especially non-linear operations → suitable for masking
confirmed by benchmarks

22/22

SLIDE 71

Conclusion

Subterranean 2.0 in a nutshell:

Target security strength
128 bits for keyed modes: Deck and SAE
112 bits for unkeyed mode: XOF
Safety margin is comfortable, per our analysis and two 3rd-party papers
more 3rd party cryptanalysis is welcome!
Lightweight
total storage in SAE and XOF: 257-bit state and some 32-bit I/O buffers
# operations per absorbed/squeezed bit very low
especially non-linear operations → suitable for masking
confirmed by benchmarks

Thanks for your attention!

22/22