Linear and Differential Cryptanalysis-Computer Security-Lecture Handout, Exercises of Computer Security

Download Linear and Differential Cryptanalysis-Computer Security-Lecture Handout and more Exercises Computer Security in PDF only on Docsity! Contents 1 Introduction 3 2 Linear Cryptanalysis 3 2.1 Substitution permutation network . . . . . . . . . . . . . . . . . . . . 3 2.2 Overview of the attack . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 2.3 Finding a linear approximation . . . . . . . . . . . . . . . . . . . . . . 5 2.3.1 Linear Approximation for a single S-box . . . . . . . . . . . . 6 2.3.2 Linear Approximation for the complete cipher . . . . . . . . . 6 2.4 The actual attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 2.5 Conclusion on Linear Cryptanalysis . . . . . . . . . . . . . . . . . . . 9 3 Differential Cryptanalysis 10 3.1 Difference Distributions . . . . . . . . . . . . . . . . . . . . . . . . . . 10 3.2 Differential Characteristic . . . . . . . . . . . . . . . . . . . . . . . . . 12 3.3 Key Bit Extraction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 4 Linear Attack against DES 15 4.1 The Data Encryption Standard . . . . . . . . . . . . . . . . . . . . . . 15 4.2 Linear Approximations for DES . . . . . . . . . . . . . . . . . . . . . . 15 4.3 The attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 4.3.1 The full 16 rounds DES . . . . . . . . . . . . . . . . . . . . . . . 16 5 Block cipher design to prevent these attacks 17 5.1 Good Diffusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 5.2 High Nonlinearity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 5.3 Linear Transformation . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 5.4 Conclusions On SPN Design Principles . . . . . . . . . . . . . . . . . 20 6 Conclusion 21 2 docsity.com 1 Introduction The process of studying methods of encryption to obtain information from en- crypted data without knowing the secret key is called cryptanalysis. It is usually a deep analysis and attacking of an encryption method to find the secret key. In this report we are going to introduce two cryptanalysis techniques, namely Linear and Differential cryptanalysis. In the first section we describe linear crypt- analysis, with a small example Substitution Permutation Network (SPN), in section 3 we explain the differential cryptanalysis and the idea of extracting key bits of a SPN by looking at the differences between input and output pairs. In section 4 we explain how the linear cryptanalysis can be applied to the Data Encryption Standard (DES). First by a small 3 rounds DES and then the full 16 rounds DES. In section 5 we describe what can be done to prevent linear and differential crypt- analysis attacks and make the SPN resistant. 2 Linear Cryptanalysis A linear cryptanalysis is a known plain text attack, against a block cipher. The attack was first described by Matsui in 1994 as an attack against DES [M93]. But linear cryptanalysis can be used against many other block ciphers, and must there- fore be considered when designing new block ciphers. In this section, we will describe the steps of the general linear cryptanalysis attack. But first we will introduce an SPN cipher which will be used as an example cipher. 2.1 Substitution permutation network We will now describe the general substitution permutation network (SPN), and introduce an example SPN that will be used in this section and in section 3. A SPN is a block cipher that consist of a number of rounds, each containing a substitution and a permutation. The key will normally be expanded into round keys, that will be XOR’ed at the beginning of each round. Our small example SPN1 takes as input 16 bits, and outputs 16 bits. The key is also 16 bits, but they are expanded into 5 round keys of 16 bits. In each round the 16 bits are XOR’ed with the round key, then they are split into four blocks of four bit and each block goes through a substitution box (S-box). At the end of each round, the 16 bits are permuted. In our case we use the same S-box for all blocks and all rounds. The permutation can be seen in figure 1, which shows all of the example cipher. Our concrete S-box can bee seen in figure 2. 2.2 Overview of the attack A linear cryptanalysis can be split into two steps. First you have to find a linear approximation for the SPN youwant to break. The idea is to find an approximation that only contains plaintext bits and input bits to the last round. After we have found an approximation, we are ready to make the actual attack. Notice that you don’t need any ciphertext or plaintext to do the first step. It is only an analysis of the SPN, and therefore independent of the key you want to find. This means that you only have to make the analysis once for a certain SPN. In the actual attackwe try to find some of the bits of the last round key. The idea is to calculate the input bits to the last round, that are in our approximation. We 1Borrowed from [H02] 3 docsity.com 2.3.1 Linear Approximation for a single S-box We want to find a linear equations in the input and output bits of the S-box. In our case there are 8 variables, namely X1, ..., X4, Y1, ..., Y4. We can then construct a Linear Approximation Table with the bias of all possible combinations of the variables. In our case there will be 28 = 256 entries in the table. We will write this table as a 16 × 16 table with the 16 combinations of input as rows and the 16 combinations of output as columns. We will represent the input combination X1⊕X3 as the binary number 1010, and write it as a decimal: 10. We will represent the outputs in the same way. The table can be seen in figure 3. The bias values are represented as integers that should be divided by 16 to get the actual bias. 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 0 8 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 -2 -2 0 0 -2 6 2 2 0 0 2 2 0 0 2 0 0 -2 -2 0 0 -2 -2 0 0 2 2 0 0 -6 2 3 0 0 0 0 0 0 0 0 2 -6 -2 -2 2 2 -2 -2 4 0 2 0 -2 -2 -4 -2 0 0 -2 0 2 2 -4 2 0 5 0 -2 -2 0 -2 0 4 2 -2 0 -4 2 0 -2 -2 0 6 0 2 -2 4 2 0 0 2 0 -2 2 4 -2 0 0 -2 7 0 -2 0 2 2 -4 2 0 -2 0 2 0 4 2 0 2 8 0 0 0 0 0 0 0 0 -2 2 2 -2 2 -2 -2 -6 9 0 0 -2 -2 0 0 -2 -2 -4 0 -2 2 0 4 2 -2 10 0 4 -2 2 -4 0 2 -2 2 2 0 0 2 2 0 0 11 0 4 0 -4 4 0 4 0 0 0 0 0 0 0 0 0 12 0 -2 4 -2 -2 0 2 0 2 0 2 4 0 2 0 -2 13 0 2 2 0 -2 4 0 2 -4 -2 2 0 2 0 0 2 14 0 2 2 0 -2 -4 0 2 -2 0 0 -2 -4 2 -2 0 15 0 -2 -4 -2 -2 0 2 0 0 -2 4 -2 -2 0 2 0 Figure 3: Linear Approximation table. The rows are S-box input and the columns are output. When we have made the Linear Approximation tables for all S-boxes used in the cipher, we are ready to find the linear approximation for the whole cipher. 2.3.2 Linear Approximation for the complete cipher I will start this subsection by introducing some notation2: Xi The i’th input bit to the S-box. Yi The i’th output of the S-box. Pi The i’th bit of the plaintext. Ci The i’th bit of the ciphertext. U j i The i’th bit of the input to the S-boxes in the j’th round. V j i The i’th bit of the output of the S-boxes in the j’th round. K j i The i’th bit of key in the j’th round. A[a1, a2, ..., an] The XOR between bit a1 − an, like U3[1, 5, 8] = U31 ⊕ U 3 5 ⊕ U 3 8 . To get an overview of how we construct the linear approximation, see figure 4. The first thing to do is to find a good linear approximation for an S-box in the first round. We choose S-box S12 (see Figure 1), and the equation X [1, 3, 4] ⊕ Y2 = 0, since the corresponding entry (11,4) in the Linear Approximation table has a high 2The notation is borrowed from [M93] 6 docsity.com value (in our case 4, which means a bias at 0.25). Notice that when this equation is applied to S-box S12, we get the equation U1[5, 7, 8]⊕ V 16 = 0 But U1[5, 7, 8] = P [5, 7, 8]⊕K1[5, 7, 8], and we get the equation P [5, 7, 8]⊕ V 16 ⊕K 1[5, 7, 8] = 0 (1) where the only unknown besides the key bits is V 16 . So now we will trace this bit through the cipher. Remember that the left side of the equation still have the same bias, namely 0.25. We follow the unknown bit V 16 through the permutation. In figure 4 we see that V 16 = K 2 6 ⊕ U 2 6 , so now we need a linear approximation for S-box S22, containing only one input bit, namely U26 which is the second input to S22,X2. When looking at the Linear Approximation table we find that X2 ⊕ Y [2, 4] = 0 has a good bias (- 0.25). Output 2 and 4 for S-box S22 are the bits V 2 6 and V 2 8 , and we get the equation U26 ⊕ V 2[6, 8] = 0 m V 16 ⊕K 2 6 ⊕ V 2[6, 8] = 0 (2) where the left side still have the bias -0.25. Againwe follow the bits V 2[6, 8] through the permutation, and find that V 2[6, 8] = K3[6, 14]⊕ U3[6, 14]. U36 and U 3 14 are both send as the second input bit, X2, for the S-boxes S32 and S34 respectively. This means that we can use the same linear ap- proximation for both S32 and S34 as we just did for S22, namely X2 ⊕ Y [2, 4] = 0. Output 2 and 4 for S-box S32 are the bits V 3 6 and V 3 8 , and for S-box S34 they are V 3 14 and V 316. This gives us that U36 ⊕ V 3[6, 8] = 0 m V 26 ⊕K 3 6 ⊕ V 3[6, 8] = 0 (3) and U314 ⊕ V 3[14, 16] = 0 m V 214 ⊕K 3 14 ⊕ V 3[14, 16] = 0 (4) where the left side of the equations both have bias -0.25 again. Now we can combine equation (1)-(4), by taking the XOR of all left sides and all the right sides. By eliminating duplicated bits, we get the equation P [5, 7, 8]⊕ V 3[6, 8, 14, 16]⊕K1[5, 7, 8]⊕K26 ⊕K 3 [ 6, 14] = 0 (5) Once more we follow the bits V 36 , V 3 8 , V 3 14 and V 3 16 through the permutation and find that V 3[6, 8, 14, 16] = U4[6, 8, 14, 16] ⊕ K4[6, 8, 14, 16]. If we insert that into equation (5), we finally get the linear approximation we are looking for P [5, 7, 8]⊕ U4[6, 8, 14, 16]⊕ ΣK = 0 where ΣK is an XOR of some key bits. Remember that the left side, is the XOR of four random variables, with bias 0.25, -0.25, -0.25 and -0.25 respectively. Now the Piling Up lemma tells that the bias of such an XOR is 23 · 4 16 · (− 4 16 )3 = − 1 32 7 docsity.com Figure 4: A path through our example SPN. We don not know the key bits, but we know they are fixed, meaning that the XOR ΣK is equal to 0 or 1. Therefore the bias of the random variable P [5, 7, 8]⊕ U4[6, 8, 14, 16] will be either − 132 or 1 32 . In other words we could say that the equation P [5, 7, 8]⊕ U4[6, 8, 14, 16] = 0 will be true with probability 1532 or 17 32 . So now we have found a linear approxima- tion, and we shall see how to use that in the next subsection. 8 docsity.com X ′ = 0000 then Y ′ = 1110, thus X ′′ = ∆X ⊕X ′ = 1011⊕ 0000 = 1011 then Y ′′ = 1100 and∆Y = 0010 comes from figure 6. X’ Y’ ∆Y when∆X = 1011 ∆Y when∆X = 1000 ∆Y when ∆X = 0100 0000 1110 0010 1101 1100 0001 0100 0010 1110 1011 0010 1101 0111 0101 0110 0011 0001 0010 1011 1001 0100 0010 0101 0111 1100 0101 1111 1111 0110 1011 0110 1011 0010 1011 0110 0111 1000 1101 1111 1001 1000 0011 0010 1101 0110 1001 1010 0111 1110 0011 1010 0110 0010 0101 0110 1011 1100 0010 1011 1011 1100 0101 1101 0111 0110 1101 1001 0010 0110 0011 1110 0000 1111 1011 0110 1111 0111 0101 1111 1011 Figure 6: Sample difference pairs of the S-box. From figure 6 we can see that the number of occurrence of ∆Y = 0010 given ∆X = 1011 is 8 out of 16. In the same way we can compute the probability of the other differentials, that is the number of occurrence of a differential pair (∆X, ∆Y ) divided by 16, see figure 7. Each element in the table of figure 7 presents the num- ber of occurrence of an output difference∆Y given an input difference∆X4. Before we can describe the attack we have to discuss the influence of the key on the S-box differential (considering figure 5). The input to a S-box is represented byX , the output by Y , and letW = [W1W2W3W4] denote the input to round keys, where by input the round key Wi we mean the output from the previous round before being XOR ’ed with the round key,Wi see figure 2. So the input difference to a round key is ∆W = [W ′1 ⊕W ′′ 1 W ′ 2 ⊕W ′′ 2 W ′ 3 ⊕W ′′ 3 W ′ 4 ⊕W ′′ 4 ] whereW ′ = [W ′1W ′ 2W ′ 3W ′ 4] andW ′′ = [W ′′1 W ′′ 2 W ′′ 3 W ′′ 4 ]. Lets now take a look at input difference to the round keys, since the key is the same for both inputs we have ∆Wi = W ′ i ⊕W ′′ i = (X ′ i ⊕Ki)⊕ (X ′′ i ⊕Ki) = X ′ i ⊕X ′′ i = ∆Xi since Ki ⊕ Ki = 0. Thus the input difference of the input to the round key is the same as input difference to the S-box, this is to say that the key bits do not have any influence on the input difference. 4It is worth to mention that the S-box could be ideal if the probability distribution for occurring a particular ∆Y given∆X was 1 16 , however it can be proved that this is not possible [H02]. 11 docsity.com 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 0 16 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 2 0 0 0 2 0 2 4 0 4 2 0 0 2 0 0 0 2 0 6 2 2 0 2 0 0 0 0 2 0 3 0 0 2 0 2 0 0 0 0 4 2 0 2 0 0 4 4 0 0 0 2 0 0 6 0 0 2 0 4 2 0 0 0 5 0 4 0 0 0 2 2 0 0 0 4 0 2 0 0 2 6 0 0 0 4 0 4 0 0 0 0 0 0 2 2 2 2 7 0 0 2 2 2 0 2 0 0 2 2 0 0 0 0 4 8 0 0 0 0 0 0 2 2 0 0 0 4 0 4 2 2 9 0 2 0 0 2 0 0 4 2 0 2 2 2 0 0 0 10 0 2 2 0 0 0 0 0 6 0 0 2 0 0 4 0 11 0 0 8 0 0 2 0 2 0 0 0 0 0 2 0 2 12 0 2 0 0 2 2 2 0 0 0 0 2 0 6 0 0 13 0 4 0 0 0 0 0 4 2 0 2 0 2 0 2 0 14 0 0 2 4 2 0 0 0 6 0 0 0 0 0 2 0 15 0 2 0 0 6 0 0 0 0 4 0 2 0 0 2 0 Figure 7: Difference distribution. 3.2 Differential Characteristic After handling the differential data for S-boxes in an SPN, we have enough infor- mation to find useful differential characteristic of the overall cipher. The idea is to attack the cipher by finding a subset key bits following the last round. This is done by constructing a differential characteristic of certain S-box difference pairs in each round, such that a differential involves plaintext bits and input data to the last round of S-boxes. Consider the SPN illustrated in figure 8. In this diagram the active S-boxes S12, S23, S32, and S33 have non-zero differentials. This forms a characteristic for the first three rounds of the cipher. The difference pairs of the active S-boxes are S12 : ∆X = 11 ≡ 1011→ ∆Y = 2 ≡ 0010 with probability 8 16 S23 : ∆X = 4 ≡ 0100→ ∆Y = 6 ≡ 0110 with probability 6 16 S32 : ∆X = 2 ≡ 0010→ ∆Y = 5 ≡ 0101 with probability 6 16 S33 : ∆X = 2 ≡ 0010→ ∆Y = 5 ≡ 0101 with probability 6 16 which can be verified from the table of figure 7. The other S-boxes have input difference zero. In the following we use Ui to denote the input to the i’th round S-box and Vi to denote the output of the i’th round S-box. The input difference to the first round is given by ∆U1 = [0000 1011 0000 0000] and the corresponding output difference is ∆V1 = [0000 0010 0000 0000] 12 docsity.com Figure 8: Differential Characteristic with ∆P as the input difference By looking at difference pair for S12 and the following round permutation, we realize that the input difference to the second round S-box is ∆U2 = [0000 0000 0100 0000] with probability 12 . The second round differential with respect to difference pair for S23 is ∆V2 = [0000 0000 0110 0000] and the permutation of round two gives ∆U3 = [0000 0010 0010 0000] 13 docsity.com Figure 9: An overview of the 3 rounds DES cipher. with the same probability 1264 , whereK i is the round key for the i’th round. We can remove the key bit K122, since we consider it to have a fixed value, and it therefore just determine if the probability is 1264 or 1− 12 64 . We dont mind knowing which case we are in. Notice thatX2 goes through the second round without being changed, andX2 is therefore input to the last round. So now we should invert the last round, and compute the four needed bits of X2, so we can check when the equation holds. X2 is equal to C.H ⊕ F (C.L, K3), and the only unknown is K3. We have to find the four bits of X2 using only a subset of the key bits. This is possible, since we only need four of the bit of X2. If we study the F function we find that the four bits come from a permutation, and before that the S-boxes. But since there are only four bits they can not come from more than four different S-boxes. To compute these S-boxes we need 6 key bits for each, which means that we only need 24 bits of K3 to find the needed four bits ofX2. So nowwe can go through all the 224 key candidates all our plaintext/ciphertext pairs, and compute for which key the equation is true, furthest from half the times. That candidate would be our guess for the corresponding key bits of K3. 4.3.1 The full 16 rounds DES To attack the full 16 rounds DES, one would need the equations as stated in sub- section 4.2. Using these equations as approximations of the F-functions in DES 16 docsity.com reduced to 15 rounds we get the following linear approximation: P.H [7, 18, 24]⊕ P.L[12, 16]⊕ C.H15[7, 18, 24, 29]⊕ C.L1515 ⊕ Σkey = 0 (7) Where C.L15 and C.H15 are the right and left sides of the ciphertext achieved from this reduced DES respectively. Σkey is the XOR of several round key bits from dif- ferent rounds, but as explained above we will however not care very much about these bits since they are fixed and thus their XOR is also fixed. [?] states that this is the best approximation of 15 rounds of DES and that it has bias 1.19−22. We can then extend the reducedDES to a full 16 DES cipher by adding onemore round. Now since the 15’th round will no longer be the last round this will swap the positions ofC.L15 andC.H15. Let us writeC.H15 = X.L15 andC.L15 = X.H15. We then get the following approximation from (7): P.H [7, 18, 24]⊕ P.L[12, 16]⊕X.L15[7, 18, 24, 29]⊕X.H1515 = 0 (8) Notice that we have now omitted Σkey as argued above. (8) is then the approx- imation we would like to check by inverting the last round of the 16 DES cipher. Now let C.L and C.H be the right and left part of the ciphertext obtained from 16 round DES. We can then decipher the ciphertext of 16 round DES by one round to get the input to the 16’th round X.L15 and X.H15. By simple definition of DES we have that: X.L15 = C.L and X.H15 = C.H ⊕ F (X.L15, K16) = C.H ⊕ F (C.L, K16) So applying this to (8), we can check if the approximation holds for a given key K16 by checking if the following holds: P.H [7, 18, 24]⊕ P.L[12, 16]⊕ C.L[7, 18, 24, 29]⊕ C.H1515 ⊕ F (C.L, K 16)15 = 0 The only part of this equation that is not given in the plaintext/ciphertext pair is then the bit F (C.L, K16)15. This bit however is only affected by a single S-box of F so only 6 bits of K16 is needed to check if the equation holds (since S-boxes take 6bit inputs). We can now obtain the correct 6 key bits as described above. The remaining key bits can then be obtained by exhaustive search. In [M94] Matsui uses the round symmetry of DES to create an other linear ap- proximation corresponding to (7) with the same bias. By also using this approx- imation, we can obtain further 6 key bits. So a total of 12 key bits can be found in this way. Matsui uses a slightly different algorithm from the one we have pre- sented. This also obtains the bit Σkey for each approximation, and this way one could obtain as much as 14 key bits. In [?] Matsui improved this algorithm by instead using a approximation of 14 round approximation of DES. This way he obtained 26 key bits. Matsui estimates that the original attack needs 247 plaintext/chipertext pairs in order to be successful with high probability and the improved attack needs only 243 pairs. However [J01] shows experimental results that suggest that only 241 pairs are really needed for the improved version of the attack. 5 Block cipher design to prevent these attacks The obvious question is now; what can we do to make our SPN resistant against linear and differential cryptanalysis. [HT94] describes three design principles to make an SPN stronger against linear and differential attacks. Two of the points focus on S-box design, the last point adds a linear transformation between S-boxes besides the permutation. 17 docsity.com 5.1 Good Diffusion Let pR−1 be the probability of a high probability differential characteristic, as de- fined in section 3.2, for round R − 1 in a SPN . The number of plaintexts needed for a differential analysis attack to be successful with high probability can then be approximated to be at least ND = 1 pR−1 . In this subsection we describe a principle to decrease the probability of all characteristics for an SPN, and thus increasing ND. In order to be resistant to differential analysis, S-boxes of the SPN should have good diffusion properties. That is given inputs that has small differences the cor- responding outputs of an S-box should have large differences. For example if two inputs to an S-box only differ on one bit, say 1000 and 1001 for our example SPN in the above sections, we want the corresponding outputs to be different on at least two bits. This motivates the following definition of the diffusion order of an S-box, which is a lower bound on the output difference for small difference input. Here hw is the hamming weight, which is the number of 1’s in a bit string. Notice that hw(∆X) is exactly the number of bits that are different from X ′ in X ′′ when X ′ ⊕X ′′ = ∆X. Definition 5.1 (Diffusion Order). An S-box satisfies diffusion order λ > 0 if, for hw(∆X > 0), hw(∆Y) > { λ + 1− hw(∆X), hw(X) < λ + 1 0, otherwise DES S-boxes satisfies a diffusion order of one. That is for inputs to a DES S-box that are only different on one bit the outputs will be different on at least two bits. Active S-boxes are the S-boxes that are involved in a characteristic. Having many active S-boxes in a characteristic decreases the probability of the characteris- tic occurring. Combining S-boxes that satisfy high diffusion orders, with a permu- tation so that no two outputs of a round r S-box are connected to the same round r + 1 S-box, we get an SPN where characteristics have relatively large amounts of active S-boxes. Intutively this is because the high diffusion order garranties that either the inputs to an active S-box, Sa, are different on many bits or the output is. The permutation then tells us that if in the former case, there were many active S-boxes in the round before Sa, and in the latter case that there will be many active S-boxes in the round after Sa. From [HT94] we have the following upper bound, on the probability of charac- teristics in such an SPN: Theorem 5.1. Given an SPN with R rounds such that R is a multiple of 4, using a permutation as described above, and S-boxes satisfying diffusion order λ. The probability pR−1 of a (R− 1)-round characteristic is bounded in the following way: pR−1 6 p λ+2 2 R−(λ+1) Where p is the best probability of input/output XOR’s over an S-box. This means that the higher diffusion order S-boxes of the SPN satisfy the lower is the probability that any characteristic holds. So to make an SPN resistant to differential analysis we just need to make sure the S-boxes have high diffusion order. However such S-boxes are very rare. As- sume that one XOR pair, (∆X, ∆Y), for an S-box violating diffusion order 1 is independent of other XOR pairs violating the same diffusion order. [HT94] shows that under this assumption, the probability of randomly choosing an n×n bijective 18 docsity.com