using multiple differentials

Using Multiple Differentials...

On the LLR and χ2 Statistical Tests in Differential Context

Celine Blondeau

Aalto University

Luxembourg, January 2013

joint work with Benoıt Gerard and Kaisa Nyberg

Outline

IntroductionDifferential CryptanalysisMultiple Differential Cryptanalysis

Partitioning the Output DifferencesSet of Simple DifferencesSpecial set of Truncated Differentials

Analysing InformationLLR Statistical Testχ2 Statistical Test

ExperimentsExperimental ResultsDiscussion

Outline

Block ciphers

EK : Fm2 → Fm

I K : Master keyI F : Round functionI Ki : Round key

cccc cccc cccc cccc

S3 S2 S1 S0

��

SMALLPRESENT-[4]

Statistical Attacks

Statistical attacks:I Take advantage of a non-uniform behavior of the cipherI Two families: Linear and Differential cryptanalysis

Improvement of differential cryptanalysis

I Differential cryptanalysis [Biham Shamir 91]I Truncated differential cryptanalysis [Knudsen 95]I Impossible differential cryptanalysis [Biham Biryukov Shamir

99]I Higher order differential cryptanalysis [Lai 94] [Knudsen 95]I Bulk Multiple differential cryptanalysis [Blondeau Gerard 11]

Differential CryptanalysisGiven an input difference between two plaintexts, some outputdifferences occur more often than others.

δin δout

Differential: pair of input and output difference (δin, δout)

Differential probability: p = PX ,K [ EK (x)⊕ Ek (x ⊕ δin) = δout ]

Uniform probability: θ = 2−m

Using Multiple differentials...

I Truncated differential cryptanalysisI Impossible differential cryptanalysisI Higher order differential cryptanalysisI Bulk differential cryptanalysis

One non-uniform probability is used for comparison with uniformprobability

Using Multiple differentials...

I Truncated differential cryptanalysisI Impossible differential cryptanalysisI Higher order differential cryptanalysisI Bulk differential cryptanalysis

One non-uniform probability is used for comparison with uniformprobability

Bulk differential cryptanalysis [FSE 2011]

I Set of differences (δin(v), δout

(v)), with probabilities pv .

I p = 1∆in

∑v pv expected probability.

I θ = 1∆in

12m uniform probability.

Frequencies are summed up.

How to use the probability of each differential individually?

I p = 1∆in

I θ = 1∆in

I p = 1∆in

I θ = 1∆in

Related Work

Linear Cryptanalysis [Matsui 93]:

I Multiple linear cryptanalysis [Baigneres Junod Vaudenay 04]

I Multidimensional linear cryptanalysis [Hermelin Cho Nyberg08]

Both use LLR and/or χ2 statistical tests.

Differential Cryptanalysis:

Recently :

I How to apply LLR and/or χ2 statistical tests?I How to partition the output differences?

Multiple Differential Cryptanalysis

I Fixed input difference δin (To simplify the analysis)

I Vector of “differences”: V = [δ(v)out ] after r rounds,

I p = [pv ]v∈V vector of expected probabilities.

I θ = [θv ]v∈V vector of uniform probabilities.

I qk = [qkv ]v∈V vector of observed probabilities for the key k .

Recent Work

[Albrecht Leander 12]

LLR statistical test

Application to SMALLPRESENT-[4] (m = 16) and KATAN-32(m = 32)

[Blondeau Gerard Nyberg 12]

LLR and χ2 statistical tests.

What to do when m > 32 ?

⇒ Introduction of partitioning functions

Outline

Partitioning Functions

We analyze two “orthogonal” cases

I Unbalanced partitioningI Take a subset of simple differences

I Balanced partitioningI Group the differences in order to be able to use information of

the whole output space.

Aim:I Compare Time, Memory and Data complexity of the different

methods.

Partitioning Functions

We analyze two “orthogonal” cases

I Unbalanced partitioningI Take a subset of simple differences

I Balanced partitioningI Group the differences in order to be able to use information of

the whole output space.

Aim:I Compare Time, Memory and Data complexity of the different

methods.

Last Round Attack

Plaintext

Characteristic

Partial State??

r roundsF rK

Distinguisher

Last Round Attack

Plaintext

Characteristic

Partial State??

r roundsF rK

Distinguisher

?Substitution Layer

Key addition

S7 S6 S5 S4 S3 S2 S1 S0

k7 k6 k5 k4 k3 k2 k1 k0e e e e e e e eCiphertext

Unbalanced Partitioning

Idea: Subset of simple differences

I Output differences (δ(v)out )1≤v≤A,

I Counter for each of these differentials qkv .

I As∑A

i=1 qkv 6= 1

I We have a “trash” counter qk0 which gathers all other output

differences.

Last Round Attack: We increment the counter qkv

if the difference δ(v)out is obtained after partial deciphering.

Unbalanced Partitioning: Last Round Attack

V = [δ(v)out ]v

��* HHYV

Substitution LayerS7 S6 S5 S4 S3 S2 S1 S0

k7 k6 k5 k4 k3 k2 k1 k0e e e e e e e e

V = [δ(v)out ]v

��* HHYV

S7 S6 S5 S4 S3 S2 S1 S0

k7 k6 k5 k4 k3 k2 k1 k0e e e e e e e eS4 S3 S1 Active Sboxes

��* HHYV

S7 S6 S5 S4 S3 S2 S1 S0

k7 k6 k5 k4 k3 k2 k1 k0e e e e e e e eS4 S3 S1

Sieving processDiscard some ciphertext pairs

��* HHYV

S7 S6 S5 S4 S3 S2 S1 S0

6e 6e 6e For all key candidates,partially decipherk4 k3 k1

6��@I

��* HHYV

S7 S6 S5 S4 S3 S2 S1 S0

6e 6e 6ek4 k3 k1

6��@I If δ = δ(v)out

Increment qkv

OtherwiseIncrement qk

��* HHYV

S7 S6 S5 S4 S3 S2 S1 S0

6e 6e 6ek4 k3 k1

6��@I If δ = δ(v)out

Increment qkv

OtherwiseIncrement qk

Analyse the vectors qk for each key

Unbalanced Partionning: Remarks

Corresponding known/former attacks:I Differential cryptanalysis.

Advantage:I A sieving process⇒ “smaller” time complexity

Disadvantage:I Subset of output space⇒ Not all informationI Small probabilities⇒ Non-tightness of the information

Balanced Partitioning

Idea: Using information from all differences by grouping them.

Let V = [δ(v)out ]v a subspace of Fm

A group of differences ∆(v)out = δ

(v)out ⊕ V (V ⊕ V = Fm

A counter qkv for each group of differences.

Balanced Partitioning: Last Round Attack

∆out = δout ⊕ V

Substitution LayerS7 S6 S5 S4 S3 S2 S1 S0e e e e e e e ek7 k6 k5 k4 k3 k2 k1 k0

∆out = δout ⊕ V

S7 S6 S5 S4 S3 S2 S1 S0e e e e e e e ek7 k6 k5 k4 k3 k2 k1 k0

S7 S6 S5 S4 S3 S2 S1 S0 Active Sboxes

S7 S6 S5 S4 S3 S2 S1 S0

No sieving processPartially decipher for all pairs

S7 S6 S5 S4 S3 S2 S1 S0For all key candidates,

partially decipherk4 k3 k26e 6e 6eS4 S3 S2

S7 S6 S5 S4 S3 S2 S1 S0

k4 k3 k26e 6e 6eS4 S3 S2

��*6HHYIf δ ∈ δ(v)

out ⊕ VIncrement qk

S7 S6 S5 S4 S3 S2 S1 S0

k4 k3 k26e 6e 6eS4 S3 S2

��*6HHYIf δ ∈ δ(v)

out ⊕ VIncrement qk

Analyse the vectors qk for each key

Balanced Partitioning: Remarks

Corresponding known/former attacks:I Truncated Differential cryptanalysis.

Advantage:I Whole output space⇒ More informationI Bigger Probabilities⇒ Tightness of the information

Disadvantage:I No sieving process⇒ Larger time complexity

Outline

Statistical TestsProbability distribution vectors

I Expected: p = [pv ]v∈V

I Uniform: θ = [θv ]v∈V

I Observed: qk (for a given key candidate k )

LLR test: requires the knowledge of the theoretical probability p.

Sk = LLRk (qk ,p, θ)def= Ns

∑v∈V

qkv log

χ2 test: Does not require the knowledge of p for the attack

Sk = χ2k (qk , θ) = Ns

∑v∈V

(qkv − θv )2

Complexities

Let S(k) be the statistic obtained for a key candidate k .

Sk = LLRk (qk ,p, θ) or = χ2k (qk , θ)

Sk ∼{N (µR, σ

2R) if k = Kr ,

N (µW , σ2W ) otherwise.

[Selcuk 07]:I Estimates of the value of µR, µW , σR, σw for both LLR and χ2

statistical tests.I Estimates of the Data Complexity

Asymptotic Complexity when PS = 0.5

a: AdvantageΦ0,1 : cumulative function of standard normal distribution

LLR test:

N ≈Varp(log(p

θ ))[Ep(log(p

θ ))− Eθ(log(pθ ))]2 Φ−2

0,1(1− 2−a)

χ2 test:

N ≈√

2|V |C(p)

Φ−10,1(1− 2−a)

where C(p) =∑

(pv−θv )2

Outline

Unbalanced Partitioning: Simple differences

20 22 24 26 28 30

log2(N)

LLR : Ex. a = 4Th. a = 4Ex. a = 11Th. a = 11

χ2 : Ex. a = 4Th. a = 4Ex. a = 11Th. a = 11

Balanced Partitioning: Group of output differences

19 21 23 25 27

log2(N)

LLR : Ex. a = 4Th. a = 4Ex. a = 7Th. a = 7

χ2 : Ex. a = 4Th. a = 4Ex. a = 7Th. a = 7

Conclusions

Balanced or Unbalanced partitioning ?I Time Complexity: unbalanced⇒ faster attack.I Data Complexity: depends of the cipher.

LLR or χ2?I If we have a good estimate of the expected probabilities⇒ LLR provides better Data and Memory complexities

I Otherwise LLR is not effective

using multiple differentials

Documents

urban-rural happiness differentials across the world ·...

multiple regression analysis using climate...

multiple regression using sas

state hazard group differentials

section 3.9 - differentials

t5 recoverylive ethics&boundaries 07-23-19boundaries.pdf ·...

using multiple generative ... - cmap.polytechnique.fr

linear approximations and differentials

socio-economic differentials in contraceptive

epigastric pain differentials info.ppt

easy differentials calculus

differentials textbook (diffy q's)

angina pectoris: the differentials

wage differentials and international trade in italy using...

differentials: poetry, poetics, pedagogy

differentials in mortality

using differentials to bridge the vector calculus...

deleuze and differentials

differentials (3.9)

using the multiple indicator-multiple cause (mimic