differential cryptanalysis of round-reduced simon and speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4...
TRANSCRIPT
![Page 1: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/1.jpg)
Differential Cryptanalysis ofRound-Reduced Simon and Speck
Farzaneh Abed Eik List Stefan Lucks Jakob Wenzel
Bauhaus-Universität Weimar
FSE 2014March 27, 2014
March 27, 2014
![Page 2: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/2.jpg)
Agenda
MotivationSimon and SpeckOur MethodResultsDiscussion
March 27, 2014
![Page 3: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/3.jpg)
Motivation
Section 1
Motivation
March 27, 2014
![Page 4: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/4.jpg)
Motivation
Motivation
June 2013, two lightweight ciphers SIMON, SPECK by NSAIntensively optimizedPerformant in both hard- and softwareNo security analysis for both ciphers⇒ left as a task to the community
March 27, 2014
![Page 5: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/5.jpg)
SIMON and SPECK
Section 2
SIMON and SPECK
March 27, 2014
![Page 6: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/6.jpg)
SIMON and SPECK
SIMON
Uses ARX constructionFamilies of Feistel-networkThree simple operations: AND, rotations, XORState size 2n and key size k , 10 family members
March 27, 2014
![Page 7: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/7.jpg)
SIMON and SPECK
SIMON (cont’d)
Require: (L0,R0) {Plaintext}Ensure: (Lr ,Rr ) {Ciphertext}
1: for i = 1, . . . , r do2: Li ← R i−1 ⊕ K i−1 ⊕ f (Li−1) ⊕
(Li−1 ≪ 2)3: R i ← Li−1
4: end for5: return (Lr ,Rr )
⋘
⋘
⋘
Figure: SIMON encryption
March 27, 2014
![Page 8: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/8.jpg)
SIMON and SPECK
SPECK
Three operations: Addition, rotations, XORSupport variety of block and key sizes, 10 family membersSimilar to ThreeFish but much faster
March 27, 2014
![Page 9: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/9.jpg)
SIMON and SPECK
SPECK (cont’d)
Require: (L0,R0) {Plaintext}Ensure: (Lr ,Rr ) {Ciphertext}
1: for i = 1, . . . , r do2: Li ← (Li−1 ≫ α) + R i−1 mod 2n
3: Li ← Li ⊕ K i−1
4: R i ← (R i−1 ≪ β)⊕ Li
5: end for6: return (Lr ,Rr )
Ri−1 i−1
Ki
Ri i
L
L
Figure: SPECK encryption
March 27, 2014
![Page 10: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/10.jpg)
Method
Section 3
Method
March 27, 2014
![Page 11: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/11.jpg)
Method
Why Differential Attacks
Slide: XOR of 1-bit constant with round keysLinear: Difficulties to linearise ANDMITM: Fast diffusion in key scheduleSplice and Cut: Fast diffusion in key schedule
March 27, 2014
![Page 12: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/12.jpg)
Method
Methods for Differential Characteristic and Probability
Twofold approach:
1 Matsui’s Algorithm:Finds the best r -round characteristic in depth-first mannerUsse as reference trail for the Branch-and-Bound
2 Branch and bound (B&B) Algorithm:Prunes the searchFinds the optimal solution
March 27, 2014
![Page 13: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/13.jpg)
Method
How to Apply Matsui and B&B
Start from the input difference αPropagate in forward and backward directionCollect all output difference α→ β and their PUse as starting point for the next round in depth-first manner
March 27, 2014
![Page 14: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/14.jpg)
Method
How to Apply Matsui and B&B (cont’d)
Searching all possible paths is infeasiblePrune the search treeDefine P thresholdConsider pairs with P � 2p−threshold andmaximum number of characteristics
March 27, 2014
![Page 15: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/15.jpg)
Method
Branch-and-Bound
∆in
r+1
r+2
r+3
r+4 ∆out
r-1
r
r-2 ∆out
March 27, 2014
![Page 16: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/16.jpg)
Method
Differential Attacks Procedure
1 Collect text pairs2 Filter out pairs3 Filter out round keys4 Test all remaining key candidates by brute-force
March 27, 2014
![Page 17: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/17.jpg)
Method
Differential Attacks (cont’d)
1. Collection phase:
1 Collect plaintext pairs (Pi ,P ′i )
2 Obtain (Ci ,C′i ) ciphertext pairs from encryption oracle
March 27, 2014
![Page 18: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/18.jpg)
Method
Differential Attacks (cont’d)
2. Filtering phase:
3 Derive all pairs (Ci ,C′i ) with the correct difference4 Store all correct pairs in a list
March 27, 2014
![Page 19: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/19.jpg)
Method
Differential Attacks (cont’d)
3. Key Guessing phase:
5 Guess some key bits6 For all ciphertext in the list partially decrypt (Ci ,C′i )7 Test for the match, if yes increment the counter8 Output key candidates with highest counter
March 27, 2014
![Page 20: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/20.jpg)
Method
Differential Attacks (cont’d)
4. Brute-force phase:
9 Identify correct values for all remaining keys
March 27, 2014
![Page 21: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/21.jpg)
Results
Section 4
Results
March 27, 2014
![Page 22: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/22.jpg)
Results
Differential Attacks on Simon
Cipher Total Attacked Data Memory SuccessRds Rds (CP) (Bytes) Rate
SIMON32/64 32 18 231.2 215.0 0.63SIMON48/k 36 19 246.0† 220.0 0.98SIMON64/k 42,44 26 263.0 231.0 0.86SIMON96/k 52,54 35 293.2 237.8 0.63SIMON128/k 68,72 46 2125.6 240.6 0.63
CP = chosen plaintexts† = chosen ciphertexts
March 27, 2014
![Page 23: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/23.jpg)
Results
Differential Attacks on Speck
Cipher Total Attacked Data Memory SuccessRds Rds (CP) (Bytes) Rate
SPECK32/64 22 10 229 216 0.99SPECK48/k 22,23 12 245 224 0.99SPECK64/k 26,27 15 261 232 0.99SPECK96/k 28,29 15 289 248 0.99SPECK128/k 32-34 16 2116 264 0.99
March 27, 2014
![Page 24: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/24.jpg)
Results
Rectangle Attack on Speck
Cipher Total Attacked Data Memory SuccessRds Rds (CP) (Bytes) Rate
SPECK32/64 22 11 230.1 237.1 ≈ 1SPECK48/k 22,23 12 243.2 245.8 ≈ 1SPECK64/k 26,27 14 263.6 265.6 ≈ 1SPECK96/k 28,29 16 290.9 294.5 ≈ 1SPECK128/k 32-34 18 2125.9 2121.9 ≈ 1
March 27, 2014
![Page 25: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/25.jpg)
Results
Comparison for SIMON
Cipher Total Rds. Biryukov Alkhzaimi UsRds. Pr Rds. Pr Rds. Pr
SIMON32/64 32 14 2−30.94 16 2−29.48 18 2−30.22
SIMON48/k 36 15 2−42.11 18 2−42.6 15 2−43.01
SIMON64/k 42,44 21 2−61.17 24 2−62.0 21 2−61.01
SIMON96/k 52,54 - − 29 2−87.5 35 2−92.2
SIMON128/k 68,72 - − 40 2−124.8 46 2−124.6
March 27, 2014
![Page 26: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/26.jpg)
Results
Comparison for SPECK
Cipher Total Rds. Biryukov UsRds. Pr Rds. Pr
SPECK32/64 22 9 2−31 10 2−30.99
SPECK48/k 22,23 10 2−43.87 12 2−40.55
SPECK64/k 26,27 13 2−57.70 15 2−58.9
SPECK96/k 28,29 - − 15 2−83.98
SPECK128/k 32-34 - − 16 2−111.16
March 27, 2014
![Page 27: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/27.jpg)
Conclusion
Section 5
Conclusion
March 27, 2014
![Page 28: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/28.jpg)
Conclusion
Conclusion
Differential attacks on up to half of the rounds for SIMON and SPECK
SIMON is highly vulnerable against differential cryptanalysisAny new analysis on addition-based ARX would be a threat to SPECK
ThreeFish, 2010, only 24/72 rounds up to now, SPECK, 2013, up to half
March 27, 2014
![Page 29: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/29.jpg)
Conclusion
March 27, 2014
![Page 30: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/30.jpg)
Differentials for SIMON32/64
Rd. ∆Li ∆R i log2(p) Rd. ∆Li ∆R i log2(p)
0 0 ∆6 8 ∆4 ∆2,6,14 −6
1 ∆6 0 0 9 ∆2,14 ∆4 −2
2 ∆8 ∆6 −2 10 ∆0 ∆2,14 −4
3 ∆6,10 ∆8 −2 11 ∆14 ∆0 −2
4 ∆12 ∆6,10 −4 12 0 ∆14 −2
5 ∆6,10,14 ∆12 −2 13 ∆14 0 0
6 ∆0,8 ∆6,10,14 −6 147 ∆2,6,14 ∆0,8 −4 15
Σ −36
Σacc −30.22
∑: the total probability of the full characteristic∑acc : the accumulated probability of all found trails from start to the end
March 27, 2014
![Page 31: Differential Cryptanalysis of Round-Reduced Simon and Speck · 0 0 6 8 4 2;6;14 6 1 6 0 0 9 2;14 4 2 2 8 6 2 10 0 2;14 4 3 6;10 8 2 11 14 0 2 4 12 6;10 4 12 0 14 2 5 6;10;14 12 2](https://reader033.vdocuments.us/reader033/viewer/2022052000/6012a977c8a7ed06cd571ff4/html5/thumbnails/31.jpg)
Differentials for SPECK32/64
Rd. ∆Li ∆R i log2(p) Rd. ∆Li ∆R i log2(p)
0 ∆5,6,9,11 ∆0,2,9,14 6 ∆15 ∆1,3,10,15 −2
1 ∆0,4,9 ∆2,9,11 −5 7 ∆1,3,8,10,15 ∆5,8,10,12,15 −4
2 ∆11,13 ∆4 −4 8 ∆1,3,5,15 ∆3,5,7,10,12,14,15 −6
3 ∆6 0 −2 9 ∆3,5,7,8,15 ∆0,1,3,8,9,12,14,15 −7
4 ∆15 ∆15 0 105 ∆8,15 ∆1,8,15 −1
Σ −31
Σacc −30.99
March 27, 2014