![Page 1: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/1.jpg)
Cryptanalysis of
Round-Reduced LED
Ivica Nikolić, Lei Wang and Shuang Wu
FSE 2013
Singapore
March 11, 2013
1
![Page 2: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/2.jpg)
Outline
• Backgrounds Specification
Previous Analysis
• Slidex Attack Application
• Multicollision Application
• Distinguishers Differential Property
Random-difference Distinguisher
• Conclusion
2
![Page 3: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/3.jpg)
Outline
• Backgrounds Specification
Previous Analysis
• Slidex Attack Application
• Multicollision Application
• Distinguishers Differential Property
Random-difference Distinguisher
• Conclusion
3
![Page 4: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/4.jpg)
LED
• Designed by Guo et al. at CHES 2011
• Light Encryption Device
64-bit block
64- or 128-bit key (primarily)
• Conservative security, e.g. concerning
Related-key attack
Distinguishers in hash function setting
4
![Page 5: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/5.jpg)
Specification (1/2)
• Extremely simple key schedule
Denote the secret key as K
LED-64: K as each round key
LED-128: K=K0||K1, then K0 and K1 as
round keys alternatively
F0 F1 Ft …
K0 K1 Kt
P C 5
![Page 6: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/6.jpg)
Specification (2/2)
• LED-64: 8 steps; LED-128: 12 steps
• Step functions
AES like
4 rounds and each round as below
Differ in round constants.
6
![Page 7: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/7.jpg)
Timeline of Previous Analysis • Guo et al. at CHES 2011
Distinguishers on 3.75/6.75-step LED-64/-128
Super-Sbox cryptanalysis
• Isobe and Shibutani at ACISP 2012
Key recovery on 2/4-step LED-64/-128
Meet-in-the-middle cryptanalysis
• Mendel et al. at ASIACRYPT 2012
Key recovery on 4-step LED-128
Related-key key recovery on 4/6-step LED-64/-128
Guess-then-recover, local collision, characteristics
and differentials of step functions 7
![Page 8: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/8.jpg)
Security State of LED
• The number of attacked steps
Key Recovery
Distinguisher Single-key Related-key
LED-64
(8 steps)
2
4
3.75
LED-128
(12 steps)
4
6
6.75
8
![Page 9: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/9.jpg)
Outline
• Backgrounds Specification
Previous Analysis
• Slidex Attack Application
• Multicollision Application
• Distinguishers Differential Property
Random-difference Distinguisher
• Conclusion
9
![Page 10: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/10.jpg)
Security State of LED
• The number of attacked steps
Key Recovery
Distinguisher Single-key Related-key
LED-64
(8 steps)
2
4
3.75
LED-128
(12 steps)
4
6
6.75
10
![Page 11: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/11.jpg)
Slidex Attack
• Dunkelman et al. at EUROCRYPT 2012
• Known-plaintext attack
• Wok for any public permutation E
• Time*Data=2n
K is n bits long
E
K K
P C
11
![Page 12: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/12.jpg)
Application to 4-Step LED-128
• Guess K0
• Recover K1
F0
K0
P P' F3
K0
C C'
K1 K1
C' P' F1
K0
F2
E
12
![Page 13: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/13.jpg)
Comparison
• Model
Ours: known-plaintext
Previous: chosen-plaintext
• Complexity
Data Time
IS12 216 2112
MRT+12 264 296
Ours 232 296
13
![Page 14: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/14.jpg)
Outline
• Backgrounds Specification
Previous Analysis
• Slidex Attack Application
• Multicollision Application
• Distinguishers Differential Property
Random-difference Distinguisher
• Conclusion
14
![Page 15: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/15.jpg)
A 2-Step Even-Mansour
• K is n bits long
• E0 and E1 are public permutations
E0
K K
P E1
K
C
15
![Page 16: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/16.jpg)
A 2-Step Even-Mansour
• K is n bits long
• E0 and E1 are public permutations
E0
K K
P E1
K
C
Can we recover K with a complexity
less than 2n?
16
![Page 17: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/17.jpg)
An Observation (1/7)
• K = P X
• K = E0(X) E1-1(Y)
• K = Y C
E0
K K
P E1
K
C X Y
17
![Page 18: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/18.jpg)
An Observation (2/7)
• K = P X
• K = E0(X) E1-1(Y)
• K = Y C
E0
K K
P E1
K
C X Y
We recover X for some P, which
gives us K immediately.
18
![Page 19: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/19.jpg)
An Observation (3/7)
• K = P X
• K = E0(X) E1-1(Y)
• K = Y C
P = E0(X) E1-1(P X) C X
19
![Page 20: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/20.jpg)
An Observation (4/7)
• K = P X
• K = E0(X) E1-1(Y)
• K = Y C
P = E0(X) E1-1(P X) C X
20
![Page 21: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/21.jpg)
An Observation (5/7)
• For a t-multicollision on P C, namely
we get
C1 P1 = Ct Pt = … = const
Pi = E0(Xi) E1-1(const Xi) Xi
21
![Page 22: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/22.jpg)
An Observation (6/7)
• For a t-multicollision on P C, namely
we get
denoted as
C1 P1 = Ct Pt = … = const
Pi = G(Xi)
Pi = E0(Xi) E1-1(const Xi) Xi
22
![Page 23: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/23.jpg)
An Observation (7/7)
• For a t-multicollision on P C, namely
we recover a Xi with a complexity 2n/t
try 2n/t random values as X, and match
G(X) to {P1, P2, …, Pt}.
C1 P1 = Ct Pt = … = const
23
![Page 24: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/24.jpg)
Application to 6-Step LED-128
• Guess K0
• Recover K1
F0
K0
P P' F5
K0
C C'
K1 K1
C' P' F1
K0
F2
E0 K1
F3
K0
F4
E1
24
![Page 25: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/25.jpg)
Outline
• Backgrounds Specification
Previous Analysis
• Slidex Attack Application
• Multicollision Application
• Distinguishers Differential Property
Random-difference Distinguisher
• Conclusion
25
![Page 26: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/26.jpg)
Differential vs Characteristic
• Differential
• Characteristic
The characteristic probability on an active
step function is upper bounded by 2-50.
∆in ∆out ? ? ? ?
∆in ∆out ∆1 ∆2 ∆3 ∆4
26
![Page 27: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/27.jpg)
Differential on 2-step LED-64
• For a differential ∆1, ∆2)→∆3
what is the complexity of finding a
solution (P, K)?
F0 F1 ∆1
∆2 ∆2 ∆2
∆3
27
![Page 28: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/28.jpg)
Differential on 2-step LED-64
• Meet-in-the-middle approach
One solution with a birthday complexity
• Differential multicollision distinguisher
F0 F1 ∆1
∆2 ∆2 ∆2
∆3
28
![Page 29: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/29.jpg)
Extend to 4-Step LED-64
• Chosen differentials ∆, ∆ →∆
Complexity of birthday bound to find a
solution (P, K).
∆
∆ ∆ ∆
F0 F1 F2 F3
∆ ∆
∆
prob=1 prob=1
29
![Page 30: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/30.jpg)
Application to 8-Step LED-128
• Set a random value to K1 and ∆K1=0
• Set ∆P=∆K0=∆, and find a solution P, K0)
F2*i F2*i+1
K1
Gi
∆
∆ ∆ ∆
G0 G1 G2 G3
∆ ∆
∆
30
![Page 31: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/31.jpg)
Application to 8-Step LED-128
• Set a random value to K1 and ∆K1=0
• Set ∆P=∆K0=∆, and find a solution P, K0)
F2*i F2*i+1
K1
Gi
∆
∆ ∆ ∆
G0 G1 G2 G3
∆ ∆
∆
Exploit the freedom of both K0 and K1
31
![Page 32: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/32.jpg)
Random-Difference Distinguisher
• On a random difference ∆
Set ∆K0=∆, ∆K1=0, ∆P=∆ and ∆C=∆
The complexity of finding a solution?
Ideal case: 2n (n=64)
LED-128 ∆P= ∆ ∆C= ∆
∆K0= ∆ ∆K1= 0
32
![Page 33: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/33.jpg)
Distinguisher on 10 Steps
• Difference propagation
Passive step function
Active step function
∆
∆
∆ ∆ ∆ ∆ ∆
∆
0 0 0 0 0
33
![Page 34: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/34.jpg)
Attack Procedure (1/3)
• Phase 1: find solutions for differentials
on F2 and F3, and on F6 and F7.
Exploit the freedom of K1
At Phase 1, the value of K1 is chosen.
∆
∆
∆ ∆ ∆ ∆ ∆
∆
0 0 0 0 0
34
![Page 35: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/35.jpg)
Phase 1 • Find a set of (K1, Xi, Yi)s such that
all K1s are equal
(K1, Xi)s follows differential on F2 and F3
(K1, Yi)s follows differential on F6 and F7
∆K1=0
∆ ∆X=∆ F2 F3 F6 F7 ∆ ∆Y=∆
∆K1=0
Find collision on K1
35
![Page 36: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/36.jpg)
Attack Procedure (2/3)
• Phase 2: match a solution on F2 and F3
to a solution on F6 and F7
Exploit the freedom of K0
At Phase 2, the value of K0 is chosen.
∆
∆
∆ ∆ ∆ ∆ ∆
∆
0 0 0 0 0
36
![Page 37: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/37.jpg)
Phase 2
• Similar with the key-recovery attack
on single-key 1-step Even-Mansour
Utilize the set {(K1, Xi, Yi)} from Phase 1.
K0 K0
Xi F4
K1
F5
E
Yi
37
![Page 38: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/38.jpg)
Attack Procedure (3/3)
• Phase 3: compute P to obtain a
solution (P, K0, K1).
∆
∆
∆ ∆ ∆ ∆ ∆
∆
0 0 0 0 0
Prob=1 Prob=1
38
![Page 39: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/39.jpg)
Distinguisher
• The complexity of our attack is 260.3,
which is smaller than 264
10-step LED-128 is “non-ideal”
• Irrespective to the specification of
step function.
39
![Page 40: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/40.jpg)
Outline
• Backgrounds Specification
Previous Analysis
• Slidex Attack Application
• Multicollision Application
• Distinguishers Differential Property
Random-difference Distinguisher
• Conclusion
40
![Page 41: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/41.jpg)
Updated State of LED
• The number of attacked steps
Key Recovery
Distinguisher Single-key Related-key
LED-64
(8 steps)
2
4
. →
LED-128
(12 steps)
→
6
. →
41
![Page 42: Cryptanalysis of Round-Reduced LED · Outline Backgrounds ... ¾ Differential Property ¾ Random-difference Distinguisher Conclusion 2 . Outline ... The complexity of our attack is](https://reader031.vdocuments.us/reader031/viewer/2022022602/5b55bb1a7f8b9a18618bdb9f/html5/thumbnails/42.jpg)
Thank you for your attention!