Advanced Information Security 1 INTRODUCTION TO ECC Dr. Turki F. Al-Somani 2015 1.
CS548_ ADVANCED INFORMATION SECURITY
description
Transcript of CS548_ ADVANCED INFORMATION SECURITY
CS548_ADVANCED INFORMATION SECURITY20103272 Jong Heon, Park / 20103616 Hyun Woo,
Cho
Paper Presentation #1Improved version of LC in attacking DES
Contents Introduction Before the paper… Notations Principle of the attack Success Rate and Complexity The Computer Experiment Concluding Remarks
2 / 30
Paper Introduction
Linear Cryptanalysis Using two linear approximate equations
Known Plaintext attack (KPA)
M. MATSUI. The first experimental cryptanalysis of the data encryption standard. LNCS, 839, 1994, 1-11. CYRPTO '94.
3 / 30
Paper Introduction (Cont’)
Using 12 computer to experiment the attack(HP9735/PA-RISC 99MHz)
Program described in C & assembly languagesto generate plaintexts and ciphertexts
Goal : Finding 56-bit Secret Key Elapsed Time : 50 days
Generating plaintexts and ciphertexts : 40 days Searching key : only 10 days
4 / 30
Before the paper… Hellman
Linearity between input and output of S-box Shamir & Rueppel
Some S-boxes has linear approximate relation between input and output bits.
M. Matsui Derive linear approximate equations which
consist of P, C, and K bits Easier search if 247 known plaintext are
available than Exhaustive search
5 / 30
Before the paper… (Cont’)
M. Matsui Improved version of LC in breaking 16-
round DES New linear approximate equations :
Reducing the number of required plaintexts Candidate key in order of reliability :
Increasing the success rate of attack
6 / 30
Notations P : plaintext; 64-bit data after the IP C : ciphertext; 64-bit data before the IP-1
K : secret key; 56-bit data after the PC-1 PH, PL : upper/lower 32-bit data of P CH, CL : upper/lower 32-bit data of C Kr : r-th round 48-bit subkey Fr(Xr, Kr) : r-th round F-function output A[i] : i-th bit of A (A is any binary vector) A[I,j,...,k] : A[i]A[j]…A[k]
7 / 30
Principle of the attack We accept new linear approximate equations
Iinear approximate equations based on the best 14-round expression 2round ~ 15round linear approximate equations
P, C, and K2-15 Find round key of 1round, 16round Effects : reduce the number of required plaintexts
What is the linear approximate equation? Choose P[ia,ib,ic…] C[ja,jb,jc…] = K[ka,kb,kc…]
(probability(p) ≠ ½, randomly given P, C and fixed K)
Best equation is |p-½| is maximal !!
8 / 30
Principle of the attack (Cont’)
Two Best 14-round expressions PL[7,18,24] CH[7,18,24,29] CL[15]
= K2[22] K3[44] K4[22] K6[22] K7[44] K8[22] K10[22] K11[44] K12[22] K14[22]
CL[7,18,24] PH[7,18,24,29] PL[15]= K13[22] K12[44] K11[22] K9[22] K8[44] K7[22] K5[22] K4[44] K3[22] K1[22]
…probability : ½-1.19×2-21 (piling-up lemma)
9 / 30
Principle of the attack (Cont’)
Applying to F-functions from the 2nd to 15th round PH[7,18,24] F1(PL, K1)[7,18,24] CH[15]
CL[7,18,24,29] F16(CL ,K16)[15]= K3[22] K4[44] K5[22] K7[22] K8[44] K9[22] K11[22] K12[44] K13[22] K15[22]
CH[7,18,24] F16(CL ,K16)[7,18,24] PH[15] PL[7,18,24,29] F1(PL ,K1)[15] = K14[22] K13[44] K12[22] K10[22] K9[44] K8[22] K6[22] K5[44] K4[22] K2[22]
10 / 30
11 / 30
Principle of the attack (Cont’)
First, we solve these equations to derive some of the secret key bits
Consideration How much memory is required? How many secret key bits can be derived?
Effective text/key bits which affect the left side of each equations
12 / 30
Principle of the attack (Cont’)13 / 30
Principle of the attack (Cont’)
Each equation, we found 13 secret key bits 12 effective key bits + one bit of right side Using just 13 text bits (plaintext + ciphertext)
Total : 26 secret key bits Using 26 text bits
Substitution of incorrect key value for K1, K16.. P(the left side = 0) ≒ ½ So, we count #(left side=0) for each key
candidate
14 / 30
Principle of the attack (Cont’)
[ Algorithms for breaking 16-round DES ] Data Counting Phase of first equation
Prepare 213 counters TAa (0 ≤ a < 213) where a corresponds to each value on 13 effective text bits
For each plaintext and corresponding ciphertext, compute the value of effective text bits(=a) and count up the TAa by one.
15 / 30
Principle of the attack (Cont’)
Key Counting Phase of first equation Prepare 212 counters KAb (0 ≤ b < 213) where a
corresponds to each value on 12 effective key bits. For each b, KAb is the sum of TAa such that left side
of first equation (be uniquely determined by a, b) equal to zero.
Rearrange KAb in order of |KAb – N/2| and rename them KAcb (0 ≤ c < 212) Then, for each c.. If (KAcb – N/2) ≤ 0, guess that right side of equation is 0. If (KAcb – N/2) > 0, guess that right side of equation is 1.
Second equation can be solved in the same manner.
16 / 30
Principle of the attack (Cont’)
Total of 26 secret key bits (after the PC-1) K[0], K[1], K[3], K[4], K[8], K[9], K[14], K[15], K[18],
K[19], K[24], K[25], K[31], K[32], K[38], K[39], K[41], K[42], K[44], K[45], K[50], K[51], K[54], K[55], K[5] K[13] K[17] K[20] K[46], K[2] K[7] K[11] K[22] K[26] K[37] K[52]
Exhaustive Search Phase(Finding remaning 30 key bits) Let Wm (m=0,1,2…) be a series of candidates for
the 26 key bits arranged in order of their reliabiity For each Wm, search for the remaining key bits until
the correct value is found
17 / 30
Success Rate and Complexity DES reduced to 8 rounds
Left side of equation is essentially the same
Best 6-round expression
(6)
(7)
18 / 30
Success Rate and Complexity(cont’) Full 16 round DES to 8-round DES Equation of number of N random
plaintext, success rate
Depend on
19 / 30
Success Rate and Complexity(cont’) Full 16 round DES to 8-round DES Lemma 1.
Let N be the number of given random plaintexts and p be the probability that the following eq holds.
Assuming |p-1/2| is small
20 / 30
Success Rate and Complexity(cont’) Full 16 round DES to 8-round DES
8 round DES
16 round DES
21 / 30
Success Rate and Complexity(cont’) Full 16 round DES to 8-round DES Lemma 1. Success rate of our attack on 8-round DES
with N8 Same that on 16round DES with N16
plaintexts
equivalent to
22 / 30
Success Rate and Complexity(cont’) Computer experiments in Solving eq (6) 100,000 times to estimate (4)
23 / 30
Success Rate and Complexity(cont’)
24 / 30
The Computer Experiment First computer experiment in breaking
DES Implemented software only C and assembly languages 1000 lines 1Mbyte in running
25 / 30
The Computer Experiment(cont’)
26 / 30
The Computer Experiment(cont’)
27 / 30
Concluding Remarks Improvement of linear cryptanalysis Presented the first successful
experimentBreaking full 16-round DES
Remaining 30 Key bits – it also Possible Result fig.2, fig.3 – Simple function,
Formalized- New combination will give more effective
28 / 30
Nowdays. EFF made DES attack Hardware in 1998
Decode 56hours (56bit Key) 22hours in 1999
More than 128bit Keys Safe in present.
29 / 30
References National Bureau of Standards: Data Encryption Standard. (1977) Matsui, M.: Linear Cryptanalysis Method for DES cipher. Matsui M.:
On correlation between the order of S-boxes and the strength of DES.(1993)
Matsui, M.: On correlation between the order of S-boxes and the strength of DES.(1994)
Hellman, M., Merkle, R., Schroeppel, R., Washinton, L., Diffie, W., Pohlig, S., Schweizer, P.: Results of an initial attempt to cryptanalyze the NBS Data Encryption Standard. (1976)
Shamir, A: On the security of DES.(1985) Davies, D., Murphy, S.: Pairs and triplets of DES s-boxes.(preprint) Ruepple, R.A. ,: Analysis and design of stream ciphers. (1986) 김광조 : DES 의 선형 해독법에 관한 해설 (3) 한국정보보호학회 ,
정보보호학회지 通信情報保護學會誌 第 4 卷 第 1 號 , 1994. 3, pp. 30 ~ 43 (14pages)
30 / 30
Korex527 at gmail.comBetelgs at chol.com
Any Question?Any Question?