Linear Relations in Irregularly Clocked Linear Finite State Machines Cees Jansen DeltaCrypto B.V....
-
Upload
emory-stevens -
Category
Documents
-
view
217 -
download
0
Transcript of Linear Relations in Irregularly Clocked Linear Finite State Machines Cees Jansen DeltaCrypto B.V....
Linear Relations in Irregularly Clocked Linear Finite State Machines
Cees JansenDeltaCrypto B.V.
NATO-ARW
Veliko Tarnovo, October 8, 2008
20081008 CJ 2
Outline Linear Finite State Machines Linear Relations in LFSMs The Basic Algorithm A More Efficient Way… An Example Conclusions
20081008 CJ 3
L-1
ML
c0
L-2
ML-1
c1
0
M1
cL-1
o
0,:
0,:Transition State
),,,(:State LFSM
0
1
021
t
ttt
tt
ttL
tL
t
T
T
1
2
1
0
100
010001000
:(LFSR)Matrix Transition
Lc
ccc
T
)( ofroot a of role theplays i.e. ,0)(
)det()(
:Then
of Polynomial sticCharacteri thebe )(Let
xCC
xxC
xC
TT
TI
T
A Linear Finite State Machine
Matrix approach: “Error-Correcting Codes”, W.W. Peterson, 1961
20081008 CJ 4
Another LFSM
L-1 L-2 0o
c0cL-2cL-1
0100
00100001
:Matrix Transition
0121
cccc LL
T
Similarity Transform:
GCLFSR TMMT 1
1000
10010
1
1
21
121
1
L
L
LL
c
ccccc
MM
M
MTMTMTMT
iGC
iLFSR
iGC
iLFSR
GCLFSRGCLFSR
1
1
20081008 CJ 5
And Another LFSM
11
22
11
100
0
010
1
00
dt
td
td
td
Tnn
nn
jLFSR
Jumping LFSR Transition Matrix
dn
Mn
tn
dn-1
Mn-1
tn-1
d1
M1
t1
s
10000
1
000
100
10
1
,1
,21,2
,21,223
,11,11312
nn
nnnn
nn
nn
m
mm
mmm
mmmm
M
1;
1;
;0
;1
21,
1,121,,
idm
ijnmdm
ij
ji
m
jnji
jijnjiji
Jumping LFSR – LFSR Similarity Transform Matrix:
20081008 CJ 6
And Another LFSMJumping LFSR – jumping GC Similarity Transform Matrix:
n
n
nn
jGC
d
d
d
tttdt
T
100
0
10
001
1
2
1211
Jumping GC Transition Matrix
d1 d2 dns
tnt2t1
10000
1
000
100
10
1
12
1323
1,11,223
,11,11312
m
mm
mmm
mmmm
M
nn
nn
njitddm
ijnmddm
ij
ji
m
jinjji
jiinjjiji
or1;)(
1;)(
;0
;1
1111,
1,1111,,
20081008 CJ 7
Other LFSMs Include:
Subfield implementations Optimized transition matrices
Implementation complexity (#gates) Side channel characteristics
Are just simple linear transforms away from each other… Similarity Transform Matrices
20081008 CJ 8
Pomaranch V3 Family
S-box: x-1 mod I(x)
Subfield implementation
M-1
10000
1
000
100
10
1
,1
,21,2
,21,223
,11,11312
nn
nnnn
nn
nn
m
mm
mmm
mmmm
M
M
10000
1
000
100
10
1
,1
,21,2
,21,223
,11,11312
nn
nnnn
nn
nn
m
mm
mmm
mmmm
M
Different irreducible polynomial
Different (sub)field implementation
Different F/S sequence (subfield elts)
Different feedback tapsDifferent Register
M
10000
1
000
100
10
1
,1
,21,2
,21,223
,11,11312
nn
nnnn
nn
nn
m
mm
mmm
mmmm
M
F F S SS F
6 1
20081008 CJ 9
0,:
0,:Transition State
),,,(:State LFSM
0
1
021
t
ttt
tt
ttL
tL
t
T
T
)( ofroot a of role theplays i.e. ,0)(
)det()(
:Then
of Polynomial sticCharacteri thebe )(Let
xCC
xxC
xC
TT
TI
T
A Linear Finite State Machine
0
:RelationLinear
:bitsOutput
01111
0
STT
ST
Coococo
o
tttLtLLt
tt
L-1
ML
c0
L-2
ML-1
c1
0
M1
cL-1
o
1
2
1
0
100
010001000
:(LFSR)Matrix Transition
Lc
ccc
T
20081008 CJ 10
Irregularly Clocked LFSMs Two or more Transition Matrices
Selected by some external control signal May change per output bit produced
Classic clock control: Jump control:
0
:RelationLinear
:bitsOutput
011011010
001111
100
11
SITTTTTT
STT
aaaoaoaoaoa
o
LL LL
tttLtLLtL
tt
eTTTT 10 ,ITTTT 10 ,
20081008 CJ 11
Linear Relations Linear relations in L+1 output bits of
irregularly stepped LFSM always occur Objective is to determine all linear relations
(aL,…,a0) and their occurrences (all combinations of external control signal bits resulting in Lin.Rel.)
Here output bits of Binary Jump Registers are considered
Bias in occurrence of Linear Relations leads to cryptanalysis
20081008 CJ 12
Power Polynomial & Notation Power Polynomial dependent on jump control bits ji
Linear Relation Coefficients for LFSM output bits ot
LFSM Characteristic Polynomial
Linear Relation
011
1)( cxcxcxcxC LL
LL
0,,,, 01111011 ttLtLLtLLL oaoaoaoaaaaa
0,
0,1)(
1
011
1
iijxpxpxpxpxP
jumping of casein )()(mod0)(0
xCxCxPaL
20081008 CJ 13
Solving for Linear Relations
Always solution: determinant = 1 Upper triangular matrix: use back substitution
)()(0
xCxPaL
011
10
10
12
021
011 ,,,,
1000
10010
1
,,,, ccccp
ppppp
aaaa LL
LLL
LLL
LL
LL
Lipaca
capapa
capapacapaca
L
ij
jijii
LL
LL
LLLLL
LLL
LLLLL
LL
0,
1
001
010
221212
111
Matrix PL
20081008 CJ 14
Basic AlgorithmTo determine the linear relation coefficients, given the L jump control bits and the LFSM’s Characteristic Polynomial C(x) of degree L
0,,Return .4
0 else 2.3
)()()(;1 then if 3.1
do 0 downto for .3
)()( polynomialauxiliary Set .2
,,1),( theCalculate .1
aa
a
xPxHxHaph
Li
xCxH
LxP
L
i
iiiii
Clearly the coefficients aL,…,a0 are functions of cL,…,c0 and the jump control bits jL,…,j1
Linear in L as polynomial arithmetic is used (in 32-/64-bit words)!But exponentially many combinations of jump control bits needed to determine LES /LEB!
20081008 CJ 15
Solving for Linear Relations Rev.
Matrix PL expanded into ji :
Note the relation from the definition of Pl :
111
,1
iii pjppp
10001000
10000100
101
,,,,
1
1212
123121323123
11
11211
011
jjjjjjjjjjjjjjjjj
jjjjjjjjjj
aaaa
L
LLLL
LL
20081008 CJ 16
Solving for Linear Relations (2)
The inverse matrix obtained through back substitution1
10
10
12
021
10
10
12
021
1000
10010
1
1000
10010
1
p
ppppp
e
eeeee
LLL
LLL
LL
LLL
LLL
LL
1;1
ii
ijj
jii epee
0,10 je 11
11
iiii ejee
20081008 CJ 17
Solving for Linear Relations (3)So far we have:
• Shown on next slide in hexadecimal truth table form• Contains Linear Relations for all 2l combinations of Jump Control bits in one vector
10001000
10000100
101
,,,,
1
112
11212123
12123121323
11
11111
011
jjjjjjjjjjjj
jjjjjjjjjjjjj
jjjjjj
cccc
L
LLL
LL
20081008 CJ 18
Linear Relation Coefficient Vectorsa0 a1 a2 a3 a4 a5 a6
c0 3 0 00 0000 00000000 0000000000000000 0000000000000000 0000000000000000c1 1 F 00 0000 00000000 0000000000000000 0000000000000000 0000000000000000c2 1 6 FF 0000 00000000 0000000000000000 0000000000000000 0000000000000000c3 1 7 69 FFFF 00000000 0000000000000000 0000000000000000 0000000000000000c4 1 6 7E 6996 FFFFFFFF 0000000000000000 0000000000000000 0000000000000000c5 1 7 68 7EE8 69969669 FFFFFFFFFFFFFFFF 0000000000000000 0000000000000000c6 1 6 7F 6880 7EE8E881 6996966996696996 FFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFFc7 1 7 69 7FFF 68808001 7EE8E881E8818117 6996966996696996 9669699669969669c8 1 6 7E 6996 7FFFFFFE 6880800180010116 7EE8E881E8818117 E88181178117177Ec9 1 7 68 7EE8 69969668 7FFFFFFEFFFEFEE8 6880800180010116 8001011601161668c10 1 6 7F 6880 7EE8E880 6996966896686880 7FFFFFFEFFFEFEE8 FFFEFEE8FEE8E880c11 1 7 69 7FFF 68808000 7EE8E880E8808000 6996966896686880 9668688068808000c12 1 6 7E 6996 7FFFFFFF 6880800080000000 7EE8E880E8808000 E880800080000000c13 1 7 68 7EE8 69969669 7FFFFFFFFFFFFFFF 6880800080000000 8000000000000000c14 1 6 7F 6880 7EE8E881 6996966996696996 7FFFFFFFFFFFFFFF FFFFFFFFFFFFFFFFc15 1 7 69 7FFF 68808001 7EE8E881E8818117 6996966996696996 9669699669969669c16 1 6 7E 6996 7FFFFFFE 6880800180010116 7EE8E881E8818117 E88181178117177Ec17 1 7 68 7EE8 69969668 7FFFFFFEFFFEFEE8 6880800180010116 8001011601161668c18 1 6 7F 6880 7EE8E880 6996966896686880 7FFFFFFEFFFEFEE8 FFFEFEE8FEE8E880c19 1 7 69 7FFF 68808000 7EE8E880E8808000 6996966896686880 9668688068808000c20 6880800080000000 7EE8E880E8808000 E880800080000000c21 7FFFFFFFFFFFFFFF 6880800080000000 8000000000000000c22 7FFFFFFFFFFFFFFF FFFFFFFFFFFFFFFF
20081008 CJ 20
Symmetric Boolean Functions
nnnnxxnn xxSxxSxxSn
,,,,:,, 11,,1 1
n
mn
mnmnnn
mn xxSxxSxxS
0111 ,,,,:,,
Symmetric Boolean Functions of order m, nm0
Function values: nH
n
mmnn xxwwm
wxxS ,,;2mod,, 10
1
Property: 111111
11 ,,,,,, n
mnn
mnnn
mn xxSxxSxxxS
20081008 CJ 21
Symmetric Boolean Functions
General SBFs:
1112
2121
11101
12
211
10
11
00
1
)()()(
)()()(
: with,
nnnnnnn
nnnnnnn
nnnnnn
nnnn
SSSS
SSSS
SSSS
SSSx
Proposition:
11
10
11
11
111
1 21,
nnnn
nn
nn
nn
nnn
nn
nnn
mn
mn
mn
mn
mnn
SSSx
SSSSx
SSx
nmSSSSSx
20081008 CJ 22
Applying SBFsThe inverse matrix:
10000010000
1000
10010
1
1000
10010
1
11
11
12
12
22
13
12
13
23
11
11
11
21
1
10
10
12
021
SSS
SSSSSS
SSSSS
e
eeeee L
LLL
LLL
LLL
LL
11
11
iiii ejee
nmSnmSS
S nn
mn
mnm
n ;;1From Proposition
20081008 CJ 23
Applying SBFs Same columnwise recursion for all
matrix elements above diagonal Linear SBF allways included
Very compact representation SBF vector of length n versus truth
table of length 2n Easy to evaluate SBFs
n+1 weight values
20081008 CJ 24
Calculating Linear Relations
126A1E2266AA1FE202206A1E22266E220120262
011FE26201AA1FE262
0166AAFE262012266AA7E22
011E22662A3E2201A1E22662A1E2
016A1E2226AE20126A1E226A2
0126A1E2620126A1E262
0126AE220126A62
01262201262
0122012
0000000000000000001
18
17
16
15
11314
13
12
11
10
9
8
7
6
5
4
3
2
1
0
1817161514131211109876543210
cccc
fccccccccccccccc
aaaaaaaaaaaaaaaaaaa
L
ik
iikki fca
1;2mod2 12
1
kfff ik
iik
ik
20081008 CJ 25
Pomaranch V3 Even sections: 1410761
Odd sections: 1501203
134C14C345CE1523F6B1D27719B2C14411410761 1817161514131211109876543210 aaaaaaaaaaaaaaaaaaa
145678121718 xxxxxxxx
179151718 xxxxxx
J = 84074, LEB = 660, |LES| = 7172
134D16A3E4D217639B2AC1F5E12262AE311501203 1817161514131211109876543210 aaaaaaaaaaaaaaaaaaa
J =27044, LEB = 720, |LES| = 4962
20081008 CJ 26
All Linear Relations
111810017110016101001511110014100010113110011101210101001011111111011010100000110109110000101111810100011100007111100100100006100010110110001511001110110100114101010011011101013111111010110011111210000011110101000011110000100011111000101817161514131211109876543210 aaaaaaaaaaaaaaaaaaawH C(x): 1410761
C(x+1): 1410237
20081008 CJ 27
Conclusions
Similarity Transforms: Jumping LFSMs optimized for implementation
Linear Relations in output of jump controlled LFSMs: Coefficients are symmetric Boolean
functions of jump control bits Speed-up of LES/LEB calculations
enormously Generalizations