Related-Cipher Attacks

Transcription

1 Relaed-Cipher Aacs Hongjun Wu Laboraories for Informaion Technology Heng Mui Keng Terrace Singapore 96 LSRKNYR$PMXEWXEVIHYWK Absrac. We formally inroduce he concep of relaed-cipher aac. In his paper, we consider he relaed ciphers as bloc ciphers wih he same round funcion bu wih differen round numbers. If heir ey schedules do no depend on he oal round number, hen relaed-cipher aac could be applied if he same ey is used. We applied his aac o bloc cipher SQUARE and show ha SQUARE is vulnerable o his aac. We also show ha a new AES ey schedule proposed a ACISP is weaer han he original one under his aac. We hen classify he differenial aacs ino hree caegories: relaed-message aac (he original differenial crypanalysis), relaed-ey aac and relaedcipher aac. These aacs should be aen ino consideraion in cipher design. Inroducion There have been a number of aacs on bloc ciphers. The mos imporan wo inds of aacs are differenial crypanalysis [] and linear crypanalyis []. There are some varians or eensions of hese wo aacs such as he higher order differenial crypanalysis [7], runcaed differenial crypanalysis [5], muliple linear approimaions [9], non-linear approimaions [6], pariioning crypanalysis [4] and differenial-linear crypanalysis [8], ec. A common feaure of hese aacs is ha boh he cipher and he ey are fied. By analyzing some nown (or chosen) plaines, informaion abou he ey could be revealed. The linear crypanalysis can also be applied in he ciphere only aac when here is sufficien redundancy in he plaines. All hese aacs are very imporan in he design of ciphers. In [], he relaed-ey aac is inroduced. For his aac, he cipher is fied while he eys are relaed. This aac can be applied when some relaed eys and one common cipher are used o encryp messages. Relaed ey aac has imporan implicaion on he ey schedule design of bloc ciphers. In his paper, we inroduce a new aac relaed-cipher aac. For relaed-cipher aac, he ey is fied while he ciphers are relaed. I could be applied when someone uses he same ey in relaed ciphers. In his paper, we consider he relaed ciphers as bloc ciphers wih he same round funcion bu differen round number and heir ey schedules do no depend on he oal round number. This aac can find he ey easily when he difference beween he round numbers is small. Relaed-cipher aac has imporan implicaion on he design of he ey schedule of bloc ciphers wih fleible round number. R. Deng e al. (Eds.): ICICS, LNCS 5, pp ,. Springer-Verlag Berlin Heidelberg

2 448 Hongjun Wu This paper is organized as follows. The relaed-cipher aac is inroduced in Secion. Secion applies he relaed-cipher aac o some bloc ciphers wih fleible round number. Secion 4 suggess a way o resis relaed cipher aac by relaing he ey schedule o he oal round number of he bloc cipher. Secion 5 concludes his paper. Relaed-Cipher Aac Usually a secre ey is associaed wih one paricular cipher. However, he same ey may be used in differen ciphers in some cases. If hose ciphers are relaed, he relaed-cipher aac may be applied. In his paper, we deal wih he bloc ciphers wih fleible round number. Fleible round number is a feaure in some bloc ciphers. I allows a user o choose greaer securiy level. However, he ey schedule of some of hese bloc ciphers does no depend on he oal round number. We denoe hese bloc ciphers as relaed ciphers. For his ind of cipher, if he same ey is used in he ciphers wih differen round number, hen he ey can be found when he difference beween he round numbers is small. The aac is oulined below. Relaed-Cipher Aac on Bloc Ciphers. Consider wo relaed bloc ciphers. Boh of hem have he same round funcion, bu wih differen round numbers, r and (r + r) respecively. If a ey is used in hese wo ciphers o encryp he same message, he aac can be carried ou on he r- round cipher. For his r-round cipher, he plaine is he ciphere of he r-round cipher and he ciphere is ha of he (r + r)-round cipher. The ey can be deermined easily for small r. In he ne secion, we will apply relaed-cipher aac on some bloc ciphers wih fleible round number. Relaed-Cipher Aac on Some Bloc Ciphers In his secion relaed cipher aac is applied o wo bloc ciphers wih fleible round number. Bloc SQUARE [] is vulnerable o his ind of aac. AES [] can resis his ind of aac. Bu a new AES ey schedule [] is no ha secure. Oher bloc ciphers wih fleible round number such as SAFER [] are also vulnerable o he relaed cipher aac bu we omi he aacs here. These resuls show ha some of he bloc ciphers wih fleible round number are really vulnerable o relaed cipher aac if heir ey schedules are no carefully designed. Care should be aen when we design bloc ciphers wih fleible round number. In Subsecion., we apply he aac o SQUARE. In Subsecion., AES is shown o be able o resis he relaedcipher aac. In Subsecion., we show ha a new AES ey schedule presened a ACISP is no secure agains he relaed-cipher aac.. Bloc Cipher SQUARE SQUARE is a new bloc cipher designed by J. Daemen, L. Knudsen and V. Rijmen. The round number of SQUARE is se o eigh while he designers also allow he con-

3 Relaed-Cipher Aacs 449 servaive users o increase he number of rounds in a sraigh way. The ey schedule of SQUARE does no depend on he oal round number of he cipher and hus vulnerable o he relaed cipher aac... Srucure of SQUARE The srucure of SQUARE is oulined below. Ineresed readers may refer o [] for he deail. SQUARE is an ieraed bloc cipher wih a bloc lengh and ey lengh of 8 bis each. The basic building blocs of he cipher are five differen inverible ransformaions ha operae on a 4 4 array of byes. The elemen of a sae a in row i and column j is specified as a i,j. Boh indees sar from. These five ransformaions are oulined below. A Linear Transformaion θ. θ b = θ ( a) b = c a c a c a c a : i, j j i, j i, j i, j i, where he muliplicaion in GF( 8 ) and he indices of c is aen modulo 4. If he rows of a sae is denoed by polynomials Using his noaion, and defining a i ( ) = ai, j j= c( ) = c j= Then θ can be described as a modular polynomial muliplicaion: In SQUARE, c() b = θ ( a) b ( ) = c( ) a ( ) mod( ) for i < 4 is chosen o be i i + c( ) = A Nonlinear Transformaion γ. γ is a nonlinear bye subsiuion and is defined as γ : b = γ ( a) bi j = Sγ ( ai, j j j 4, j wih S γ an inverible 8-bi subsiuion able. In SQUARE, he S-bo is consruced by aing he mapping an affine ransformaion o he oupu bis. A Bye Permuaion π. π : = π ( a) b i = a b, j j, i Biwise Round Key Addiion σ. σ [ ] consiss of he biwise addiion of a round ey. σ[ ] : b = σ[ ]( a) b = a ) and applying

4 45 Hongjun Wu The Round Key Evoluion ψ. The round eys are derived ieraively from he cipher ey K in he following way. = K = ψ ( ) + where ψ is an inverible affine ransformaion and = ψ ( ) is defined by + = rol( ) = = = C () where rol(a i ) is a lef bye-roaion operaion on a row as rol [ ai, ai,ai,ai, ] = [ ai,ai, ai,ai, ] and he round consans C are also defined ieraively as C C = = C We noice ha he ey schedule of SQUARE does no depend on he oal round number. The Cipher SQUARE The h round funcion is denoed by ρ [ ] : ρ[ ] = σ[ SQUARE is defined as eigh rounds preceeded by a ey addiion [ σ ] and by θ : SQUARE[] = ] o π o γ ρ[ ] o ρ[ ] o ρ[ ] o ρ[ ] o 4 ρ[ ] o ρ[ ] o ρ[ ] o ρ[ ] oσ[ o θ ] oθ As a safey margin, he designers fied he number of rounds o eigh. However, he designers also allow conservaive users o increase he number of rounds in a sraigh way... Relaed Cipher Aac on SQUARE From he descripion of SQUARE, i is noed ha he ey schedule of SQUARE does no depend on he oal round number. So SQAUARE ciphers wih differen round numbers are relaed. If he same ey is used in SQUARE wih differen round number, hen he relaed cipher aac can be applied. Denoe c r as he ciphere of r round SQUARE and c r as ha of r round SQUARE. If a c r and a c r are relaed o he same plaine, hey are denoed as one righ pair. We apply he relaed cipher aac o he siuaions where r = and r =.

5 Relaed-Cipher Aacs 45 When r =, he cipher ey can be deermined from only one righ pair. In his case, SQUARE is reduced o only one round and he following relaion holds From equaion (), he round ey is derived as r r r c + + = ρ [ ]( c ) () = ( π o γ oθ ( c r )) c The cipher ey K can be derived from his round ey direcly since he ey evoluion ψ is inverible. This cipher ey K can be used o decryp all he messages encryped wih i. When r =, he cipher ey can be deermined from wo righ pairs easily. In his case, SQUARE is reduced o wo rounds and he following relaion holds Le hen equaion () is simplified o c c r = ρ[ ] o ρ[ ]( c ) () c r = π o γ o θ ( c r ) r r ( π o γ oθ ( c )) (4) + = r We noe he fac ha one row of ( c ) is relaed o one column of + r ( c ). So equaion (4) is decomposed ino four bloc ciphers each wih - bi bloc lengh. These four bloc ciphers have he common form as c = γ o θ ( c )) (5) ( The value of (or ) can be deermined easily from pairs of ( c, c ). So he round ey (or ) is nown and he cipher ey can be deermined.. Bloc Cipher AES AES is also wih fleible round number: for AES-8, for AES-9, and 4 for AES-56 (where AES- indicaes AES wih -bi secre ey). However, AES is no vulnerable o he relaed-cipher aac... Srucure of AES We inroduce only he ey schedule of AES here. Is pseudo code is given in Fig.. In Fig., he ey[ ] represens he cipher ey, N is he lengh of he cipher ey in - bi words, Nb is he bloc size in words, w[ ] is he round eys, Nr is he round number. Subword, RoWord and Rcon are some funcions we will omi heir illusraions here.

6 45 Hongjun Wu /I])\TERWMSRF]XIOI]?OA[SVH[?FVAO) FIKMR [SVHXIQT M! [LMPIM O [?MA![SVHOI]?MAOI]?MA OI]?MAOI]?MA M!M IRH[LMPI M!O [LMPIM FVA XIQT![?MA MJMQSHO! XIQT!7YF;SVH6SX;SVHXIQT\SV6GSR?MOA IPWIMJO"ERHMQSHO! XIQT!7YF;SVHXIQT IRHMJ [?MA![?MOA\SVXIQT M!M IRH[LMPI IRH Fig.. Pseudo code for AES ey schedule.. AES Is Able o Resis he Relaed-Cipher Aac From he descripion of he AES ey schedule, we see ha he ey schedule of AES depends on he ey lengh N. I is hus impossible for he same ey being used in he AES wih differen round numbers. Even if a 56-bi ey is he repea of a 8-bi ey and boh of hem are used o encryp he same message, he relaed-cipher aac could no be applied since he ey schedule of AES-56 is slighly differen from ha of AES-8. We see ha AES is able o resis he relaed cipher aac because he relaionship beween he ey lengh and he round number is fied. I is hus avoided ha he same ey being used in he relaed ciphers.. A New AES Key Schedule A ACISP, a new AES ey schedule [] was proposed. However, we will show ha his new ey schedule is weaer han he original one under he relaed-cipher aac.

7 Relaed-Cipher Aacs 45.. Descripion of he New AES Key Schedule We inroduce only he new ey schedules for AES-9 and AES-56 here. IXT!V!JSV%)7 T!V!JSV%)7 JSVV!XSV JSVN!XS E N!O N 7?V NA 7?/ NT A E N!O NT 7?V NA 7?/ N A JSVM!XS &]XI7YFE 7LMJX6S[E M\'SPYQRE %HH6SYRH/I]EF /6 V!E Fig.. Pseudo code for he new AES ey schedule In Fig., each M j represens one bye of he cipher ey. ByeSub, ShifRow, Mi- Column and AddRoundKey are he componens of he AES round funcion. S[ ] is he S-bo used in AES. Each KR r represens a 8-bi round ey... Weaness in he New AES Key Schedule We consider he following scenario. Consider ha a 64-bi ey being used in AES- 9 and AES-56. And very liely he 64-bi ey is concaenaed o form he 9 and 56-bi ey, respecively. Then he firs round eys for AES-9 and AES-56 would be idenical. Now an aac could be applied o he las wo rounds of AES Mehod o Resis he Relaed Cipher Aac In Secion, we applied he relaed-aac on SQUARE, AES and a new AES ey schedule. AES is able o resis he aac. In his secion, we inroduce a general mehod o resis he relaed-cipher aac on bloc ciphers wih fleible round number: relaing he ey schedule o he oal round number. So when he same ey is used o encryp he same plaine, he inermediae value afer he ih round in he r round cipher should be quie differen from ha in he r round cipher (r r ). The acual implemenaion ha relaes he ey schedule o he oal round number may vary from cipher o cipher. In he following eample, we show how o relae he ey schedule of SQUARE o he oal round number. The original ey schedule of SQUARE is mainained and addiional modificaion is carried ou on he subeys.

8 454 Hongjun Wu Afer he original ey schedule of SQUARE, we denoe all he subeys as,..., n (each one is one bye). The addiional modificaion is carried ou in his way: for i = o n do = S i [ S [ r]]; γ i + where S γ is he S-bo used in SQUARE and r is he oal round number. We epec ha SQUARE wih his modified ey schedule could resis he relaed-cipher aac. Since 8 round SQUARE is in use now, we sugges o eep he 8-round SQUARE he same as in [], bu hose SQUARE wih increased round number may adop his srenghened ey schedule. γ 5 Conclusion In his paper, we inroduced he relaed-cipher aac and applied his aac o some bloc ciphers wih fleible round number. A Bloc cipher wih fleible round number bu wih ey schedule unrelaed o he oal round number is vulnerable o his aac. Care should be aen in designing ciphers wih fleible feaures. A mehod o resis relaed cipher aac by relaing he ey schedule o he oal round number is also suggesed. Afer inroducing he relaed-cipher aac, we can classify he differenial aac as relaed-message aac (he original differenial crypanalysis), relaed-ey aac and relaed-cipher aac. Any combinaion of hese aacs also gives a new aac. We believe ha he cipher design should ae all hese aacs ino consideraion. References. E. Biham and A. Shamir. Differenial Crypanalysis of he Daa Encrypion Sandard, Springer-Verlag, 99.. E. Biham. New Types of Crypanalyic Aacs Using Relaed Keys. In T. Helleseh, edior, Advances in Crypology: Proc. of Eurocryp 9, LNCS 765, pages 98-49, Springer-Verlag, J. Daemen, L. Knudsen and V. Rijmen. The Bloc Cipher SQUARE. In E. Biham, edior, Fas Sofware Encrypion Proc. Forh Inernaional Worshop, Haifa, Israel, January 997, LNCS 67, pages -7, Springer Verlag, C. Harpes and J.L. Massey. Pariioning Crypanalysis. In E. Biham, edior, Fas Sofware Encrypion: Forh Inernaional Worshop, Haifa, Israel, January 997, LNCS 67, pages -7, Springer Verlag, L.R. Knudsen. Truncaed and higher order differenials. In B. Preneel, edior, Fas Sofware Encrypion: Second Inernaional Worshop, Leuven, Belgium, 994, LNCS 8, pages 96-, Springer Verlag, L.R. Knudsen and M.J.B. Robshaw. Non-Linear Approimaions in Linear Crypanalysis. In U. Maurer, edior, Advancess in Crypology Eurocryp 96, LNCS 7, pages 4-5. Springer Verlag, X. Lai. Higher order derivaives and differenial crypanalysis. In Proc. Symposium on Communicaion, Coding and Crypography, in honor of James L. Massey on he occasion of his 6 h birhday, Feb. -, 994, Mone-Veria, Ascona, Swizerland, 994.

9 Relaed-Cipher Aacs S.K. Langford and M.E. Hellman. Differenial-linear crypanalysis. In Y. G. Desmed, edior, Advances in Crypology Proc. Crypo 94, LNCS 89, pages 7-6. Springer Verlag, B.S. Kalisi Jr. and M.J.B. Robshaw. Linear Crypanalysis Using Muliple Approimaions. In Y. G. Desmed, edior, Advances in Crypology Proc. Crypo 94, LNCS 89, pages 7-9. Springer Verlag, J. Massey. SAFER K-64: A Bye-Oriened Bloc-Ciphering Algorihm. In R. Anderson, edior, Fas Sofware Encrypion Proc. Cambridge Securiy Worshop, Cambridge, U.K., Dec. 9-, 99, LNCS 89, Springer-Verlag, pp.-7. [See also: SAFER K-64: One Year Laer. In B. Preneel, edior, Fas Sofware Encrypion-- Proceedings of he Second Inernaional Worshop on Fas Sofware Encrypion, Springer-Verlag, 995, pp.- 4; and Srenghened Key Schedule for he Cipher SAFER, posed o he USENET newsgroup sci.cryp, Sepember 9, 995]. M. Masui, Linear Crypanalysis Mehod for DES Cipher. In T. Helleseh, edior, Advances in Crypology Proc. of Eurocryp '9, LNCS 765, pages 86-97, Springer- Verlag, L. May, M. Henricsen, W. Millan, G. Carer, and E. Dawson, Srenghening he Key Schedule of he AES. In Informaion Securiy and Privacy Proc. of ACISP, LNCS 84, pages Naional Insiue of Sandards and Technology, Advanced Encrypion Sandard. Available a hp:// csrc.nis.gov/encrypion/aes/