减缩轮PRIDE算法的线性分析

PRIDE是Albrecht等人在2014美密会上提出的轻量级分组密码算法.PRIDE采用典型SPN密码结构,共迭代20轮.其设计主要关注于线性层,兼顾了算法的效率和安全.该文探讨了S盒和线性层矩阵的线性性质,构造了16条优势为2^-5的2轮线性逼近和8条优势为2^-3的1轮线性逼近.利用合适的线性逼近,结合密钥扩展算法、S盒的线性性质和部分和技术,我们对18轮和19轮PRIDE算法进行了线性分析.该分析分别需要2⁶⁰个已知明文,2^74.9次18轮加密和2⁶²个已知明文,2^74.9次19轮加密.另外,我们给出了一些关于S盒差分性质和线性性质之间联系的结论,有助于减少攻击过程中的计算量.本文是已知明文攻击.本文是关于PRIDE算法的第一个线性分析.     

截断差分概率的上界估计与应用

截断差分分析是差分分析的一个变形。为说明一个密码算法能够抵抗截断差分分析,需要给出截断差分概率的上界。Masayuki Kanda等人就密码算法中S盒为GF(256)上的乘法逆变换和仿射双射变换复合而成时,提出了截断差分概率的上界一个猜想。该文就一般双射S盒给出了该概率上界问题的一个估计,Masayuki Kanda的猜想是该估计所考虑问题的一个特例,在一些情况下,该估计给出的上界与Masayuki Kanda的猜想接近。利用该结论可以衡量密码算法截断差分传递链概率的上界。该结论为分组密码抗截断差分分析的可证明安全性提供了理论依据。     

Making the Impossible Possible

This paper introduces new techniques and correct complexity analyses for impossible differential cryptanalysis, a powerful block cipher attack. We show how the key schedule of a cipher impacts an impossible differential attack, and we provide a new formula for the time complexity analysis that takes this parameter into account. Further, we show, for the first time, that the technique of multiple differentials can be applied to impossible differential attacks. Then, we demonstrate how this technique can be combined in practice with multiple impossible differentials or with the so-called state-test technique. To support our proposal, we implemented the above techniques on small-scale ciphers and verified their efficiency and accuracy in practice. We apply our techniques to the cryptanalysis of ciphers including AES-128, CRYPTON-128, ARIA-128, CLEFIA-128, Camellia-256 and LBlock. All of our attacks significantly improve previous impossible differential attacks and generally achieve the best memory complexity among all previous attacks against these ciphers.     

Multidimensional Differential‐Linear Cryptanalysis of ARIA Block Cipher

ARIA is a 128‐bit block cipher that has been selected as a Korean encryption standard. Similar to AES, it is robust against differential cryptanalysis and linear cryptanalysis. In this study, we analyze the security of ARIA against differential‐linear cryptanalysis. We present five rounds of differential‐linear distinguishers for ARIA, which can distinguish five rounds of ARIA from random permutations using only 284.8 chosen plaintexts. Moreover, we develop differential‐linear attacks based on six rounds of ARIA‐128 and seven rounds of ARIA‐256. This is the first multidimensional differential‐linear cryptanalysis of ARIA and it has lower data complexity than all previous results. This is a preliminary study and further research may obtain better results in the future.     

Improved impossible differential and biclique cryptanalysis of HIGHT

HIGHT is a lightweight block cipher introduced in CHES 2006 by Hong et al as a block cipher suitable for low‐resource applications. In this paper, we propose improved impossible differential and biclique attacks on HIGHT block cipher both exploiting the permutation‐based property of the cipher's key schedule algorithm as well as its low diffusion. For impossible differential attack, we found a new 17‐round impossible differential characteristic that enables us to propose a new 27‐round impossible differential attack. The total time complexity of the attack is 2^120.4 where an amount of 2^59.3 chosen plaintext‐ciphertext pairs and 2^107.4 memory are required. We also instantiate a new biclique cryptanalysis of HIGHT, which is based on the new idea of splitting each of the forward and backward keys into 2 parts where the computations associated to each one are performed independently. The time complexity and data complexity of this attack are 2^125.7 and 2⁴², respectively. To the best of our knowledge, this is the fastest biclique attack on full‐round HIGHT.     

嵌套SP网络的New-Structure系列结构的零相关线性逼近与不可能差分性质研究

分组密码的安全性分析是密码学的重要研究内容,其中不可能差分分析和零相关线性分析是密码算法安全性分析的重要方法.本文利用中间相错方法,通过对扩散层进行限制,给出了嵌套SP网络的New-Structure 系列结构的零相关线性逼近.给出了New-Structure I和New-Structure IV结构中概率非零的差分传递链和相关优势非零的线性逼近传递链在结构上的一致性.此外也给出了嵌套SP网络New-Structure I、III的16/22轮不可能差分特征.最后给出在分组规模和密钥规模均为128比特时,对New-Structure I,III,IV进行21/28/22轮的不可能差分攻击和19/28/22轮的多维零相关线性逼近攻击所需要的时间复杂度和数据复杂度.本文的结果对基于New-Structure结构设计的密码算法的安全性分析提供了理论依据.     

On Probability of Success in Linear and Differential Cryptanalysis

Despite their widespread usage in block cipher security, linear and differential cryptanalysis still lack a robust treatment of their success probability, and the success chances of these attacks have commonly been estimated in a rather ad hoc fashion. In this paper, we present an analytical calculation of the success probability of linear and differential cryptanalytic attacks. The results apply to an extended sense of the term “success” where the correct key is found not necessarily as the highest-ranking candidate but within a set of high-ranking candidates. Experimental results show that the analysis provides accurate results in most cases, especially in linear cryptanalysis. In cases where the results are less accurate, as in certain cases of differential cryptanalysis, the results are useful to provide approximate estimates of the success probability and the necessary plaintext requirement. The analysis also reveals that the attacked key length in differential cryptanalysis is one of the factors that affect the success probability directly besides the signal-to-noise ratio and the available plaintext amount.     

一类分组密码变换簇抵抗线性密码分析的安全性评估

线性密码分析是针对分组密码的强有力的攻击方法，估计分组密码抵抗线性密码分析的能力是分组密码安全性评估的重要内容之一.基于实际应用背景，提出了"四分组类CLEFIA变换簇"的概念，并利用变换簇中两种特殊分组密码结构的线性逼近之间的关系，给出了变换簇中所有密码结构抵抗线性密码分析的安全性评估结果，并提出了需要进一步探讨的若干问题.这种利用变换簇对分组密码进行研究的方法，为分组密码的安全性评估提供了一个较为新颖的思路.     

2轮Trivium的多线性密码分析

作为欧洲流密码发展计划eSTREAM的7个最终获选算法之一,Trivium的安全性考察表明至今为止还没有出现有效的攻击算法。该文针对2轮Trivium,通过找出更多线性逼近方程,对其进行了多线性密码分析,提出了一种更有效的区分攻击算法。与现有的单线性密码分析算法相比,该算法攻击成功所需的数据量明显减少,即:若能找到n个线性近似方程,在达到相同攻击成功概率的前提下,多线性密码分析所需的数据量只有单线性密码分析的1/n。该研究结果表明,Trivium的设计还存在一定的缺陷,投入实用之前还需要实施进一步的安全性分析。     

Attacks on Block Ciphers of Low Algebraic Degree

In this paper an attack on block ciphers is introduced, the interpolation attack. This method is useful for attacking ciphers that use simple algebraic functions (in particular quadratic functions) as S-boxes. Also, attacks based on higher-order differentials are introduced. They are special and important cases of the interpolation attacks. The attacks are applied to several block ciphers, the six-round prototype cipher by Nyberg and Knudsen, which is provably secure against ordinary differential cryptanalysis, a modified version of the block cipher SHARK, and a block cipher suggested by Kiefer. Received April 1999 and revised October 2000 Online publication 9 April 2001     

韩国加密标准的安全性分析

SEED是韩国的数据加密标准,设计者称用线性密码分析攻击SEED的复杂度为2^335.4,而用本文构造的15轮线性逼近攻击SEED的复杂度为2³²⁸.为了说明SEED抵抗差分密码分析的能力,设计者首先对SEED的变体SEED^*做差分密码分析,指出9轮SEED*对差分密码分析是安全的;利用SEED^*的扩散置换和盒子的特性,本文构造SEED^*的9轮截断差分,因此10轮SEED^*对截断差分密码分析是不免疫的.本文的结果虽然对SEED的实际应用构成不了威胁,但是显示了SEED的安全性并没有设计者所称的那样安全.     

Instant Ciphertext-Only Cryptanalysis of GSM Encrypted Communication

In this paper we present a very practical ciphertext-only cryptanalysis of GSM (Global System for Mobile communications) encrypted communication, and various active attacks on the GSM protocols. These attacks can even break into GSM networks that use “unbreakable” ciphers. We first describe a ciphertext-only attack on A5/2 that requires a few dozen milliseconds of encrypted off-the-air cellular conversation and finds the correct key in less than a second on a personal computer. We extend this attack to a (more complex) ciphertext-only attack on A5/1. We then describe new (active) attacks on the protocols of networks that use A5/1, A5/3, or even GPRS (General Packet Radio Service). These attacks exploit flaws in the GSM protocols, and they work whenever the mobile phone supports a weak cipher such as A5/2. We emphasize that these attacks are on the protocols, and are thus applicable whenever the cellular phone supports a weak cipher, for example, they are also applicable for attacking A5/3 networks using the cryptanalysis of A5/1. Unlike previous attacks on GSM that require unrealistic information, like long known-plaintext periods, our attacks are very practical and do not require any knowledge of the content of the conversation. Furthermore, we describe how to fortify the attacks to withstand reception errors. As a result, our attacks allow attackers to tap conversations and decrypt them either in real-time, or at any later time. We present several attack scenarios such as call hijacking, altering of data messages and call theft. An earlier version of this paper appears in Barkan et al. (Advances in Cryptology, Proceedings of Crypto 2003, Lecture Notes in Computer Science, vol. 2729, pp. 600–616, 2003).     

对288轮Trivium算法的线性分析

此前对288轮Trivium算法线性分析的文章中,均将密钥视为随机且变化的值,这样对算法进行分析是存在问题的,攻击者实际上无法将得到的线性偏差用于对算法实施攻击.本文在选择IV(Initialization Vector)攻击条件下,重新对288轮Trivium算法进行了线性分析.由于将密钥比特作为未知的定值,因而由密钥比特组成的非线性项是定值,不会产生线性偏差,在选取10个特殊IV后,得到一个线性偏差为1.9E-6的线性逼近式.     

对混沌序列密码的相关密钥攻击

该文首次提出了对混沌序列密码的相关密钥攻击方法。该方法将线性密码分析的思想与对混沌密码的分割攻击方法相结合, 利用多个相关密钥产生的乱数序列对混沌密码实施分割攻击, 从而大大提高了分割攻击方法的效率, 克服了当混沌密码吻合度分布泄漏的信息较小或密钥规模较大时, 分割攻击方法难以将攻击方案的计算复杂性降低在可实现范围内的局限。作为例子, 该文实现了对具有64bit密钥的ZLL混沌密码的相关密钥攻击, 在主频为2.5GHz的Pentium 4-PC机上, 整个攻击时间平均为154s, 成功率为0.96。     

基于SAT的ARX不可能差分和零相关区分器的自动化搜索

ARX（Addition，Rotation，Xor）算法基于模整数加，异或加和循环移位三种运算，便于软硬件的快速实现.不可能差分分析和零相关分析是攻击ARX的有效方法，攻击的关键是搜索更长轮数、更多数量的不可能差分和零相关区分器.目前很多的搜索方法都没有充分考虑非线性组件的性质，往往不能搜索得到更好、更准确的区分器.本文提出了基于SAT（Satisfiability）的ARX不可能差分和零相关区分器的自动化搜索算法.通过分析ARX算法组件的性质，特别是常规模加和密钥模加这两种非线性运算差分和线性传播的特性，给出了高效简单的SAT约束式.在此基础上，建立SAT模型进行区分器的搜索.作为应用，本文首次给出了Chaskey算法13条4轮不可能差分和1条4轮零相关区分器；首次给出了SPECK32算法10条6轮零相关区分器和SPECK48算法15条6轮零相关区分器；在较短的时间内，给出了HIGHT算法17轮的不可能差分和零相关区分器.与现有结果相比，无论是区分器的条数，还是搜索区分器的时间均有明显的提升.此外，通过重新封装求解器STP的输出接口，建立了自动化的SAT\\SMT分析模型，能够给出ARX算法在特殊输入输出差分和掩码集合下，不可能差分和零相关区分器轮数的上界.     

轻量级密码算法MIBS的零相关和积分分析

MIBS是适用于RFID和传感资源受限环境的轻量级分组算法。该文构造了一些关于MIBS的8轮零相关线性逼近,结合密钥扩展算法的特点和部分和技术,对13轮MIBS-80进行了多维零相关分析。该分析大体需要262.1个已知明文和274.9次加密。此外,利用零相关线性逼近和积分区分器之间的内在联系,推导出8轮的积分区分器,并且对11轮的MIBS-80进行了积分攻击,大体需要260个选择明文和259.8次加密。     

四分组类CLEFIA变换簇抵抗差分密码分析的安全性评估

差分密码分析是针对分组密码的强有力的攻击方法,估计分组密码抵抗差分密码分析的能力是分组密码安全性评估的重要内容之一.基于实际应用背景,提出了“四分组类CLEFIA变换簇”的概念,并利用变换簇中两种特殊分组密码结构的差分对应之间的关系,给出了变换簇中所有密码结构抵抗差分密码分析的安全性评估结果.     

Rotational Rebound Attacks on Reduced Skein

In this paper we combine two powerful methods of symmetric cryptanalysis: rotational cryptanalysis and the rebound attack. Rotational cryptanalysis was designed for the analysis of bit-oriented designs like ARX (Addition-Rotation-XOR) schemes. It has been applied to several hash functions and block ciphers, including the new standard SHA-3 (Keccak). The rebound attack is a start-from-the-middle approach for finding differential paths and conforming pairs in byte-oriented designs like Substitution-Permutation networks and AES. We apply our new compositional attack to the reduced version of the hash function Skein, a finalist of the SHA-3 competition. Our attack penetrates more than two thirds of the Skein core—the cipher Threefish, and made the designers to change the submission in order to prevent it. The rebound part of our attack has been significantly enhanced to deliver results on the largest number of rounds. We also use neutral bits and message modification methods from the practice of collision search in MD5 and SHA-1 hash functions. These methods push the rotational property through more rounds than previous analysis suggested, and eventually establish a distinguishing property for the reduced Threefish cipher. We formally prove that such a property cannot be found for an ideal cipher within the complexity limits of our attack. The complexity estimates are supported by extensive experiments.     

3D密码的不可能差分攻击

3D密码是在CANS2008上提出的一个新的分组密码算法,与以往的分组密码算法不同,它采用了3维结构。密码设计者给出了3D密码的一个5轮不可能差分并对6轮3D密码进行了不可能差分攻击。该文通过3D密码的结构特性找到了新的6轮不可能差分。基于新的不可能差分和3D密码的等价结构,可以对7轮和8轮3D密码进行有效的不可能差分攻击。此外,结合其密钥扩展规则,可以将攻击轮数提高至9轮。该文的攻击结果优于密码设计者的结果。     

LiCi分组密码算法的不可能差分分析

LiCi是由Patil等人(2017)提出的轻量级分组密码算法。由于采用新型的设计理念,该算法具有结构紧凑、能耗低、占用芯片面积小等优点,特别适用于资源受限的环境。目前该算法的安全性备受关注,Patil等人声称:16轮简化算法足以抵抗经典的差分攻击及线性攻击。该文基于S盒的差分特征,结合中间相遇思想,构造了一个10轮的不可能差分区分器。基于此区分器,向前后各扩展3轮,并利用密钥编排方案,给出了LiCi的一个16轮的不可能差分分析方法。该攻击需要时间复杂度约为283.08次16轮加密,数据复杂度约为259.76选择明文,存储复杂度约为276.76数据块,这说明16轮简化的LiCi算法无法抵抗不可能差分攻击。