Related-key rectangle attack on 36 rounds of the XTEA block cipher

XTEA is a 64-round block cipher with a 64-bit block size and a 128-bit user key, which was designed as a short C program that would run safely on most computers. In this paper, we present a related-key rectangle attack on a series of inner 36 rounds of XTEA without making a weak key assumption, and a related-key rectangle attack on the first 36 rounds of XTEA under certain weak key assumptions. These are better than any previously published cryptanalytic results on XTEA in terms of the numbers of attacked rounds.

Security analysis of the full-round DDO-64 block cipher

DDO-64 is a 64-bit Feistel-like block cipher based on data-dependent operations (DDOs). It is composed of 8 rounds and uses a 128-bit key. There are two versions of DDO-64, named DDO-64V₁ and DDO-64V₂, according to the key schedule. They were designed under an attempt for improving the security and performance of DDP-based ciphers. In this paper, however, we show that like most of the existing DDP-based ciphers, DDO-64V₁ and DDO-64V₂ are also vulnerable to related-key attacks. The attack on DDO-64V₁ requires 2^35.5 related-key chosen plaintexts and 2^63.5 encryptions while the attack on DDO-64V₂ only needs 8 related-key chosen plaintexts and 2³¹ encryptions; our attacks are both mainly due to their simple key schedules and structural weaknesses. These works are the first known cryptanalytic results on DDO-64V₁ and DDO-64V₂ so far.     

A lightweight mechanism for detection of cache pollution attacks in Named Data Networking

Content-Centric Networking (CCN) is an emerging paradigm being considered as a possible replacement for the current IP-based host-centric Internet infrastructure. In CCN, named content – rather than addressable hosts – becomes a first-class entity. Content is therefore decoupled from its location. This allows, among other things, the implementation of ubiquitous caching.     

Multidimensional zero-correlation attacks on lightweight block cipher HIGHT: Improved cryptanalysis of an ISO standard

HIGHT is a block cipher designed in Korea with the involvement of Korea Information Security Agency. It was proposed at CHES 2006 for usage in lightweight applications such as sensor networks and RFID tags. Lately, it has been adopted as ISO standard. Though there is a great deal of cryptanalytic results on HIGHT, its security evaluation against the recent zero-correlation linear attacks is still lacking. At the same time, the Feistel-type structure of HIGHT suggests that it might be susceptible to this type of cryptanalysis. In this paper, we aim to bridge this gap.We identify zero-correlation linear approximations over 16 rounds of HIGHT. Based upon those, we attack 27-round HIGHT (round 4 to round 30) with improved time complexity and practical memory requirements. This attack of ours is the best result on HIGHT to date in the classical single-key setting. We also provide the first attack on 26-round HIGHT (round 4 to round 29) with the full whitening key.     

Timing predictability of cache replacement policies

Hard real-time systems must obey strict timing constraints. Therefore, one needs to derive guarantees on the worst-case execution times of a system’s tasks. In this context, predictable behavior of system components is crucial for the derivation of tight and thus useful bounds. This paper presents results about the predictability of common cache replacement policies. To this end, we introduce three metrics, evict, fill, and mls that capture aspects of cache-state predictability. A thorough analysis of the LRU, FIFO, MRU, and PLRU policies yields the respective values under these metrics. To the best of our knowledge, this work presents the first quantitative, analytical results for the predictability of replacement policies. Our results support empirical evidence in static cache analysis.

随机分组密码算法框架及实现

针对现有的对分组密码的攻击方法对于未知结构的密码算法是无效的特点,提出了一个根据已有分组密码算法生成随机密码算法的框架,其密码算法是由随机控制密钥生成的,因而算法是随机的,能抵抗针对固定结构的密码算法的线性密码分析和差分密码分析。同时还提出了一个具体的AES的随机化算法,该算法具有可证明的安全性,其安全性高于原始的AES,性能与原始的AES算法接近。     

一个混沌分组密码算法的分析*

研究了一个基于混沌设计的分组密码算法的安全性,发现该算法所产生的混沌序列具有前几个值对混沌初态和参数的低位比特变化不够敏感的性质,在选择明文攻击条件下,提出了攻击加密算法等效密钥的分割攻击方法。分组密码算法的密钥长度为106 bit,分割攻击方法的计算复杂性约为260,存储复杂性约为250,成功率为0.928 4。     

LiCi密码的差分故障攻击

LiCi轻量级分组密码算法是2017年提出的一种新型密码算法,其具有结构微小、消耗能量少等优点,适用于物联网等资源受限的环境.在LiCi的设计文档中,对该算法抵御差分攻击和线性攻击的能力进行了分析,但LiCi算法对于差分故障攻击的抵抗能力尚未得到讨论.针对LiCi算法每轮迭代的移位规律,在第31轮迭代时的左半侧多次注入...     

对XW混沌密码算法的分割攻击*

分析了徐淑奖等人提出的一类混沌迭代加密算法的安全性,发现该加密算法由混沌映射产生的量化序列的前几个量化值对混沌初始值低位比特的变化不够敏感,据此提出了在选择明文攻击条件下由量化序列恢复混沌初始值的先攻击高位比特再攻击低位比特的分割攻击方法。在参数r= 4已知且密钥长度为64 bit的条件下,分割攻击算法仅需1个选择明密对,其成功率为0.930 5,计算复杂性约为219.7,存储复杂性约为211.6。     

缓存侧信道攻击与防御

近年来,随着信息技术的发展,信息系统中的缓存侧信道攻击层出不穷.从最早利用缓存计时分析推测密钥的想法提出至今,缓存侧信道攻击已经历了10余年的发展和演进.研究中梳理了信息系统中缓存侧信道攻击风险,并对缓存侧信道攻击的攻击场景、实现层次、攻击目标和攻击原理进行了总结．系统分析了针对缓存侧信道攻击的防御技术,从缓存侧信道攻击防御的不同阶段出发,分析了攻击检测和防御实施2部分研究工作,并基于不同防御原理对防御方法进行分类和分析.最后,总结并讨论了互联网生态体系下缓存侧信道攻击与防御的研究热点,指出缓存侧信道攻击与防御未来的研究方向,为想要在这一领域开始研究工作的研究者提供参考.

     

An ANFIS-based cache replacement method for mitigating cache pollution attacks in Named Data Networking

Named Data Networking (NDN) is a candidate next-generation Internet architecture designed to overcome the fundamental limitations of the current IP-based Internet, in particular strong security. The ubiquitous in-network caching is a key NDN feature. However, pervasive caching strengthens security problems namely cache pollution attacks including cache poisoning (i.e., introducing malicious content into caches as false-locality) and cache pollution (i.e., ruining the cache locality with new unpopular content as locality-disruption).In this paper, a new cache replacement method based on Adaptive Neuro-Fuzzy Inference System (ANFIS) is presented to mitigate the cache pollution attacks in NDN. The ANFIS structure is built using the input data related to the inherent characteristics of the cached content and the output related to the content type (i.e., healthy, locality-disruption, and false-locality). The proposed method detects both false-locality and locality-disruption attacks as well as a combination of the two on different topologies with high accuracy, and mitigates them efficiently without very much computational cost as compared to the most common policies.     

SNAKE(2)分组密码的积分攻击

针对目前对SNAKE算法的安全性分析主要是插值攻击及不可能差分攻击,评估了SNAKE(2)算法对积分攻击的抵抗能力。利用高阶积分的思想,构造了一个8轮区分器,利用该区分器,对SNAKE(2)算法进行了9轮、10轮积分攻击。攻击结果表明,SNAKE(2)算法对10轮积分攻击是不免疫的。     

Cryptanalysis of an involutional block cipher using cellular automata

In 2006, an involutional block cipher using cellular automata was proposed. A self-invertible CA-based structure allows for an efficient hardware implementation. This paper analyzes the insecurity of the cipher due to its conjugate property. The results of this study will make it possible to construct a decryption process without knowledge of the secret key.     

SIMECK密码代数故障攻击研究

针对SIMECK密码给出一种代数故障攻击方法。首先给出SIMECK加密轮函数和密钥生成策略等效代数方程创建方法;分别设定故障已知模型和故障未知模型,并在故障未知模型下提出基于故障注入差分和基于正确/故障密文差分确定故障索引值两种策略创建故障信息方程;利用基于SAT问题求解方程组。结果表明,在SIMECK32/64第24轮注入单比特翻转故障,故障已知模型和基于故障注入差分的故障未知模型均仅需2次注入即可恢复完整64比特主密钥;在第27轮注入故障,基于密文差分的未知模型需9次注入可恢复完整主密钥。与已有研究相比,该攻击密钥搜索复杂度更低,所需故障注入样本量更少。     

E2算法的中间相遇攻击

作为AES的候选算法,E2算法由于其特殊的两层SP结构一直是人们研究的热点。研究了E2算法抵抗中间相遇攻击的能力。基于E2算法的结构,利用中间相遇的思想设计了一个4轮区分器,利用该区分器,对E2算法进行了5轮、6轮中间相遇攻击。研究结果表明,E2-128算法对于5轮中间相遇攻击以及E2-256算法对于6轮中间相遇攻击是不抵抗的。这是首次用中间相遇的攻击方法对E2算法进行的分析,相对于已有的结果,该方法降低了所用数据复杂度。     

Improving cache locality for GPU-based volume rendering

We present a cache-aware method for accelerating texture-based volume rendering on a graphics processing unit (GPU). Because a GPU has hierarchical architecture in terms of processing and memory units, cache optimization is important to maximize performance for memory-intensive applications. Our method localizes texture memory reference according to the location of the viewpoint and dynamically selects the width and height of thread blocks (TBs) so that each warp, which is a series of 32 threads processed simultaneously, can minimize memory access strides. We also incorporate transposed indexing of threads to perform TB-level cache optimization for specific viewpoints. Furthermore, we maximize TB size to exploit spatial locality with fewer resident TBs. For viewpoints with relatively large strides, we synchronize threads of the same TB at regular intervals to realize synchronous ray propagation. Experimental results indicate that our cache-aware method doubles the worst rendering performance compared to those provided by the CUDA and OpenCL software development kits.     

What is the effective key length for a block cipher: an attack on every practical block cipher

Recently,several important block ciphers are considered to be broken by the brute-force-like cryptanalysis,with a time complexity faster than the exhaustive key search by going over the entire key space but performing less than a full encryption for each possible key.Motivated by this observation,we describe a meetin-the-middle attack that can always be successfully mounted against any practical block ciphers with success probability one.The data complexity of this attack is the smallest according to the unicity distance.The time complexity can be written as 2k(1-),where>0 for all practical block ciphers.Previously,the security bound that is commonly accepted is the length k of the given master key.From our result we point out that actually this k-bit security is always overestimated and can never be reached because of the inevitable loss of the key bits.No amount of clever design can prevent it,but increments of the number of rounds can reduce this key loss as much as possible.We give more insight into the problem of the upper bound of effective key bits in block ciphers,and show a more accurate bound.A suggestion about the relationship between the key size and block size is given.That is,when the number of rounds is fixed,it is better to take a key size equal to the block size.Also,effective key bits of many well-known block ciphers are calculated and analyzed,which also confirms their lower security margins than thought before.The results in this article motivate us to reconsider the real complexity that a valid attack should compare to.     

A DNA sticker algorithm for bit-substitution in a block cipher

To attack block cipher systems, it is inevitable to handle the bit-substitutions, such as S-box, cycle left shift, and expansion substitutions. In this paper, a DNA sticker algorithm for bit-substitution such as cycle left shift is proposed. The proposed algorithm requires two equal long memory strands. The first memory strand stores the original binary string, while the second memory strand stores the resulting binary string. With the proposed algorithm, cycle left shift is performed on a mass of equal long binary strings, and the computation complexity of the cycle left shift is O(n)$O\left(n\right)$ for all n$n$-bit binary strings. Furthermore, this work indicates that block cipher systems with a 64-bit key are perhaps insecure. This paper presents clear evidence of the ability of DNA computing to perform intractable computation problems.     

一种分组密码S盒抗Glitch攻击的方案

伴随着网络信息时代的飞速发展,各种电子产品应运而生,人们的生活变得越来越智能,越来越便捷,然而在便捷的背后却隐藏着重大的安全隐患。密码芯片是保障信息安全的重要手段之一,所以提高密码芯片的安全性迫在眉睫。以Stefan等人的针对分组密码芯片S盒的Glitch攻击为模型背景,通过加入一组同步寄存器提出基于FPGA的一种针对分组密码S盒抗Glitch攻击的方案,并通过CMOS器件的属性和Altera公司在QuatusⅡ软件中嵌入的Signal Tap功能,从理论和仿真两方面分别验证了该方案不但能够大幅度减少Glitch的个数,还能够减少各级电路产生Glitch的相关性,从而降低了攻击的成功率,提高了分组密码S盒实现的安全性,为后续FPGA密码芯片的防护提供了依据。     

Differential attack on nine rounds of the SEED block cipher

The SEED block cipher has a 128-bit block length, a 128-bit user key and a total number of 16 rounds. It is an ISO international standard. In this letter, we describe two 7-round differentials with a trivially larger probability than the best previously known one on SEED, and present a differential cryptanalysis attack on a 9-round reduced version of SEED. The attack requires a memory of 2^69.71 bytes, and has a time complexity of 2^126.36 encryptions with a success probability of 99.9% when using 2¹²⁵ chosen plaintexts, or a time complexity of 2^125.36 encryptions with a success probability of 97.8% when using 2¹²⁴ chosen plaintexts. Our result is better than any previously published cryptanalytic results on SEED in terms of the numbers of attacked rounds, and it suggests for the first time that the safety margin of SEED decreases below half of the number of rounds.