Differential Side Channel Analysis Attacks on FPGA Implementations of ARIA

In this paper, we first investigate the side channel analysis attack resistance of various FPGA hardware implementations of the ARIA block cipher. The analysis is performed on an FPGA test board dedicated to side channel attacks. Our results show that an unprotected implementation of ARIA allows one to recover the secret key with a low number of power or electromagnetic measurements. We also present a masking countermeasure and analyze its second‐order side channel resistance by using various suitable preprocessing functions. Our experimental results clearly confirm that second‐order differential side channel analysis attacks also remain a practical threat for masked hardware implementations of ARIA.     

Impossible Differential Cryptanalysis of Reduced-Round ARIA and Camellia

This paper studies the security of the block ciphers ARIA and Camellia against impossible differential cryptanalysis. Our work improves the best impossible differential cryptanalysis of ARIA and Camellia known so far. The designers of ARIA expected no impossible differentials exist for 4-round ARIA. However, we found some nontrivial 4-round impossible differentials, which may lead to a possible attack on 6-round ARIA. Moreover, we found some nontrivial 8-round impossible differentials for Camellia, whereas only 7-round impossible differentials were previously known. By using the 8-round impossible differentials, we presented an attack on 12-round Camellia without FL/FL^-1 layers.     

High‐Speed Hardware Architectures for ARIA with Composite Field Arithmetic and Area‐Throughput Trade‐Offs

This paper presents two types of high‐speed hardware architectures for the block cipher ARIA. First, the loop architectures for feedback modes are presented. Area‐throughput trade‐offs are evaluated depending on the S‐box implementation by using look‐up tables or combinational logic which involves composite field arithmetic. The sub‐pipelined architectures for non‐feedback modes are also described. With loop unrolling, inner and outer round pipelining techniques, and S‐box implementation using composite field arithmetic over GF(2⁴)², throughputs of 16 Gbps to 43 Gbps are achievable in a 0.25 μm CMOS technology. This is the first sub‐pipelined architecture of ARIA for high throughput to date.     

Multidimensional Differential‐Linear Cryptanalysis of ARIA Block Cipher

ARIA is a 128‐bit block cipher that has been selected as a Korean encryption standard. Similar to AES, it is robust against differential cryptanalysis and linear cryptanalysis. In this study, we analyze the security of ARIA against differential‐linear cryptanalysis. We present five rounds of differential‐linear distinguishers for ARIA, which can distinguish five rounds of ARIA from random permutations using only 284.8 chosen plaintexts. Moreover, we develop differential‐linear attacks based on six rounds of ARIA‐128 and seven rounds of ARIA‐256. This is the first multidimensional differential‐linear cryptanalysis of ARIA and it has lower data complexity than all previous results. This is a preliminary study and further research may obtain better results in the future.     

Design and Implementation of Unified Hardware for 128‐Bit Block Ciphers ARIA and AES

ARIA and the Advanced Encryption Standard (AES) are next generation standard block cipher algorithms of Korea and the US, respectively. This letter presents an area‐efficient unified hardware architecture of ARIA and AES. Both algorithms have 128‐bit substitution permutation network (SPN) structures, and their substitution and permutation layers could be efficiently merged. Therefore, we propose a 128‐bit processor architecture with resource sharing, which is capable of processing ARIA and AES. This is the first architecture which supports both algorithms. Furthermore, it requires only 19,056 logic gates and encrypts data at 720 Mbps and 1,047 Mbps for ARIA and AES, respectively.     

低轮ARIA的不可能差分

不可能差分是对分组密码的一种有效攻击方法.它是寻找不可能出现的差分关系,并排除满足这种关系的密钥,最终恢复出秘密密钥.分析了韩国新型分组密码算法ARIA的不可能差分.首先分析了ARIA混淆层的特性,构造了ARIA的4轮不可能差分,选择225.5个明文对,使其密文异或具有低64b为零的形式,利用4轮不可能差分特性对5轮的ARIA进行了分析.选择230个明文对对6轮ARIA进行分析.     

ARIA密码算法的不可能差分归一化分析

Unified Impossible Differential (UID) cryptanalysis is a systematic method for finding impossible differentials for block ciphers. Regarding to the problem of automatically retrieving the impossible differential characteristics of block ciphers, with the use of particular intermediate difference state expression, UID gets the same or better results compared with other present cryptanalysis results. ARIA is a Korean block cipher expecting that there are no impossible differentials on four or more rounds. Based on a property of the Diffusion Layer (DL) of ARIA, a specific selection is used before conflict searching to optimize. UID is applied to ARIA, and 6 721 impossible differential chains are found. The length of those chains is four rounds, the same as existing results, but more varied in form. Moreover, ARIA is a Substitution-Permutation Network (SPN), not a Feistel structure or generalized Feistel structure as UID was applied to before.     

7轮ARIA-256的不可能差分新攻击

如何针对分组密码标准ARIA给出新的安全性分析是当前的研究热点。基于ARIA的算法结构,利用中间相遇的思想设计了一个新的4轮不可能差分区分器。基于该区分器,结合ARIA算法特点,在前面加2轮,后面加1轮,构成7轮ARIA-256的新攻击。研究结果表明：攻击7轮ARIA-256所需的数据复杂度约为2120选择明文数据量,所需的时间复杂度约为2219次7轮ARIA-256加密。与已有的7轮ARIA-256不可能差分攻击结果相比较,新攻击进一步地降低了所需的数据复杂度和时间复杂度。     

对ARIA算法的不可能飞去来攻击

构造了ARIA算法的4轮不可能飞去来区分器,首次给出5轮ARIA算法和6轮ARIA-192／256算法的不可能飞去来攻击。与飞去来攻击相比,对5轮ARIA算法的不可能飞去来攻击需要2107．9个选择明文和2107.9次5轮ARIA加密,数据和时间复杂度均优于飞去来攻击;对6轮ARIA算法的不可能飞去来攻击需要2116.5个选择明文和2137.4次6轮ARIA加密,数据复杂度优于飞去来攻击。     

Secure Hardware Implementation of ARIA Based on Adaptive Random Masking Technique

The block cipher ARIA has been threatened by side‐channel analysis, and much research on countermeasures of this attack has also been produced. However, studies on countermeasures of ARIA are focused on software implementation, and there are no reports about hardware designs and their performance evaluation. Therefore, this article presents an advanced masking algorithm which is strong against second‐order differential power analysis (SODPA) and implements a secure ARIA hardware. As there is no comparable report, the proposed masking algorithm used in our hardware module is evaluated using a comparison result of software implementations. Furthermore, we implement the proposed algorithm in three types of hardware architectures and compare them. The smallest module is 10,740 gates in size and consumes an average of 47.47 μW in power consumption. Finally, we make ASIC chips with the proposed design, and then perform security verification. As a result, the proposed module is small, energy efficient, and secure against SODPA.