Structural Evaluation of AES and Chosen-Key

Minimal Number of Active S-Boxes for AES in the SK model. Rounds. 1. 2. 3. 4 ... What would this table look like for the AES structure in the RK model ? .... Pros. ▷ works on DES in single-key. Drawbacks. ▷ Rely on non-equivalent differential.
Télécharger le PDF
732KB taille 2 téléchargements 346 vues
commentaire
Report
Motivations

Algorithms

Application to AES-128

Distinguishing 9R AES-128

Structural Evaluation of AES and Chosen-Key Distinguisher of 9-round AES-128 Jérémy Jean joint work with Pierre-Alain Fouque and Thomas Peyrin (appeared at CRYPTO 2013) École Normale Supérieure, France

Séminaire Crypto de Versailles — 27 Novembre 2013 http://www.di.ens.fr/~jean/

The End

Motivations

Algorithms

Application to AES-128

Outline

1. Motivations 2. Algorithms 3. Application to AES-128 Truncated differences Actual differences 4. Distinguishing 9R AES-128 5. The End

Distinguishing 9R AES-128

The End

Motivations

Algorithms

Application to AES-128

Outline

1. Motivations 2. Algorithms 3. Application to AES-128 Truncated differences Actual differences 4. Distinguishing 9R AES-128 5. The End

Distinguishing 9R AES-128

The End

Motivations

Algorithms

Application to AES-128

Distinguishing 9R AES-128

Block Ciphers Iterated SPN Block Ciphers I I I I I I

Internal Permutation : f Number of Iterations : r SPN : f = P ◦ S applies Substitution (S) and Permutation (P). Secret Key : k Key Scheduling Algorithm : k → (k0 , . . . , kr ) Ex : AES, PRESENT, SQUARE, Serpent, etc. k

Key Scheduling Algorithm k0 s0

kr −1

k1 f

s1

...

kr f

sr

sr +1

The End

Motivations

Algorithms

Application to AES-128

Distinguishing 9R AES-128

Advanced Encryption Standard The AES Block Cipher (Rijndael) I

Designed by Joan Daemen and Vincent Rijmen

I

Key-Alternating Cipher (round function : f )

I

Block size : 128 bits — Key sizes : 128, 192 or 256 bits

I

Number r of iterations : 10, 12 or 14

I

Substitution-Permutation Network structure

The End

Motivations

Algorithms

Application to AES-128

Distinguishing 9R AES-128

AES Round Function ki

SB

si

SR

MC

AK

si+1

The End

Motivations

Algorithms

Application to AES-128

Distinguishing 9R AES-128

AES Round Function ki

S SB

SR

MC

AK

si One Step I

SubBytes (SB) layer : applies S-Box S to all bytes

si+1

The End

Motivations

Algorithms

Application to AES-128

Distinguishing 9R AES-128

AES Round Function ki

SB

SR

MC

AK

si One Step I

SubBytes (SB) layer : applies S-Box S to all bytes

I

ShiftRows (SR) layer

si+1

The End

Motivations

Algorithms

Application to AES-128

Distinguishing 9R AES-128

AES Round Function ki

SB

SR

MC

AK

si One Step I

SubBytes (SB) layer : applies S-Box S to all bytes

I

ShiftRows (SR) layer

si+1

The End

Motivations

Algorithms

Application to AES-128

Distinguishing 9R AES-128

AES Round Function ki

×M

SB

SR

MC

AK

si

si+1

One Step I

SubBytes (SB) layer : applies S-Box S to all bytes

I

ShiftRows (SR) layer

I

MixColumns (MC) layer : applies MDS matrix M to all columns

The End

Motivations

Algorithms

Application to AES-128

Distinguishing 9R AES-128

AES Round Function ki

SB

SR

MC

si

si+1

One Step I

SubBytes (SB) layer : applies S-Box S to all bytes

I

ShiftRows (SR) layer

I

MixColumns (MC) layer : applies MDS matrix M to all columns

I

AddRoundKey (AK) xors the subkey ki to the state

The End

Motivations

Algorithms

Application to AES-128

Distinguishing 9R AES-128

Differentials and Differential Characteristics Differential (Characteristics) I I I

Used in differential cryptanalysis. Sequence of differences at each round for an iterated primitive. A differential is a collection of characteristics.

Examples δ1 δ3 ∆

δ δ2

δ → ∆ is a differential. δ → δ1 → δ2 → δ3 → ∆ is a differential characteristic. I P(δ → δ1 → δ2 → δ3 → ∆) is its differential probability. I I

The End

Motivations

Algorithms

Application to AES-128

Distinguishing 9R AES-128

Differentials and Differential Characteristics

Differential Characteristics Differential characteristics are easier to handle than differentials. =⇒ We usually focus on characteristics. I Designers’ goal : upper-bound the differential probability of characteristics. I

Example : 4-round AES 1R

1R

1R

1R

Difference No difference

4-round characteristic with 25 active S-Boxes (minimal). AES S-Box : pmax = 2−6 . I Differential probability : p ≤ 2−6×25 = 2−150 . I I

The End

Motivations

Algorithms

Application to AES-128

Distinguishing 9R AES-128

The End

AES Design of the AES I

AES Permutation : structurally bounded diffusion for any rounds

I

Provably resistant to Single-Key (SK) differential attacks

I

Very easy to get the bounds by hand (just using the fact that the MixColumns matrix is MDS)

Minimal Number of Active S-Boxes for AES in the SK model Rounds min

1 1

2 5

3 9

4 25

5 26

6 30

7 34

8 50

9 51

10 55

Question What would this table look like for the AES structure in the RK model ?

Motivations

Algorithms

Application to AES-128

Distinguishing 9R AES-128

AES Key Schedule Design of the AES Key Schedule Ad-hoc key schedule =⇒ RK Attacks for AES-192/256 [BKN-C09], [BK-A09], [BN-E10]. I hard to analyze, so far no simple proof/analysis exist, except the computer-based ones. I

S

S

S