Cryptanalysis, Reverse-Engineering and Design of Symmetric ... · S-Box Reverse-Engineering Outline...
71
Cryptanalysis, Reverse-Engineering and Design of Symmetric Cryptographic Algorithms Léo Perrin CSC & SnT, University of Luxembourg CryptoLUX Team ; supervised by Alex Biryukov July 5th 2018
Transcript of Cryptanalysis, Reverse-Engineering and Design of Symmetric ... · S-Box Reverse-Engineering Outline...
Cryptanalysis, Reverse-Engineering and Design of
Symmetric Cryptographic Algorithms
Léo Perrin
CSC & SnT, University of Luxembourg
CryptoLUX Team ; supervised by Alex Biryukov
July 5th 2018
Introduction What is cryptography?
Cryptography? (1/3)
Alice Bob
1 / 27
Introduction What is cryptography?
Cryptography? (1/3)
Alice Bob
Charlie
1 / 27
Introduction What is cryptography?
Cryptography? (1/3)
1 / 27
Introduction What is cryptography?
Cryptography? (2/3)
Cryptography is everywhere!
2 / 27
Introduction What is cryptography?
Cryptography? (3/3)
CRYPTO
LUX
3 / 27
Introduction What is cryptography?
Cryptography? (3/3)
CRYPTO
LUX
Envelope: Confidentiality
(nobody can read it)
3 / 27
Introduction What is cryptography?
Cryptography? (3/3)
CRYPTO
LUX
Envelope: Confidentiality
(nobody can read it)
Seal: Integrity
(nobody can modify it)
3 / 27
Introduction What is cryptography?
Cryptography? (3/3)
CRYPTO
LUX
Envelope: Confidentiality
(nobody can read it)
Seal: Integrity
(nobody can modify it)
Signature: Authentication
(it was wrien by the right person)
Paul
3 / 27
Introduction What is cryptography?
Modern Cryptography
Before
Now
Data encrypted Le�ers/Digits
0,1 (bits)
Method
By hand/
Computer program
machine
Cryptographers
Linguists
Mathematicians
inventors
Computer scientists
Example
4 / 27
Introduction What is cryptography?
Modern Cryptography
Before Now
Data encrypted Le�ers/Digits 0,1 (bits)
Method
By hand/
Computer program
machine
Cryptographers
Linguists Mathematicians
inventors Computer scientists
Example
4 / 27
Introduction How do we make cryptographic algorithms?
How do we design such algorithms?
5 / 27
Introduction How do we make cryptographic algorithms?
“Cryptographic Pipeline”
Fundamental Research
time
Design Public Analysis Deployment
Publication Standardization
Small teams Academic community IndustryScope
statement
Algorithm
specification
Design
choices
justifications
Security
analysis
Try and break
published algo-
rithms
Unbroken algo-
rithm are even-
tually trusted
Implements al-
gorithm in ac-
tual products
6 / 27
Introduction How do we make cryptographic algorithms?
“Cryptographic Pipeline”
Fundamental Research
time
Design Public Analysis Deployment
Publication Standardization
Small teams Academic community IndustryScope
statement
Algorithm
specification
Design
choices
justifications
Security
analysis
Try and break
published algo-
rithms
Unbroken algo-
rithm are even-
tually trusted
Implements al-
gorithm in ac-
tual products
6 / 27
Introduction How do we make cryptographic algorithms?
“Cryptographic Pipeline”
Fundamental Research
time
Design Public Analysis Deployment
Publication Standardization
Small teams Academic community Industry
Scope
statement
Algorithm
specification
Design
choices
justifications
Security
analysis
Try and break
published algo-
rithms
Unbroken algo-
rithm are even-
tually trusted
Implements al-
gorithm in ac-
tual products
6 / 27
Introduction How do we make cryptographic algorithms?
“Cryptographic Pipeline”
Fundamental Research
time
Design Public Analysis Deployment
Publication Standardization
Small teams Academic community IndustryScope
statement
Algorithm
specification
Design
choices
justifications
Security
analysis
Try and break
published algo-
rithms
Unbroken algo-
rithm are even-
tually trusted
Implements al-
gorithm in ac-
tual products
6 / 27
Introduction How do we make cryptographic algorithms?
“Cryptographic Pipeline”
Fundamental Research
time
Design Public Analysis Deployment
Publication Standardization
Small teams Academic community IndustryScope
statement
Algorithm
specification
Design
choices
justifications
Security
analysis
Try and break
published algo-
rithms
Unbroken algo-
rithm are even-
tually trusted
Implements al-
gorithm in ac-
tual products
6 / 27
Introduction How do we make cryptographic algorithms?
“Cryptographic Pipeline”
Fundamental Research
time
Design Public Analysis Deployment
Publication Standardization
Small teams Academic community IndustryScope
statement
Algorithm
specification
Design
choices
justifications
Security
analysis
Try and break
published algo-
rithms
Unbroken algo-
rithm are even-
tually trusted
Implements al-
gorithm in ac-
tual products
6 / 27
Introduction How do we make cryptographic algorithms?
“Cryptographic Pipeline”
Fundamental Research
time
Design Public Analysis Deployment
Publication Standardization
Small teams Academic community IndustryScope
statement
Algorithm
specification
Design
choices
justifications
Security
analysis
Try and break
published algo-
rithms
Unbroken algo-
rithm are even-
tually trusted
Implements al-
gorithm in ac-
tual products
6 / 27
Introduction How do we make cryptographic algorithms?
“Cryptographic Pipeline”
Fundamental Research
time
Design Public Analysis Deployment
Publication Standardization
Small teams Academic community IndustryScope
statement
Algorithm
specification
Design
choices
justifications
Security
analysis
Try and break
published algo-
rithms
Unbroken algo-
rithm are even-
tually trusted
Implements al-
gorithm in ac-
tual products
6 / 27
Introduction How do we make cryptographic algorithms?
“Cryptographic Pipeline”
Fundamental Research
time
Design Public Analysis Deployment
Publication Standardization
Small teams Academic community IndustryScope
statement
Algorithm
specification
Design
choices
justifications
Security
analysis
Try and break
published algo-
rithms
Unbroken algo-
rithm are even-
tually trusted
Implements al-
gorithm in ac-
tual products
6 / 27
Introduction How do we make cryptographic algorithms?
What about my thesis?
Funded by the FNR (ACRYPT Project)
7 / 27
Introduction How do we make cryptographic algorithms?
What about my thesis?
Funded by the FNR (ACRYPT Project)
7 / 27
Introduction How do we make cryptographic algorithms?
3 Di�erent Directions
Lightweight Cryptography
5 papers (FSE, ASIACRYPT, JoCEn), 2 invited talks
1 new block cipher
S-Box Reverse-Engineering
8 conference papers (CRYPTO, EUROCRYPT...), 7 invited talks
Discussions with ISO
Purposefully Hard Cryptography
1 paper (ASIACRYPT)
1 patent (+1 paper under submission)
8 / 27
Introduction How do we make cryptographic algorithms?
3 Di�erent Directions
Lightweight Cryptography
5 papers (FSE, ASIACRYPT, JoCEn), 2 invited talks
1 new block cipher
S-Box Reverse-Engineering
8 conference papers (CRYPTO, EUROCRYPT...), 7 invited talks
Discussions with ISO
Purposefully Hard Cryptography
1 paper (ASIACRYPT)
1 patent (+1 paper under submission)
8 / 27
Introduction How do we make cryptographic algorithms?
3 Di�erent Directions
Lightweight Cryptography
5 papers (FSE, ASIACRYPT, JoCEn), 2 invited talks
1 new block cipher
S-Box Reverse-Engineering
8 conference papers (CRYPTO, EUROCRYPT...), 7 invited talks
Discussions with ISO
Purposefully Hard Cryptography
1 paper (ASIACRYPT)
1 patent (+1 paper under submission)
8 / 27
Introduction How do we make cryptographic algorithms?
Outline
1 Introduction
2 Lightweight Cryptography
3 S-Box Reverse-Engineering
4 Conclusion
9 / 27
Lightweight Cryptography
Outline
1 Introduction
2 Lightweight Cryptography
3 S-Box Reverse-Engineering
4 Conclusion
9 / 27
Lightweight Cryptography What is it?
Internet of Things
Everything is being connected to the internet.
10 / 27
Lightweight Cryptography What is it?
Internet of Things
Everything
10 / 27
Lightweight Cryptography What is it?
Internet of Things
Everything
10 / 27
Lightweight Cryptography What is it?
Internet of Things
Everything
10 / 27
Lightweight Cryptography What is it?
Security
“In IoT, the S is for Security.”
Internet-enabled devices have security flaws.
Security is an a�erthought (at best).
Security has a cost in terms of engineering...
... and computationnal resources!
11 / 27
Lightweight Cryptography What is it?
Security
“In IoT, the S is for Security.”
Internet-enabled devices have security flaws.
Security is an a�erthought (at best).
Security has a cost in terms of engineering...
... and computationnal resources!
11 / 27
Lightweight Cryptography What is it?
Lightweight Cryptography
Lightweight cryptography uses li�le resources.
LWC is a very active research area!
12 / 27
Lightweight Cryptography What is it?
Lightweight Cryptography
Lightweight cryptography uses li�le resources.
LWC is a very active research area!
12 / 27
Lightweight Cryptography Our Contributions
Overview
Fundamental Research
Design Public Analysis Deployment
• Extensive survey of the state of the art
• Invention of a new design strategy
• Block cipher Sparx
• A�acks on Gluon
• Results on Prince
• Results on Twine
13 / 27
Lightweight Cryptography Our Contributions
Overview
Fundamental Research
Design Public Analysis Deployment
• Extensive survey of the state of the art
• Invention of a new design strategy
• Block cipher Sparx
• A�acks on Gluon
• Results on Prince
• Results on Twine
13 / 27
Lightweight Cryptography Our Contributions
Overview
Fundamental Research
Design Public Analysis Deployment
• Extensive survey of the state of the art
• Invention of a new design strategy
• Block cipher Sparx
• A�acks on Gluon
• Results on Prince
• Results on Twine
13 / 27
Lightweight Cryptography Our Contributions
Overview
Fundamental Research
Design Public Analysis Deployment
• Extensive survey of the state of the art
• Invention of a new design strategy
• Block cipher Sparx
• A�acks on Gluon
• Results on Prince
• Results on Twine
13 / 27
Lightweight Cryptography Our Contributions
Highlights
A�acks on Prince We won round 1 of the “PRINCE challenge”
The corresponding paper was selected in the top 3 papers
at FSE’15;
Sparx First ARX-based block cipher proven secure against some
a�acks.
Design strategy re-used by third parties from Waterloo
(Canada) to build sLiSCP
NIST Survey greatly appreciated (and cited) by NIST in their
ongoing standardization e�ort
I presented Sparx at a NIST workshop
14 / 27
Lightweight Cryptography Our Contributions
Highlights
A�acks on Prince We won round 1 of the “PRINCE challenge”
The corresponding paper was selected in the top 3 papers
at FSE’15;
Sparx First ARX-based block cipher proven secure against some
a�acks.
Design strategy re-used by third parties from Waterloo
(Canada) to build sLiSCP
NIST Survey greatly appreciated (and cited) by NIST in their
ongoing standardization e�ort
I presented Sparx at a NIST workshop
14 / 27
Lightweight Cryptography Our Contributions
Highlights
A�acks on Prince We won round 1 of the “PRINCE challenge”
The corresponding paper was selected in the top 3 papers
at FSE’15;
Sparx First ARX-based block cipher proven secure against some
a�acks.
Design strategy re-used by third parties from Waterloo
(Canada) to build sLiSCP
NIST Survey greatly appreciated (and cited) by NIST in their
ongoing standardization e�ort
I presented Sparx at a NIST workshop
14 / 27
S-Box Reverse-Engineering
Outline
1 Introduction
2 Lightweight Cryptography
3 S-Box Reverse-Engineering
4 Conclusion
14 / 27
S-Box Reverse-Engineering What is it?
What is an S-Box?
The “S-Box” of the last Russian standards
15 / 27
S-Box Reverse-Engineering What is it?
Breaking the Pipeline
time
Design Public Analysis Deployment
Publication Standardization
Implements al-
gorithm in ac-
tual products
Small teams Academic community IndustryScope
statement
Algorithm
specification
Design
choices
justifications
Security
analysis
Try and break
published algo-
rithm
Unbroken algo-
rithm are even-
tually trusted
???
16 / 27
S-Box Reverse-Engineering What is it?
Breaking the Pipeline
time
Design Public Analysis Deployment
Publication Standardization
Implements al-
gorithm in ac-
tual products
Small teams Academic community Industry
Scope
statement
Algorithm
specification
Design
choices
justifications
Security
analysis
Try and break
published algo-
rithm
Unbroken algo-
rithm are even-
tually trusted
???
16 / 27
S-Box Reverse-Engineering What is it?
The Need for Reverse-Engineering
A malicious designer can easily hide a structure in an S-Box.
To keep an advantage in implementation...
... or an advantage in cryptanalysis (backdoor).
17 / 27
S-Box Reverse-Engineering What is it?
The Need for Reverse-Engineering
A malicious designer can easily hide a structure in an S-Box.
To keep an advantage in implementation...
... or an advantage in cryptanalysis (backdoor).
17 / 27
S-Box Reverse-Engineering What is it?
The Need for Reverse-Engineering
A malicious designer can easily hide a structure in an S-Box.
To keep an advantage in implementation...
... or an advantage in cryptanalysis (backdoor).
17 / 27
S-Box Reverse-Engineering Our Contributions
Kuznyechik/Stribog
Stribog
Type Hash function
Publication 2012
Kuznyechik
Type Block cipher
Publication 2015
Common ground
Both are standard symmetric primitives in Russia.
Both were designed by the FSB (TC26).
Both use the same 8 × 8 S-Box, π .
18 / 27
S-Box Reverse-Engineering Our Contributions
Kuznyechik/Stribog
Stribog
Type Hash function
Publication 2012
Kuznyechik
Type Block cipher
Publication 2015
Common ground
Both are standard symmetric primitives in Russia.
Both were designed by the FSB (TC26).
Both use the same 8 × 8 S-Box, π .
18 / 27
S-Box Reverse-Engineering Our Contributions
How?
Given an S-Box... Where do we even start?
19 / 27
S-Box Reverse-Engineering Our Contributions
Fourier to the Rescue
Linear Approximations Table (LAT)
The LAT of S : {0, 1}n → {0, 1}n is a 2n × 2
nmatrix such that
LATS[a, b] =∑x∈Fn
2
(−1)a·x⊕b ·S (x ) .
ab
��LATS[a, b]�� = 0
c
d
��LATS[c, d]�� ≥ 20
20 / 27
S-Box Reverse-Engineering Our Contributions
Fourier to the Rescue
Linear Approximations Table (LAT)
The LAT of S : {0, 1}n → {0, 1}n is a 2n × 2
nmatrix such that
LATS[a, b] =∑x∈Fn
2
(−1)a·x⊕b ·S (x ) .
ab
��LATS[a, b]�� = 0
c
d
��LATS[c, d]�� ≥ 20
20 / 27
S-Box Reverse-Engineering Our Contributions
The LAT of π
21 / 27
S-Box Reverse-Engineering Our Contributions
The LAT of π (reordered columns)
22 / 27
S-Box Reverse-Engineering Our Contributions
The LAT of η ◦ π ◦ µ
23 / 27
S-Box Reverse-Engineering Our Contributions
Final Decomposition Number 1
ω
σ
ϕ �
ν1ν0
I�
α
� Multiplication in F2
4
α Linear permutation
I Inversion in F2
4
ν0,ν1,σ 4 × 4 permutations
ϕ 4 × 4 function
ω Linear permutation
24 / 27
S-Box Reverse-Engineering Our Contributions
S-Box Reverse-Engineering: Summary
Set up a process and tools to recover hidden structures and/or design
criteria for S-Boxes.
Successful applications to Streebog/Kuznyechik (FSB), Skipjack
(NSA)... and a theorem!
Found new cryptographic a�acks.
Hopefully, deterred publications of unjustified algorithms.
Caught the a�ention of the community: I gave many invited talks on
this topic.
25 / 27
S-Box Reverse-Engineering Our Contributions
S-Box Reverse-Engineering: Summary
Set up a process and tools to recover hidden structures and/or design
criteria for S-Boxes.
Successful applications to Streebog/Kuznyechik (FSB), Skipjack
(NSA)... and a theorem!
Found new cryptographic a�acks.
Hopefully, deterred publications of unjustified algorithms.
Caught the a�ention of the community: I gave many invited talks on
this topic.
25 / 27
S-Box Reverse-Engineering Our Contributions
S-Box Reverse-Engineering: Summary
Set up a process and tools to recover hidden structures and/or design
criteria for S-Boxes.
Successful applications to Streebog/Kuznyechik (FSB), Skipjack
(NSA)... and a theorem!
Found new cryptographic a�acks.
Hopefully, deterred publications of unjustified algorithms.
Caught the a�ention of the community: I gave many invited talks on
this topic.
25 / 27
Conclusion
Outline
1 Introduction
2 Lightweight Cryptography
3 S-Box Reverse-Engineering
4 Conclusion
25 / 27
Conclusion
Conclusion
My co-authors and I made significant contribution to lightweight
cryptography.
We pioneered the field of S-Box reverse-engineering and obtained
important results in cryptography and in mathematics.
We worked on another topic (“Purposefully hard cryptography”, useful
for crypto-currencies, DRM systems, spam mitigation...).
26 / 27
Conclusion
Conclusion
My co-authors and I made significant contribution to lightweight
cryptography.
We pioneered the field of S-Box reverse-engineering and obtained
important results in cryptography and in mathematics.
We worked on another topic (“Purposefully hard cryptography”, useful
for crypto-currencies, DRM systems, spam mitigation...).
26 / 27
Conclusion
Conclusion
My co-authors and I made significant contribution to lightweight
cryptography.
We pioneered the field of S-Box reverse-engineering and obtained
important results in cryptography and in mathematics.
We worked on another topic (“Purposefully hard cryptography”, useful
for crypto-currencies, DRM systems, spam mitigation...).
26 / 27
Conclusion
Conclusion
My co-authors and I made significant contribution to lightweight
cryptography.
We pioneered the field of S-Box reverse-engineering and obtained
important results in cryptography and in mathematics.
We worked on another topic (“Purposefully hard cryptography”, useful
for crypto-currencies, DRM systems, spam mitigation...).
26 / 27
Conclusion
I am grateful to...
my PhD advisor Alex Biryukov,
the uni.lu for providing such a good research environment,
my colleagues and co-authors,
my friends and family,
the Amis de l’Université and their sponsors...
... and to you for listening!
27 / 27
Conclusion
I am grateful to...
my PhD advisor Alex Biryukov,
the uni.lu for providing such a good research environment,
my colleagues and co-authors,
my friends and family,
the Amis de l’Université and their sponsors...
... and to you for listening!
27 / 27
Conclusion
I am grateful to...
my PhD advisor Alex Biryukov,
the uni.lu for providing such a good research environment,
my colleagues and co-authors,
my friends and family,
the Amis de l’Université and their sponsors...
... and to you for listening!
27 / 27
Conclusion
I am grateful to...
my PhD advisor Alex Biryukov,
the uni.lu for providing such a good research environment,
my colleagues and co-authors,
my friends and family,
the Amis de l’Université and their sponsors...
... and to you for listening!
27 / 27
