We demonstrate the first attacks on the SPN ciphers with 6, 7, 8, and 9 secret layers. In particular, we show a decomposition attack on the SASASASAS scheme when the S-box size M and the block length N satisfy the condition M^2 < N (for example, 8-bit S-box and 128-bit block)

Alex Biryukov

Dmitry Khovratovich

We demonstrate the first attacks on the SPN ciphers with 6, 7, 8, and 9 secret layers. In particular, we show a decomposition attack on the SASASASAS scheme when the S-box size m and the block length n satisfy the condition m2 ≤ n (for example, 8-bit S-box and 128-bit block). 

CiteSeerX

Decomposition attack on SASASASAS

Cryptology ePrint Archive

Decomposition attack on SASASASASAlex Biryukov and Dmitry KhovratovichUniversity of Luxembourgalex.biryukov@uni.lu, khovratovich@gmail.comJuly 1, 2015AbstractWe demonstrate the first attacks on the SPN ciphers with 6, 7, 8, and 9 secret layers. In particular,we show a decomposition attack on the SASASASAS scheme when the S-box size m and the blocklength n satisfy the condition m2 ≤ n (for example, 8-bit S-box and 128-bit block).1 IntroductionA block cipher with secret nonlinear layers S and secret affine transformations A is a fundamentalconcept in both symmetric and asymmetric cryptography. For years, only up to 5-layer schemes couldbe analyzed in a generic, structural way. The so called ”ASASA” structure with two S-box layers andthree affine layers was suggested by Patarin in 1997 [12] and broken by Biham in 2000 [2] due to non-bijectivity of S-boxes. The SASAS structure was attacked with practical complexity in 2001 by Biryukovand Shamir [4, 5]. The attack recovered S-boxes and affine layers up to affine equivalence (as equivalentlayers produce identical ciphers).The ASASA scheme with injective S-boxes and schemes with more layers were considered secure sincethen and motivated Biryukov et al. to propose a number of schemes based on the generic ASASA forblack-box, white-box, and public-key cryptography in 2014 [3]. However, it turned out that this variantis also insecure, even though the attack complexity is practical for small block sizes only. Independently,Minaud et al. [11] and Dinur et al. [8] found decomposition attacks for several instances of ASASA bothfor large and small block sizes. These results suggest the insecurity of generic 5-layer schemes with secretlayers, but give little insight on the security of longer variants.The structural decomposition attacks are supposed to be difficult since the secret components aredescribed with much more than n bits of information, where n is the block size. In some cases the attackswith complexity 2n and higher are not a surprise [8]. Moreover, for small block lengths n, which is atypical setting in the white-box cryptography, a scheme can be called secure only if the decompositioncomplexity is far larger than 2n. It is unclear whether this can be achieved for 6-layer and longer schemes.Our contributions. In this work we combine the existing techniques altogether and demonstrateattacks on 6-, 7-, 8-, and 9-layer schemes. As a groundbreaking result, we demonstrate a decompositionattack on the SASASASAS scheme (which is a generic 5-round substitution affine network) with totalcomplexity of 2n or less for certain parameters (e.g., 2240 for secret 8-bit S-boxes and 256-bit block size).Our methods apply for certain (but natural) combinations of S-box size and block size, and, to littlesurprise, for smaller S-boxes we can attack even more layers.Related work. Our attacks are purely algebraic but highlight the links between the Square/multiset/integralattack and the high-order differential attack. In this context, a reader might be interested in the schemeswith very small S-boxes [1] and attacks on them [9, 10]. The degree deficiency effect, that we exploit, wasnoticed in [7] and used in [6] to demonstrate that Rijndael-256 achieves full degree only after 7 rounds.2 Algebraic degree of iterative functionsThe following result originated in the discussion on the security of Keccak permutation. The small size(5 bits) and low degree (2) of Keccak S-boxes warned cryptographers that the full-round permutation1might be insecure to algebraic attacks or distinguishers. Indeed, after some point, the algebraic degreeof the multi-round SPN structure does not grow as fast as expected. For m-bit bijective S-boxes thathave maximum possible degree (m− 1), the following result holds.Theorem 1 ([7]). Let G be an arbitrary function on Fn2 . Let F be a bijection on Fn2 corresponding tothe concatenation of m smaller bijective Sboxes.1. If the degree of all S-boxes is m− 1, thendeg(G ◦ F ) ≤ n−⌈n− deg(G)m− 1⌉.In other words, the difference between n and the scheme degree decreases at maximum by the factorof (m − 1) with each new layer. Due to rounding the fraction in the equation, the degree deficiency iseven larger.3 Attack on SASASASASWe proceed to our main result and then derive some interesting implications. Consider the ASASASAscheme with secret bijective m-bit S-boxes (possibly different) and secret affine transformations overGF (2). Apparently, if there are at least m such S-boxes in each layer, then the scheme does not havethe maximum possible degree.Theorem 2. If m2 ≤ n, thendeg(ASASASA) ≤ n− 3.Proof. The degree of the ASA subscheme does not exceed m−1, and the degree of the ASASA subschemedoes not exceed (m− 1)2 < n. If we add one more S-layer, Theorem 1 implies thatdeg(ASASAS) ≤ n−⌈n− (m− 1)2m− 1⌉= n−⌈nm− 1⌉+ m− 1. (1)From the theorem condition we getm2 ≤ n =⇒ m2 − 1 < n =⇒ nm− 1> m + 1 =⇒ −⌈nm− 1⌉≤ −m− 2.We substitute this to Eq. (1) and obtain thatdeg(ASASAS) ≤ n− 3.Clearly, the degree does not change if we add one more A-layer. This ends the proof.For ASASA-like schemes the degree growth is shown in Table 1. It can be seen that ASASASAschemes with 4-bit S-boxes and 16-bit block, or 8-bit S-boxes and 128-bit block, do not have the maximumpossible degree.3.1 Decomposition attack on ASASASASProcedure. Consider now the ASASASAS scheme (one more S-layer). Denote deg(ASASASA) by d.If we encrypt any affine subspace of dimensiond + 1 ≤ n + m−⌈nm− 1⌉,the inputs to the last S-layer would sum to zero. Consider, w.l.o.g., the first S-box S0. As noticed in [5],we get an equation:S−10 (x1)⊕ S−10 (x2)⊕ · · · ⊕ S−10 (x2d+1) = 0, (2)where xj is the output of S0 at j-th encryption.We encrypt 2m such subspaces (cubes) and collect 2m equations of type (2). The resulting systemis linear w.r.t. new variables yj = S−10 (j), j ∈ Zm2 . However, it has multiple solutions, as for any affineinvertible transformation B if S is a solution then S(B()) is a solution as well. Thus our system of2equations has rank at most1 2m−m−1. Since any solution is good for us, we can fix S−1(xi) at (m+ 1)arbitrary points, get a full rank system, and solve it in 23m time.Using the technique from [11], the ASASASA scheme can then be decomposed with complexityn22d+1.Complexity. The complexity of peeling off the final S-layer is determined by the number of encryptions,which is upper bounded by 2d+m+1. However, this bound can be improved significantly. Consider anaffine space of dimension d′ > d+ 1, where (n− d′) variables are fixed and the other are free. How manyspaces of dimension (d + 1) are inside? Note that we should exclude linearly dependent spaces.Consider subspaces of dimension d′− 1, which are formed by fixing any of d′ variables to 1. These d′subspaces are linearly independent. Within each, we can select (d′ − 1) subspaces of dimension (d′ − 2)in the same fashion. Therefore, a space of dimension (d+3) contains at least d2 +5d spaces of dimensiond + 1. For all m,n that we consider the condition d2 + 5d > 2m holds, so the total complexity of theattack is upper bounded byCDecompose ASASASAS ≤ 2d+3 ≤ 2n+m+2−dnm−1e.For certain parameters, like m = 4, n = 16 we can take into account the fact that (2m−m−1) spacesare sufficient, and d + 1 ≥ 2m −m− 1. In this case the complexity of the attack is smaller by the factorof 2.3.2 Attack on SASASASASNow let us make the final step and consider a scheme with yet another S-layer, i.e. SASASASAS. Theobservation here (also used in [9]) is that by fixing an input to a single S-box and varying the others wealso get an affine space, even if we do not know its constant bits. In the terms of the multiset attack,the S-box layer preserves the multiset property, which has the affine property that we need. As long asd + 1 ≤ n−m, i.e. at least one S-box can be fixed, this approach works. Unfortunately, we can not fixarbitrary bits anymore to reduce the data complexity.The attack procedure is very similar to that for ASASASAS. Let k be maximum such that d + 1 ≤n − km. Then one of k S-boxes takes 2m −m − 1 values, and the other take all possible values. Thetotal data complexity is slightly less than 2n−(k−1)m.For some extreme cases the complexity is almost 2n. However, we stress that this not an upper boundfor this kind of attacks. Indeed, we recover the secret components, which are described with more thann bits of information (about m2m bits for an S-box and n2 bits for the affine layer). We summarize ourattacks in Table 2 and give the equivalent key size for the AS pair of layers (m2m + n2).1In practice it is usually equal to this value, as confirmed both by [5] and our experimentsS-box size Block size ASA ASASA ASASASAVerified experimentally3 12 2 4 83 15 2 4 84 12 3 9 114 16 3 9 136 12 5 10 116 18 5 15 17Theorem 1 implications8 128 7 49 1168 256 7 49 2276 120 5 25 10410 120 9 106 11816 128 15 120 127Table 1: Degree evolution3S-box Block Key size ASASAS SASASAS ASASASAS SASASASAS4 12 208 211 - - -4 16 312 211 215 215 -6 12 500 212 - - -6 18 700 217 - - -6 24 960 221 - - -6 36 210 228 236 236 -6 120 214 228 236 2106 21148 128 214 252 264 2118 21288 256 216 252 264 2230 2240Table 2: Summary of our decomposition attacks3.3 Even more layersOur results can be further extended to more esoteric scenarios, where m  n. For example, if m3 ≤ n(4-bit S-boxes, 64-bit block) the 11-layer scheme can be decomposed with complexity less than 2n. Ingeneral, at least (2 logm n + 7) secret layers are needed to achieve security against this sort of attacks.4 Experimental verificationWe have verified our attack by experiments. We considered the ASASASAS scheme with 16-bit blockand 4 4-bit S-boxes. The inputs to the last S-layer have degree 13, thus they sum to zero over a cube ofdimension 14.We need 24 linearly independent equations to recover the S-box. We encrypted 215 plaintexts thatstart with the zero bit. Within this structure, we consider 15 substructures {Si}, where i-th bit is zeroin Si. We got a system of 15 equations (2), which has rank 11 (in most cases). We assigned arbitrarydistinct values to 5 unknowns and solved the resulting system. As a result, we got an S-box, which isaffine-equivalent to the original one. When we take true values of this unknowns, the S-box is recoveredprecisely.References[1] Martin R. Albrecht, Christian Rechberger, Thomas Schneider, Tyge Tiessen, and Michael Zohner.Ciphers for MPC and FHE. In Elisabeth Oswald and Marc Fischlin, editors, EUROCRYPT 2015,volume 9056 of Lecture Notes in Computer Science, pages 430–454. Springer, 2015.[2] Eli Biham. Cryptanalysis of patarin’s 2-round public key system with S boxes (2R). In BartPreneel, editor, EUROCRYPT 2000, volume 1807 of Lecture Notes in Computer Science, pages408–416. Springer, 2000.[3] Alex Biryukov, Charles Bouillaguet, and Dmitry Khovratovich. Cryptographic schemes based onthe ASASA structure: Black-box, white-box, and public-key (extended abstract). In Palash Sarkarand Tetsu Iwata, editors, ASIACRYPT 2014, volume 8873 of Lecture Notes in Computer Science,pages 63–84. Springer, 2014.[4] Alex Biryukov and Adi Shamir. Structural cryptanalysis of SASAS. In Birgit Pfitzmann, editor,EUROCRYPT 2001, volume 2045 of Lecture Notes in Computer Science, pages 394–405. Springer,2001.[5] Alex Biryukov and Adi Shamir. Structural cryptanalysis of SASAS. J. Cryptology, 23(4):505–518,2010.[6] Christina Boura and Anne Canteaut. On the influence of the algebraic degree of f-1 on the algebraicdegree of G ◦ F. IEEE Transactions on Information Theory, 59(1):691–702, 2013.[7] Christina Boura, Anne Canteaut, and Christophe De Cannière. Higher-order differential propertiesof keccak and Luffa. In Antoine Joux, editor, FSE’2011, volume 6733 of Lecture Notes in ComputerScience, pages 252–269. Springer, 2011.4[8] Itai Dinur, Orr Dunkelman, Thorsten Kranz, and Gregor Leander. Decomposing the ASASA blockcipher construction. IACR Cryptology ePrint Archive, 2015:507, 2015.[9] Itai Dinur, Yunwen Liu, Willi Meier, and Qingju Wang. Optimized interpolation attacks on lowmc.Cryptology ePrint Archive, Report 2015/418, 2015. http://eprint.iacr.org/.[10] Christoph Dobraunig, Maria Eichlseder, and Florian Mendel. Higher-order cryptanalysis of lowmc.Cryptology ePrint Archive, Report 2015/407, 2015. http://eprint.iacr.org/.[11] Brice Minaud, Patrick Derbez, Pierre-Alain Fouque, and Pierre Karpman. Key-recovery attacks onASASA. Cryptology ePrint Archive, Report 2015/516, 2015. http://eprint.iacr.org/.[12] Jacques Patarin and Louis Goubin. Asymmetric cryptography with s-boxes. In Yongfei Han, Tat-suaki Okamoto, and Sihan Qing, editors, ICICS’97, volume 1334 of Lecture Notes in ComputerScience, pages 369–380. Springer, 1997.5

Decomposition attack on SASASASAS

Abstract

Similar works

Full text

Available Versions

CiteSeerX

Cryptology ePrint Archive