Naya-Plasencia, María

INRIA a CCSD electronic archive server

HAL Id: hal-01953897https://hal.inria.fr/hal-01953897Submitted on 13 Dec 2018HAL is a multi-disciplinary open accessarchive for the deposit and dissemination of sci-entific research documents, whether they are pub-lished or not. The documents may come fromteaching and research institutions in France orabroad, or from public or private research centers.L’archive ouverte pluridisciplinaire HAL, estdestinée au dépôt et à la diffusion de documentsscientifiques de niveau recherche, publiés ou non,émanant des établissements d’enseignement et derecherche français ou étrangers, des laboratoirespublics ou privés.Introduction to Symmetric CryptographyMaría Naya-PlasenciaTo cite this version:María Naya-Plasencia. Introduction to Symmetric Cryptography. Summer School on real-world cryptoand privacy, Jun 2018, Sibenik, Croatia. ￿hal-01953897￿Introduction to SymmetricCryptographyMaŕıa Naya-PlasenciaInria, FranceSummer School on real-world crypto and privacyŠibenik, Croatia - June 11 2018Outline▶ Introduction▶ One Time pad - Stream Ciphers▶ Block Ciphers - Operation Modes▶ Hash function▶ Symmetric Cryptanalysis: Foundation of Trust▶ Differential (and Linear) Cryptanalysis▶ New DirectionsSymmetric CryptographyCryptography▶ Cryptography : hiding/protecting information againstmalicious adversaries.▶ Main aims:Confidentiality ⇒ usually with the help of a keyAuthenticationIntegrity...1/67Cryptography - EncryptionSymmetric encryption and Asymmetric encryptionAlice BobCharlie2/67Symmetric Cryptography        1.2.  3/67Asymmetric CryptographyWithout needing a previous meeting:4/67Asymmetric vs Symmetric CryptographyAsymmetric:• Advantage: No need of key exchange.• Disadvantage: Computationally costly.Symmetric:• Disadvantage: Need of key exchange.• Advantage: Performant, adapted to constrainedenvironments.⇒ Use asymmetric for key exchange, and next usesymmetric!!.5/67Security of Encryption AlgorithmsAsymmetric (e.g. RSA) (no key exchange/computationally costly)Security based on well-known hard mathematicalproblems (e.g. factorization).Symmetric (e.g. AES) (key exchange needed/efficient)Ideal security defined by generic attacks.Need of continuous security evaluation (cryptanalysis).6/67Generic Attacks on Ciphers▶ Security provided by an ideal cipher defined by the bestgeneric attack:exhaustive search for the key in 2|K|.▶ Recovering the key from a secure cipher must beinfeasible:⇒ typical key sizes |K| = 128 to 256 bits.7/67CryptanalysisIn general:A primitive is considered secure as long as no attack betterthan generic attacks on it is found.Cryptanalysis: looking for these other attacks.(we will see more about this later)8/67One Time Pad & Stream CiphersOne Time Pad▶ One Time Pad: provides perfect secrecy.With a completly random key K                                 ⇒ all C are equally likely,but needs a secret key as long as the message!!9/67OTP with shorter keys?Solution:▶ From a shorter secret seed k, generate a “long”sequence (keystream) indistinguishable from randomif we don’t have the seed k10/67Stream CiphersIn practice: the keystream is obtained from pseudo-randomgenerators.Additive stream cipher:gpseudo-random generator -6-+stkeystreamplaintextctK, IV = initialisationmtciphertext11/67Stream CiphersInitialisation, transition, extraction:K, IVx0   @@@&%'$Φ&%'$Φ x1   @@@? ? ? ? ??- -? ? ? ? ??- -?Int. StateKeystreamf fs0 s1· · ·transition12/67Ex: Combination generatorsDevice nDevice 2Device 1...f@@@@@@R      -- S keystreamx1x2xnwhere each xi has period Ti.13/67eSTREAM projectAfter Nessie’s failure:▶ Launched by European network ECRYPT 2005-08▶ Conception of new dedicated stream ciphers▶ 37 submitted algorithms▶ 8 in final portfolio, only 6 unbroken now...Seems difficult - how could it be easier? ⇒ Block ciphers14/67Ex. Trivium (eSTREAM portfolio)80 bit key and IV, 288 bit state [DC-P’06].15/67Block CiphersBlock ciphersMessage decomposed into blocks, each transformed by thesame function EK.EK- -?P CKEK is composed of a round transform repeated throughseveral similar rounds.16/67Block ciphers - Two main families▶ Feistel constructions:▶ SPN constructions: transform the whole state:• Substitution layer (S-boxes, non-linear)• Permutation layer typically ⊕ and/or rotations.• Subkey addition.17/67Block ciphers▶ Key schedule: generates subkeys for each round fromthe secret key.▶ A block cipher is a family of permutations parametrizedby the key.What to do when:▶ Longer messages than a block?▶ Several messages?⇒ Operation modes18/67Operation Modes: ECB▶ Problem: equal Ptxts generate equal Ctxts19/67Operation Modes: CBC [EMST’76]▶ Proven secure if the block cipher is secure and if thekey is changed after ≪ 2n/2 encryptions.20/67Interlude: birthday paradoxBirthday Paradox▶ ”In a room with 23 people, there is a 50% chance ofhaving two colliding dates of birthday”.Intuitive explanation:23 people ⇒ 23×222 pairs.With 2n/2 elements we can build about 2n pairs (so we havea good chance of finding a collision).21/67Back to modesCBC: Careful with RecommendationsSweet-32 attack [BL’16], based on finding a collision in theinternal state:For ciphers of 64 bits, we can find a collision in about 232encrypted blocks, and recover the plaintext.Possible because the security recommendations were notrespected.22/67Operation Modes: CTR[DH’ 79]▶ Proven secure if the block cipher is secure and if thekey is changed after ≪ 2n/2 encryptions (missing differenceattack otherwise [LS18]).23/67AESAES Competition and WinnerLaunched by NIST to find a succesor of DES 97-00.15 submissions, 1 winner: Rijndael [Daemen-Rijmen 97]AES:▶ SPN cipher.▶ 10/12/14 rounds for 128/192/256-bit keys.▶ Block of 128 bits.24/67AES Round FunctionImages from http://en.wikipedia.org/wiki/Advanced Encryption Standard25/67Authenticated EncryptionAEIn order to provide confidentiality and authenticity:▶ Authenticated encryption:▶ Caesar competition finished this year.▶ See next talk by Thomas Shrimpton26/67Hash FunctionsCryptographic Hash FunctionsH : {0, 1}∗ → {0, 1}ℓh• Given a message of arbitrary length returns a short’random-looking’ value of fixed length.• Many applications: MAC’s (authentification), digitalsignatures, integrity check of executables, pseudorandomgeneration...27/67Cryptographic Hash Functions28/67Hash Functions applicationsAutentication:29/67Hash Functions applicationsDigital signature:30/67Hash Functions applicationsVerifying the integrity:31/67Security requirements of hash functions▶ Collision resistanceFinding two messages M and M′ so thatH(M) = H(M′) must be ”hard”.▶ Second preimage resistanceGiven a message M and H(M), finding anothermessage M′ so that H(M) = H(M′) must be ”hard”.▶ Preimage resistanceGiven a hash H, finding a message M so thatH(M) = H must be ”hard”.32/67Security requirements of hash functions?A strict definition of ”hard”:▶ Collision resistance• Generic attack needs 2ℓh/2 hash function calls ⇒any attack requires at least as many hash function callsas the generic attack.▶ Second preimage resistance and preimage resistance• Generic attack needs 2ℓh hash function calls ⇒any attack requires at least as many hash function callsas the generic attack.33/67Why Preimage Resistance? Example34/67Why Collision Resistance? Example35/67Why 2nd Preimage Resistance? Example36/67Iterative Hashing▶ Difficulty to create algorithms with an arbitrary lengthinput: concept of iterative hashing.▶ The message is split into blocks. Typically, an iterativehash function can be defined by:a compression function, that takes a chaining value anda message block and generates a new chaining value.an construction, that defines how to iterate theapplications of the compression function.37/67Padding the message▶ Cut the message in blocks of fixed length.▶ If the length of the message is not a multiple of thesize of the block?• we can not just complete it with zeroes:• 00010 and 0001000 can produce a collision.▶ Ex. of sound padding: Add ’1’ in the end, next add’0’s until completing the block.▶ Strengthened padding: includes the message length.38/67Construction: Merkle-Damg̊ard [MD’79]▶ Apply iteratively a compression function f▶ Collision-resistance proof: if f is collision resistant,then the hash function is collision resistant.f fM1 M2IV fMkfin.H39/67Construction: Sponge [Bertoni et al. 08]6??6cr						P P P P P P------------i?m0i?m1i?m2i?m3absorbing squeezing6z06z16z2▶ Based on a permutation P .▶ Sponge proof of indifferentiability: if P is arandom permutation, then the hash function isindifferentiable from a random oracle.40/67SHA-3 CompetitionA NIST competition for looking for a hash standardreplacement of SHA-1.▶ From 2008 to 2012.▶ 64 initial submissions▶ 1 winner: Keccak41/67Keccak [Bertoni et al. 08]• |State| = 1600 bits• |M | = 1024 bits (256) or 512 bits(512).6??6cr				P P P P----------i?m0i?m1i?m2i?m3absorbing squeezing6z042/67Keccak: Internal Permutation24 rounds of θ, ρ, π, χ, ι:Images from http://keccak.noekeon.org/Keccak-reference-3.0.pdf43/67CryptanalysisCryptanalysis: Foundation of ConfidenceAny attack better than the generic oneis considered a “break”.▶ Proofs on symmetric primitives need to makeunrealistic assumptions.▶ We are often left with an empirical measure of thesecurity: cryptanalysis.44/67CryptanalysisStudies the security of cryptographic primitives.AKA: Trying to break the primitives, to find attacks:Empirical measure of security.45/67Cryptanalysis and ConfidenceSecurity by knowledge and not by obscurity → only goodway to go.▶ Primitives are known to the general public ⇒ their bestexisting cryptanalysis should also be known,▶ implying a great need for public cryptanalysis (the niceguys).46/67Current scenario▶ Competitions (AES, SHA-3, eSTREAM, CAESAR).▶ New needs: lightweight, FHE-friendly, easy-masking.⇒ Many good proposals/candidates.▶ How to choose?▶ How to be ahead of possible weaknesses?▶ How to keep on trusting the chosen ones?47/67Cryptanalysis: Foundation of ConfidenceWhen can we consider a primitive as secure?• A primitive is secure as far as no attack on it is known.• The more we analyze a primitive without finding anyweaknesses, the more reliable it is.Design new attacks + improvement of existing ones:▶ essential to keep on trusting the primitives,▶ or to stop using the insecure ones!48/67What can an attacker do?We can consider the attacker to have access to:▶ Known Ciphertexts (KPA)▶ Known Plaintexts (KCA)▶ Chosen Plaintexts (CPA)▶ Chosen Ciphertexts (CCA)▶ Adaptative-Chosen Plaintexts...(ACPA)In general: we expect the primitives to resist attacks in thestrongest possible non trivial setting.49/67On weakened versionsIf no attack is found on a given cipher, what can we sayabout its robustness, security margin?The security of a cipher is not a 1-bit information:• Round-reduced attacks.• Analysis of components.⇒ determine and adapt the security margin.50/67Ex.: Advanced Encryption StandartWinner: AES-128, 10 rounds.▶ 1998: best internal attack: 6 rounds.▶ 2001: new attack on 7 rounds.▶ 2001 to 2018: more than 30 new attacks, improvingcomplexity.▶ 2018: best known attack is still on 7 rounds. Bestcomplexity: 297 data, 299 time and 298 memory [DFJ12].”The hard problem here is to break AES” (Anne Canteaut)51/67On high complexitiesWhen considering large keys, sometimes attacks breakingthe ciphers might have a very high complexity far frompractical e.g.. 2120 for a key of 128 bits.Still dangerous because:• Weak properties not expected by the designers.• Experience shows us that attacks only get better.• Other existing ciphers without the ”ugly”properties.52/67On very high complexitiesAttack complexity reduced by one or two bits regardinggeneric attack:▶ When determining the security margin: find the highestnumber of rounds reached.▶ Security redefinition when a new generic attack is found(e.g. accelerated key search with bicliques [BKR 12]).53/67On weaker scenariosKey recovery, state recovery, plaintext recovery vs ...Distinguishers are dangerous: e.g. to decide between onlytwo possible plaintexts.Related-keys might be dangerous, depending on the use ofthe cipher (if used in hash functions, these properties shouldbe known).54/67On weaker scenariosCollision, preimage, second-preimage vs ...Distinguishers, compression function collisions, semi-freestart collisions... (might invalidate proof assumptions).In general, most of the cases might be seen as non-expected”ugly” properties. Better to consider other existing cipherswithout the ”ugly”properties.55/67Cryptanalysis WarningsRecommendations should be respected. For example:▶ Flame [2012]: collisions on MD5[WFL2004].▶ Attaque sur TLS[ABP..13]: Bias of RC4[FMS01].▶ Sloth[BL16]: collisions on MD5[WLF2004].Problems that were predicted !!56/67Differential CryptanalysisDifferential Cryptanalysis [BS’90]Given an input difference between two plaintexts, someoutput differences occur more often than others.X′X′′Y′Y′′∆X ∆YEKEKDifferential: input and output difference (∆X,∆Y ).Differential probability:PX,K[EK(X)⊕ EK(X +∆X) = ∆Y ] (vs 2−n).Chosen Plaintext Attacks. Provides a distinguisher.57/67Differential paths▶ Differential path = configuration of differences in theinternal state through rounds.▶ Each differential path has a probability of being verified.▶ Easier to compute a priori: hypothesis of stochasticequivalence: consider the rounds independent:compute the differential probability of a path bymultiplying the probability of each round.▶ The S-box DDT provides, for all α and β:DDT [α, β] = #{x|S(x+ α) + S(x) = β▶ DP of linear layer is 1.58/67Differential path: example 0 0  0  0 0  0  0 0  0  0 0  0 0 0  0 0 00 0  0 0 0  0 0 0      0 0 0 0 0 0 0 0  1 1 12 2 	59/67Differential Cryptanalysis [BS’90]Probability of differential: sum of all the differential paths.Hard to determine. Try to approximate by the highestprobability ones...Many hypothesis: actually, rounds are not independent, forsome keys it (not always) behaves like a random key...⇒ Importance of implementing attacks (or reduced-roundattacks) in order to verify theoretical assumptions.60/67Last round attacks: key recoveryR-round differential(∆X,∆Y ) of high probability⇓attack R+ n rounds of the cipher.1. Find many pairs with input difference ∆X.2. Encrypt each of them for R+ n rounds of the cipher.If the partial decryption of the last n rounds leads to adifference ∆Y frequently enough, then the key bits involvedare the correct ones with high probability.61/67Differential CryptanalysisMany improvements, related techniques:▶ Truncated differentials▶ Neutral bits▶ Conditional differentials▶ Impossible differentials▶ Rebound attacks...62/67Linear CryptanalysisLinear cryptanalysis [MY’92]▶ The dual of differential cryptanalysis:▶ Exploit the existence of (highly) biased affine relationsbetween some plaintext and ciphertext bits.▶ This bias can be used to mount a distinguisher or evento recover some keybits.63/67Linear cryptanalysis [MY’92]This expression⊕i∈Sp Pi ⊕⊕j∈SK Kj =⊕k∈SC Ckis verified with high bias 2−ε:Pb = 12(1± 2−ε),with about 22ε data we can detect the bias. Known plaintextattacks.64/67Improvements Linear cryptanalysis▶ Big number of (very) technical improvements.▶ Many variants: last-round, multiple, multidimensional,zero correlation,...We are always looking at how to improve the complexities,how to reach more rounds...65/67Important/Future DirectionsImportant/Future Directions▶ Permutaton-based primitives (sponge family)▶ Lightweight primitives ⇒ new NIST competition▶ New needs: FHE, masking..▶ Post-quantum security?66/67ConclusionConclusion▶ Many new needs/ scenarios▶ Cyptanalysis: new techniques, improvements, families.A never ending task.▶ Better safe than sorry!▶ To be continued on Friday with Lightweight Primitivesand Cryptanalysis.67/67

Introduction to Symmetric Cryptography

https://hal.inria.fr/hal-01953897/file/Introduction%20to%20symmetric%20crypto.pdf

Introduction to Symmetric Cryptography

Abstract

Similar works

Full text

Available Versions

INRIA a CCSD electronic archive server