A. Canteaut

C. Boura

Ming Duan

X. J. Lai

XueJia Lai

Crossref

    © The Author(s) 2012. This article is published with open access at Springerlink.com csb.scichina.com   www.springer.com/scp                       *Corresponding author (email: dodoxixi@gmail.com) Article Computer Science & Technology February 2012  Vol.57  No.6: 694697  doi: 10.1007/s11434-011-4909-x  Improved zero-sum distinguisher for full round Keccak-f  permutation DUAN Ming1,2* & LAI XueJia1 1 Department of Computer Science and Engineering, Shanghai Jiao Tong University, Shanghai 200240, China;  2 Basic Courses Department, University of Foreign Language, Luoyang 471003, China Received August 2, 2011; accepted September 30, 2011  Keccak is one of the five hash functions selected for the final round of the SHA-3 competition, and its inner primitive is a permu-tation called Keccak-f. In this paper, we observe that for the inverse of the only nonlinear transformation in Keccak-f, the algebraic degree of any output coordinate and the one of the product of any two output coordinates are both 3, which is 2 less than its size of 5. Combining this observation with a proposition on the upper bound of the degree of iterated permutations, we improve the zero-sum distinguisher for the Keccak-f permutation with full 24 rounds by lowering the size of the zero-sum partition from 21590 to 21575. hash functions, higher order differentials, algebraic degree, zero-sum, SHA-3  Citation:  Duan M, Lai X J. Improved zero-sum distinguisher for full round Keccak-f permutation. Chin Sci Bull, 2012, 57: 694697, doi: 10.1007/s11434- 011-4909-x     Zero-sum distinguishers, introduced by Aumasson and Meier and presented at the rump session of CHES 2009, are a method for generating zero-sum structures for iterated permutations, which combine higher order differential tech-nique with inside-out technique and are mainly decided by the algebraic degree of the permutation. In the public com-ment on the NIST Hash competition 2010, zero-sum distin-guishers are shown to be deterministic and valid, although they generate zero-sum structures with only a small ad-vantage over the generic method. Zero-sum distinguishers can also be used to create partitions of inputs into many different zero-sum structures for the permutation [1]. Keccak is a family of cryptographic sponge functions and is one of the five hash functions selected for the third (and final) round of the SHA-3 competition. Its core component is a permutation named Keccak-f, which is composed of several iterations of five transformations. A first zero-sum distinguisher for the Keccak-f permutation with 16 rounds was given in 2009. Since then, zero-sum distinguishers for the Keccak-f permutation with a greater number of rounds were obtained [1,2], with the smallest known zero-sum par-tition for the Keccak-f permutation with full 24 rounds hav-ing size 21590. In this paper, we study the properties of the inverse of the nonlinear transformation in Keccak-f, and observe that the algebraic degree of the product of any two output coordi-nates of this inverse is 2 less than its size. This enables us construct a zero-sum partition for the Keccak-f permutation with full 24 rounds of size 21575. 1  Zero-sum distinguishers We first introduce the notions of higher order derivatives related to zero-sum distinguishers. 1.1  Higher order derivatives Higher order derivatives were introduced into cryptography by Lai in [3].   Duan M, et al.   Chin Sci Bull   February (2012) Vol.57 No.6 695 Definition 1.  Let f(x) be a Boolean function from 2nF  to F2. The derivative of f at point a 2nF  is defined by ( ) ( ) ( )a f x f x a f x    . The i-th (i>1) derivative of the function f at points {a1, a2, …, ai} is defined by  ( ) ( 1)1 1 1,..., ,...,( ) ( )    i ii i ia a a a af x f x , where ( 1)1 1,...,( )iia af x  is the (i1)-th derivative of f at points {a1, a2, … , ai-1}. The 0-th derivative of f is defined to be f (x) itself. Higher order derivatives should be computed at points that are linearly independent, otherwise the derivative will trivially be zero. Note that the degree of the derivative of a function is at least 1 less than the degree of the function. This implies that the (d+1)-th derivative of an n-variable Boolean function of degree d is zero, and this is used in many cryptanalysis methods including zero-sum distin-guishers. 1.2  Zero-sum properties Note that the permutation used in a hash function does not depend on a secret parameter, and this property of the per-mutation can be exploited from the middle. The zero-sum property introduced by Aumasson and Meier is based on higher order differential technique and inside-out technique. The main idea is to take higher order derivatives at initial states inverted from an intermediate internal state subspace, which differs from traditional higher order differential dis-tinguishers that take derivatives directly from the initial state subspace. So zero-sum distinguishers lower the degree of higher order derivatives by nearly half with the added cost of some inverted computations. We now give the definitions of zero-sum and zero-sum partitions. Further details can be found in [1]. Definition 2.  Let F be a function from 2nF  into 2mF . A zero-sum for F of size K is a subset {x1, x2, …, xK} 2 nF  of elements which sum to zero and for which the correspond-ing images by F also sum to zero. That is, 1 1( ) 0K Ki ii ix F x    . Definition 3.  Let P be a permutation from 2nF  into 2nF . A zero-sum partition for F of size K=2k is a collection of 2nk disjoint zero-sums Xi={xi,1, xi,1, … ,,2kix } 2 nF . That is,  2 2 22 , ,1 110, 1 2n k k kn n ki i j i jj jiX F and x P x i        . 2  Description of the Keccak-f permutation The size of Keccak-f is 1600, and the state can be repre-sented by a 3-dimensional binary matrix of size 5×5×64. The five transformations are respectively called , , ,  and . Only the transformation  is nonlinear, its degree being 2 while the degree of its inverse is 3. The Boolean components of  are listed in Table 1. More details of the Keccak-f permutation are available in the website of the NIST Hash competition. 3  Generalized and intuitive upper bound of the degree of iterated permutations High algebraic degree is an important design principle for cryptographic algorithms. It is difficult to determine the algebraic degree when the number of rounds in the algo-rithm is too big. Estimating the upper bound on the algebra-ic degree is relatively feasible. In [4], Canteaut and Videau gave an upper bound on the degree of composition of non-linear functions and used it to estimate the algebraic degree of the whole algorithm. In the rump session of Crypto 2010, Boura et al. [2] proposed an improved upper bound for iter-ated permutations with a nonlinear layer composed of paral-lel applications of small balanced S-boxes. We next discuss this latter upper bound and give a proposition for a visual-ized bound in some cases. Theorem 1[2]. Let f be a function from 2nF  into 2nF  corresponding to the concatenation of m smaller balanced S-boxes, S1, ..., Sm, defined over 2nF . Let k be the maximal degree of the product of any k coordinates from any one of these smaller S-boxes. Then, for any function G from 2nF  into 2lF , we have   deg( )deg n GG F n   , where  001 10max i nin in     . Most notably, we have Table 1  Boolean components of  Output Corresponding Boolean function 0 x0+x2+x1x2 1 x1+x3+x2x3 2 x2+x4+x3x4 3 x0+x3+x0x4 4 x1+x4+x0x1 696 Duan M, et al.   Chin Sci Bull   February (2012) Vol.57 No.6  0deg( )deg1  n GG F nn. Moreover, if n0 3 and all S-boxes have degree at most   n0 2, we have  0deg( )deg2n GG F nn   . Lemma 1.  Let f be a function from 2nF  into 2nF  cor-responding to the concatenation of m smaller S-boxes, S1, ..., Sm, defined over 02 .nF  Let k be the maximal degree of the product of any k coordinates of any one of these smaller S-boxes. If n0 2k 1(k 1) and i n0 1 for any i from 1 to n0 1, and i n0 2 for any i from 1 to k 1 (k2), then 0 0 0( )( ) ( ) 0in k n n i      for any i from 1 to n0 1. Proof: When k = 1, then we have 0 0 0 0 0 00 00 0( )( ) ( ) ( 1)( ) ( )( 1) ( )( 1) ( 1) 0.i in k n n i n n n in n in n                 When k 2, then we have 0 0 0 0 00 00( )( ) ( ) 2( ) ( )2( ) ( 1)2 1 0.in k n n i n k n in k nn k              First, from Theorem 1, we know that the condition that the S-boxes are balanced in confirms that the inequality   i n0 1 is satisfied for any i from 1 to n0 1. This is not a necessary condition, however, and it is not necessary to limit the condition to balanced S-boxes. That is, the condi-tion in Theorem 1 can be generalized. Second, note that the parameter  in the theorem is the maximum value of 00 in in   for i from 1 to n0 1. Lemma 1 tells us that the positive integer n0 k also suffices in some cases. That is, the inequality 000 in in kn     always holds under the conditions of the lemma, so we get  (n0 k). With the more generalized condition and more determi-nate parameter, we have the following intuitive upper bound by combining the theorem and the lemma. Proposition 1.  Let f be a function from 2nF  into 2nF  corresponding to the concatenation of m smaller S-boxes, S1, ..., Sm, defined over 02 .nF  Let k be the maximal degree of the product of any k coordinates of any one of these smaller S-boxes. If n0 2k 1(k 1) and i n0 1 for any i from 1 to n0 1, and i n0 2 for any i from 1 to k 1 (k2), then, for any function G from 2nF  into 2lF , we have 0deg( )deg( )n GG F nn k   . Actually, when the conditions of Proposition 1 are satis-fied and n0 is an even number, then the parameter  can be improved to n0 k1/2, but a discussion of this is not rele-vant to this paper. 4  Improved zero-sum distinguisher for Keccak-f 4.1  An observation about Keccak-f We give the Boolean components of 1 and the product of any two output coordinates of the transformation in Tables 2 and 3 respectively. From Table 3, an interesting observation about the in-verse of the nonlinear layer of Keccak-f can be obtained. Observation: For the inverse of the only nonlinear trans-formation in Keccak-f, the algebraic degree of any output coordinate and the one of the product of any two output coordinates are both 3, which is 2 less than its size of 5. 4.2  Improved zero-sum partition for full 24-rounds Keccak-f permutation Let R denote the Keccak-f round permutation. Note that   Table 2  Boolean components of 1 Output Corresponding Boolean function 01 x0+x2+x4+x1x2+x1x4+x3x4+x1x3x4 11 x0+x1+x3+x0x2+x0x4+x2x3+x0x2x4 21 x1+x2+x4+x0x1+x1x3+x3x4+x0x1x3 31 x0+x2+x3+x0x4+x1x2+x2x4+x1x2x4 41 x1+x3+x4+x0x1+x0x3+x2x3+x0x2x3 Table 3  Product of any two output coordinates of 1 Output Corresponding Boolean function 0111 x0+x0x1+x0x2+x0x3+x0x4+x0x2x3+x0x2x4 0121 x2+x4+x0x2+x0x4+x1x2+x1x4+x3x4+x0x3x4+x1x3x4 0131 x0+x2+x0x3+x0x4+x1x2+x2x3+x2x4+x3x4+x1x2x3+x1x2x4 0141 x4+x0x3+x0x4+x1x4+x2x4+x1x2x4+x1x3x4 1121 x1+x0x1+x1x2+x1x3+x1x4+x0x1x3+x1x3x4 1131 x0+x3+x0x1+x0x2+x0x4+x1x3+x2x3+x0x1x4+x0x2x4 1141 x1+x3+x0x1+x0x3+x1x4+x2x3+x3x4+x0x2x3+x2x3x4 2131 x2+x0x2+x1x2+x2x3+x2x4+x0x2x4+x1x2x4 2141 x1+x4+x0x1+x1x2+x1x3+x2x4+x3x4+x0x1x2+x0x1x3+x0x3x4+x2x3x4 3141 x3+x0x3+x1x3+x2x3+x3x4+x0x1x3+x0x2x3  Duan M, et al.   Chin Sci Bull   February (2012) Vol.57 No.6 697 is the only nonlinear transformation in R. Combining our earlier observation and Proposition 1, we have     deg( )deg deg3n GG R G n      and    1 1 deg( )deg deg2n GG R G n      , where G is any function from 52F  into 2lF . Our upper bounds on the degree of the inverse of Keccak-f are less than the bounds in [2] when the number of rounds is more than seven. The comparisons are listed in Table 4. Combining these upper bounds on deg(R) with those in [2] and our lowered upper bounds on deg(R ), we have a zero-sum partition of size 21575 for the full Keccak-f permu-tation. This is smaller than the original size of 21590, as  Table 4  Comparison of the upper bounds on deg(R)  Round Bound in [2] Our bound 1 3 3 2 9 9 3 27 27 4 81 81 5 243 243 6 729 729 7 1309 1164 8 1503 1382 9 1567 1491 10 1589 1545 11 1596 1572 12 1598 1586 13 1599 1593 14 1599 1596 15 1599 1598 16 1599 1599  confirmed in the updated version of [2] appearing in the Preproceedings of FSE 2011. Indeed, one can consider the intermediate states after the three linear layers ,  and , in the 12-th round of Keccak-f in any subspace V correspond-ing to a collection of 315 rows, because the upper bound of the backward 11 rounds is 1572 and that of the forward 12 rounds is 1536 [2]. 5  Discussion In this paper, we lower the size of a zero-sum partition for the Keccak-f permutation with full 24 rounds based on an interesting observation about the inverse of the nonlinear transformation in the permutation. One can verify that some of the products of three output coordinates also have a de-gree of only 3. This property may be used for more practical cryptanalysis of Keccak in the future. The authors express their great thanks to C. Boura and the anonymous reviewers for their helpful comments. This work was supported by the National Natural Science Foundation of China (60573032, 60773092 and 61073149), and Research Fund for the Doctoral Program of Higher Edu-cation of China (20090073110027). 1 Boura C, Canteaut A. Zero-sum distinguishers for iterated permuta-tions and application to Keccak-f and Hamsi-256. In: Proceedings of the 17th International Workshop on Selected Areas in Cryptography 2010 Aug 1213, Waterloo, Ontario, Canada. Waterloo: LNCS Springer Press, 2010. 1–17 2 Boura C, Canteaut A, Cannière C D. Higher-order differential prop-erties of Keccak and Luffa, In: Proceedings of the 18th International Workshop on Fast Software Encryption 2011 Feb 1416, Lyngby, Denmark. Lyngby: LNCS Springer Press, 2011. 252–269 3 Lai X J. Higher order derivatives and differential cryptanalysis. In: Communications and Cryptography: Two Sides of One Tapestry 1994, Switzerland. Switzerland: Kluwer Adademic Publishers, 1994. 227–233 4 Canteaut A,Videau M. Degree of composition of highly nonlinear functions and applications to higher order differential cryptanalysis. In: Advances in Cryptology-EUROCRYPT 2002, International Con-ference on the Theory and Applications of Cryptographic Techniques, Apr 28May 2, Amsterdam, The Netherlands. Amsterdam: LNCS Springer Press, 2002. 518–533  Open Access This article is distributed under the terms of the Creative Commons Attribution License which permits any use, distribution, and reproduction in any medium, provided the original author(s) and source are credited.  

Chinese Science Bulletin

Improved zero-sum distinguisher for full round Keccak-f permutation

https://link.springer.com/content/pdf/10.1007%2Fs11434-011-4909-x.pdf

Improved zero-sum distinguisher for full round Keccak-f permutation

Abstract

Similar works

Full text

Available Versions

Crossref