National Institute of Standards and Technology における超伝導研究及び生活

We present a new block cipher LED. While dedicated to compact hardware implementation, and offering the smallest silicon footprint among comparable block ciphers, the cipher has been designed to simultaneously tackle three additional goals. First, we explore the role of an ultra-light (in fact non-existent) key schedule. Second, we consider the resistance of ciphers, and LED in particular, to related-key attacks: we are able to derive simple yet interesting AES-like security proofs for LED regarding related- or single-key attacks. And third, while we provide a block cipher that is very compact in hardware, we aim to maintain a reasonable performance profile for software implementation.

The LED block cipher

We present a new garbled circuit construction for two-party secure function evaluation (SFE). In our one-round protocol, XOR gates are evaluated "for free", which results in the corresponding improvement over the best garbled circuit implementations (e.g. Fairplay [19]).

We build permutation networks [26] and Universal Circuits (UC) [25] almost exclusively of XOR gates; this results in a factor of up to 4 improvement (in both computation and communication) of their SFE. We also improve integer addition and equality testing by factor of up to 2.

We rely on the Random Oracle (RO) assumption. Our constructions are proven secure in the semi-honest model.

/pdf/improved-garbled-circuit-free-xor-gates-and-applications-3cn0m0a05t.pdf

Improved Garbled Circuit: Free XOR Gates and Applications

An important open problem in the area of Traitor Tracing is designing a scheme with constant expansion of the size of keys (users' keys and the encryption key) and of the size of ciphertexts with respect to the size of the plaintext. This problem is known from the introduction of Traitor Tracing by Chor, Fiat and Naor. We refer to such schemes as traitor tracing with constant transmission rate. Here we present a general methodology and two protocol constructions that result in the first two public-key traitor tracing schemes with constant transmission rate in settings where plaintexts can be calibrated to be sufficiently large. Our starting point is the notion of copyrighted function which was presented by Naccache, Shamir and Stern. We first solve the open problem of discrete-log-based and public-key-based copyrighted function. Then, we observe the simple yet crucial relation between (public-key) copyrighted encryption and (public-key) traitor tracing, which we exploit by introducing a generic design paradigm for designing constant transmission rate traitor tracing schemes based on copyrighted encryption functions. Our first scheme achieves the same expansion efficiency as regular ElGamal encryption. The second scheme introduces only a slightly larger (constant) overhead, however, it additionally achieves efficient black-box traitor tracing (against any pirate construction).

Traitor Tracing with constant transmission rate

A new stream cipher, Grain, is proposed. The design targets hardware environments where gate count, power consumption and memory is very limited. It is based on two shift registers and a non-linear output function. The cipher has the additional feature that the speed can be increased at the expense of extra hardware. The key size is 80 bits and no attack faster than exhaustive key search has been identified. The hardware complexity and throughput compares favourably to other hardware oriented stream ciphers like E0 and A5/1.

/pdf/grain-a-stream-cipher-for-constrained-environments-2azyz8fiei.pdf

Grain: a stream cipher for constrained environments

Let X-1, X-2, ... , X-k be independent n bit random variables. If they have arbitrary distributions, we show how to compute distributions like Pr{X-1 circle plus X-2 circle plus (...) circle plus X-k} and Pr{X-1 boxed plus X-2 boxed plus (...) boxed plus X-k} in complexity O(kn2(n)). Furthermore, if X-1, X-2, ... X-k are uniformly distributed we demonstrate a large class of functions F(X-1, X-2, ... X-k), for which we can compute their distributions efficiently. These results have applications in linear cryptanalysis of stream ciphers as well as block ciphers. A typical example is the approximation obtained when additions modulo 2(n) are replaced by bitwise addition. The efficiency of such an approach is given by the bias of a distribution of the above kind. As an example, we give a new improved distinguishing attack on the stream cipher SNOW 2.0. (Less)

Fast computation of large distributions and its cryptographic applications

A new stream cipher, Grain-128, is proposed. The design is very small in hardware and it targets environments with very limited resources in gate count, power consumption, and chip area. Grain-128 supports key size of 128 bits and IV size of 96 bits. The design is very simple and based on two shift registers, one linear and one nonlinear, and an output function.

http://www.ecrypt.eu.org/stream/p2ciphers/grain/Grain128_p2.pdf

A Stream Cipher Proposal: Grain-128

A new family of stream ciphers, Grain, is proposed. Two variants, a 80-bit and a 128-bit variant are specified, denoted Grain and Grain-128 respectively. The designs target hardware environments where gate count, power consumption and memory are very limited. Both variants are based on two shift registers and a nonlinear output function. The ciphers also have the additional feature that the speed can be easily increased at the expense of extra hardware.

The Grain Family of Stream Ciphers

TRIVIUM is a stream cipher designed in 2005 by C. De Canniere and B. Preneel for the European project eSTREAM. It has an internal state of 288 bits and the key of length 80 bits. Although the design has a simple and elegant structure, no attack on it has been found yet.

In this paper a family of TRIVIUM-like designs is studied. We propose a set of techniques for methodological cryptanalysis of these structures in general, including state recovering and linear distinguishing attacks. In particular, we study the original TRIVIUM and present a state recovering attack with time complexity around c283.5, which is 230 faster than the best previous result. Our attack clearly shows that TRIVIUM has a very thin safety margin and that in its current form it can not be used with longer 128-bit keys.

Finally, we identify interesting open problems and propose a new design TRIVIUM/128, which resists all of our attacks proposed in this paper. It also accepts a 128 bit secret key due to the improved security level.

/pdf/two-trivial-attacks-on-trivium-4cqaopk2b4.pdf

Two trivial attacks on TRIVIUM

The stream cipher RC4 was designed by R Rivest in 1987, and it is a widely deployed cipher In this paper we analyse the class RC4-Nof RC4-like stream ciphers, where Nis the modulus of operations, as well as the length of internal arrays Our new attack is a state recovery attack which accepts the keystream of a certain length, and recovers the internal state For the reduced RC4-100, our attack has total complexity of around 293operations, whereas the best previous attack (from Knudsen et al) needs 2236of time

The complexity of the attack applied to the original RC4-256 depends on the parameters of specific states (patterns), which are in turn hard to discover Extrapolated parameters from smaller patterns give us the attack of complexity about 2241, and it is much smaller than the complexity of the best known previous attack 2779 The algorithm of the new attack was implemented and verified on small cases

/pdf/new-state-recovery-attack-on-rc4-53zse6chg0.pdf

Alexander Maximov

Papers

Fast computation of large distributions and its cryptographic applications

A Stream Cipher Proposal: Grain-128

The Grain Family of Stream Ciphers

Two trivial attacks on TRIVIUM

New State Recovery Attack on RC4