Showing papers by "Florian Mendel published in 2015"
TL;DR: In this paper, the rebound attack was introduced as a variant of differential cryptanalysis on hash functions and applied to the hash function Whirlpool, standardized by ISO/IEC.
Abstract: We introduce the rebound attack as a variant of differential cryptanalysis on hash functions and apply it to the hash function Whirlpool, standardized by ISO/IEC. We give attacks on reduced variants of the 10-round Whirlpool hash function and compression function. Our results are collisions for 5.5 and near-collisions for 7.5 rounds on the hash function, as well as semi-free-start collisions for 7.5 and semi-free-start near-collisions for 9.5 rounds on the compression function. Additionally, we introduce the subspace problem as a generalization of near-collision resistance. Finally, we present the first distinguishers that apply to the full compression function and the full underlying block cipher W of Whirlpool.
66 citations
29 Nov 2015
TL;DR: In this paper, the authors examined the collision resistance of step-reduced versions of SHA-512/224 and SHA512/256 by using differential cryptanalysis in combination with sophisticated search tools and showed that the truncation performed by these variants on their larger state allows them to attack several more rounds compared to the untruncated family members.
Abstract: In 2012, NIST standardized SHA-512/224 and SHA-512/256, two truncated variants of SHA-512, in FIPS 180-4. These two hash functions are faster than SHA-224 and SHA-256 on 64-bit platforms, while maintaining the same hash size and claimed security level. So far, no third-party analysis of SHA-512/224 or SHA-512/256 has been published. In this work, we examine the collision resistance of step-reduced versions of SHA-512/224 and SHA-512/256 by using differential cryptanalysis in combination with sophisticated search tools. We are able to generate practical examples of free-start collisions for 44-step SHA-512/224 and 43-step SHA-512/256. Thus, the truncation performed by these variants on their larger state allows us to attack several more rounds compared to the untruncated family members. In addition, we improve upon the best published collisions for 24-step SHA-512 and present practical collisions for 27 steps of SHA-512/224, SHA-512/256, and SHA-512.
55 citations
04 Nov 2015
TL;DR: The reasoning extends to hybrid schemes, where the communication party to protect against side-channel attacks is stateful, and is illustrated by describing a collision attack against an example of a hybrid scheme patented by Kocher, and presenting a tweak leading to beyond birthday security.
Abstract: Fresh re-keying is a type of protocol which aims at splitting the task of protecting an encryption/authentication scheme against side-channel attacks in two parts. One part, a re-keying function, has to satisfy a minimum set of properties such as good diffusion, and is based on an algebraic structure that is easy to protect against side-channel attacks with countermeasures such as masking. The other part, a block cipher, brings resistance against mathematical cryptanalysis, and only has to be secure against single-measurement attacks. Since fresh re-keying schemes are cheap and stateless, they are convenient to use in practice and do not require any synchronization between communication parties. However, it has been shown that their first instantiation from Africacrypt 2010 only provides birthday security because of a mathematical only collision-based key recovery attack recently put forward by Dobraunigi¾?eti¾?al. CARDIS 2014. In this paper, we provide two provably secure in the ideal cipher model solutions to avoid such collision attacks. The first one is based on classical block ciphers, but does not achieve beyond-birthday CPA security i.e. it only provably prevents the CARDIS 2014 key recovery attack and requires an additional block cipher execution in the protocol. The second one is based on tweakable block ciphers and provides tight CPA security while also being more efficient. As a complement, we also show that our reasoning extends to hybrid schemes, where the communication party to protect against side-channel attacks is stateful. We illustrate this claim by describing a collision attack against an example of a hybrid scheme patented by Kocher, and presenting a tweak leading to beyond birthday security. We conclude the paper by discussing the use of fresh/hybrid re-keying for encryption and authentication, together with a cautionary note on their side-channel resistance.
45 citations
20 Apr 2015
TL;DR: The first results regarding linear cryptanalysis of Ascon are presented, improve upon the results of the designers regarding differential cryptanalysis, and bounds on the minimum number of (linearly and differentially) active S-boxes for the Ascon permutation are proved.
Abstract: We present a detailed security analysis of the CAESAR candidate Ascon. Amongst others, cube-like, differential and linear cryptanalysis are used to evaluate the security of Ascon. Our results are practical key-recovery attacks on round-reduced versions of Ascon-128, where the initialization is reduced to 5 out of 12 rounds. Theoretical key-recovery attacks are possible for up to 6 rounds of initialization. Moreover, we present a practical forgery attack for 3 rounds of the finalization, a theoretical forgery attack for 4 rounds finalization and zero-sum distinguishers for the full 12-round Ascon permutation. Besides, we present the first results regarding linear cryptanalysis of Ascon, improve upon the results of the designers regarding differential cryptanalysis, and prove bounds on the minimum number of (linearly and differentially) active S-boxes for the Ascon permutation.
41 citations
25 Nov 2015
TL;DR: In this article, the secret key of a round-reduced variant of LowMC with 80-bit security was recovered, where the number of rounds was reduced from 11 to 9.
Abstract: LowMC is a family of block ciphers developed particularly for use in multi-party computations and fully homomorphic encryption schemes, where the main performance penalty comes from non-linear operations. Thus, LowMC has been designed to minimize the total quantity of logical “and” operations, as well as the “and” depth. To achieve this, the LowMC designers opted for an incomplete S-box layer that does not cover the complete state, and compensate for it with a very dense, randomly chosen linear layer. In this work, we exploit this design strategy in a cube-like key-recovery attack. We are able to recover the secret key of a round-reduced variant of LowMC with 80-bit security, where the number of rounds is reduced from 11 to 9. Our attacks are independent of the actual instances of the used linear layers and therefore, do not exploit possible weak choices of them. From our results, we conclude that the resulting security margin of 2 rounds is smaller than expected.
27 citations
29 Nov 2015
TL;DR: This work presents a heuristic search tool which is capable of finding linear characteristics even for primitives with a relatively large state, and without a strongly aligned structure.
Abstract: Differential and linear cryptanalysis are the general purpose tools to analyze various cryptographic primitives. Both techniques have in common that they rely on the existence of good differential or linear characteristics. The difficulty of finding such characteristics depends on the primitive. For instance, AES is designed to be resistant against differential and linear attacks and therefore, provides upper bounds on the probability of possible linear characteristics. On the other hand, we have primitives like SHA-1, SHA-2, and Keccak, where finding good and useful characteristics is an open problem. This becomes particularly interesting when considering, for example, competitions like CAESAR. In such competitions, many cryptographic primitives are waiting for analysis. Without suitable automatic tools, this is a virtually infeasible job. In recent years, various tools have been introduced to search for characteristics. The majority of these only deal with differential characteristics. In this work, we present a heuristic search tool which is capable of finding linear characteristics even for primitives with a relatively large state, and without a strongly aligned structure. As a proof of concept, we apply the presented tool on the underlying permutations of the first round CAESAR candidates Ascon, ICEPOLE, Keyak, Minalpher and PrOst.
27 citations
Posted Content•
TL;DR: In this paper, the secret key of a round-reduced variant of LowMC with PRESENT-like security was recovered, where the number of rounds was reduced from 11 to 9.
Abstract: LowMC is a family of block ciphers developed particularly for use in multi-party computations and fully homomorphic encryption schemes, where the main performance penalty comes from non-linear operations. Thus, LowMC has been designed to minimize the total quantity of logical “and” operations, as well as the “and” depth. To achieve this, the LowMC designers opted for an incomplete S-box layer that does not cover the complete state, and compensate for it with a very dense, randomly chosen linear layer. In this work, we exploit this design strategy in a cube-like key-recovery attack. We are able to recover the secret key of a round-reduced variant of LowMC with PRESENT-like security, where the number of rounds is reduced from 11 to 9. Our attacks are independent of the actual instances of the used linear layers and therefore, do not exploit possible weak choices of them. From our results, we conclude that the resulting security margin of 2 rounds is smaller than expected.
21 citations
Posted Content•
TL;DR: This paper presents a generic chosen-plaintext key-recovery attack on both fresh re-keying schemes to counter side-channel and fault attacks and suggests weaker primitives like 80-bit PRESENT are used, even lower attack complexities are possible.
Abstract: At AFRICACRYPT 2010 and CARDIS 2011, fresh re-keying schemes to counter side-channel and fault attacks were introduced. The idea behind those schemes is to shift the main burden of side-channel protection to a re-keying function \(g\) that is easier to protect than the main block cipher. This function produces new session keys based on the secret master key and random nonces for every block of message that is encrypted. In this paper, we present a generic chosen-plaintext key-recovery attack on both fresh re-keying schemes. The attack is based on two observations: Since session key collisions for the same message are easy to detect, it is possible to recover one session key with a simple time-memory trade-off strategy; and if the re-keying function is easy to invert (such as the suggested multiplication constructions), the attacker can use the session key to recover the master key. The attack has a complexity of about \(2 \cdot 2^{n/2}\) (instead of the expected \(2^n\)) for an \(n\)-bit key. For the typically employed block cipher AES-128, this would result in a key-recovery attack complexity of only \(2^{65}\). If weaker primitives like 80-bit PRESENT are used, even lower attack complexities are possible.
17 citations
08 Mar 2015
TL;DR: Forgery attacks on Prost-OTR in a related-key setting have been studied in this article, where the authors exploit how the Prost permutation is used in an Even-Mansour construction.
Abstract: We present a forgery attack on Prost-OTR in a related-key setting. Prost is a family of authenticated encryption algorithms proposed as candidates in the currently ongoing CAESAR competition, and Prost-OTR is one of the three variants of the Prost design. The attack exploits how the Prost permutation is used in an Even-Mansour construction in the Feistel-based OTR mode of operation. Given the ciphertext and tag for any two messages under two related keys K and \(K \oplus \varDelta \) with related nonces, we can forge the ciphertext and tag for a modified message under K. If we can query ciphertexts for chosen messages under \(K \oplus \varDelta \), we can achieve almost universal forgery for K. The computational complexity is negligible.
15 citations
12 Aug 2015
TL;DR: By using differential cryptanalysis, this work is able to create forgeries from a known ciphertext-tag pair with a probability of 2-60.3 for a round-reduced version of ICEPOLE-128, where the last permutation is reduced to 4 out of 6 rounds.
Abstract: ICEPOLE is a family of authenticated encryptions schemes submitted to the ongoing CAESAR competition and in addition presented at CHES 2014. To justify the use of ICEPOLE, or to point out potential weaknesses, third-party cryptanalysis is needed. In this work, we evaluate the resistance of ICEPOLE-128 against forgery attacks. By using differential cryptanalysis, we are able to create forgeries from a known ciphertext-tag pair with a probability of $$2^{-60.3}$$2-60.3 for a round-reduced version of ICEPOLE-128, where the last permutation is reduced to 4 out of 6 rounds. This is a noticeable advantage compared to simply guessing the right tag, which works with a probability of $$2^{-128}$$2-128. As far as we know, this is the first published attack in a nonce-respecting setting on round-reduced versions of ICEPOLE-128.
3 citations
Posted Content•
TL;DR: A forgery attack on Prost-OTR is presented, which exploits how the Prost permutation is used in an Even-Mansour construction in the Feistel-based OTR mode of operation.
Abstract: We present a forgery attack on Prst-OTR in a related-key setting. Prst is a family of authenticated encryption algorithms pro- posed as candidates in the currently ongoing CAESAR competition, and Prst-OTR is one of the three variants of the Prst design. The attack exploits how the Prst permutation is used in an Even-Mansour construc- tion in the Feistel-based OTR mode of operation. Given the ciphertext and tag for any two messages under two related keys K and K with related nonces, we can forge the ciphertext and tag for a modied message under K. If we can query ciphertexts for chosen messages under K , we can achieve almost universal forgery for K. The computa- tional complexity is negligible.
Posted Content•
TL;DR: In this article, a detailed security analysis of CAESAR candidate Ascon is presented, where cube-like, differential and linear cryptanalysis are used to evaluate the security of Ascon.
Abstract: We present a detailed security analysis of the CAESAR candidate Ascon. Amongst others, cube-like, differential and linear cryptanalysis are used to evaluate the security of Ascon. Our results are practical key-recovery attacks on round-reduced versions of Ascon-128, where the initialization is reduced to 5 out of 12 rounds. Theoretical keyrecovery attacks are possible for up to 6 rounds of initialization. Moreover, we present a practical forgery attack for 3 rounds of the finalization, a theoretical forgery attack for 4 rounds finalization and zero-sum distinguishers for the full 12-round Ascon permutation. Besides, we present the first results regarding linear cryptanalysis of Ascon, improve upon the results of the designers regarding differential cryptanalysis, and prove bounds on the minimum number of (linearly and differentially) active Sboxes for the Ascon permutation.
Posted Content•
TL;DR: In this paper, the authors focus on the construction of semi-free-start collisions for SHA-256, and show how to turn them into collisions using a two-block approach.
Abstract: In this paper, we focus on the construction of semi-free-start collisions for SHA-256, and show how to turn them into collisions. We present a collision attack on 28 steps of the hash function with practical complexity. Using a two-block approach we are able to turn a semi-freestart collision into a collision for 31 steps with a complexity of at most 2. The main improvement of our work is to extend the size of the local collisions used in these attacks. To construct differential characteristics and confirming message pairs for longer local collisions, we had to improve the search strategy of our automated search tool. To test the limits of our techniques we present a semi-free-start collision for 38 steps.
Posted Content•
TL;DR: In this paper, a heuristic search tool is presented for finding linear characteristics even for primitives with a relatively large state, and without a strongly aligned structure, and applied the presented tool on the underlying permutations of the first round CAESAR candidates Ascon, ICEPOLE, Keyak, Minalpher and Prost.
Abstract: Differential and linear cryptanalysis are the general purpose tools to analyze various cryptographic primitives. Both techniques have in common that they rely on the existence of good differential or linear characteristics. The difficulty of finding such characteristics depends on the primitive. For instance, AES is designed to be resistant against differential and linear attacks and therefore, provides upper bounds on the probability of possible linear characteristics. On the other hand, we have primitives like SHA-1, SHA-2, and Keccak, where finding good and useful characteristics is an open problem. This becomes particularly interesting when considering, for example, competitions like CAESAR. In such competitions, many cryptographic primitives are waiting for analysis. Without suitable automatic tools, this is a virtually infeasible job. In recent years, various tools have been introduced to search for characteristics. The majority of these only deal with differential characteristics. In this work, we present a heuristic search tool which is capable of finding linear characteristics even for primitives with a relatively large state, and without a strongly aligned structure. As a proof of concept, we apply the presented tool on the underlying permutations of the first round CAESAR candidates Ascon, ICEPOLE, Keyak, Minalpher and Prost.