The "coefficient H technique" is a tool introduced in 1991 and used to prove various pseudo-random properties from the distribution of the number of keys that sends cleartext on some ciphertext. It can also be used to find attacks on cryptographic designs. We can like this unify a lot of various pseudo-random results obtained by different authors. In this paper we will present this technique and we will give some examples of results obtained.

/pdf/the-coefficients-h-technique-3cxy7lh1w5.pdf

The Coefficients H Technique

Format-preserving encryption (FPE) encrypts a plaintext of some specified format into a ciphertext of identical format--for example, encrypting a valid credit-card number into a valid credit-card number. The problem has been known for some time, but it has lacked a fully general and rigorous treatment. We provide one, starting off by formally defining FPE and security goals for it. We investigate the natural approach for achieving FPE on complex domains, the "rank-then-encipher" approach, and explore what it can and cannot do. We describe two flavors of unbalanced Feistel networks that can be used for achieving FPE, and we prove new security results for each. We revisit the cycle-walking approach for enciphering on a non-sparse subset of an encipherable domain, showing that the timing information that may be divulged by cycle walking is not a damaging thing to leak.

/pdf/format-preserving-encryption-i796tkn2sr.pdf

Format-Preserving Encryption

Block ciphers encrypt blocks of plaintext, messages, into blocks of ciphertext under the action of a secret key, and the process of encryption is reversed by decryption which uses the same user-supplied key. Block ciphers are fundamental to modern cryptography, in fact they are the most widely used cryptographic primitive useful in their own right, and in the construction of other cryptographic mechanisms. In this book the authors provide a technically detailed, yet readable, account of the state of the art of block cipher analysis, design, and deployment. The authors first describe the most prominent block ciphers and give insights into their design. They then consider the role of the cryptanalyst, the adversary, and provide an overview of some of the most important cryptanalytic methods. The book will be of value to graduate and senior undergraduate students of cryptography and to professionals engaged in cryptographic design. An important feature of the presentation is the authors' exhaustive bibliography of the field, each chapter closing with comprehensive supporting notes.

The Block Cipher Companion

We prove beyond-birthday-bound security for most of the well-known types of generalized Feistel networks: (1) unbalanced Feistel networks, where the n-bit to m-bit round functions may have n ≠ m; (2) alternating Feistel networks, where the round functions alternate between contracting and expanding; (3) type-1, type-2, and type-3 Feistel networks, where n-bit to n-bit round functions are used to encipher kn-bit strings for some k ≥ 2; and (4) numeric variants of any of the above, where one enciphers numbers in some given range rather than strings of some given size. Using a unified analytic framework, we show that, in any of these settings, for any e > 0, with enough rounds, the subject scheme can tolerate CCA attacks of up to q ∼ N1-e adversarial queries, where N is the size of the round functions' domain (the larger domain for alternating Feistel). Prior analyses for most generalized Feistel networks established security to only q ∼ N0.5 queries.

/pdf/on-generalized-feistel-networks-5efwuun977.pdf

On generalized Feistel networks

Physical attacks on cryptographic implementations and devices have become crucial. In this context a recent line of research on a new class of side-channel attacks, called memory attacks , has received increasingly more attention. These attacks allow an adversary to measure a significant fraction of secret key bits directly from memory, independent of any computational side-channels.

Physically Unclonable Functions (PUFs) represent a promising new technology that allows to store secrets in a tamper-evident and unclonable manner. PUFs enjoy their security from physical structures at submicron level and are very useful primitives to protect against memory attacks.

In this paper we aim at making the first step towards combining and binding algorithmic properties of cryptographic schemes with physical structure of the underlying hardware by means of PUFs. We introduce a new cryptographic primitive based on PUFs, which we call PUF-PRFs. These primitives can be used as a source of randomness like pseudorandom functions (PRFs). We construct a block cipher based on PUF-PRFs that allows simultaneous protection against algorithmic and physical attackers, in particular against memory attacks. While PUF-PRFs in general differ in some aspects from traditional PRFs, we show a concrete instantiation based on established SRAM technology that closes these gaps.

/pdf/memory-leakage-resilient-encryption-based-on-physically-4l6asx794e.pdf

Memory Leakage-Resilient Encryption Based on Physically Unclonable Functions

In this paper, we describe generic attacks on unbalanced Feistel schemes with contracting functions. These schemes are used to construct pseudo-random permutations from kn bits to kn bits by using d pseudo-random functions from (k 1) n bits to n bits. We describe known plaintext attacks (KPA) and non-adaptive chosen plaintext attacks (CPA-1) against these schemes with less than 2 kn plaintext/ciphertext pairs and complexity strictly less than O(2 kn ) for a number of rounds d 2k, we also describe some attacks on schemes with generators, (i.e. schemes where the d pseudo-random functions are generated) and where more than one permutation is required.

Generic Attacks on Unbalanced Feistel Schemes with Contracting Functions

In this paper, we describe generic attacks on unbalanced Feistel schemes with contracting functions. These schemes are used to construct pseudo-random permutations from kn bits to kn bits by using d pseudo-random functions from (k–1)n bits to n bits. We describe known plaintext attacks (KPA) and non-adaptive chosen plaintext attacks (CPA-1) against these schemes with less than 2kn plaintext/ciphertext pairs and complexity strictly less than O(2kn) for a number of rounds d ≤2k –1. Consequently at least 2k rounds are necessary to avoid generic attacks. For k=3, we found attacks up to 6 rounds, so 7 rounds are required. When d ≥2k, we also describe some attacks on schemes with generators, (i.e. schemes where the d pseudo-random functions are generated) and where more than one permutation is required.

https://www.iacr.org/archive/asiacrypt2006/42840400/42840400.pdf

Generic attacks on unbalanced feistel schemes with contracting functions

Unbalanced Feistel schemes with expanding functions are used to construct pseudo-random permutations from kn bits to kn bits by using random functions from n bits to (k - 1)n bits. At each round, all the bits except n bits are changed by using a function that depends only on these n bits. Jutla [6] investigated such schemes, which he denotes by Fkd, where d is the number of rounds. In this paper, we describe novel Known Plaintext Attacks (KPA) and Non-Adaptive Chosen Plaintext Attacks (CPA-1) against these schemes. With these attacks we will often be able to improve the results of Jutla.

/pdf/generic-attacks-on-unbalanced-feistel-schemes-with-expanding-2j6e09wemc.pdf

Generic attacks on unbalanced Feistel schemes with expanding functions

This book provides a survey on different kinds of Feistel ciphers, with their definitions and mathematical/computational properties. Feistel ciphers are widely used in cryptography in order to obtain pseudorandom permutations and secret-key block ciphers. In Part 1, we describe Feistel ciphers and their variants. We also give a brief story of these ciphers and basic security results. In Part 2, we describe generic attacks on Feistel ciphers. In Part 3, we give results on DES and specific Feistel ciphers. Part 4 is devoted to improved security results. We also give results on indifferentiability and indistinguishability.

Feistel Ciphers: Security Proofs and Cryptanalysis

Xoring two permutations is a very simple way to construct pseudorandom functions from pseudorandom permutations. The aim of this paper is to get precise security results for this construction when the two permutations on n bits f and g are public. We will first prove that f ⊕ g is indifferentiable from a random function on n bits when the attacker is limited with q queries, with \(q \ll \sqrt {2^n}\). This bound is called the “birthday bound”. We will then prove that this bound can be improved to q 3 ≪ 22n . We essentially instantiate length preserving random functions, starting from fixed key ideal cipher with high security guarantee.

Valérie Nachef

Papers

Generic Attacks on Unbalanced Feistel Schemes with Contracting Functions

Generic attacks on unbalanced feistel schemes with contracting functions

Generic attacks on unbalanced Feistel schemes with expanding functions

Feistel Ciphers: Security Proofs and Cryptanalysis

Indifferentiability beyond the Birthday Bound for the Xor of Two Public Random Permutations