There is, I think, something ethereal about i —the square root of minus one. I remember first hearing about it at school. It seemed an odd beast at that time—an intruder hovering on the edge of reality.

Usually familiarity dulls this sense of the bizarre, but in the case of i it was the reverse: over the years the sense of its surreal nature intensified. It seemed that it was impossible to write mathematics that described the real world in …

I and i

We introduce the key reinstallation attack. This attack abuses design or implementation flaws in cryptographic protocols to reinstall an already-in-use key. This resets the key's associated parameters such as transmit nonces and receive replay counters. Several types of cryptographic Wi-Fi handshakes are affected by the attack. All protected Wi-Fi networks use the 4-way handshake to generate a fresh session key. So far, this 14-year-old handshake has remained free from attacks, and is even proven secure. However, we show that the 4-way handshake is vulnerable to a key reinstallation attack. Here, the adversary tricks a victim into reinstalling an already-in-use key. This is achieved by manipulating and replaying handshake messages. When reinstalling the key, associated parameters such as the incremental transmit packet number (nonce) and receive packet number (replay counter) are reset to their initial value. Our key reinstallation attack also breaks the PeerKey, group key, and Fast BSS Transition (FT) handshake. The impact depends on the handshake being attacked, and the data-confidentiality protocol in use. Simplified, against AES-CCMP an adversary can replay and decrypt (but not forge) packets. This makes it possible to hijack TCP streams and inject malicious data into them. Against WPA-TKIP and GCMP the impact is catastrophic: packets can be replayed, decrypted, and forged. Because GCMP uses the same authentication key in both communication directions, it is especially affected. Finally, we confirmed our findings in practice, and found that every Wi-Fi device is vulnerable to some variant of our attacks. Notably, our attack is exceptionally devastating against Android 6.0: it forces the client into using a predictable all-zero encryption key.

/pdf/key-reinstallation-attacks-forcing-nonce-reuse-in-wpa2-tcuksgp69s.pdf

Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2

The U.S. National Security Agency (NSA) developed the Simon and Speck families of lightweight block ciphers as an aid for securing applications in very constrained environments where AES may not be suitable. This paper summarizes the algorithms, their design rationale, along with current cryptanalysis and implementation results.

/pdf/simon-and-speck-block-ciphers-for-the-internet-of-things-2vkz23sw1g.pdf

SIMON and SPECK: Block Ciphers for the Internet of Things.

In this article, we revisit the design strategy of PRESENT, leveraging all the advances provided by the research community in construction and cryptanalysis since its publication, to push the design up to its limits. We obtain an improved version, named GIFT, that provides a much increased efficiency in all domains (smaller and faster), while correcting the well-known weakness of PRESENT with regards to linear hulls.

GIFT : A Small Present

s for articles or notes should entice the prospective reader into exploring the subject of the paper and should make it clear to the reader why this paper is interesting and important. The abstract should highlight the concepts of the paper rather than summarize the mechanics. The abstract is the first impression of the paper, not a technical summary of the paper. Excessive use of notation is discouraged as it can limit the interest of the broad readership of the MAA and can limit searchability of the article. Letters to the editor on any topic are invited. Comments, criticisms, and suggestions for making the Monthly more lively, entertaining, and informative can be forwarded to editor Susan Colley. Formatting and templates Authors who use LaTeX are urged to use the Monthly template and maa-monthly.sty (and its standard environments) with no custom formatting. Journal names in references should match those used on MathSciNet. For filler, please download and use the following Monthly filler template. References References should be presented in a separate section at the end of the document. The references should be listed alphabetically by the first author’s last name, then, as needed, by the co-author’s last names and the resource’s

/pdf/american-mathematical-monthly-375wbk2yzc.pdf

American Mathematical Monthly

In this paper, we show structural cryptanalyses against two popular networks, i.e., the Feistel Network and the Substitute-Permutation Network (SPN). Our cryptanalyses are distinguishing attacks by an improved integral distinguisher. The integral distinguisher is one of the most powerful attacks against block ciphers, and it is usually constructed by evaluating the propagation characteristic of integral properties, e.g., the ALL or BALANCE property. However, the integral property does not derive useful distinguishers against block ciphers with non-bijective functions and bit-oriented structures. Moreover, since the integral property does not clearly exploit the algebraic degree of block ciphers, it tends not to construct useful distinguishers against block ciphers with low-degree functions. In this paper, we propose a new property called the division property, which is the generalization of the integral property. It can effectively construct the integral distinguisher even if the block cipher has non-bijective functions, bit-oriented structures, and low-degree functions. From viewpoints of the attackable number of rounds or chosen plaintexts, the division property can construct better distinguishers than previous methods. Although our attack is a generic attack, it can improve several integral distinguishers against specific cryptographic primitives. For instance, it can reduce the required number of chosen plaintexts for the \(10\)-round distinguisher on Keccak-\(f\) from \(2^{1025}\) to \(2^{515}\). For the Feistel cipher, it theoretically proves that Simon 32, 48, 64, 96, and 128 have \(9\)-, \(11\)-, \(11\)-, \(13\)-, and \(13\)-round integral distinguishers, respectively.

/pdf/structural-evaluation-by-generalized-integral-property-3bm4chslbg.pdf

Structural Evaluation by Generalized Integral Property

Ciphers that do not use S-boxes have been discussed for the demand on lightweight cryptosystems, and their round functions consist of and, rotation, and xor. Especially, the Simoni¾?family is one of the most famous ciphers, and there are many cryptanalyses again the Simoni¾?family. However, it is very difficult to guarantee the security because we cannot use useful techniques for S-box-based ciphers. Very recently, the division property, which is a new technique to find integral characteristics, was shown in Eurocrypt 2015. The technique is powerful for S-box-based ciphers, and it was used to break, for the first time, the full MISTY1 in CRYPTO 2015. However, it has not been applied to non-S-box-based ciphers like the Simoni¾?family effectively, and only the existence of the 10-round integral characteristic on Simon32 was proven. On the other hand, the experimental characteristic, which possibly does not work for all keys, covers 15 rounds, and there is a 5-round gap. To fill the gap, we introduce a bit-based division property, and we apply it to show that the experimental 15-round integral characteristic always works for all keys. Though the bit-based division property finds more accurate integral characteristics, it requires much time and memory complexity. As a result, we cannot apply it to symmetric-key ciphers whose block length is over 32. Therefore, we alternatively propose a method for designers. The method works for ciphers with large block length, and it shows "provable security" against integral cryptanalyses using the division property. We apply this technique to the Simoni¾?family and show that Simon48, 64, 96, and 128 probably do not have 17-, 20-, 25-, and 29-round integral characteristics, respectively.

/pdf/bit-based-division-property-and-application-to-simon-family-aklkshsght.pdf

Bit-Based Division Property and Application to Simon Family

In this article, we revisit the design strategy of PRESENT, leveraging all the advances provided by the research community in construction and cryptanalysis since its publication, to push the design up to its limits We obtain an improved version, named GIFT, that provides a much increased efficiency in all domains (smaller and faster), while correcting the well-known weakness of PRESENT with regards to linear hulls GIFT is a very simple and clean design that outperforms even SIMON or SKINNY for round-based implementations, making it one of the most energy efficient ciphers as of today It reaches a point where almost the entire implementation area is taken by the storage and the Sboxes, where any cheaper choice of Sbox would lead to a very weak proposal In essence, GIFT is composed of only Sbox and bit-wiring, but its natural bitslice data flow ensures excellent performances in all scenarios, from area-optimised hardware implementations to very fast software implementation on high-end platforms We conducted a thorough analysis of our design with regards to state-of-the-art cryptanalysis, and we provide trong bounds with regards to differential/linear attacks

GIFT: A Small Present Towards Reaching the Limit of Lightweight Encryption

SIMON family is one of the recent lightweight block cipher designs introduced by NSA. So far there have been several cryptanalytic results on this cipher by means of differential, linear and impossible differential cryptanalysis. In this paper, we study the security of SIMON32, SIMON48/72 and SIMON48/96 by using integral, zero-correlation linear and impossible differential cryptanalysis. Firstly, we present a novel experimental approach to construct the best known integral distinguishers of SIMON32. The small block size, 32 bits, of SIMON32 enables us to experimentally find a 15-round integral distinguisher, based on which we present a key recovery attack on 21-round SIMON32, while previous best results only achieved 19 rounds. Moreover, we attack 20-round SIMON32, 20-round SIMON48/72 and 21-round SIMON48/96 based on 11 and 12-round zero-correlation linear hulls of SIMON32 and SIMON48 respectively. Finally, we propose new impossible differential attacks which improve the previous impossible differential attacks. Our analysis shows that SIMON maintains enough security margin.

/pdf/cryptanalysis-of-reduced-round-simon32-and-simon48-39u7xfq2nr.pdf

Yosuke Todo

Papers

GIFT : A Small Present

Structural Evaluation by Generalized Integral Property

Bit-Based Division Property and Application to Simon Family

GIFT: A Small Present Towards Reaching the Limit of Lightweight Encryption

Cryptanalysis of Reduced-round SIMON32 and SIMON48