We think you have liked this presentation. If you wish to download it, please recommend it to your friends in any social system. Share buttons are a little bit lower. Thank you!
Presentation is loading. Please wait.
Published byMatthew Spencer
Modified over 3 years ago
1 KCipher-2 KDDI R&D Laboratories Inc.
©KDDI R&D Laboratories Inc. All rights Reserved. 2 Introduction LFSR-based stream ciphers Linear recurrence between internal states as a feedback polynomial. LFSR-based stream ciphers have been attacked using the linear recurrence. In KCipher-2, Dynamic Feedback Control mechanism is used for hiding the linear recurrence.
©KDDI R&D Laboratories Inc. All rights Reserved. 3 Design policy Security Produce sufficient period sequences Use different two functions (NLF, and Dynamic Feedback Control) Satisfy -bit key level security Performance Good Performance for Software implementation Consist of basic operations
©KDDI R&D Laboratories Inc. All rights Reserved. 4 Advantages of KCipher-2 Fast Encryption/Decryption KCipher-2 suits fast software implementations 128-bit keys are available Size of Internal State is Small The size is 640 bits Security Margin KCipher-2 is secure without the need for a DFC mechanism. The DFC mechanism is an extra security margin. Resistance against Existing Attacks NLF is designed in consideration of attacks on SNOW 2.0 such as an algebraic attack and a distinguishing attack.
©KDDI R&D Laboratories Inc. All rights Reserved. 5 Profile of K2 128- Key 128-bit IV 640-bit state 32-bit X 16 Registers (FSR-A, FSR-B) 32-bit X 4 Internal Memories for NLF 64-bit keystream per cycle Max cycle without re-initialization is 2^58 cycle (2^64 keystream bits) The algorithm was presented in SASC 2007 workshop (Jan. 2007) -> satisfy the maturity criteria
©KDDI R&D Laboratories Inc. All rights Reserved. 6 KCipher-2
©KDDI R&D Laboratories Inc. All rights Reserved. 7 Use Two Functions Non-Linear Function (NLF) and Dynamic Feedback Control (DFC) NLF Provide nonlinearity of output keystream Dynamic Feedback Control Hide Linear Recurrence of FSR-B
©KDDI R&D Laboratories Inc. All rights Reserved. 8 Dynamic Feedback Control Control coefficients for FSR-B Feedback (Clock) Controller 0, 1 2 bits of FSR-A
©KDDI R&D Laboratories Inc. All rights Reserved. 9 Dynamic Feedback Control (cont.) Performance Do not increase the cost significantly Only change a table of multiplying coefficients α_i. Security The attacker may need to guess control bits in some attacks such as Guess-and-Determine Attacks Algebraic Attacks Hide linear recurrence between internal states of FSR-B Effective for protecting against several attacks
©KDDI R&D Laboratories Inc. All rights Reserved. 10 Non-Linear Function Four 32-bit Substitution functions are used Connect Four internal Memories via the Substitution Functions Input six registers Output 64-bit keystream per cycle Well-evaluated structure (like SNOW) The number of S-Box is twice as that of SNOW
©KDDI R&D Laboratories Inc. All rights Reserved. 11 Non-Linear Function (2) Left Part and Right part of NLF is connected Produce double-length keystream Improve the security Left or right keystream is computed from previous memories of both sides. L2 L1R2 R1 Sub Substitution consists of well-evaluated S-boxes and a linear permutation (same as SNOW). Internal memories hide relation between registers and keystream. LFSR-A LFSR-B
©KDDI R&D Laboratories Inc. All rights Reserved. 12 Analysis of KCipher-2 Stream Cipher Periods The period is expected to be more than the periods of output of FSR-A Statistical Tests Evaluated output of FSR-A, FSR-B, and keystream These properties were good
©KDDI R&D Laboratories Inc. All rights Reserved. 13 Security against Existing Attacks Time-Memory trade off Lengths of IV and the secret keys are sufficiently large. Internal state is sufficiently larger than the secret key Correlation Attack No correlation that has large probability was found. Chosen/Related IV Attack The internal state is well mixed by the initialization process. Secure
©KDDI R&D Laboratories Inc. All rights Reserved. 14 Security against existing Attacks(2) Guess-and-Determine Attack In case of attacking FSR-B without multiplying α i (i=1,2,3) Assume that the attacker obtain values The attacker have to guess two registers and four memories to recover all registers of FSR-B. The complexity is O(2^196) However, the attacker have to guess at least two registers of FSR-A without the assumption. The attack is more than O(2^256) Dynamic feedback makes the attack more complicated. Secure
©KDDI R&D Laboratories Inc. All rights Reserved. 15 Security against Existing Attacks(3) Distinguishing Attack Secure The attacker have to use four mask values. (two masks for attacking SNOW 2.0) Sub consists of AES S- boxes; thus, it has a good linear property. We could not find a linear distinguisher with a feasible linear probability. Dynamic feedback prevents the attack
©KDDI R&D Laboratories Inc. All rights Reserved. 16 Security against Existing Attacks(4) Algebraic Attacks General evaluation results were good. A algebraic attack such as an attack on SNOW 2.0 is impossible, because; The attacker cannot obtain a linear equation of fixed values of keystream and registers. The attacker have to guess control bits of FSR-B. Secure
©KDDI R&D Laboratories Inc. All rights Reserved. 17 Performance Performance on Pentium4 3.2 GHz The algorithm consists of XOR, ADD, and Table lookups. Performances of these computation is expected to be independent against CPU types. Key. Gen.Init. Kcipher-2 (Optimal) 5.45 C/Byte1162 C/Init.
6.1.2 Overview DES is a block cipher, as shown in Figure 6.1.
©KDDI R&D Laboratories Inc. ALL Rights Reserved. Cryptanalysis on Clock Controlled Stream Ciphers Shinsaku Kiyomoto KDDI R&D Laboratories Inc
DES The Data Encryption Standard (DES) is a classic symmetric block cipher algorithm. DES was developed in the 1970’s as a US government standard The block.
Stream Ciphers 1 Stream Ciphers. Stream Ciphers 2 Stream Ciphers Generalization of one-time pad Trade provable security for practicality Stream.
Block Cipher Modes of Operation and Stream Ciphers
Session 6: Introduction to cryptanalysis part 1. Contents Problem definition Symmetric systems cryptanalysis Particularities of block ciphers cryptanalysis.
From Crypto-Theory to Crypto-Practice 1 CHAPTER 14: From Crypto-Theory to Crypto-Practice SHIFT REGISTERS The first practical approach to ONE-TIME PAD.
Cryptanalysis of the Stream Cipher DECIM Hongjun Wu and Bart Preneel Katholieke Universiteit Leuven ESAT/COSIC.
International Data Encryption Algorithm
Digital Kommunikationselektroink TNE027 Lecture 6 (Cryptography) 1 Cryptography Algorithms Symmetric and Asymmetric Cryptography Algorithms Data Stream.
Códigos y Criptografía Francisco Rodríguez Henríquez A Short Introduction to Stream Ciphers.
Lecture 23 Symmetric Encryption
Xiutao Feng Institute of Software Chinese Academy of Sciences A Byte-Based Guess and Determine Attack on SOSEMANUK.
ECE454/CS594 Computer and Network Security
Chapter 20 Symmetric Encryption and Message Confidentiality.
CS 483 – SD SECTION BY DR. DANIYAL ALGHAZZAWI (3) Information Security.
Lecture 5: Cryptographic Hashes
“Advanced Encryption Standard” & “Modes of Operation”
1 Introduction to Practical Cryptography Lectures 3/4 Stream Ciphers.
© 2017 SlidePlayer.com Inc. All rights reserved.