We think you have liked this presentation. If you wish to download it, please recommend it to your friends in any social system. Share buttons are a little bit lower. Thank you!
Presentation is loading. Please wait.
Published byMatthew Spencer
Modified over 2 years ago
1 KCipher-2 KDDI R&D Laboratories Inc.
©KDDI R&D Laboratories Inc. All rights Reserved. 2 Introduction LFSR-based stream ciphers Linear recurrence between internal states as a feedback polynomial. LFSR-based stream ciphers have been attacked using the linear recurrence. In KCipher-2, Dynamic Feedback Control mechanism is used for hiding the linear recurrence.
©KDDI R&D Laboratories Inc. All rights Reserved. 3 Design policy Security Produce sufficient period sequences Use different two functions (NLF, and Dynamic Feedback Control) Satisfy -bit key level security Performance Good Performance for Software implementation Consist of basic operations
©KDDI R&D Laboratories Inc. All rights Reserved. 4 Advantages of KCipher-2 Fast Encryption/Decryption KCipher-2 suits fast software implementations 128-bit keys are available Size of Internal State is Small The size is 640 bits Security Margin KCipher-2 is secure without the need for a DFC mechanism. The DFC mechanism is an extra security margin. Resistance against Existing Attacks NLF is designed in consideration of attacks on SNOW 2.0 such as an algebraic attack and a distinguishing attack.
©KDDI R&D Laboratories Inc. All rights Reserved. 5 Profile of K Key 128-bit IV 640-bit state 32-bit X 16 Registers (FSR-A, FSR-B) 32-bit X 4 Internal Memories for NLF 64-bit keystream per cycle Max cycle without re-initialization is 2^58 cycle (2^64 keystream bits) The algorithm was presented in SASC 2007 workshop (Jan. 2007) -> satisfy the maturity criteria
©KDDI R&D Laboratories Inc. All rights Reserved. 6 KCipher-2
©KDDI R&D Laboratories Inc. All rights Reserved. 7 Use Two Functions Non-Linear Function (NLF) and Dynamic Feedback Control (DFC) NLF Provide nonlinearity of output keystream Dynamic Feedback Control Hide Linear Recurrence of FSR-B
©KDDI R&D Laboratories Inc. All rights Reserved. 8 Dynamic Feedback Control Control coefficients for FSR-B Feedback (Clock) Controller 0, 1 2 bits of FSR-A
©KDDI R&D Laboratories Inc. All rights Reserved. 9 Dynamic Feedback Control (cont.) Performance Do not increase the cost significantly Only change a table of multiplying coefficients α_i. Security The attacker may need to guess control bits in some attacks such as Guess-and-Determine Attacks Algebraic Attacks Hide linear recurrence between internal states of FSR-B Effective for protecting against several attacks
©KDDI R&D Laboratories Inc. All rights Reserved. 10 Non-Linear Function Four 32-bit Substitution functions are used Connect Four internal Memories via the Substitution Functions Input six registers Output 64-bit keystream per cycle Well-evaluated structure (like SNOW) The number of S-Box is twice as that of SNOW
©KDDI R&D Laboratories Inc. All rights Reserved. 11 Non-Linear Function (2) Left Part and Right part of NLF is connected Produce double-length keystream Improve the security Left or right keystream is computed from previous memories of both sides. L2 L1R2 R1 Sub Substitution consists of well-evaluated S-boxes and a linear permutation (same as SNOW). Internal memories hide relation between registers and keystream. LFSR-A LFSR-B
©KDDI R&D Laboratories Inc. All rights Reserved. 12 Analysis of KCipher-2 Stream Cipher Periods The period is expected to be more than the periods of output of FSR-A Statistical Tests Evaluated output of FSR-A, FSR-B, and keystream These properties were good
©KDDI R&D Laboratories Inc. All rights Reserved. 13 Security against Existing Attacks Time-Memory trade off Lengths of IV and the secret keys are sufficiently large. Internal state is sufficiently larger than the secret key Correlation Attack No correlation that has large probability was found. Chosen/Related IV Attack The internal state is well mixed by the initialization process. Secure
©KDDI R&D Laboratories Inc. All rights Reserved. 14 Security against existing Attacks(2) Guess-and-Determine Attack In case of attacking FSR-B without multiplying α i (i=1,2,3) Assume that the attacker obtain values The attacker have to guess two registers and four memories to recover all registers of FSR-B. The complexity is O(2^196) However, the attacker have to guess at least two registers of FSR-A without the assumption. The attack is more than O(2^256) Dynamic feedback makes the attack more complicated. Secure
©KDDI R&D Laboratories Inc. All rights Reserved. 15 Security against Existing Attacks(3) Distinguishing Attack Secure The attacker have to use four mask values. (two masks for attacking SNOW 2.0) Sub consists of AES S- boxes; thus, it has a good linear property. We could not find a linear distinguisher with a feasible linear probability. Dynamic feedback prevents the attack
©KDDI R&D Laboratories Inc. All rights Reserved. 16 Security against Existing Attacks(4) Algebraic Attacks General evaluation results were good. A algebraic attack such as an attack on SNOW 2.0 is impossible, because; The attacker cannot obtain a linear equation of fixed values of keystream and registers. The attacker have to guess control bits of FSR-B. Secure
©KDDI R&D Laboratories Inc. All rights Reserved. 17 Performance Performance on Pentium4 3.2 GHz The algorithm consists of XOR, ADD, and Table lookups. Performances of these computation is expected to be independent against CPU types. Key. Gen.Init. Kcipher-2 (Optimal) 5.45 C/Byte1162 C/Init.
DES is a block cipher, as shown in Figure Overview Figure 6.1 Encryption and decryption with DES.
Secret Key Cryptography Nick Feamster CS 6262 Spring 2009.
1 DES The Data Encryption Standard (DES) is a classic symmetric block cipher algorithm. DES was developed in the 1970s as a US government standard The.
Security – Keys, Digital Signatures and Certificates I CS3517 Distributed Systems and Security Lecture 19.
© 2007 Levente Buttyán and Jean-Pierre Hubaux Security and Cooperation in Wireless Networks Appendix A: Introduction to cryptographic.
Md. Kamrul Hasan Assistant Professor and Chairman Computer and Communication Engineering Dept. Network Security.
Pseudo Random and Random Numbers Vivek Bhatnagar and Chaitanya Cheruvu.
1. Parallel Databases Introduction I/O Parallelism Interquery Parallelism Intraquery Parallelism Intraoperation Parallelism Interoperation Parallelism.
1 Chapter 11. Hash Tables. 2 Many applications require a dynamic set that supports only the dictionary operations, INSERT, SEARCH, and DELETE. Example:
ECE454/CS594 Computer and Network Security Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall 2011.
1 Built-in Self-test. 2 Introduction Test generation and response evaluation done on-chip. Only a few external pins to control BIST operation. Additional.
Block Cipher Modes of Operation and Stream Ciphers CSE 651: Introduction to Network Security.
Chapter 12: Indexing and Hashing Basic Concepts Ordered Indices B+-Tree Index Files B-Tree Index Files Static Hashing Dynamic Hashing Comparison of Ordered.
Analysis of Algorithms II The Recursive Case Except as otherwise noted, the content of this presentation is licensed under the Creative Commons Attribution.
L1. 1 Introduction to Algorithms 6.046J/18.401J LECTURE 1 Analysis of Algorithms Insertion sort Merge sort Prof. Charles E. Leiserson.
Chapter 8 Database Security and Authorization Copyright © 2004 Pearson Education, Inc.
Side-Channel Attacks on RSA with CRT Weakness of RSA Alexander Kozak Jared Vanderbeck.
© Negnevitsky, Pearson Education, Lecture 7 Artificial neural networks: Supervised learning Introduction, or how the brain works Introduction, or.
1 Lecture 2 ANALYSIS OF VARIANCE: AN INTRODUCTION.
Hashes and Message Digests Nick Feamster CS 6262: Network Security Spring 2009.
Satellite Link Design. Content Design of the Satellite Links Link Budget and their Interpretation.
Introduction to Hypothesis Testing. What is a Hypothesis Test? A hypothesis test is a statistical method that uses sample data to evaluate a hypothesis.
PARALLEL RANDOM NUMBER GENERATION Ahmet Duran CISC 879.
Chapter 13 Instruction-Level Parallelism and Superscalar Processors.
Comp 122, Spring 2004 Order Statistics. order - 2 Lin / Devi Comp 122 Order Statistic i th order statistic: i th smallest element of a set of n elements.
1 Copyright © 2012, Elsevier Inc. All rights reserved. Chapter 2 M EMORY H IERARCHY D ESIGN Computer Architecture A Quantitative Approach, Fifth Edition.
Chapter 14 Query Optimization. ©Silberschatz, Korth and Sudarshan14.2Database System Concepts 3 rd Edition Chapter 14: Query Optimization Introduction.
Silberschatz, Galvin, and Gagne Applied Operating System Concepts Module 14: Network Structures Background Motivation Topology Network Types.
Turing Machines January 2003 Part 2:. 2 TM Recap We have seen how an abstract TM can be built to implement any computable algorithm TM has components:
RISC Instruction Pipelines and Register Windows By: Andy Le CS147 – Dr. Sin-Min Lee San Jose State University, Fall 2003.
© 2016 SlidePlayer.com Inc. All rights reserved.