1. Session 6: Introduction to cryptanalysis part 1

2. Contents Problem definition Symmetric systems cryptanalysis Particularities of block ciphers cryptanalysis Asymmetric systems cryptanalysis

3. Problem definition A Plaintext KEY decipher decrypt Cryptanalysis Ciphertext encipher Plaintext KEY B

4. Problem definition The problem of cryptanalysis: Given some information related to the cryptosystem (at least the ciphertext), determine plaintext and/or the key. The goal of the designer is to make this problem as difficult as possible for the cryptanalyst.

5. Problem definition General assumption – all the details of the cryptosystem are known to the cryptanalyst. The only unknown is the key.

6. Problem definition Types of attack: Ciphertext-only attack Known plaintext attack Chosen plaintext attack Chosen ciphertext attack. The ciphertext-only attack is the most difficult one for the cryptanalyst (in general). The more information known to the cryptanalyst, the easier the attack.

7. Problem definition The “brute force attack” Elementary attack – no knowledge about cryptanalysis is necessary. Assumptions: The cryptosystem is known. The ciphertext is known. The goal: Determine the key/plaintext. The means: Trying all the possible keys.

8. Problem definition Complexity of the brute force attack: Extremely high, if there are many possible keys – impractical. Key space – the total number of keys possible in a cryptosystem.

9. Problem definition Examples of key space size: Key space – 40 bits 1  10 12 Key space – 56 bits (DES) 7  10 16 Key space – 128 bits 3  10 38 Key space – 256 bits 1  10 77 Number of 256-bit primes 1  10 72 Age of the Sun in seconds 1  10 16 Number of clock pulses of a 3GHz computer clock through the Sun’s age 5.4  10 26

10. Problem definition A cryptosystem’s security is ultimately determined by the size of its key space. However, this is the upper limit of this security measure. There may be a problem in the system design that may cause a significant reduction of the effective key space. The task of the cryptanalyst – to find this pitfall and to use it to attack the system.

11. Symmetric systems Basic attack methods against stream and block ciphers: Algebraic Statistical Algebraic attack: The key symbols (e.g. bits) are the unknowns in the system of equations assigned to the PRNG.

12. Symmetric systems Algebraic attack (cont.): Given all the details of the PRNG to be cryptanalyzed (except the key bits), determine the system of equations that relates the bits of the output sequence with the bits of the key. The designer’s goal: To make this system as non-linear as possible. The reason: non-linear systems are difficult to solve – there is no general method other than trying all the possible values of the variables: 2 n possibilities for a system with n variables.

13. Symmetric systems The problem of solving a non-linear system in GF(2) – the satisfiability problem (SAT). Cook’s theorem (1971): SAT is NP-complete However, some instances of the SAT problem may be easier to solve. The designer should check the system assigned to the PRNG.

14. Symmetric systems Example: consider the PRNG below:

15. Symmetric systems The system of equations: (1) y 1 =(x 1 +x 4 )(x 5 +x 7 )= =x 1 x 5 +x 1 x 7 +x 4 x 5 +x 4 x 7 (2) y 2 =(x 1 +x 4 +x 3 )(x 5 +x 7 +x 6 )= =x 1 x 5 +x 1 x 7 +x 1 x 6 +x 4 x 5 +x 4 x 7 +x 4 x 6 + +x 3 x 5 +x 3 x 7 +x 3 x 6 … (we need 7 independent equations)

16. Symmetric systems Methods of solving the system: The brute force method: try all the possible 2 7 -1 solutions (all zeros are not permitted). The linearization method: Replace all the products by new variables Solve the obtained linear system (e.g. by Gaussian algorithm) Try to guess the variables that were included in the products, given the values of the new variables, in such a way that the overall system is consistent.

17. Symmetric systems Example (cont.) y 1 =z 1 +z 2 +z 3 +z 4 y 2 =z 1 +z 2 +z 5 +z 3 +z 4 +z 6 +z 7 +z 8 +z 9 …

18. Symmetric systems There are many other methods of solving systems assigned to PRNGs: Linear consistency test (LCT) Methods of computational commutative algebra (Groebner bases etc.) etc. Cryptanalysis of a seriously designed system always includes search.

19. Symmetric systems Statistical methods In the previous example, the majority of the output symbols will be zero, due to the AND combining function. The non-linearity of the assigned system of equations is the highest possible. However, it is possible to make use of bad statistical properties of the output sequence to determine the plaintext sequence.

20. Symmetric systems Example: With the AND output combiner, the probability of zero in the output sequence will be ¾. This means that, upon enciphering with this sequence as the keystream, the probability that the plaintext bit is equal to the ciphertext bit is ¾. Consequence – easy reconstruction of the plaintext.

21. Symmetric systems Correlation – The output sequence coincides too much with one or more internal sequences – this enables correlation attacks – a kind of statistical attack. Correlation attacks: It is possible to divide the task of the cryptanalyst into several less difficult tasks – “Divide and conquer”.

22. Symmetric systems F balanced – good statistical properties Typical example – the Geffe’s generator

23. Symmetric systems Problem: Correlation!

24. Symmetric systems Since the output sequence is correlated with both input sequences, we can independently guess the input sequences’ bits with high probability if the output sequence is known.

25. Two most important attacks against block ciphers: Linear cryptanalysis Differential cryptanalysis Modern block ciphers are designed in such a way that these attacks have no chance of success (Rijndael, Kasumi, etc.) Symmetric systems

26. Linear cryptanalysis Known plaintext attack the cryptanalyst has a set of plaintexts and the corresponding ciphertexts The cryptanalyst has no way of guessing which plaintext and the corresponding ciphertext were used.

27. Symmetric systems Linear cryptanalysis tries to take advantage of high probability occurrences of linear expressions involving plaintext bits, ciphertext bits (or round output bits) and subkey bits. The basic idea is to approximate the operation of a portion of the cipher with a linear expression. The approach is to determine such expressions with high or low probability of occurrence.

28. Symmetric systems Example: Here, i and j are the numbers of the rounds from which the bits of the input vector X and the output vector Y are taken, respectively. u bits from the vector X and v bits from the vector Y are taken.

29. Symmetric systems If a block cipher displays a tendency for such linear equations to hold with a probability much higher (or much lower) than ½, this is evidence of the cipher’s poor randomization abilities. The deviation (bias) from the probability of ½ for such an expression to hold is exploited in linear cryptanalysis. This deviation is denominated linear probability bias.

30. Symmetric systems Denominate the probability that the equation holds with p L. The higher the magnitude of the probability bias  p L -1/2 , the better the applicability of linear cryptanalysis with fewer known plaintexts required in the attack. p L =1 catastrophic weakness – there is always a linear relation in the cipher. p L =0 catastrophic weakness – there is an affine relationship in the cipher (a complement of a linear relationship).

31. Symmetric systems Consider two random variables, X 1 and X 2. X 1  X 2 =0 a linear expression – equivalent to X 1 =X 2. X 1  X 2 =1 an affine expression – equivalent to X 1  X 2. Assume the following probability distributions:

32. Symmetric systems If X 1 and X 2 are independent, then

33. Symmetric systems It can be shown that

34. Symmetric systems With probability bias introduced p 1 =1/2+  1 p 2 =1/2+  2 -1/2   1,  2  1/2 we have

35. Extension to n random binary variables – the piling-up lemma – Matsui, 1993 For n independent random binary variables, X 1, X 2, …, X n or equivalently Symmetric systems

36. If p i =0 or 1 for all i, then or 1. If only one p i =1/2, then In developing the linear approximation of a cipher, the X i values actually represent linear approximations of the S-boxes.

37. Symmetric systems Example: Four random binary variables, X 1, X 2, X 3 and X 4. Let and Let us derive the expression for the sum of X 1 and X 3 by adding

38. Symmetric ciphers Since we may consider X 1  X 2 and X 2  X 3 to be independent, we can use the piling-up lemma to determine and consequently

39. Symmetric systems The expressions X 1  X 2 =0 and X 2  X 3 =0 are analogous to linear approximations of S-boxes The expression X 1  X 3 =0 is analogous to a cipher approximation where the intermediate bit X 2 is eliminated. A real analysis is much more complex, involving many S-box approximations.