LINEAR CRYPTANALYSIS

Samed Bajric

UNIVERSITY OF PRIMORSKA

FAMNIT

06. June 2011.

Outline

1 Introduction

A Quick Review of DES

Linear Cryptanalysis

2 Mathematical Framework

Substitution - Permutation Network

Linear Attack on SPN

3 Conclusion

Introduction

Data Encryption Standard (DES)-history

The most famous and analyzed block cipher -international banking standard

Design criteria were kept secret (including differentialcryptanalysis) for more than 20 years

Based on IBM’s LUCIFER but changes introduced by NSA

Still no trapdoors have been found

Introduction

DES Algorithm

Block length 64 bits, key length 56 bits

Introduction

Linear Attack on DES idea

In DES S-box maps 6 input bits to 4 output bits i.e.,

S : F 62 → F 4

2 , where F2 = {0, 1}

(x1, ..., x6)→ (y1, ..., y4)

Assume,

y1 = x1x2x3 + x2x5 + x2 + x4

y2 = x1x2x3 + x2x5 + x1 + x4

⇒ y1 ⊕ y2 = x1 ⊕ x2

Introduction

Specifically, if Pi are plaintext bits, Ci are ciphertext bits, and Ki

are subkey bits, then we wish to find an expression of the form

Pi1 ⊕ Pi2 ⊕ ...Pij ⊕ Ci1 ⊕ Ci2 ⊕ ...Cik = Ki1 ⊕Ki2 ⊕ ...Kim

such that this expression has a high or low probability ofoccurrence.

No such obvious expression should exist, otherwise the cipher istrivially weak. If we were to randomly select bits for the aboveexpression, it would hold exactly 1

2 the time.

Definition

For a given linear approximation to part of a cipher, let p be theprobability that it holds. We refer to |p − 1

2 | as the bias of theapproximation.

Introduction

2 the time.

Definition

Introduction

2 the time.

Definition

Reducing DES

Let us simplify DES by

Reducing the code lengthfrom 64 to 16

Removing expansionfunction E(R)Taking identical S-boxesof size 4 bits

Repeating over lessrounds

Reducing DES

Let us simplify DES by

Reducing the code lengthfrom 64 to 16

Removing expansionfunction E(R)Taking identical S-boxesof size 4 bits

Repeating over lessrounds

SPN is a 16-bit block cipher

Each round consists of asubstitution and a permutation

4× 4-bit S-box

key-mixing by XOR-ing

SPN S-box and Permutation

SPN uses a single 4-bit S-Box that has the following structure:

input 0 1 2 3 4 5 6 7 8 9 A B C D E Foutput E 4 D 1 2 F B 8 3 A 6 C 5 9 0 7

And the following 16-bit permutation:

input 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16output 1 5 9 13 2 6 10 14 3 7 11 15 4 8 12 16

The S-Box provides the confusion function and the permutationimplements the diffusion operation in SPN, thus making itcryptographically similar to DES.

input 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16output 1 5 9 13 2 6 10 14 3 7 11 15 4 8 12 16

Linear and Affine approximation of S-Box

Question:How do we come up with the desired expression for the entirecipher?

We start by looking at the only non-linear component, the S-Box.

To find the linear or affine approximation of the S-Box we simplyconsider every possible expression of the input bits Xi and outputbits Yj . Thus the expression has the form⊕

Xi =⊕j∈V

where U and V range over all possible subsets of {1, 2, 3, 4}. Wethen compare how often this expression coincides with the S-Box.

Xi =⊕j∈V

The number of agreements (minus 8) between the S-Box and everypossible expression is summarized in the table below. Thus to getthe bias, one must only divide by 16.

S-Box Approximation Example

We can take thefollowing expression asan example:

X2 ⊕X3 = Y1 ⊕ Y3 ⊕ Y4

Applying all possible values for the input X bits it turns out thatthe expression holds in 12 out of the 16 cases. Hence, thisexpression has a bias of 12

16 −12 = 1

X2 ⊕X3 = Y1 ⊕ Y3 ⊕ Y4

16 −12 = 1

X2 ⊕X3 = Y1 ⊕ Y3 ⊕ Y4

16 −12 = 1

What this means for 1 round

Note, from the previous table, thatthe expression X1 ⊕X3 ⊕X4 = Y2

has a bias of +14

Note also that U15 = P5 ⊕K1

has a bias of +14

We can now write down the following linear approximation acrossthe 1st round of SPN:

V 16 = U1

5 ⊕ U17 ⊕ U1

= (P5⊕K15 )⊕(P7⊕K1

7 )⊕(P8⊕K18 )

This expression holds with probabilityof 3

4 (bias of +14)

We can get expressions that hold with some non-12 probability for

every round. But we must somehow combine them to write anexpression relating the plaintext and ciphertext bits.

We use thePiling Up Lemma for this purpose.

Piling - Up Lemma

For n independent, random binary variables X1, X2, ..., Xn,

Pr(X1 ⊕X2 ⊕ ...⊕Xn = 0) =12

+ 2n−1n∏

or, equivalently,

ε1,2,...,n = 2n−1n∏

where ε1,2,...,n represents the bias of X1 ⊕X2 ⊕ ...⊕Xn = 0

every round. But we must somehow combine them to write anexpression relating the plaintext and ciphertext bits. We use thePiling Up Lemma for this purpose.

Piling - Up Lemma

Pr(X1 ⊕X2 ⊕ ...⊕Xn = 0) =12

+ 2n−1n∏

or, equivalently,

ε1,2,...,n = 2n−1n∏

every round. But we must somehow combine them to write anexpression relating the plaintext and ciphertext bits. We use thePiling Up Lemma for this purpose.

Piling - Up Lemma

Pr(X1 ⊕X2 ⊕ ...⊕Xn = 0) =12

+ 2n−1n∏

or, equivalently,

ε1,2,...,n = 2n−1n∏

We can write down 4 approximations

S12 : X1 ⊕X3 ⊕X4 = Y2

S22 : X2 = Y2 ⊕ Y4

S32 : X2 = Y2 ⊕ Y4

S34 : X2 = Y2 ⊕ Y4

Each of these has a probability biasmagnitude of 1

S12 : X1 ⊕X3 ⊕X4 = Y2

S22 : X2 = Y2 ⊕ Y4

S32 : X2 = Y2 ⊕ Y4

S34 : X2 = Y2 ⊕ Y4

S12 : X1 ⊕X3 ⊕X4 = Y2

S22 : X2 = Y2 ⊕ Y4

S32 : X2 = Y2 ⊕ Y4

S34 : X2 = Y2 ⊕ Y4

Consider the first 2 rounds:

X1 ⊕X3 ⊕X4 = Y2

⇒ (P5 ⊕K15 )⊕ (P7 ⊕K1

7 )⊕ (P8 ⊕K18 ) = V 1

X2 = Y2 ⊕ Y4 ⇒ (V 16 ⊕K2

6 = V 26 ⊕ V 2

Each of these has a bias of magnitude 14 and we can combine to

obtain:

V 26 ⊕ V 2

8 ⊕ P5 ⊕ P7 ⊕ P8 ⊕K15 ⊕K1

7 ⊕K18 ⊕K2

By the Piling Up Lemma this holds with bias

2 · 14· 14

Consider the first 2 rounds:

X1 ⊕X3 ⊕X4 = Y2

⇒ (P5 ⊕K15 )⊕ (P7 ⊕K1

7 )⊕ (P8 ⊕K18 ) = V 1

X2 = Y2 ⊕ Y4 ⇒ (V 16 ⊕K2

6 = V 26 ⊕ V 2

Each of these has a bias of magnitude 14 and we can combine to

obtain:

V 26 ⊕ V 2

8 ⊕ P5 ⊕ P7 ⊕ P8 ⊕K15 ⊕K1

7 ⊕K18 ⊕K2

By the Piling Up Lemma this holds with bias

2 · 14· 14

Using this principle we can write the following equation over 3rounds of SPN:

U46 ⊕ U4

8 ⊕ U414 ⊕ U4

16 ⊕ P5 ⊕ P7 ⊕ P8 = K

WhereK = K1

5 ⊕K17 ⊕K1

8 ⊕K26 ⊕K3

6 ⊕K314 ⊕K4

6 ⊕K48 ⊕K4

14 ⊕K416.

Note that since the key is fixed, K = 0 or 1 and thus we canignore it since we only care about the bias.

The magnitude of the bias of the above expression, by the PilingUp Lemma, is 1

Using this principle we can write the following equation over 3rounds of SPN:

U46 ⊕ U4

8 ⊕ U414 ⊕ U4

16 ⊕ P5 ⊕ P7 ⊕ P8 = K

WhereK = K1

5 ⊕K17 ⊕K1

8 ⊕K26 ⊕K3

6 ⊕K314 ⊕K4

6 ⊕K48 ⊕K4

14 ⊕K416.

Note that since the key is fixed, K = 0 or 1 and thus we canignore it since we only care about the bias.

The magnitude of the bias of the above expression, by the PilingUp Lemma, is 1

Extracting Key Bits

We can partially undo the last round by guessing the last key.

If we guess correctly, the equation will hold with high bias. If weguess wrong, the equation will probably hold with probability closeto 1

2 , that is, a bias close to 0.

BUT to do this, we don’t need to guess the entire key for the lastround! Our expression only involves 4 fourth round input (U4) bits,output from 2 S-Boxes of the third round. Thus we only need toguess 28 = 256 values, instead 216 = 65546, which is hugedifference.

For each value of the guessed target partial subkey we can undothe last round and determine the bias of the equation. Highestbias indicates likely correct guess.

Extracting Key Bits

Conclusion

One might say that 8 bits of the last round key is not veryuseful

How many plaintext/ciphertext pairs do we need to make thisattack?

Conclusion

Thank you for your Attention!

LINEAR CRYPTANALYSIS

Documents

UNIT-I Q.1 Explain Differential And Linear Cryptanalysis ... · 11/7/2019 · Q.1 Explain Differential And Linear Cryptanalysis Of DES. Ans: The Data Encryption Standard (DES) is

Linear cryptanalysis method for DES ciphermath.boisestate.edu/~liljanab/Math509Spring10/matsui_des.pdf · Title: Linear cryptanalysis method for DES cipher Author: Matsui, M. Subject:

Linear Cryptanalysis of DES M. Matsui. 1.Linear Cryptanalysis Method for DES Cipher. EUROCRYPT 93, 1994.Linear Cryptanalysis Method for DES Cipher 2.The

On Multidimensional Linear Cryptanalysisweil0005/OMLC_ACISP10.pdfMotivation Multidimensional Extension to Matsui’s Alg. 1 Cryptanalysis and Conclusions On Multidimensional Linear

Evaluation of Differential Linear Cryptanalysis Combined ... · cryptographic security system, combined attack. has been implemented in 1. INTRODUCTION. Cryptanalysis is a discipline

"Zero-Correlation Linear Cryptanalysis with Reduced Data ...anbog/fse12-zerocorrelation.pdf · Zero Correlation Linear Cryptanalysis with Reduced Data Complexity Andrey Bogdanov 1

Cryptanalysis of stream ciphers with linear masking · Cryptanalysis of stream ciphers with linear masking ... This framework can be applied to many ciphers, and for those ciphers

Differential and Linear Cryptanalysis - Radboud … and...Diﬀerential cryptanalysis Linear cryptanalysis Diﬀerential and Linear Cryptanalysis Lars R. Knudsen June 2014 L.R. Knudsen

Experimenting Linear Cryptanalysis

Multidimensional Zero-Correlation Linear Cryptanalysis of ...cadams/papers/prepro/paper_23.pdf · Multidimensional Zero-Correlation Linear Cryptanalysis of Reduced Round SPARX-128

Linear cryptanalysis method for DES cipher - BGUbeimel/Courses/crypto2001/Matsui.pdf · Title: Linear cryptanalysis method for DES cipher Author: Matsui, M. Subject: Advances in Cryptology

New Links Between Differential and Linear Cryptanalysisusers.ics.aalto.fi/blondeau/PDF/EUROCRYPT2013-Slide.pdfNew Links Between Differential and Linear Cryptanalysis Celine Blondeau

Linear Cryptanalysis of DES - Pascal Junod Abstract The main goal of this diploma work is the implementation of Matsui’s linear cryptanalysis of DES and a statistical and theoretical

Linear Cryptanalysis Using Multiple Linear Approximations · Miia HERMELINa, Kaisa NYBERGb a Finnish Defence Forces b Aalto University School of Science and Nokia Abstract. In this

Improved Integral and Zero-correlation Linear Cryptanalysis of … · 2016. 2. 17. · Improved Integral and Zero-correlation Linear Cryptanalysis of Reduced-round CLEFIA Block Cipher

Feistel Schemes and Bi-Linear Cryptanalysis Schemes and Bi-Linear Cryptanalysis? (Long extended version of Crypto 2004 paper) Nicolas T. Courtois Axalto Smart Cards Crypto Research,

Di erential-Linear Cryptanalysis Revisited erential-Linear Cryptanalysis Revisited C eline Blondeau 1and Gregor Leander2?and Kaisa Nyberg 1 Department of Information and Computer Science,

Linear Cryptanalysis: Key Schedules and Tweakable Block ... · ThorstenKranz,GregorLeanderandFriedrichWiemer 3 butwefeelthatitdidnotgettheattentionitdeserves. Tosupportthegeneralunderstanding,wedeveloptheFouriercoeﬃcientofthelinear

Cryptanalysis of Modern Symmetric-Key Block Ciphersib/Classes/CS482-705_Winter10-11/Slides/...Cryptanalysis of Modern Symmetric-Key Block Ciphers [Based on “A Tutorial on Linear

Linear Cryptanalysis Method for DES Cipher...Linear Cryptanalysis Method for DES Cipher Mitsuru Matsui Computer & Information Systems Laboratory Mitsubishi Electric Corporation 5-1-1,