Cryptanalysis of Haraka
|
|
|
- Marshall Carson
- 6 years ago
- Views:
Transcription
1 Cryptanalysis of Haraka Jérémy Jean Agence Nationale de la Sécurité des Systèmes d Information Crypto Laboratory FSE Tokyo, Japan March 6, 2017 Jeremy.Jean@ssi.gouv.fr
2 Introduction Let n be a positive integer (typically, n 128, n 160 or n 256) General Hash Function Securely hashes any string to a fixed-width n-bit string h n Required security levels: (Second) preimage resistance: n bits Collision resistance: n 2 bits Examples: SHA-2, SHA-3, etc. Hash Function for Hash-Based Signature Schemes Why? Used in a few schemes for PQ crypto: e.g., Lamport [Lam79], XMSS [BDH11], SPHINCS [BHH 15] One pair of short-input hash functions: h n 0 1 n 0 1 n and h 2n 0 1 2n 0 1 n Only required security: n-bit (second) preimage resistance Example: Haraka (n 256) No collision resistance: non-trivial to adapt usual design strategies to drop this security requirement 1/14 Jérémy Jean (ANSSI) / Cryptanalysis of Haraka March 6, 2017
3 Specifications of Haraka: High-Level Overview Haraka: Two Functions Haraka-256/ and: Haraka-512/ Haraka-256/256 Internal state: 256 bits Davies-Meyer mode Inner permutation: 256 Output size: 256 bits Haraka-512/256 Internal state: 512 bits Davies-Meyer mode Inner permutation: 512 Output size: 256 bits Final truncation m (m) m Claimed Security 256-bit preimage security Stronger Haraka variant: 128-bit collision security [Broken] [Broken] 2/14 Jérémy Jean (ANSSI) / Cryptanalysis of Haraka March 6, 2017
4 Haraka-256/256 Inner Permutation 256 Internal state: 2 AES states Repeat 5 steps (i 0 4): Apply 1R AES on each state w/ key RC 2i Apply 1R AES on each state w/ key RC 2i 1 Permute the AES columns (mix) Final Davies-Meyer feed-forward Claimed Security Preimage resistance: #steps: 5 Security level: 256 bits One step of 256 A A RC 2i RC 2i A A RC 2i+1 RC 2i+1 Collision resistance: #steps: 6 (stronger) Security level: 128 bits 3/14 Jérémy Jean (ANSSI) / Cryptanalysis of Haraka March 6, 2017
5 Haraka-512/256 Inner Permutation 512 Same principle as 256 Final truncation to produce 256 bits Claimed Security Preimage resistance: #steps: 5 Security level: 256 bits One step of 512 A A A A RC 2i RC 2i RC 2i RC 2i A A A A RC 2i+1 RC 2i+1 RC 2i+1 RC 2i+1 Collision resistance: #steps: 6 (stronger) Security level: 128 bits Final Truncation: Remove 8 out of 16 AES columns c 0 c 1 c 2 c 3 c 4 c 5 c 6 c 7 c 8 c 9 c 10 c 11 c 12 c 13 c 14 c 15 4/14 Jérémy Jean (ANSSI) / Cryptanalysis of Haraka March 6, 2017
6 Haraka Round Constants Highly Structured Round Constants The 128-bit round constant RC i verifies: RC i = c i c i c i c i where 32-bit c i has one bit at Position i. RC RC RC Spoiler Alert The attacks proposed in this talk rely on this structure 5/14 Jérémy Jean (ANSSI) / Cryptanalysis of Haraka March 6, 2017
7 Symmetries in the Keyless AES Round Function A Classes of Size 2 64 and 2 32 (used in the collision attack) A symmetric state with two equal halves stays symmetric after A: SB SR MC L L L 0 L 0 L 00 L 00 L 000 L 000 A state with four equal columns is called strongly symmetric Pairs of States with Swapped Halves (used in the preimage attack) Let S 1 S 2 be a pair of AES states with swapped halves, then A S 1 and A S 2 also have swapped halves S 1 = L R SB L 0 R 0 SR MC L00 R 00 = A(S 1 ) S 2 = R L SB R 0 L 0 SR MC R00 L 00 = A(S 2 ) 6/14 Jérémy Jean (ANSSI) / Cryptanalysis of Haraka March 6, 2017
8 Collision Attack on Haraka General Idea The strongly symmetric property propagates in all the Haraka components since the round constants are strongly symmetric Details for Haraka-256/256 Input: 2 AES strongly symmetric states Then, in each step: Keyless AES maintains the property Constant addition as well Column reordering becomes identity Davies-Meyer feedforward keeps symmetry Hence, all output columns are equal Symmetric States x x x x x x x x A A RC 2i RC 2i A A RC 2i+1 RC 2i+1 y y y y y y y y Notes Enough to collide on a 32-bit column Collisions after about 2 16 evaluations y y y y y y y y Same cost for Haraka-512/256 7/14 Jérémy Jean (ANSSI) / Cryptanalysis of Haraka March 6, 2017
9 Preimage Attack on Haraka-512/256 Preimage Problem Detail and Idea Given y the 256-bit preimage challenge, find one 512-bit x such that Haraka-512/256 x y About solutions rely on symmetry to reduce this Problem too constrained for Haraka-256/ bit x RC 2i RC 2i RC 2i RC 2i RC 2i+1 RC 2i+1 RC 2i+1 RC 2i+1 5 mix 8/ bit y March 6, 2017
10 A 3-Step Symmetry Class for 512 Step Step Step c 0 c 1 c 2 c 3 c 4 c 5 c 6 c 7 c 6 c 7 c 4 c 5 c 2 c 3 c 0 c 1 c 0 0 c 0 1 c 0 2 c 0 3 c 0 4 c 0 5 c 0 6 c 0 7 c 0 2 c 0 3 c 0 0 c 0 1 c 0 6 c 0 7 c 0 4 c 0 5 c 00 0 c 00 1 c 00 2 c 00 3 c 00 4 c 00 5 c 00 6 c 00 7 c 00 0 c 00 1 c 00 2 c 00 3 c 00 4 c 00 5 c 00 6 c Notes Each variable is a 32-bit AES column Symmetry class extended from the one with swapped halves on AES Rely on the structure of the mix column permutation Size: states following the 3-step symmetry Constrained problem: if we force the preimage to go through these 3 rounds, only one solution expected 9/14 Jérémy Jean (ANSSI) / Cryptanalysis of Haraka March 6, 2017
11 Preimage Attack Strategy I Step 1 Step 2 Step 3 Step 4 Step c 0 c 1 c 2 c 3 c 4 c 5 c 6 c 7 c 6 c 7 c 4 c 5 c 2 c 3 c 0 c 1 c 0 0 c 0 1 c 0 2 c 0 3 c 0 4 c 0 5 c 0 6 c 0 7 c 0 2 c 0 3 c 0 0 c 0 1 c 0 6 c 0 7 c 0 4 c 0 5 c 00 0 c 00 1 c 00 2 c 00 3 c 00 4 c 00 5 c 00 6 c 00 7 c 00 0 c 00 1 c 00 2 c 00 3 c 00 4 c 00 5 c 00 6 c Preimage challenge y: Truncate x 3 6 x 7 8 x 9 12 x 13 Notes If the last 3 steps follow the symmetry about 1 preimage for y The challenge fixes 128 bits of the 256-bit symmetry freedom Hence, if an algorithm can enumerate the possible input states in less than operations, it is a preimage attack. 10/14 Jérémy Jean (ANSSI) / Cryptanalysis of Haraka March 6, 2017
12 Preimage Attack Strategy II Step 1 Step 2 Step 3 Step 4 Step c 0 c 1 c 2 c 3 c 4 c 5 c 6 c 7 c 6 c 7 c 4 c 5 c 2 c 3 c 0 c 1 c 0 0 c 0 1 c 0 2 c 0 3 c 0 4 c 0 5 c 0 6 c 0 7 c 0 2 c 0 3 c 0 0 c 0 1 c 0 6 c 0 7 c 0 4 c 0 5 c 00 0 c 00 1 c 00 2 c 00 3 c 00 4 c 00 5 c 00 6 c 00 7 c 00 0 c 00 1 c 00 2 c 00 3 c 00 4 c 00 5 c 00 6 c Preimage challenge y: Truncate x 3 6 x 7 8 x 9 12 x 13 Towards an Enumeration Algorithm in Operations Focus on the steps not covered by the symmetry Step 2 partially inverted (formally) Reduction to an attack on 3-round AES with partial information on the input 11/14 Jérémy Jean (ANSSI) / Cryptanalysis of Haraka March 6, 2017
13 Preimage Attack: Enumeration Algorithm Algorithm (simplified) Due to symmetry in last 3 steps at most values for all at most values for all For all values of Each of the 4 inputs states can only assume values (32- and 64-bit constraints) For each State i 0 3, store the 2 32 states in list L i For all in L 0 L 1, store partial in L 01 For all in L 2 L 3, store partial in L 23 About 1 collision between L 01 and L 23 one preimage candidate About candidates generated in about operations Known Known Known Known A A A A RC 0 RC0 RC0 RC0 A A A A RC 1 RC1 RC1 RC1 RC1 A A A A RC 2 RC2 RC2 RC2 RC2 12/14 Jérémy Jean (ANSSI) / Cryptanalysis of Haraka March 6, 2017
14 Preimage Attack on Haraka-512/256: Wrapping Up Preimage Algorithm Rely on the 3-step 256-bit symmetry class The challenge y fixes 128 bits of the 256-bit of symmetry freedom Generate preimage candidates in operations Filter them to verify the remaining 128 bits of the preimage challenge Conclusion One preimage is found in about function evaluations, 2 64 times faster than exhaustive search 13/14 Jérémy Jean (ANSSI) / Cryptanalysis of Haraka March 6, 2017
15 Conclusion Attacks Collision attack Complexity: 2 16 evaluations Break 128-bit claimed security Apply to any number of steps Preimage attack Only works for Haraka-512/256 Complexity: function evaluations, 2 64 memory Break 256-bit claimed security Final Remarks All attacks rely on a bad choice of round constant Designs very easy to patch Haraka v2 (see talk on Tuesday) 14/14 Jérémy Jean (ANSSI) / Cryptanalysis of Haraka March 6, 2017
16 Conclusion Attacks Collision attack Complexity: 2 16 evaluations Break 128-bit claimed security Apply to any number of steps Preimage attack Only works for Haraka-512/256 Complexity: function evaluations, 2 64 memory Break 256-bit claimed security Final Remarks All attacks rely on a bad choice of round constant Designs very easy to patch Haraka v2 (see talk on Tuesday) Thank you for your attention! 14/14 Jérémy Jean (ANSSI) / Cryptanalysis of Haraka March 6, 2017
Observations and Attacks On The SHA-3 Candidate Blender
Observations and Attacks On The SHA-3 Candidate Blender Craig Newbold cjnewbold@googlemail.com Abstract 51 candidates have been accepted as first round candidates in NIST s SHA-3 competition, to decide
The Grindahl hash functions
The Grindahl hash functions Søren S. Thomsen joint work with Lars R. Knudsen Christian Rechberger Fast Software Encryption March 26 28, 2007 Luxembourg 1/ 17 1 Introduction 2 Grindahl 3 Design considerations
Vortex: A New Family of One-way Hash Functions Based on AES Rounds and Carry-less Multiplication
Vortex: A New Family of One-way Hash Functions Based on AES Rounds and Carry-less ultiplication Shay Gueron 2, 3, 4 and ichael E. Kounavis 1 1 Corresponding author, Corporate Technology Group, Intel Corporation,
H must be collision (2n/2 function calls), 2nd-preimage (2n function calls) and preimage resistant (2n function calls)
What is a hash function? mapping of: {0, 1} {0, 1} n H must be collision (2n/2 function calls), 2nd-preimage (2n function calls) and preimage resistant (2n function calls) The Merkle-Damgård algorithm
Security Analysis of Extended Sponge Functions. Thomas Peyrin
Security Analysis of Extended Sponge Functions Hash functions in cryptology: theory and practice Leiden, Netherlands Orange Labs University of Versailles June 4, 2008 Outline 1 The Extended Sponge Functions
Security Enhancement of the Vortex Family of Hash Functions
Security Enhancement of the Vortex Family of Hash Functions Shay Gueron 1,2 and ichael Kounavis 3 1 obility Group, Intel Corporation 2 University of Haifa, Israel 3 Intel Labs, Circuits and Systems Research
Finding Second Preimages of Short Messages for Hamsi-256
Finding Second Preimages of Short Messages for Hamsi-256 Thomas Fuhr ANSSI, Paris, France and TELECOM-ParisTech, Paris, France thomas.fuhr@ssi.gouv.fr Abstract. In this paper we study the second preimage
Semi-free start collision attack on Blender
Semi-free start collision attack on Blender Xu Liangyu and Li Ji Sony China Research Laboratory {Liangyu.Xu, Ji.Li}@sony.com.cn Abstract. Blender is a cryptographic hash function submitted to NIST s SHA3
CRYPTANALYSIS AGAINST SYMMETRIC- KEY SCHEMES WITH ONLINE CLASSICAL QUERIES AND OFFLINE QUANTUM COMPUTATIONS
#RSAC SESSION ID: CRYP-W14 CRYPTANALYSIS AGAINST SYMMETRIC- KEY SCHEMES WITH ONLINE CLASSICAL QUERIES AND OFFLINE QUANTUM COMPUTATIONS Akinori Hosoyamada Researcher NTT Secure Platform Laboratories Cryptanalysis
First practical results on reduced-round Keccak Unaligned rebound attack. María Naya-Plasencia INRIA Paris-Rocquencourt, France
First practical results on reduced-round Keccak Unaligned rebound attack María Naya-Plasencia INRIA Paris-Rocquencourt, France Outline Introduction First Practical Results [NP-Röck-Meier11] CP-Kernel:
Cryptographic Hash Functions
ECE458 Winter 2013 Cryptographic Hash Functions Dan Boneh (Mods by Vijay Ganesh) Previous Lectures: What we have covered so far in cryptography! One-time Pad! Definition of perfect security! Block and
Keccak discussion. Soham Sadhu. January 9, 2012
Keccak discussion Soham Sadhu January 9, 2012 Keccak (pronounced like Ketchak ) is a cryptographic hash function designed by Guido Bertoni, Joan Daemen, Michaël Peeters and Gilles Van Assche. Keccak is
PQ-Crypto Standardization Preparing today for the future of cryptography
PQ-Crypto Standardization Preparing today for the future of cryptography Workshop Quantum-Safe Cryptography for Industry (QsCI) Aline Gouget Principal researcher, Advanced Cryptography team Manager Embedded
Course Business. Midterm is on March 1. Final Exam is Monday, May 1 (7 PM) Allowed to bring one index card (double sided) Location: Right here
Course Business Midterm is on March 1 Allowed to bring one index card (double sided) Final Exam is Monday, May 1 (7 PM) Location: Right here 1 Cryptography CS 555 Topic 18: AES, Differential Cryptanalysis,
Attacks on Advanced Encryption Standard: Results and Perspectives
Attacks on Advanced Encryption Standard: Results and Perspectives Dmitry Microsoft Research 29 February 2012 Design Cryptanalysis history Advanced Encryption Standard Design Cryptanalysis history AES 2
Syrvey on block ciphers
Syrvey on block ciphers Anna Rimoldi Department of Mathematics - University of Trento BunnyTn 2012 A. Rimoldi (Univ. Trento) Survey on block ciphers 12 March 2012 1 / 21 Symmetric Key Cryptosystem M-Source
Improved (Pseudo) Preimage Attack and Second Preimage Attack on Round-Reduced Grøstl Hash Function *
JOURNAL OF INFORMATION SCIENCE AND ENGINEERING 30, 1789-1806 (014) Improved (Pseudo) Preimage Attack and Second Preimage Attack on Round-Reduced Grøstl Hash Function * JIAN ZOU 1,, WENLING WU 1, SHUANG
Block Ciphers Introduction
Technicalities Block Models Block Ciphers Introduction Orr Dunkelman Computer Science Department University of Haifa, Israel March 10th, 2013 Orr Dunkelman Cryptanalysis of Block Ciphers Seminar Introduction
Differential Cryptanalysis
Differential Cryptanalysis See: Biham and Shamir, Differential Cryptanalysis of the Data Encryption Standard, Springer Verlag, 1993. c Eli Biham - March, 28 th, 2012 1 Differential Cryptanalysis The Data
Lecture 1 Applied Cryptography (Part 1)
Lecture 1 Applied Cryptography (Part 1) Patrick P. C. Lee Tsinghua Summer Course 2010 1-1 Roadmap Introduction to Security Introduction to Cryptography Symmetric key cryptography Hash and message authentication
Single Block Attacks and Statistical Tests on CubeHash
Single Block Attacks and Statistical Tests on CubeHash Benjamin Bloom Alan Kaminsky August 21, 2009 Abstract This paper describes a second preimage attack on the CubeHash cryptographic one-way hash function.
Cryptanalysis of the GOST Hash Function
Cryptanalysis of the GOST Hash Function Florian Mendel, Norbert Pramstaller, and Christian Rechberger Institute for Applied Information Processing and Communications (IAIK) - Krypto Group Faculty of Computer
Block Ciphers that are Easier to Mask How Far Can we Go?
Block Ciphers that are Easier to Mask How Far Can we Go? Benoît Gérard, Vincent Grosso, María Naya-Plasencia, François-Xavier Standaert DGA & UCL Crypto Group & INRIA CHES 2013 Santa Barbara, USA Block
Cryptography Trends: A US-Based Perspective. Burt Kaliski, RSA Laboratories IPA/TAO Cryptography Symposium October 20, 2000
Cryptography Trends: A US-Based Perspective Burt Kaliski, RSA Laboratories IPA/TAO Cryptography Symposium October 20, 2000 Outline Advanced Encryption Standard Dominant design Thoughts on key size Advanced
COMP4109 : Applied Cryptography
COMP4109 : Applied Cryptography Fall 2013 M. Jason Hinek Carleton University Applied Cryptography Day 2 information security cryptographic primitives unkeyed primitives NSA... one-way functions hash functions
Secret Key Cryptography
Secret Key Cryptography 1 Block Cipher Scheme Encrypt Plaintext block of length N Decrypt Secret key Cipher block of length N 2 Generic Block Encryption Convert a plaintext block into an encrypted block:
The Rectangle Attack
The Rectangle Attack and Other Techniques for Cryptanalysis of Block Ciphers Orr Dunkelman Computer Science Dept. Technion joint work with Eli Biham and Nathan Keller Topics Block Ciphers Cryptanalysis
Complementing Feistel Ciphers
Ivica Nikolić (joint work with Alex Biryukov) Nanyang Technological University, Singapore University of Luxembourg, Luxembourg 11 March 2013 1 Complementation Property 2 General Complementation Property
9/30/2016. Cryptography Basics. Outline. Encryption/Decryption. Cryptanalysis. Caesar Cipher. Mono-Alphabetic Ciphers
Cryptography Basics IT443 Network Security Administration Slides courtesy of Bo Sheng Basic concepts in cryptography systems Secret cryptography Public cryptography 1 2 Encryption/Decryption Cryptanalysis
Winter 2011 Josh Benaloh Brian LaMacchia
Winter 2011 Josh Benaloh Brian LaMacchia Symmetric Cryptography January 20, 2011 Practical Aspects of Modern Cryptography 2 Agenda Symmetric key ciphers Stream ciphers Block ciphers Cryptographic hash
Narrow-Bicliques: Cryptanalysis of Full IDEA. Gaetan Leurent, University of Luxembourg Christian Rechberger, DTU MAT
Narrow-Bicliques: Cryptanalysis of Full IDEA Dmitry Khovratovich, h Microsoft Research Gaetan Leurent, University of Luxembourg Christian Rechberger, DTU MAT Cryptanalysis 101 Differential attacks Linear
Homework 2. Out: 09/23/16 Due: 09/30/16 11:59pm UNIVERSITY OF MARYLAND DEPARTMENT OF ELECTRICAL AND COMPUTER ENGINEERING
UNIVERSITY OF MARYLAND DEPARTMENT OF ELECTRICAL AND COMPUTER ENGINEERING ENEE 457 Computer Systems Security Instructor: Charalampos Papamanthou Homework 2 Out: 09/23/16 Due: 09/30/16 11:59pm Instructions
CSCI 454/554 Computer and Network Security. Topic 3.1 Secret Key Cryptography Algorithms
CSCI 454/554 Computer and Network Security Topic 3.1 Secret Key Cryptography Algorithms Outline Introductory Remarks Feistel Cipher DES AES 2 Introduction Secret Keys or Secret Algorithms? Security by
History of message integrity techniques
History of message integrity techniques Chris Mitchell 17th January 2008 1 Contents of talk 1. CBC-MACs 2. Standardised CBC-MACs 3. EMAC and ARMAC 4. New CBC-MAC schemes 5. RMAC 6. The XCBC family 7. Other
Cryptography Basics. IT443 Network Security Administration Slides courtesy of Bo Sheng
Cryptography Basics IT443 Network Security Administration Slides courtesy of Bo Sheng 1 Outline Basic concepts in cryptography systems Secret key cryptography Public key cryptography Hash functions 2 Encryption/Decryption
AIT 682: Network and Systems Security
AIT 682: Network and Systems Security Topic 3.1 Secret Key Cryptography Algorithms Instructor: Dr. Kun Sun Outline Introductory Remarks Feistel Cipher DES AES 2 Introduction Secret Keys or Secret Algorithms?
Lecture 3: Symmetric Key Encryption
Lecture 3: Symmetric Key Encryption CS996: Modern Cryptography Spring 2007 Nitesh Saxena Outline Symmetric Key Encryption Continued Discussion of Potential Project Topics Project proposal due 02/22/07
Crypto Basics. Recent block cipher: AES Public Key Cryptography Public key exchange: Diffie-Hellmann Homework suggestion
Crypto Basics Recent block cipher: AES Public Key Cryptography Public key exchange: Diffie-Hellmann Homework suggestion 1 What is a cryptosystem? K = {0,1} l P = {0,1} m C = {0,1} n, C C E: P K C D: C
Network Security Essentials Chapter 2
Network Security Essentials Chapter 2 Fourth Edition by William Stallings Lecture slides by Lawrie Brown Encryption What is encryption? Why do we need it? No, seriously, let's discuss this. Why do we need
Computer Security. 08. Cryptography Part II. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 08. Cryptography Part II Paul Krzyzanowski Rutgers University Spring 2018 March 23, 2018 CS 419 2018 Paul Krzyzanowski 1 Block ciphers Block ciphers encrypt a block of plaintext at a
Update on Tiger. Kasteelpark Arenberg 10, B 3001 Heverlee, Belgium
Update on Tiger Florian Mendel 1, Bart Preneel 2, Vincent Rijmen 1, Hirotaka Yoshida 3, and Dai Watanabe 3 1 Graz University of Technology Institute for Applied Information Processing and Communications
Cryptanalysis of the GOST Hash Function
Cryptanalysis of the GOST Hash Function Florian Mendel Joint work with: Norbert Pramstaller, Christian Rechberger, Marcin Kontak, and Janusz Szmidt Institute for Applied Information Processing and Communications
Data Encryption Standard (DES)
Data Encryption Standard (DES) Best-known symmetric cryptography method: DES 1973: Call for a public cryptographic algorithm standard for commercial purposes by the National Bureau of Standards Goals:
Computer Security 3/23/18
s s encrypt a block of plaintext at a time and produce ciphertext Computer Security 08. Cryptography Part II Paul Krzyzanowski DES & AES are two popular block ciphers DES: 64 bit blocks AES: 128 bit blocks
Due: April 17, 11:59pm. Project 2
COS 433: Cryptography (Spring 2018) Project 2 Princeton University Due: April 17, 11:59pm Project 2 Introduction You are interning at the super secretive TLA (Three Letter Agency) again. This time, the
MasterMath Cryptology /2 - Cryptanalysis
MasterMath Cryptology 2015 2/2 Cryptanalysis Friday, 17 April, 2015 09:59 10. Hash Function Cryptanalysis (v3) Cryptographic hash functions map messages of arbitrary size to a fixed size hash, e.g. a bitstring
n-bit Output Feedback
n-bit Output Feedback Cryptography IV Encrypt Encrypt Encrypt P 1 P 2 P 3 C 1 C 2 C 3 Steven M. Bellovin September 16, 2006 1 Properties of Output Feedback Mode No error propagation Active attacker can
CS-E4320 Cryptography and Data Security Lecture 5: Hash Functions
Lecture 5: Hash Functions Céline Blondeau Email: celine.blondeau@aalto.fi Department of Computer Science Aalto University, School of Science Hash Functions Birthday Paradox Design of Hash Functions SHA-3
Computer Security. 08r. Pre-exam 2 Last-minute Review Cryptography. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 08r. Pre-exam 2 Last-minute Review Cryptography Paul Krzyzanowski Rutgers University Spring 2018 March 26, 2018 CS 419 2018 Paul Krzyzanowski 1 Cryptographic Systems March 26, 2018 CS
Garantía y Seguridad en Sistemas y Redes
Garantía y Seguridad en Sistemas y Redes Tema 2. Cryptographic Tools Esteban Stafford Departamento de Ingeniería Informá2ca y Electrónica Este tema se publica bajo Licencia: Crea2ve Commons BY- NC- SA
Vortex. A New Family of One-Way Hash Functions. Based on AES Rounds and Carry-less Multiplication. Intel Corporation, IL
Vortex A New Family of One-Way Hash Functions Based on AES Rounds and Carry-less Multiplication Shay Gueron Michael E. Kounavis Intel Corporation, IL Intel Corporation, US and University of Haifa, IL Information
Fault Diagnosis Schemes for Low-Energy BlockCipher Midori Benchmarked on FPGA
Fault Diagnosis Schemes for Low-Energy BlockCipher Midori Benchmarked on FPGA Abstract: Achieving secure high-performance implementations for constrained applications such as implantable and wearable medical
This document is downloaded from DR-NTU, Nanyang Technological University Library, Singapore.
This document is downloaded from DR-NTU, Nanyang Technological University Library, Singapore. Title Improved Meet-in-the-Middle cryptanalysis of KTANTAN (poster) Author(s) Citation Wei, Lei; Rechberger,
Message authentication codes
Message authentication codes Martin Stanek Department of Computer Science Comenius University stanek@dcs.fmph.uniba.sk Cryptology 1 (2017/18) Content Introduction security of MAC Constructions block cipher
CSC 5930/9010 Modern Cryptography: Cryptographic Hashing
CSC 5930/9010 Modern Cryptography: Cryptographic Hashing Professor Henry Carter Fall 2018 Recap Message integrity guarantees that a message has not been modified by an adversary Definition requires that
Construction of secure and fast hash functions using nonbinary error-correcting codes
Downloaded from orbit.dtu.dk on: Sep 09, 2018 Construction of secure and fast hash functions using nonbinary error-correcting codes Knudsen, Lars Ramkilde; Preneel, Bart Published in: I E E E Transactions
Deoxys v1.41. Designers/Submitters: School of Physical and Mathematical Science, Nanyang Technological University, Singapore
Deoxys v1.41 Designers/Submitters: Jérémy Jean 1,2, Ivica Nikolić 2, Thomas Peyrin 2, Yannick Seurin 1 1 ANSSI, Paris, France 2 Division of Mathematical Sciences, School of Physical and Mathematical Science,
Chapter 3 Block Ciphers and the Data Encryption Standard
Chapter 3 Block Ciphers and the Data Encryption Standard Last Chapter have considered: terminology classical cipher techniques substitution ciphers cryptanalysis using letter frequencies transposition
Introduction to Modern Symmetric-Key Ciphers
Introduction to Modern Symmetric-Key Ciphers 1 Objectives Review a short history of DES. Define the basic structure of DES. List DES alternatives. Introduce the basic structure of AES. 2 Data Encryption
An Improved Algebraic Attack on Hamsi-256
An Improved Algebraic Attack on Hamsi-256 Itai Dinur and Adi Shamir Computer Science department The Weizmann Institute Rehovot 76100, Israel Abstract. Hamsi is one of the 14 second-stage candidates in
Block Ciphers and the Data Encryption Standard (DES) Modified by: Dr. Ramzi Saifan
Block Ciphers and the Data Encryption Standard (DES) Modified by: Dr. Ramzi Saifan Block ciphers Keyed, invertible Large key space, large block size A block of plaintext is treated as a whole and used
Once upon a time... A first-order chosen-plaintext DPA attack on the third round of DES
A first-order chosen-plaintext DPA attack on the third round of DES Oscar Reparaz, Benedikt Gierlichs KU Leuven, imec - COSIC CARDIS 2017 Once upon a time... 14 November 2017 Benedikt Gierlichs - DPA on
Initial recommendations of long-term secure post-quantum systems
Initial recommendations of long-term secure post-quantum systems Tanja Lange 07 September 2015 Dagstuhl Workshop on Quantum Cryptanalysis Post-Quantum Cryptography for Long-term Security Project funded
page 1 Introduction to Cryptography Benny Pinkas Lecture 3 November 18, 2008 Introduction to Cryptography, Benny Pinkas
Introduction to Cryptography Lecture 3 Benny Pinkas page 1 1 Pseudo-random generator Pseudo-random generator seed output s G G(s) (random, s =n) Deterministic function of s, publicly known G(s) = 2n Distinguisher
Symmetric Encryption Algorithms
Symmetric Encryption Algorithms CS-480b Dick Steflik Text Network Security Essentials Wm. Stallings Lecture slides by Lawrie Brown Edited by Dick Steflik Symmetric Cipher Model Plaintext Encryption Algorithm
Computer Security CS 526
Computer Security CS 526 Topic 4 Cryptography: Semantic Security, Block Ciphers and Encryption Modes CS555 Topic 4 1 Readings for This Lecture Required reading from wikipedia Block Cipher Ciphertext Indistinguishability
Attack on DES. Jing Li
Attack on DES Jing Li Major cryptanalytic attacks against DES 1976: For a very small class of weak keys, DES can be broken with complexity 1 1977: Exhaustive search will become possible within 20 years,
Hash Function. Guido Bertoni Luca Breveglieri. Fundations of Cryptography - hash function pp. 1 / 18
Hash Function Guido Bertoni Luca Breveglieri Fundations of Cryptography - hash function pp. 1 / 18 Definition a hash function H is defined as follows: H : msg space digest space the msg space is the set
BCA III Network security and Cryptography Examination-2016 Model Paper 1
Time: 3hrs BCA III Network security and Cryptography Examination-2016 Model Paper 1 M.M:50 The question paper contains 40 multiple choice questions with four choices and student will have to pick the correct
Computer and Data Security. Lecture 3 Block cipher and DES
Computer and Data Security Lecture 3 Block cipher and DES Stream Ciphers l Encrypts a digital data stream one bit or one byte at a time l One time pad is example; but practical limitations l Typical approach
Cryptanalysis of Symmetric-Key Primitives: Automated Techniques
1 / 39 Cryptanalysis of Symmetric-Key Primitives: Automated Techniques Nicky Mouha ESAT/COSIC, KU Leuven, Belgium IBBT, Belgium Summer School on Tools, Mykonos Tuesday, May 29, 2012 2 / 39 Outline 1 2
The SKINNY Family of Lightweight Tweakable Block Ciphers
The SKINNY Family of Lightweight Tweakable Block Ciphers Jérémy Jean joint work with: Christof Beierle Stefan Kölbl Gregor Leander Amir Moradi Thomas Peyrin Yu Sasaki Pascal Sasdrich Siang Meng Sim CRYPTO
Elaine Barker and Allen Roginsky NIST June 29, 2010
Elaine Barker and Allen Roginsky NIST June 29, 2010 Background: Cryptography is used to protect sensitive information Attackers are becoming smarter, and computers are becoming more powerful Many commonly
Cryptographic Hash Functions
Cryptographic Hash Functions Cryptographic Hash Functions A cryptographic hash function takes a message of arbitrary length and creates a message digest of fixed length. Iterated Hash Function A (compression)
Week 4. : Block Ciphers and DES
Week 4. : Block Ciphers and DES Model of Symmetric Cryptosystem Cryptanalyst Adversary M K E Insecure Channel D Plaintext M Ciphertext C Secure Channel Plaintext M Key K Shared Secret Key C = E K (M) D
Cryptography and Network Security
Cryptography and Network Security Spring 2012 http://users.abo.fi/ipetre/crypto/ Lecture 14: Folklore, Course summary, Exam requirements Ion Petre Department of IT, Åbo Akademi University 1 Folklore on
Permutation-based symmetric cryptography
Permutation-based symmetric cryptography Guido Bertoni 1 Joan Daemen 1 Michaël Peeters 2 Gilles Van Assche 1 1 STMicroelectronics 2 NXP Semiconductors Keccak & SHA-3 Day Université Libre de Bruxelles March
Recommendation to Protect Your Data in the Future
Recommendation to Protect Your Data in the Future Prof. Dr.-Ing. Tim Güneysu Arbeitsgruppe Technische Informatik / IT-Sicherheit (CEITS) LEARNTEC Karlsruhe 27.01.2016 Long-Term Security in the Real World
Improved and Multiple Linear Cryptanalysis of Reduced Round Serpent
Improved and Multiple Linear Cryptanalysis of Reduced Round Serpent Description of the Linear Approximations B. Collard, F.-X. Standaert, J.-J. Quisquater UCL Crypto Group, Microelectronics Laboratory,
Lecture 18 Message Integrity. Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Slides from Miller & Bailey s ECE 422
Lecture 18 Message Integrity Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Slides from Miller & Bailey s ECE 422 Cryptography is the study/practice of techniques for secure communication,
NEW COMPRESSION FUNCTION TO SHA-256 BASED ON THE TECHNIQUES OF DES.
NEW COMPRESSION FUNCTION TO SHA-256 BASED ON THE TECHNIQUES OF DES. 1 ZAKARIA KADDOURI, 2 FOUZIA OMARY, 3 ABDOLLAH ABOUCHOUAR, 4 MOHSSIN DAARI, 5 KHADIJA ACHKOUN. LRI Laboratory (Ex: Networks and Data
Preimage attacks on the round-reduced Keccak with the aid of differential cryptanalysis
Preimage attacks on the round-reduced Keccak with the aid of differential cryptanalysis Pawe l Morawiecki 1,3, Josef Pieprzyk 2, Marian Srebrny 1,3, and Micha l Straus 1 1 Section of Informatics, University
Improved Key Recovery Attacks on Reduced-Round AES with Practical Data and Memory Complexities
Improved Key Recovery Attacks on Reduced-Round AES with Practical Data and Memory Complexities Achiya Bar-On 1, Orr Dunkelman 2, Nathan Keller 1, Eyal Ronen 3, and Adi Shamir 3 1 Department of Mathematics,
Hashing, One-Time Signatures, and MACs. c Eli Biham - March 21, Hashing, One-Time Signatures, and MACs
Hashing, One-Time Signatures, and MACs c Eli Biham - March 21, 2011 159 Hashing, One-Time Signatures, and MACs Digital Signatures A signature is (according to the Miriam-Webster dictionary): 1. (a) The
2/7/2013. CS 472 Network and System Security. Mohammad Almalag Lecture 2 January 22, Introduction To Cryptography
CS 472 Network and System Security Mohammad Almalag malmalag@cs.odu.edu Lecture 2 January 22, 2013 Introduction To Cryptography 1 Definitions Cryptography = the science (art) of encryption Cryptanalysis
CSCE 715: Network Systems Security
CSCE 715: Network Systems Security Chin-Tser Huang huangct@cse.sc.edu University of South Carolina Next Topic in Cryptographic Tools Symmetric key encryption Asymmetric key encryption Hash functions and
Jaap van Ginkel Security of Systems and Networks
Jaap van Ginkel Security of Systems and Networks November 17, 2016 Part 3 Modern Crypto SSN Modern Cryptography Hashes MD5 SHA Secret key cryptography AES Public key cryptography DES Presentations Minimum
Short Schnorr signatures require a hash function with more than just random-prefix resistance
Short Schnorr signatures require a hash function with more than just random-prefix resistance Daniel R. L. Brown February 27, 2015 Abstract Neven, Smart and Warinschi (NSW) proved, in the generic group
Key Separation in Twofish
Twofish Technical Report #7 Key Separation in Twofish John Kelsey April 7, 2000 Abstract In [Mur00], Murphy raises questions about key separation in Twofish. We discuss this property of the Twofish key
Cryptanalysis of Block Ciphers: A Survey
UCL Crypto Group Technical Report Series Cryptanalysis of Block Ciphers: A Survey Francois-Xavier Standaert, Gilles Piret, Jean-Jacques Quisquater REGARDS GROUPE http://www.dice.ucl.ac.be/crypto/ Technical
Meet-in-the-Middle Preimage Attacks on AES Hashing Modes and an Application to Whirlpool
Meet-in-the-Middle Preimage Attacks on AES Hashing Modes and an Application to Whirlpool Yu Sasaki NTT Information Sharing Platform Laboratories, NTT Corporation 3-9-11 Midoricho, Musashino-shi, Tokyo
Cryptography: Symmetric Encryption (finish), Hash Functions, Message Authentication Codes
CSE 484 / CSE M 584: Computer Security and Privacy Cryptography: Symmetric Encryption (finish), Hash Functions, Message Authentication Codes Spring 2016 Franziska (Franzi) Roesner franzi@cs.washington.edu
Hash-based Signatures
Hash-based Signatures IETF/IRTF CFRG Draft on XMSS Fraunhofer Workshop Series 01 Post-Quantum Cryptography in Practice Speaker: Dr. Bernhard Jungk 1 extended Merkle Signature Scheme 2 extended Merkle Signature
Elastic Block Ciphers: Method, Security and Instantiations
Elastic Block Ciphers: Method, Security and Instantiations Debra L. Cook 1, Moti Yung 2, Angelos D. Keromytis 3 1 Department of Computer Science, Columbia University, New York, NY, USA dcook@cs.columbia.edu
CSC 474/574 Information Systems Security
CSC 474/574 Information Systems Security Topic 2.1 Introduction to Cryptography CSC 474/574 By Dr. Peng Ning 1 Cryptography Cryptography Original meaning: The art of secret writing Becoming a science that
McOE: A Family of Almost Foolproof On-Line Authenticated Encryption Schemes
McOE: A Family of Almost Foolproof On-Line Authenticated Encryption Schemes Ewan Fleischmann Christian Forler Stefan Lucks Bauhaus-Universität Weimar FSE 2012 Fleischmann, Forler, Lucks. FSE 2012. McOE:
Permutation-based Authenticated Encryption
Permutation-based Authenticated Encryption Gilles Van Assche 1 1 STMicroelectronics COST Training School on Symmetric Cryptography and Blockchain Torremolinos, Spain, February 2018 1 / 44 Outline 1 Why
Block Ciphers and Data Encryption Standard. CSS Security and Cryptography
Block Ciphers and Data Encryption Standard CSS 322 - Security and Cryptography Contents Block Cipher Principles Feistel Structure for Block Ciphers DES Simplified DES Real DES DES Design Issues CSS 322
A Meet in the Middle Attack on Reduced Round Kuznyechik
IEICE TRANS. FUNDAMENTALS, VOL.Exx??, NO.xx XXXX 200x 1 LETTER Special Section on Cryptography and Information Security A Meet in the Middle Attack on Reduced Round Kuznyechik Riham ALTAWY a), Member and
Computer Security: Principles and Practice
Computer Security: Principles and Practice Chapter 2 Cryptographic Tools First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Cryptographic Tools cryptographic algorithms