A Star-based Independent Biclique Attack on Full Rounds SQUARE

Transcription

1 A Star-based Independent Bclque Attack on Full Rounds SQUARE Zheng Yuan,, Zhen Peng,, Mng Mao,. Beng Electronc Scence &Technology Insttute, Beng 00070,Chna. Xdan Unversty, X an, Chna yuanzheng@best.edu.cn, zyuan@tsnghua.edu.cn @qq.com Abstract. SQUARE s an terated block cpher proposed by Daemen et.al. n FSE997. Inspred by Bogdanov et.al. s recent works [], we frst present an mproved bclque attack,.e. stat-based ndependent bclque attack on full rounds SQUARE n ths paper. We construct a one round stat-based ndependent bclque for the ntal round, and utlze matchng wth precomputaton technques to recover the whole key from the remanng rounds. The computng complexty of our 6.7 attack s encryptons and requred data can be reduced to a sngle plantext-cphertext par. To be the best of our knowledge, our attack has an optmal computng complexty and data complexty of bclque attack on full rounds SQUARE. eywords: Block cpher SQUARE, Bclque attack, Star-based ndependent bclque, balanced Bclque. Introducton SQUARE. SQUARE s an eght rounds SPN block cpher [] proposed by Daemen, nudsen and Rmen n FSE997. As we all know, Rndael, the canddate of Advanced Encrypton Standard (AES), was also proposed by Daemen and Rmen n 997, SQUARE s consdered as the predecessor of the AES. So all knd of cryptanalyss of AES, such as dfference cryptanalyss [3], lnear cryptanalyss [4], boomerang attack [], bclque attack [3], etc, are also sutable for SQUAER. The frst attack on SQUARE s a square attack [] whch s named after the block 7 3 cpher SQUARE, ths square attack can break sx rounds SQUARE wth encryptons, 7 chosen plantexts, and block of memory[]. In 0, oo et.al.gave a related-key boomerang attack on full rounds SQUARE[], they appled a three rounds related-key dfferentals to construct a seven rounds related-key boomerang dstngusher, and 36 3 wth probablty of successfully attacked on full rounds SQUARE wth encryptons and data. In 04, Hamd et.al frst presented a sngle-key attack on full rounds SQUARE [3], they constructed a 3 rounds bclque usng the ndependent related-key dfferentals and appled matchng wth 6 4 precomputaton on the remanng fve rounds wth encryptons and chosen plantexts. Ths year, ZHANG et.al showed a bclque attack on full round SQUARE [5], whch need about 6.3 encryptons and 6 chosen plantexts. Bclque attack. Bclque attack was frstly proposed by hovratovch et.al n 0[4]. A bclque allows an adversary to test a set of key canddates very effcently. The bclque attack has been regarded as an advance n the felds of symmetrc-key cryptography. Snce ts ntroducton, an entre rounds cryptanalyss researches emerged, amng to apply the bclque technques to varous

2 block cphers [5][6][7][][9][0]. In 05, Bogdanov et.al. [] proposed star bclque structures,.e., the star-based bclque attacks, on all versons of AES cpher wth the mnmal possble data complexty theoretcally, but ther star bclque structures are not ndependent. Up to now, the star-based bclque attack has not been wdely used. Our contrbutons. Motvated by the star-based bclque attacks on AES [], we frst present a star-based ndependent bclque attack on full rounds block cpher SQUARE,.e., we frst gve a star ndependent bclque structure. We construct a sngle round star ndependent bclque on the frst round accordng to the ndependent related-key dfferentals, and apply matchng wth precomputaton technque on the remanng seven rounds to recover the all bts keys. Perhaps a star ndependent bclque structure could result n a best computng complexty and date complexty among other known bclque structures for full rounds block cphers. To be the best of 6.7 our knowledge, our star-based ndependent bclque attack on full rounds SQUARE, wth encryptons and a sngle plantext-cphertext par, are better than the exstng results. In addton, we show that a bclque attack can be mproved by changng the bclque constructons or by selectng better dfferences characterstcs n the bclque constructon. Outlne. Ths paper s organzed as follows. In secton, we descrbe the block cpher SQUARE. In secton 3, we ntroduce star-based ndependent bclques. In secton 4, we present a star-based ndependent bclque attack on full rounds SQUARE. Fnally, we gve our concluson n Secton5. Descrpton of SQUARE Here, we gve a descrpton of block cpher SQUARE.. Round Transformaton SQUARE s an eght rounds an terated block cpher wth a block length and a key length of bts each. The round transformaton of SQUARE s composed of four dstnct transformatons. Smlar to AES, SQUARE s also SPN structure. The basc buldng blocks of the cpher are fve dfferent nvertble transformatons that operate on a 4 4 array of bytes. The element of a state a n row and column s specfed as a,. Both ndexes start from 0. The round transformatons are composed of a lnear transformaton, a nonlnear transformaton, a byte permutaton and btwse round key addton, as s depcted n Fg Fg. The Round Transformaton of SQUARE

3 A lnear transformaton. s a lnear operaton that operatons separately on each of the four rows of a state. We have : b ( a) b, c a, o c a, c a, c 3 a,3, 0,,,3 Where the multplcaton s n GF ( ) and the ndces of c must be taken modulo 4. The rows of a state can be denoted by polynomals,.e., the polynomal correspondng to row of a state a s gven by a ( x) a a x a x a x 3,0,,,3 Defned c( x) c x, can be descrbed as a modular polynomal multplcaton: b a b x c x a x x 4 ( ) ( ) ( ) ( ) mod 0 4 c( x ) can be denoted as a 4 4 MDS matrx M n GF ( ),where M A nonlnear transformaton. s a nonlnear byte substtuton, dentcal for all bytes. Every byte n the state s replaced by the byte generated after usng a S-box. : b ( a) b S ( a ),, Where S s an nvertble -bt substtuton table or S-box. A byte permutaton. s a lnear transformaton transposng the state matrx. s to nterchange of rows and columns of a state. : b ( a) b, a, s an nvoluton, so. Btwse round key addton. s btwse Xor. The -bt nternal state s Xor wth the -bt subkey: [ k ]: b [ k ]( a) b a k t t t where t k s the subkey of round t.. The ey Schedule 3

4 The key schedule of SQUARE s smple but effectve. The key schedule generates 9 subkeys 0 rk, rk,..., rk and each of them s bts. s the master key and 0 rk s ntated wth. + rk, 0,,...,7 s generated by rk = rk rotl( rk ) C + row(0) row(0) row(3) rk = rk rk, for,,,3 + row( ) row( ) row( ) where C s a round constant and the operaton rotl s a left-rotaton operaton rotl[ a, a, a, a ] [ a, a, a, a ],0,,,3,,,3,0 SQUARE s defned as eght rounds preceeded by a key addton 0 [ k ] and by : SQUARE[ k] [ k ] [ k ] [ k ] [ k ] [ k ] [ k ] [ k ] [ k ] [ k ] , where [ k t ] s the round transformaton t t [ k ] [ k ] 3 Star-based Independent Bcllque In ths secton, we ntroduce Canteaut el.al s star-based bclque structure, and construct a star-based ndependent bclque from related-key dfferentals. 3. Star-based Bclque Structure In paper[], Canteaut el.al frst proposed a bclque attack whose data complexty can be reduced to a sngle plantext-cphertext par. They suggested that the structure of bclque wth ust one state n one vertex set and d states n the other one, rather than d states n one vertex set and d states n the other one. The structure of the former s called a star (See Fg), and the latter s s called a balanced bclque (See Fg3). x k k d S0 S S d [0,0] [ d d, ] y y y d Fg. Stars: unbalanced bclque wth dmenson d C C 0 C d Fg3. Balanced bclque wth dmenson d 3. Constructng a Star-based Independent Bclque from Related-ey dfferentals 4

5 As we know, there are two approaches to construct balanced bclques. One s from ndependent related-key dfferentals, and the other s from nterleavng related-key dfferentals. In most cases of bclque attacks, ones always consder ndependent related-key dfferentals. Because the star-based bclque has an advantage of data complexty, we focus on constructng a star bclque from ndependent related-key dfferentals, and named ths knd of bclque as a star-based ndependent bclque. It s worth to notng that we have mplemented a star-based ndependent bclque attack on full rounds SQUARE n ths paper. The procedure of constructng a star-based bclque s followng. Suppose we have a set of d related-key - dfferentals from x to y, : (0, ) and also have another set of d related-key - dfferentals from the same part of the cpher: (0, ) If the - dfferentals and - dfferentals do not share any actve non-lnear components,.e., both of the dfferentals are ndependent, we should construct an ndependent bclque. If nput x, output y0,0 and key [0,0] also conform to both of - dfferentals and - dfferentals, then the values x y, y0,0 [, ] [0,0] form a star of dmenson d, wth We named t as a star-based ndependent bclque. 4 A Star-based Independent Bcllque Attack on Full Round Block Cpher SQUARE Accordng to Secton 3, we llustrate our star-based ndependent bclque attack on full rounds block cpher SQUARE n ths secton. We construct a sngle round star-based ndependent-bclque of SQUARE wth dmenson eght, and apply ths star-based ndependent-bclque to recover all keys of full round SQUARE. Our sngle round star-based ndependent-bclque can place the ntal round or fnal round of SQUARE. Here, we place t at the ntal round. 4. ey Parttonng We dvde the -bt key nto groups wth 6 keys n each group. The ndex s placed 5

6 n byte 0 whereas ndex s placed n byte 5. - dfferentals actvates byte 0 of key and - dfferentals actvates byte 5 of key. The base key [0,0], also the frst subkey, are all 6-byte values wth two bytes fxed to 0 whereas the remanng 4-bytes take all possble values (shown n Fg4). All of 6 keys n a set [, ] are defned relatve to the base key [0,0], and two dfferentals and, where, {0,..., }. Fg4. key parttonng 4. Constructng a Sngle Round Star-based Independent-Bclque Step-base computaton. Let x0 be the plantext, obtan y 0,0 f [0,0] ( ) under the base key [0,0], where f s the subcpher that cover the star-based ndependent-bclque (Fg5. left). Step- -dfferentals computaton. Under key dfferences ( {0,..., } ), get 0 (Fg4. mddle). Ths process has the same startng pont as the base computaton. Step3- -dfferentals computaton. Under key dfferences ( {0,..., } ), get 0 (Fg4. rght) from the same part of the SQUARE cpher,.e., ths process has the same startng pont as the base computaton. Step4- bclque computaton. Both the dfferentals do not share any non-lnear components, we can combne both the dfferentals nto a combned dfferentals. Then the values x y, y0, [, ] [0,0] form an star wth dmenson eght. As s depcted n Fg5, the dfferences propagaton n these two dfferences over one round s non-overlappng, so we could obtan a star-based ndependent bclque. 6

7 star # # # y 0 y y BaseComputaton dfferentals dfferentals Fg5. Star over frst round 4.3 Matchng wth Precomputaton Here, we choose to match on byte 0 n the state after byte permutaton transformaton of round 4. For the forward drecton of matchng, n round, no S-boxes s to be recomputed. In 3-th round, four S-boxes have to be recomputed. In 4-th round, one S-boxes need to be recomputed. So there are 5 S-boxes to be recomputed n the forward matchng (Fg6. top). For the backward drecton of matchng, n 5,6,7,-th round, four S-boxes, sxteen S-boxes, eght S-boxes, three S-boxes need to be recomputed, respectvely. Hence, there are n total 36 S-boxes to be recomputed. Forward Matchng $ $3 Backward Matchng $4 $5 $6 $7 $ Fg6. Matchng wth Precomputatons 4.4 Complextes of the Attack Computng complexty. The full round SQUARE cpher has 6*= S-boxes. From secton 4.3, the matchng wth precomputaton process yelds a recomputaton of 36 out of S-boxes. 7

8 Thus, the recomputaton needs Crecomp encryptons, whle the precomputaton needs 7 7. C precomp encryptons. The constructng one star-based ndependent-bclque needs 6 Cbclque encryptons. The elmnatng false postves needs C falsepos encryptons. Therefore, the computng complexty of our star-based ndependent bclque attack on full rounds SQUARE s C C C C C nd full ( recomp bclque precomp falsepos ) ( ) 6.7 Data complexty. For our star-based ndependent bclque attack on full rounds SQUARE, the mnmal data complexty s theoretcally attanable, whch can be reduced to a sngle known plantext-chpertext par. One known plantext-cphertext par can sometmes be enough. Two known plantext-cphertext pars yeld a success probablty of practcally. Memory complexty. The memory complexty s upper bounded by computng of subcpher nvolved n the precomputaton stage. 5 Conclusons In ths paper, we ntroduce a star-based ndependent bclques attack, and frst propose a star-based ndependent bclque attack (balanced bclque) on full rounds block cpher SQUARE. Our attack could reduce the data complexty to the theoretcally attanable mnmum. In our attack, we construct a sngle round star-based bclque on the frst round of SQUARE and apply matchng wth precomputaton on the remanng seven rounds. The computng complexty of our attack s 6.7 about encryptons, and the data complexty can be reduced to a sngle plantext-cphertext par. Compared wth the exstng bclque attacks on full rounds SQUARE, both the computng complexty and data complexty of our attack are optmal. Addtonally, we can note that the structure of bclque perhaps play an mportant role n reducng the data complexty. Reference [] Daeman, J., nudsen, L.R., Rmen, V.: The Block Cpher SQUARE. In: Bham, E. (ed.) FSE 97. LNCS, vol. 67, pp Sprnger, Hedelb erg, 997. [] oo, B., Yeom, Y., Song, J.: Related-ey Boomerang Attack on Block Cpher SQUARE. IEICE Transacton, 94-A(), 3-9, 0.

9 [3] Hamd Mala,V.: Bclque Cryptanalyss of the Block Cpher SQUARE. Let Informaton Securty, 04.(3): 07-. [4] Andrey Bogdanov, Dmtry hovratovch, and Chrstan Rechberger. Bclque Cryptanalyss of the Full AES. Cryptology eprnt Archve, Report 0/449, 0. [5] Farzaneh Abed, Chrstan Forler, Ek Lst, Stefan Lucks, and Jakob Wenzel. Bclque Cryptanalyss Of PRESENT, LED and LEIN. Cryptology eprnt Archve, Report 0/59, 0. [6] Shao-zhen Chen and Tan-mn Xu. Bclque Attack of the Full ARIA-56. Cryptology eprnt Archve, Report 0/0,0. [7] Mustafa C oban, Ferhat arako c, and Ozkan Boztas. Bclque cryptanalyss of TWINE. In Josef Peprzyk, Ahmad-Reza Sadegh, and Mark Manuls, edtors, Cryptology and Network Securty, th Internatonal Conference, CANS 0, Darmstadt, Germany, December -4, 0. Proceedngs, volume 77, pages Sprnger, 0. [] Deuko Hong, Bonwook oo, and Daesung won. Bclque attack on the full HIGHT. In Howon m, edtor, Informaton Securty and Cryptology-ICISC 0-4th Internatonal Conference, Seoul, orea, November 30-December, 0. Revsed Selected Papers, volume 759 of Lecture Notes n Computer Scence, pages Sprnger, 0. [9] Takanor Isobe and yo Shbutan. Securty Analyss of the Lghtweght Block Cphers XTEA, LED and Pccolo. In Wlly Suslo, Y Mu, and Jennfer Seberry, edtors, Informaton Securty and Prvacy-7th Australasan Conference, ACISP 0, Wollongong, NSW, Australa, July 9-, 0. Proceedngs, volume 737 of Lecture Notes n Computer Scence, pages 7-6. Sprnger, 0. [0] Yanfeng Wang, Wenlng Wu, and Xaol Yu. Bclque cryptanalyss of reduced-round pccolo block cpher. In Mark Dermot Ryan, Ben Smyth, and Guln Wang, edtors, Informaton Securty Practce and Experence-th Internatonal Conference, ISPEC 0, Hangzhou, Chna, Aprl 9-, 0. Proceedngs, volume 73 of Lecture Notes n Computer Scence, pages Sprnger, 0. [] Canteaut, A., Naya -Plasenca, M., Vayss`ere, B.: Seve-n-the-mddle: mproved MITM attacks (full verson). Cryptology eprnt Archve, report 03/34 (03) [] Andrey Bogdanov,Donghoon Chang, Mohona Ghosh et al. Bclques wth mnmal Data and Tme Complexty for AES.ICISC04. [3] Bham,E., Shamr, A.: Dfferental Cryptanalyss of the Data Encrypton Standard. Sprnger, Hedelb erg,993. [4] Matsu, M.: Lnear cryptanalyss method for DES cpher. In: EUROCRYPT 93, LNCS, vol. 765, pp Sprnger, 993. [5] ZHANG Shugang,CHEN Shaozhen.Bclque Cryptanalyss of Full Round Square wth Low Data Complexty. Journal of Informaton Engneerng Unversty

10 0

11 Appendx A # # # # # # $ $ $ # 3 $3 $3 $3 #4 $4 $4 $4 # 5 $5 $5 $5 #6 $6 $6 $6 #7 $7 $7 $7 # $ $ $ Fg7. Bclque dfferentals and matchng n full round SQUARE