A Practical Attack on KeeLoq

Transcription

1 Introducton Our Attacks Practce Conclusons A Practcal Attack on KeeLoq Sebastaan Indesteege 1 Nathan Keller 2 Orr Dunkelman 1 El Bham 3 Bart Preneel 1 1 Dept. ESAT/SCD-COSIC, K.U.Leuven, Belgum. 2 Ensten Insttute of Mathematcs, Hebrew Unversty, Israel. 3 Computer Scence Department, Technon, Israel. Eurocrypt 2008 Sebastaan Indesteege A Practcal Attack on KeeLoq 1/ 21

2 Outlne Introducton Our Attacks Practce Conclusons 1 Introducton Descrpton of the KeeLoq Block Cpher Prevous Attacks on KeeLoq 2 Our Attacks on KeeLoq Prelmnares Basc Attack Scenaro A Generalsaton of the Attack A Chosen Plantext Attack 3 Practce Expermental Results Practcal Applcablty of the Attack 4 Conclusons Sebastaan Indesteege A Practcal Attack on KeeLoq 2/ 21

3 Outlne Introducton Our Attacks Practce Conclusons KeeLoq Prevous Attacks 1 Introducton Descrpton of the KeeLoq Block Cpher Prevous Attacks on KeeLoq 2 Our Attacks on KeeLoq Prelmnares Basc Attack Scenaro A Generalsaton of the Attack A Chosen Plantext Attack 3 Practce Expermental Results Practcal Applcablty of the Attack 4 Conclusons Sebastaan Indesteege A Practcal Attack on KeeLoq 3/ 21

4 Introducton Our Attacks Practce Conclusons KeeLoq Prevous Attacks Introducton What? Lghtweght block cpher 32-bt block, 64-bt key Desgned n 1980s Sold by Mcrochp Inc. Where Is It Used? Remote keyless entry applcatons Car locks and alarms Sebastaan Indesteege A Practcal Attack on KeeLoq 4/ 21

5 Introducton Our Attacks Practce Conclusons KeeLoq Prevous Attacks Descrpton of the KeeLoq Block Cpher 528 rounds y () 31 y () 26 y () 20 y () 16 y () 9 y () 1 y () 0 ϕ () NLF k 63 + k 0 Sebastaan Indesteege A Practcal Attack on KeeLoq 5/ 21

6 Introducton Our Attacks Practce Conclusons Prevous Attacks on KeeLoq KeeLoq Prevous Attacks Attack Type Data Tme Memory Ref. Slde/Guess-and-Det KP GB [B07] Slde/Guess-and-Det KP GB [B07b] Slde/Cycle Structure 2 32 KP GB [CB07] Slde/Cycle/G&D 2 32 KP (2 37 ) 16.5 GB [B07b] Slde/Fxed Ponts 2 32 KP 2 27 > 16 GB [C+08] Slde/Algebrac 2 16 KP ? [CB07, C+08] Slde/Algebrac 2 16 KP ? [CB07, C+08] DPA DEMA [E+08] Sebastaan Indesteege A Practcal Attack on KeeLoq 6/ 21

7 Outlne Introducton Our Attacks Practce Conclusons Prelmnares Basc Generalsaton Chosen Plantext 1 Introducton Descrpton of the KeeLoq Block Cpher Prevous Attacks on KeeLoq 2 Our Attacks on KeeLoq Prelmnares Basc Attack Scenaro A Generalsaton of the Attack A Chosen Plantext Attack 3 Practce Expermental Results Practcal Applcablty of the Attack 4 Conclusons Sebastaan Indesteege A Practcal Attack on KeeLoq 7/ 21

8 Introducton Our Attacks Practce Conclusons Determnng Keybts n KeeLoq Prelmnares Basc Generalsaton Chosen Plantext y () 31 y () 26 y () 20 y () 16 y () 9 y () 1 y () 0 ϕ () NLF k 63 + k 0 Gven two KeeLoq states, 32 rounds or less apart, we can fnd the key bts used n these rounds. Bogdanov [B07] Sebastaan Indesteege A Practcal Attack on KeeLoq 8/ 21

9 Introducton Our Attacks Practce Conclusons Prelmnares Basc Generalsaton Chosen Plantext Slde Attack Cpher wth many dentcal rounds F( ) P 2 P 1 F F F... F C 1 P 2 F F... F F C 2 C 1 Sld par P 2 = F(P 1 ), then also C 2 = F(C 1 ) Encryptng C 1 and C 2 yelds another sld par,... Use these pars to attack F( ) Sebastaan Indesteege A Practcal Attack on KeeLoq 9/ 21

10 Introducton Our Attacks Practce Conclusons Basc Attack Scenaro Prelmnares Basc Generalsaton Chosen Plantext P 16 rounds 16 rounds 16 rounds 16 rounds P j k k k k Expect a sld par among 2 16 plantexts (brthday paradox) Sebastaan Indesteege A Practcal Attack on KeeLoq 10/ 21

11 Introducton Our Attacks Practce Conclusons Basc Attack Scenaro Prelmnares Basc Generalsaton Chosen Plantext P 16 rounds 16 rounds 16 rounds 16 rounds P j k k k k k C 16 rounds 16 rounds 16 rounds 16 rounds C j 528 rounds = rounds Sebastaan Indesteege A Practcal Attack on KeeLoq 10/ 21

12 Introducton Our Attacks Practce Conclusons Basc Attack Scenaro Prelmnares Basc Generalsaton Chosen Plantext P X X P j P j k k k k k C C Y j Y j C j Sebastaan Indesteege A Practcal Attack on KeeLoq 10/ 21

13 Introducton Our Attacks Practce Conclusons Basc Attack Scenaro Prelmnares Basc Generalsaton Chosen Plantext P X X P j P j k k k k k C C Y j Y j C j Guess 16 key bts: k Sebastaan Indesteege A Practcal Attack on KeeLoq 10/ 21

14 Introducton Our Attacks Practce Conclusons Basc Attack Scenaro Prelmnares Basc Generalsaton Chosen Plantext P X X P j P j k k k k k C C Y j Y j C j Guess 16 LSB s of P j : P j = X Sebastaan Indesteege A Practcal Attack on KeeLoq 10/ 21

15 Introducton Our Attacks Practce Conclusons Basc Attack Scenaro Prelmnares Basc Generalsaton Chosen Plantext P X X P j P j k k k k k C C Y j Y j C j For each plantext j, determne k Sebastaan Indesteege A Practcal Attack on KeeLoq 10/ 21

16 Introducton Our Attacks Practce Conclusons Prelmnares Basc Generalsaton Chosen Plantext Basc Attack Scenaro P X X P j P j Table 2 16 tuples P j, Y, k k k k k k C C Y j Y j C j For each plantext j, partally decrypt Y j to Y j Sebastaan Indesteege A Practcal Attack on KeeLoq 10/ 21

17 Introducton Our Attacks Practce Conclusons Prelmnares Basc Generalsaton Chosen Plantext Basc Attack Scenaro P X X P j P j Table 2 16 tuples P j, Y, k k k k k k C C Y j Y j C j For each plantext, determne k Sebastaan Indesteege A Practcal Attack on KeeLoq 10/ 21

18 Introducton Our Attacks Practce Conclusons Prelmnares Basc Generalsaton Chosen Plantext Basc Attack Scenaro P X X P j P j Table 2 16 tuples P j, Y, k k k k k k C C Y j Y j C j For each plantext, partally encrypt C to C Sebastaan Indesteege A Practcal Attack on KeeLoq 10/ 21

19 Introducton Our Attacks Practce Conclusons Prelmnares Basc Generalsaton Chosen Plantext Basc Attack Scenaro P X X P j P j Table 2 16 tuples P j, Y, k k k k k k C C? Y j Y j C j Fnd ±2 16 collson(s) between C and Yj Sebastaan Indesteege A Practcal Attack on KeeLoq 10/ 21

20 Introducton Our Attacks Practce Conclusons Prelmnares Basc Generalsaton Chosen Plantext Basc Attack Scenaro P X X? P j k k k k k P j Table 2 16 tuples P j, Y, k C C Y j Y j C j Determne (and check) k ; ±1 collson survves Sebastaan Indesteege A Practcal Attack on KeeLoq 10/ 21

21 Introducton Our Attacks Practce Conclusons Prelmnares Basc Generalsaton Chosen Plantext Basc Attack Scenaro P X X P j P j Table 2 16 tuples P j, Y, k k k k k k C C Y j Y j C j Verfy key canddates usng tral encryptons (±2 16 n total) Sebastaan Indesteege A Practcal Attack on KeeLoq 10/ 21

22 Introducton Our Attacks Practce Conclusons Prelmnares Basc Generalsaton Chosen Plantext Basc Attack Scenaro P X X P j P j Table 2 16 tuples P j, Y, k k k k k k Complexty C C Y j Y j C j Data 2 16 known plantexts Memory ±2 MB for the table Tme 2 45 KeeLoq encryptons Sebastaan Indesteege A Practcal Attack on KeeLoq 10/ 21

23 Introducton Our Attacks Practce Conclusons A Generalsaton of the Attack Prelmnares Basc Generalsaton Chosen Plantext Why 16 rounds throughout the attack? Sebastaan Indesteege A Practcal Attack on KeeLoq 11/ 21

24 Introducton Our Attacks Practce Conclusons Prelmnares Basc Generalsaton Chosen Plantext A Generalsaton of the Attack Why 16 rounds throughout the attack? No reason! t o bts P 16 rounds X tp rounds X P j tc rounds P j k ˆk 1 ˆk 2 ˆk 3 k C tp rounds C Y j tc rounds Y j 16 rounds C j Sebastaan Indesteege A Practcal Attack on KeeLoq 11/ 21

25 Introducton Our Attacks Practce Conclusons Prelmnares Basc Generalsaton Chosen Plantext A Generalsaton of the Attack Why 16 rounds throughout the attack? No reason! t o bts P 16 rounds X tp rounds X P j tc rounds P j k ˆk 1 ˆk 2 ˆk 3 k C tp rounds C Y j tc rounds Y j 16 rounds C j Sebastaan Indesteege A Practcal Attack on KeeLoq 11/ 21

26 Introducton Our Attacks Practce Conclusons A Generalsaton of the Attack Prelmnares Basc Generalsaton Chosen Plantext Why 16 rounds throughout the attack? No reason! t o bts 16 rounds P X Generalsaton tp rounds X P j tc rounds P j Parameters k t p and t ˆk c 1 If t o t p, t c ˆk 2 ˆk 3 Guess extra bts, or C C Plantext flterng Yj Optmum? tp rounds tp = t c = 15, t o = KeeLoq encryptons tc rounds Y j k rounds C j Sebastaan Indesteege A Practcal Attack on KeeLoq 11/ 21

27 Introducton Our Attacks Practce Conclusons A Chosen Plantext Attack Prelmnares Basc Generalsaton Chosen Plantext P X X P j P j k ˆk 1 ˆk 2 ˆk 3 k C C Y j Y j C j Sebastaan Indesteege A Practcal Attack on KeeLoq 12/ 21

28 Introducton Our Attacks Practce Conclusons A Chosen Plantext Attack Prelmnares Basc Generalsaton Chosen Plantext P X X P j P j constant k ˆk 1 ˆk 2 ˆk 3 k C C Y j Y j C j Sebastaan Indesteege A Practcal Attack on KeeLoq 12/ 21

29 Introducton Our Attacks Practce Conclusons A Chosen Plantext Attack Prelmnares Basc Generalsaton Chosen Plantext P X X P j P j constant k Chosen Plantext Attack ˆk 1 ˆk 2 ˆk 3 k t o > t c C C Yj Y j Keep LSB s of plantext constant less guesses Optmum t p = 20, t c = 13, t o = 17 Stll KeeLoq encryptons... C j Sebastaan Indesteege A Practcal Attack on KeeLoq 12/ 21

30 Outlne Introducton Our Attacks Practce Conclusons Experments Applcablty 1 Introducton Descrpton of the KeeLoq Block Cpher Prevous Attacks on KeeLoq 2 Our Attacks on KeeLoq Prelmnares Basc Attack Scenaro A Generalsaton of the Attack A Chosen Plantext Attack 3 Practce Expermental Results Practcal Applcablty of the Attack 4 Conclusons Sebastaan Indesteege A Practcal Attack on KeeLoq 13/ 21

31 Introducton Our Attacks Practce Conclusons Experments Applcablty Implementaton Fully mplemented (C and x86 asm) and tested 128-way btslcng, where possble... Not durng collson verfcaton Impact? Collson verfcaton s more expensve Optmal t p, t c change CP becomes much faster than KP n practce! Sebastaan Indesteege A Practcal Attack on KeeLoq 14/ 21

32 Introducton Our Attacks Practce Conclusons Experments Applcablty Expermental Results Experments on one core of an AMD Athlon 64 X Known plantext attack mnutes,.e., ±500 CPU days 288 tmes faster than [CB07] Chosen plantext attack mnutes,.e., ±218 CPU days 661 tmes faster than [CB07] Average from 500 experments. Standard devaton < 2 s. Sebastaan Indesteege A Practcal Attack on KeeLoq 15/ 21

33 Introducton Our Attacks Practce Conclusons Experments Applcablty Practcal Applcablty of the Attack Authentcaton protocols Authentcaton protocols based on KeeLoq, used e.g. n cars. KeeLoq Rollng Codes One-pass authentcaton protocol usng a synchronsed 16-bt counter. Not nterestng for our attack Sebastaan Indesteege A Practcal Attack on KeeLoq 16/ 21

34 Introducton Our Attacks Practce Conclusons Experments Applcablty Practcal Applcablty of the Attack Authentcaton protocols (contnued) KeeLoq Identfy Frend or Foe (IFF) protocol Smple challenge-response authentcaton protocol. challenge E k (challenge) Challenges are not authentcated! Chosen plantext ablty! Gatherng 2 16 CP takes ±65 mnutes Sebastaan Indesteege A Practcal Attack on KeeLoq 17/ 21

35 Introducton Our Attacks Practce Conclusons Experments Applcablty Practcal Applcablty of the Attack Key dervaton In KeeLoq, all secret keys are derved from a master key, usng one of four ways: Dervaton functon XOR, or KeeLoq Decrypton Use of a seed-value Normal Learnng, or Secure Learnng XOR-based: k = pad(id, seed) k master Fnd one secret key, fnd the master key! Sebastaan Indesteege A Practcal Attack on KeeLoq 18/ 21

36 Outlne Introducton Our Attacks Practce Conclusons 1 Introducton Descrpton of the KeeLoq Block Cpher Prevous Attacks on KeeLoq 2 Our Attacks on KeeLoq Prelmnares Basc Attack Scenaro A Generalsaton of the Attack A Chosen Plantext Attack 3 Practce Expermental Results Practcal Applcablty of the Attack 4 Conclusons Sebastaan Indesteege A Practcal Attack on KeeLoq 19/ 21

37 Introducton Our Attacks Practce Conclusons Conclusons KeeLoq s badly broken Practcal Slde/MtM attack usng 2 16 KP or CP IFF protocol gves chosen plantext ablty XOR-based key dervaton s obvously flawed Soon, cryptographers wll all drve expensve cars Attack Type Data Tme Practce Memory Slde/MtM 2 16 KP CPU days ±3 MB Slde/MtM 2 16 CP CPU days ±2 MB Not all conclusons are to be taken too serously... Sebastaan Indesteege A Practcal Attack on KeeLoq 20/ 21

38 References References [B07] [B07b] [CB07] [C+08] [E+08] Andrey Bogdanov Cryptanalyss of the KeeLoq block cpher Cryptology eprnt Archve, Report 2007/055 Andrey Bogdanov Attacks on the KeeLoq Block Cpher and Authentcaton Systems 3rd Conference on RFID Securty 2007 Ncolas T. Courtos and Gregory V. Bard Algebrac and Slde Attacks on KeeLoq Cryptology eprnt Archve, Report 2007/062 Ncolas T. Courtos, Gregory V. Bard and Davd Wagner Algebrac and Slde Attacks on KeeLoq Proceedngs of Fast Software Encrypton 2008 Thomas Esenbarth, Tmo Kasper, Amr Morad, Chrstof Paar, Mahmoud Salmaszadeh and Mohammad T. Manzur Shalman Physcal Cryptanalyss of KeeLoq Code Hoppng Applcatons Cryptology eprnt Archve, Report 2008/058 Sebastaan Indesteege A Practcal Attack on KeeLoq 21/ 21