From Lausanne to Geneva

Transcription

1 From Lausanne to Geneva How PRESENT became an ISO Standard Axel Y. Poschmann LightCrypto Cannes,

2 Agenda The beginning Optimize implementation of standard algorithm Modify best standard algorithm Design from scratch Standardization and Industry Adoption Lessons Learned and how to improve 2

3 key input output aes_done data_signal " " control_signal in-/output 128 s_output The Beginning init_mem 128 in_mem Memory rd_0,rd_1,rd_2,rd_3 init_key MEM Studi project at EPFL (11/04-02/05) Goal: Implement a lightweight AES in VHDL, synthesise it on standard-cell library then on MCML library, simulate power consumption, mount DPA, and compare the results Catch: never heard of VHDL before Result: somewhat lightweight AES (39,567 Transistors) in standard cell library with a 32-bit data path Learning: VHDL and EDA tool chain Key Management KM 32 roundkey ctrl_encrypt 32 out_km out_sb out_mem ctrl_ks 1 0 in_sb SubBytes SB out_sb 32 aes_done in_imc 32 Inverse MixColumns IMC Controler FSM out_imc ctrl_lastround out_sb 32 encrypt 0 1 in_mc 32 MixColumns MC roundkey out_mc encrypt in_imc 1 0 s_in_mem ctrl_lastround 1 0 in_mem in_mem 32 n_reset enable encrypt 3

4 Optimize Goal of subsequent Master project was to finish the open tasks Catch: gross underestimation of just how much work it is to develop a custom made standard cell library Plan B: serialised implementation of DES (inspired by Feldhofer et al.) Result: smallest DES (beat Ingrid s 15 year old record) Learning: seize opportunities and stay on course People who are still working on DES should probably start a self-help group. 4

5 SEA Results AES 3000 Hight DES AES GE DES DESXL DESL Grain PRESENT Cycles 5

6 Modify Christof: I am just thinking loudly: in one week is submission deadline of FSE 05 Instead: Let s do research. Why don't we simply replace the 8 DES S-boxes by one S-box? Result: DESL, a lightweight DES variant, FSE 07 paper Learning: S-box construction, contact with Matt Robshaw and Lars Knudsen; do not celebrate before submission deadline is over, cf CHES 06 6

7 Serialized DES -> DESL Key schedule 32% State register S-Boxes 6-to-4 substitution tables highly non-linear high Boolean compl. 34% of area! Idea: Replace S1...S8 by S together 30% 7

8 Design Criteria for single S-box DES Differential Cryptanalysis C1 DESL LC Linear Cryptanalysis Davies-Murphy Attack C1 3R 4R 5R nr C1 A=(1,2), C3 A=(1,1) A=(2,1) A=(2,2) rest b=1 b=2 b>=2 C3 C3 C4 C2 a=1 a=2 a>2 a=1 a=2 a>2 C2 C6 C5 C2 C6 C4 C2 (000010) (010000) Ci = Condition i C7 C8 8

9 SEA Results AES 3000 Hight DES AES GE DES DESXL DESL Grain PRESENT Cycles 9

10 Design Goal: design a lightweight block cipher from scratch Radically optimised for low gate count Start from HW friendly AES finalist SERPENT Result: PRESENT, CHES 07 paper Learning: continue doing in what you believe is right. You might be just 5-10 years ahead of time PRESENT, the new block cipher standard! HAHAHAHAHAHA!!!! 10

11 PRESENT Substitution Permutation Network (SPN) saves XOR 80/128 bit key length, 64 bit block length 4-bit S-boxes, bit permutation x 11

12 S-Boxes in Hardware AES-LUT 1000 AES-CF 233 DES 120 PRESENT 22.3 LUT = Boolean function Highly non-linear high Boolean complexity Large area 8 x 8 6 x 4 4 x 4 12

13 PRESENT Key Schedule S-box same as in data path round counter thwarts Related Key Attacks 13

14 HW Implementation data_out 4 data_in PRESENT-80/ State 86% Key [greg-4/64] 4 4 [greg-4/80] 64 P-Layer 64 4 <<61 4 Krypto 6% 4 5 S-Box counter key 8% n_reset FSM done 1000 GE 547 CLK 14

15 SEA Results AES 3000 Hight DES AES GE DES DESXL DESL PRESENT Cycles 15

16 Now what? How to deploy a cipher? Do not patent it Raise awareness through education (cyptool) Make it a standard, so industry will use it 16

17 ISO/IEC First contact with Riaal Domingues in December 2008 Co-editor of ISO/IEC in st Working Draft presented in Feb 2010 ISO standard published in January

18 Industry Adoption Difficult to get insights Fortune 500 Tier 1 Automotive Supplier has optimised HW and SW implementations NXP uses variants of PRESENT High-end smartphones use it for memory encryption 18

19 Citation Count PRESENT 1227 curve chacha poly Simon/Speck 249 Google, Apple HomeKit Trillium, Impinj 19

20 SIMON/SPECK First white-paper published on 29 May 2012 No design details, just outrageous implementation figures Full specifications published on 19 June 2013 First commercial products using SIMON/SPECK soon available 20

21 Curiosity triggered 21

22 Reverse Engineering 22

23 Reverse Engineering CANNOT use 6.25 GE FF! para y/n evidence Simple 2? p7 Iterated Sbox 4? serialization figures MDS 8 X p7 footnote Or ROUNDS Y TP at most n/2 times faster than bit-serial -> Feistel? Network Feistel 16 N? p10 encryption only figures KATAN style Y? p 13 bit serialized! No Rounds p7,8 simple round function p7 ammendable to crypranalysis p8 tight security margin p8 bash theoretical weaknesses no usage of haardwired key trick no comparison with KTANTAN, but with KATAN maybe adding, not XOR maybe 3 MUX for 2 key chi 3,75 NOT NAND XNOR 18 4 NOT AND XOR 23

24 Lessons Learned and how to improve Awareness and open access are key! Stir up the pre-publication hype (Apple-style) Raise awareness in many different communities through publications, talks, standard proposals Make it part of as many standards as possible Make as many optimised -and ready to use- implementations as possible freely available Spend significant effort to make it as simple as possible to use your cipher 24

25 Thank You! Questions? Axel Y. Poschmann