Differential Fault Analysis of Trivium
|
|
|
- Godwin Ward
- 5 years ago
- Views:
Transcription
1 Differential Fault Analysis of Trivium Michal Hojsík 1, 3 and Bohuslav Rudolf 2, 3 1 The Selmer Center, University of Bergen, Norway 2 National Security Authority, Czech Republic 3 Department of Algebra, Charles University in Prague, Czech Republic Fast Software Encryption 2008 February 10-13, Lausanne Michal Hojsík and Bohuslav Rudolf () Differential Fault Analysis of Trivium Fast Software Encryption / 13
2 Talk outline Talk outline Trivium description Differential fault analysis Differential fault analysis of Trivium Experimental results Michal Hojsík and Bohuslav Rudolf () Differential Fault Analysis of Trivium Fast Software Encryption / 13
3 Trivium Trivium Hardware oriented additive synchronous stream cipher Designed by de Cannière and Preneel in 2005 for estream Project Very fast in hardware and software 80-bit secret key and 80-bit initialisation vector Consists of 3 non-linear shift registers 288 bit inner state Michal Hojsík and Bohuslav Rudolf () Differential Fault Analysis of Trivium Fast Software Encryption / 13
4 Trivium Description Trivium Cipher description Inner state IS = (s 1,..., s 288 ) Keystream generation algorithm: s 1 s 66 s 69 s 91 s 92 s 93 s94 s 162 s 171 s 175 s 176 s 177 s178 s 243 s 264 s 286 s 287 s 288 zi Michal Hojsík and Bohuslav Rudolf () Differential Fault Analysis of Trivium Fast Software Encryption / 13
5 Trivium Description Trivium Cipher description Secret key K = (K 1,..., K 80 ), initialisation vector IV = (IV 1,..., IV 80 ) Initialisation algorithm = 1152 loops of the keystream gen. alg. without output K 1 K IV1 IV Michal Hojsík and Bohuslav Rudolf () Differential Fault Analysis of Trivium Fast Software Encryption / 13
6 Differential Fault Analysis General overview Differential Fault Analysis - DFA Type of active side-channel attack - adversary actively interferes with a cryptosystem First used in 1996 by Boneh et al. for RSA and by Biham and Shamir for DES Results on stream ciphers, e.g. Hoch, Shamir 2004 Fault Analysis of LFSR based ciphers, Lili128, Sober-t32 Biham, Grandboulan 2005 Impossible Fault Analysis of RC4 Michal Hojsík and Bohuslav Rudolf () Differential Fault Analysis of Trivium Fast Software Encryption / 13
7 Differential Fault Analysis Attack model DFA Attack Model General DFA attack model: Attacker is able to inject a fault into a cipher inner state or intermediate result Attacker has only partial control over their number, location, timing... Attacker can reset the device to its original state and repeat fault injection Our assumptions: Attacker is able to: obtain first n consecutive bits of (proper) keystream {z i } produced out of a state IS t inject exactly one fault (bit flip) into IS t at random position faulty inner state IS t obtain first n consecutive bits of faulty keystream {z i } produced out of IS t repeat the fault injection into the same inner state IS t m times Can be achieved in the Chosen ciphertext attack scenario Michal Hojsík and Bohuslav Rudolf () Differential Fault Analysis of Trivium Fast Software Encryption / 13
8 Fault Injection - Trivium Trivium DFA Fault Injection Attack is based on the simplicity of the Trivium feedback functions Attack uses simple equation (x + 1) y + x y = y s 1 s 40 s 66 s 69 s 91 s 92 s 93 s94 s 162 s 171 s 175 s 176 s 177 s178 s 243 s 264 s 286 s 287 s 288 zi Michal Hojsík and Bohuslav Rudolf () Differential Fault Analysis of Trivium Fast Software Encryption / 13
9 Fault Injection - Trivium Trivium DFA Fault Injection Attack is based on the simplicity of the Trivium feedback functions Attack uses simple equation (x + 1) y + x y = y +1 Michal Hojsík and Bohuslav Rudolf () Differential Fault Analysis of Trivium Fast Software Encryption / 13
10 Fault Injection - Trivium Trivium DFA Fault Injection Attack is based on the simplicity of the Trivium feedback functions Attack uses simple equation (x + 1) y + x y = y Michal Hojsík and Bohuslav Rudolf () Differential Fault Analysis of Trivium Fast Software Encryption / 13
11 Fault Injection - Trivium Trivium DFA Fault Injection Attack is based on the simplicity of the Trivium feedback functions Attack uses simple equation (x + 1) y + x y = y Michal Hojsík and Bohuslav Rudolf () Differential Fault Analysis of Trivium Fast Software Encryption / 13
12 Fault Injection - Trivium Trivium DFA Fault Injection Attack is based on the simplicity of the Trivium feedback functions Attack uses simple equation (s ) s 41 + s 40 s 41 = s s41 +1 Michal Hojsík and Bohuslav Rudolf () Differential Fault Analysis of Trivium Fast Software Encryption / 13
13 Fault Injection - Trivium Trivium DFA Fault Injection Attack is based on the simplicity of the Trivium feedback functions Attack uses simple equation s 39 (s ) + s 39 s 40 = s s39 s Michal Hojsík and Bohuslav Rudolf () Differential Fault Analysis of Trivium Fast Software Encryption / 13
14 Trivium DFA Attack Description Attack Description I Core of the attack - solve a system of equations in the inner state bits IS t = (s 1,..., s 288 ) Use equations given by the (proper) keystream {z i } Use differential fault analysis to obtain more equations Precomputation: for each fault position e, 1 e 288 express first n delta-keystream bits as expression is (s 1,..., s 288 ) store the equations in a table Fault position determination: distance between the output bits differs for each register compute the distances between nonzero bits of a keystream difference determine the fault position - table lookup Michal Hojsík and Bohuslav Rudolf () Differential Fault Analysis of Trivium Fast Software Encryption / 13
15 Attack Description III Trivium DFA Attack Description Attack algorithm: - obtain the proper keystream generated from IS t - insert the keystream equations into the system while solution not found - reset the cipher to the state IS t - insert a fault into IS t at random position - obtain the faulty keystream - determine the fault position - insert delta keystream equations into the system - try to solve the system end while - clock Trivium backwards until initial state reached - read the secret key and IV Michal Hojsík and Bohuslav Rudolf () Differential Fault Analysis of Trivium Fast Software Encryption / 13
16 Experimental Results Trivium DFA Experimental Results Attack: Number of fault injections needed, m, to obtain T inner state bits (avg. over 1000 exp.) T m Number of obtained equations: The average number (among all fault positions) of equations obtained from a random fault: number The average number of equations of degree d obtained from one fault. of steps d = 1 d = 2 d = 3 d = 4 d = 5 d = 6 d = Michal Hojsík and Bohuslav Rudolf () Differential Fault Analysis of Trivium Fast Software Encryption / 13
17 New Results (January 2008) New Results New DFA attack on Trivium Same assumptions as in the described attack Attack uses another cipher representation Attacker needs approx. 12 fault injections to obtain the secret key and IV Michal Hojsík and Bohuslav Rudolf () Differential Fault Analysis of Trivium Fast Software Encryption / 13
18 Conclusion Conclusion Differential fault analysis of Trivium described The first time DFA applied to non-linear feedback shift register stream cipher Attacker can obtain the secret key after approx. 43 (12) fault injections Attack works in chosen ciphertext attack scenario Described attacks have low complexity and are easy to implement Michal Hojsík and Bohuslav Rudolf () Differential Fault Analysis of Trivium Fast Software Encryption / 13
19 Conclusion Thank you for your attention! Michal Hojsík and Bohuslav Rudolf () Differential Fault Analysis of Trivium Fast Software Encryption / 13
Multi-Stage Fault Attacks
Multi-Stage Fault Attacks Applications to the Block Cipher PRINCE Philipp Jovanovic Department of Informatics and Mathematics University of Passau March 27, 2013 Outline 1. Motivation 2. The PRINCE Block
Key Recovery from State Information of Sprout: Application to Cryptanalysis and Fault Attack
Key Recovery from State Information of Sprout: Application to Cryptanalysis and Fault Attack Subhamoy Maitra, Santanu Sarkar, Anubhab Baksi, Pramit Dey Indian Statistical Institute, Kolkata and Indian
External Encodings Do not Prevent Transient Fault Analysis
External Encodings Do not Prevent Transient Fault Analysis Christophe Clavier Gemalto, Security Labs CHES 2007 Vienna - September 12, 2007 Christophe Clavier CHES 2007 Vienna September 12, 2007 1 / 20
A Key Management Scheme for DPA-Protected Authenticated Encryption
A Key Management Scheme for DPA-Protected Authenticated Encryption Mostafa Taha and Patrick Schaumont Virginia Tech DIAC-2013 This research was supported in part by the VT-MENA program of Egypt, and by
Fault Analysis Study of the Block Cipher FOX64
Fault Analysis Study of the Block Cipher FOX64 Ruilin Li 1, Jianxiong You 1, Bing Sun 1,, and Chao Li 1,3 1 Department of Mathematics and System Science, Science College, National University of Defense
An Introduction to new Stream Cipher Designs
An Introduction to new Stream Cipher Designs Ways of Turning Your Data into Line Noise T. E. Bjørstad The Selmer Center, Department of Informatics University of Bergen, Norway 25th Chaos Communications
Cache Timing Analysis of LFSR-based Stream Ciphers
Cache Timing Analysis of LFSR-based Stream Ciphers Gregor Leander, Erik Zenner and Philip Hawkes Technical University Denmark (DTU) Department of Mathematics e.zenner@mat.dtu.dk Cirencester, Dec. 17, 2009
TWO GENERIC METHODS OF. Chinese Academy of Sciences
TWO GENERIC METHODS OF ANALYZING STREAM CIPHERS Lin Jiao, Bin Zhang, Mingsheng Wang Chinese Academy of Sciences Outline Introduction Time Memory Data Tradeoff Attack against Grain v1 Security Evaluation
Correlated Keystreams in Moustique
, Vincent Rijmen, Tor Bjørstad, Christian Rechberger, Matt Robshaw and Gautham Sekar K.U. Leuven, ESAT-COSIC The Selmer Center, University of Bergen Graz University of Technology France Télécom Research
Stream Ciphers An Overview
Stream Ciphers An Overview Palash Sarkar Indian Statistical Institute, Kolkata email: palash@isicalacin stream cipher overview, Palash Sarkar p1/51 Classical Encryption Adversary message ciphertext ciphertext
Stream ciphers. Lecturers: Mark D. Ryan and David Galindo. Cryptography Slide: 91
Stream ciphers Lecturers: Mark D. Ryan and David Galindo. Cryptography 2017. Slide: 91 Lecturers: Mark D. Ryan and David Galindo. Cryptography 2017. Slide: 92 Stream Cipher Suppose you want to encrypt
3 Symmetric Key Cryptography 3.1 Block Ciphers Symmetric key strength analysis Electronic Code Book Mode (ECB) Cipher Block Chaining Mode (CBC) Some
3 Symmetric Key Cryptography 3.1 Block Ciphers Symmetric key strength analysis Electronic Code Book Mode (ECB) Cipher Block Chaining Mode (CBC) Some popular block ciphers Triple DES Advanced Encryption
COZMO - A New Lightweight Stream Cipher
COZMO - A New Lightweight Stream Cipher Rhea Bonnerji 0000-0002-5825-8800, Simanta Sarkar 0000-0002-4210-2764, Krishnendu Rarhi 0000-0002-5794-215X, Abhishek Bhattacharya School of Information Technology,
EC500. Design of Secure and Reliable Hardware. Lecture 1 & 2
EC500 Design of Secure and Reliable Hardware Lecture 1 & 2 Mark Karpovsky January 17 th, 2013 1 Security Errors injected by the attacker (active attacks) Reliability Errors injected by random sources e.g.
CUBE-TYPE ALGEBRAIC ATTACKS ON WIRELESS ENCRYPTION PROTOCOLS
CUBE-TYPE ALGEBRAIC ATTACKS ON WIRELESS ENCRYPTION PROTOCOLS George W. Dinolt, James Bret Michael, Nikolaos Petrakos, Pantelimon Stanica Short-range (Bluetooth) and to so extent medium-range (WiFi) wireless
Fault injection attacks on cryptographic devices and countermeasures Part 1
Fault injection attacks on cryptographic devices and countermeasures Part 1 Israel Koren Department of Electrical and Computer Engineering University of Massachusetts Amherst, MA Outline Introduction -
Trivium. 2 Specifications
Trivium Specifications Christophe De Cannière and Bart Preneel Katholieke Universiteit Leuven, Dept. ESAT/SCD-COSIC, Kasteelpark Arenberg 10, B 3001 Heverlee, Belgium {cdecanni, preneel}@esat.kuleuven.be
page 1 Introduction to Cryptography Benny Pinkas Lecture 3 November 18, 2008 Introduction to Cryptography, Benny Pinkas
Introduction to Cryptography Lecture 3 Benny Pinkas page 1 1 Pseudo-random generator Pseudo-random generator seed output s G G(s) (random, s =n) Deterministic function of s, publicly known G(s) = 2n Distinguisher
Introduction to Modern Cryptography. Lecture 2. Symmetric Encryption: Stream & Block Ciphers
Introduction to Modern Cryptography Lecture 2 Symmetric Encryption: Stream & Block Ciphers Stream Ciphers Start with a secret key ( seed ) Generate a keying stream i-th bit/byte of keying stream is a function
Introduction to information Security
First lecture Introduction to information Security Why Computer and information Security Cryptography Secret key algorithms: DES/AES Public key algorithms: RSA One-way hash functions & message digests:
FPGA Implementation of WG Stream Cipher
FPGA Implementation of WG Stream Cipher Anna Johnson Assistant Professor,ECE Department, Jyothi Engineering College,Thrissur Abstract Cryptography is the technique of providing security to a network. The
Comp527 status items. Crypto Protocols, part 2 Crypto primitives. Bart Preneel July Install the smart card software. Today
Comp527 status items Crypto Protocols, part 2 Crypto primitives Today s talk includes slides from: Bart Preneel, Jonathan Millen, and Dan Wallach Install the smart card software Bring CDs back to Dan s
Some Aspects of Block Ciphers
Some Aspects of Block Ciphers Palash Sarkar Applied Statistics Unit Indian Statistical Institute, Kolkata India palash@isical.ac.in CU-ISI Tutorial Workshop on Cryptology, 17 th July 2011 Palash Sarkar
GSM Security Overview
GSM Security Overview Mehdi Hassanzadeh Mehdi.Hassanzadeh@ii.uib.no Selmer Center, University of Bergen, Norway Norsk ryptoseminar, Bergen, November 9-10, 2011 Agenda A5 Overview : Attack History on A5/1
A Chosen-key Distinguishing Attack on Phelix
A Chosen-key Distinguishing Attack on Phelix Yaser Esmaeili Salehani* and Hadi Ahmadi** * Zaeim Electronic Industries Co., Tehran, Iran. ** School of Electronic Engineering, Sharif University of Technology,
Stream Ciphers: A Practical Solution for Efficient Homomorphic-Ciphertext Compression
Stream Ciphers: A Practical Solution for Efficient Homomorphic-Ciphertext Compression Anne Canteaut, Sergiu Carpov, Caroline Fontaine, Tancrède Lepoint, María Naya-Plasencia, Pascal Paillier, Renaud Sirdey
CPS2323. Symmetric Ciphers: Stream Ciphers
Symmetric Ciphers: Stream Ciphers Content Stream and Block Ciphers True Random (Stream) Generators, Perfectly Secure Ciphers and the One Time Pad Cryptographically Strong Pseudo Random Generators: Practical
A Fault Attack Against the FOX Cipher Family
A Fault Attack Against the FOX Cipher Family L. Breveglieri 1,I.Koren 2,andP.Maistri 1 1 Department of Electronics and Information Technology, Politecnico di Milano, Milano, Italy {brevegli, maistri}@elet.polimi.it
Lecture 2: Secret Key Cryptography
T-79.159 Cryptography and Data Security Lecture 2: Secret Key Cryptography Helger Lipmaa Helsinki University of Technology helger@tcs.hut.fi 1 Reminder: Communication Model Adversary Eve Cipher, Encryption
Improved differential fault analysis on lightweight block cipher LBlock for wireless sensor networks
Jeong et al. EURASIP Journal on Wireless Communications and Networking 2013, 2013:151 RESEARCH Improved differential fault analysis on lightweight block cipher LBlock for wireless sensor networks Kitae
PARAMETRIC TROJANS FOR FAULT-BASED ATTACKS ON CRYPTOGRAPHIC HARDWARE
PARAMETRIC TROJANS FOR FAULT-BASED ATTACKS ON CRYPTOGRAPHIC HARDWARE Raghavan Kumar, University of Massachusetts Amherst Contributions by: Philipp Jovanovic, University of Passau Wayne P. Burleson, University
Sho Endo1, Naofumi Homma1, Yu-ichi Hayashi1, Junko Takahashi2, Hitoshi Fuji2 and Takafumi Aoki1
April 15, 2014 COSADE2014 A Multiple-fault Injection Attack by Adaptiv e Timing Control under Black-box Conditi ons and a Countermeasure Sho Endo1, Naofumi Homma1, Yu-ichi Hayashi1, Junko Takahashi2, Hitoshi
Cache Timing Attacks on estream Finalists
Cache Timing Attacks on estream Finalists Erik Zenner Technical University Denmark (DTU) Institute for Mathematics e.zenner@mat.dtu.dk Echternach, Jan. 9, 2008 Erik Zenner (DTU-MAT) Cache Timing Attacks
Two Attacks Against the HBB Stream Cipher
Two Attacks Against the HBB Stream Cipher Antoine Joux 1 and Frédéric Muller 2 1 DGA and Univ. Versailles St-Quentin Antoine.Joux@m4x.org 2 DCSSI Crypto Lab Frederic.Muller@sgdn.pm.gouv.fr Abstract. Hiji-Bij-Bij
Improved Attack on Full-round Grain-128
Improved Attack on Full-round Grain-128 Ximing Fu 1, and Xiaoyun Wang 1,2,3,4, and Jiazhe Chen 5, and Marc Stevens 6, and Xiaoyang Dong 2 1 Department of Computer Science and Technology, Tsinghua University,
L2. An Introduction to Classical Cryptosystems. Rocky K. C. Chang, 23 January 2015
L2. An Introduction to Classical Cryptosystems Rocky K. C. Chang, 23 January 2015 This and the next set of slides 2 Outline Components of a cryptosystem Some modular arithmetic Some classical ciphers Shift
A Framework for the Analysis and Evaluation of Algebraic Fault Attacks on Lightweight Block Ciphers
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 1 A Framework for the Analysis and Evaluation of Algebraic Fault Attacks on Lightweight Block Ciphers Fan Zhang, Shize Guo, Xinjie Zhao, Tao Wang,
Cryptography for Resource Constrained Devices: A Survey
Cryptography for Resource Constrained Devices: A Survey Jacob John Dept. of Computer Engineering Sinhgad Institute of Technology Pune, India. jj31270@yahoo.co.in Abstract Specifically designed and developed
CHAPTER 2. KEYED NON-SURJECTIVE FUNCTIONS IN STREAM CIPHERS54 All bytes in odd positions of the shift register are XORed and used as an index into a f
CHAPTER 2. KEYED NON-SURJECTIVE FUNCTIONS IN STREAM CIPHERS53 is 512. Λ This demonstrates the contribution to the security of RC4 made by the simple swapping of S table entries in the memory update function.
New Time-Memory-Data Trade-Off Attack on the Estream Finalists and Modes of Operation of Block Ciphers
New Time-Memory-Data Trade-Off Attack on the Estream Finalists and Modes of Operation of Block Ciphers Khoongming Khoo DSO National Laboratories, 20 Science Park Drive, S118230, Singapore. kkhoongm@dso.org.sg
EEC-484/584 Computer Networks
EEC-484/584 Computer Networks Lecture 23 wenbing@ieee.org (Lecture notes are based on materials supplied by Dr. Louise Moser at UCSB and Prentice-Hall) Outline 2 Review of last lecture Introduction to
On the Applicability of Distinguishing Attacks Against Stream Ciphers
On the Applicability of Distinguishing Attacks Against Stream Ciphers Greg Rose, Philip Hawkes QUALCOMM Australia {ggr, phawkes}@qualcomm.com Abstract. We demonstrate that the existence of distinguishing
A New Architecture of High Performance WG Stream Cipher
A New Architecture of High Performance WG Stream Cipher Grace Mary S. 1, Abhila R. Krishna 2 1 P G Scholar, VLSI and Embedded Systems, Department of ECE T K M Institute of Technology, Kollam, India 2 Assistant
A Cache Timing Analysis of HC-256
A Cache Timing Analysis of HC-256 Erik Zenner Technical University Denmark (DTU) Institute for Mathematics e.zenner@mat.dtu.dk SAC 2008, Aug. 14, 2008 Erik Zenner (DTU-MAT) A Cache Timing Analysis of HC-256
An Overview of Cryptanalysis Research for the Advanced Encryption Standard
An Overview of Cryptanalysis Research for the Advanced Encryption Standard Alan Kaminsky, Rochester Institute of Technology Michael Kurdziel, Harris Corporation Stanisław Radziszowski, Rochester Institute
An Efficient Stream Cipher Using Variable Sizes of Key-Streams
An Efficient Stream Cipher Using Variable Sizes of Key-Streams Hui-Mei Chao, Chin-Ming Hsu Department of Electronic Engineering, Kao Yuan University, #1821 Jhongshan Rd., Lujhu Township, Kao-Hsiung County,
c Eli Biham - March 13, Cryptanalysis of Modes of Operation (4) c Eli Biham - March 13, Cryptanalysis of Modes of Operation (4)
Single Modes: the S Modes of Operation Modes of Operation are used to hide patterns in the plaintexts, protect against chosen plaintext attacks, and to support fast on-line encryption with precomputation.
Design Space Exploration of the Lightweight Stream Cipher WG-8 for FPGAs and ASICs
Design Space Exploration of the Lightweight Stream Cipher WG- for FPGAs and ASICs Gangqiang Yang, Xinxin Fan, Mark Aagaard and Guang Gong University of Waterloo g37yang@uwaterloo.ca Sept 9, 013 Gangqiang
Classical Cryptography
Classical Cryptography Chester Rebeiro IIT Madras STINSON : chapter 1 Ciphers Symmetric Algorithms Encryption and Decryption use the same key i.e. K E = K D Examples: Block Ciphers : DES, AES, PRESENT,
Differential Fault Analysis on the AES Key Schedule
ifferential Fault Analysis on the AES Key Schedule Junko TAKAHASHI and Toshinori FUKUNAGA NTT Information Sharing Platform Laboratories, Nippon Telegraph and Telephone Corporation, {takahashi.junko, fukunaga.toshinori}@lab.ntt.co.jp
White-Box Cryptography State of the Art. Paul Gorissen
White-Box Cryptography State of the Art Paul Gorissen paul.gorissen@philips.com Outline Introduction Attack models White-box cryptography How it is done Interesting properties State of the art Conclusion
An Improved Cryptanalysis of Lightweight Stream Cipher Grain-v1
An Improved Cryptanalysis of Lightweight Stream Cipher Grain-v1 Miodrag J. Mihaljević 1, Nishant Sinha 2, Sugata Gangopadhyay 2, Subhamoy Maitra 3, Goutam Paul 3 and Kanta Matsuura 4 1 Mathematical Institute,
Clock Glitch Fault Injection Attacks on an FPGA AES Implementation
Journal of Electrotechnology, Electrical Engineering and Management (2017) Vol. 1, Number 1 Clausius Scientific Press, Canada Clock Glitch Fault Injection Attacks on an FPGA AES Implementation Yifei Qiao1,a,
Analysis, demands, and properties of pseudorandom number generators
Analysis, demands, and properties of pseudorandom number generators Jan Krhovják Department of Computer Systems and Communications Faculty of Informatics, Masaryk University Brno, Czech Republic Jan Krhovják
Reihe Informatik in Stream Ciphers. Erik Zenner
Reihe Informatik 01-2004 On the Role of the Inner State Size in Stream Ciphers Erik Zenner On the Role of the Inner State Size in Stream Ciphers Erik Zenner Theoretische Informatik University of Mannheim
Symmetric Cryptography. Chapter 6
Symmetric Cryptography Chapter 6 Block vs Stream Ciphers Block ciphers process messages into blocks, each of which is then en/decrypted Like a substitution on very big characters 64-bits or more Stream
Grain - A Stream Cipher for Constrained Environments
Grain - A Stream Cipher for Constrained Environments Martin Hell 1, Thomas Johansson 1 and Willi Meier 2 1 Dept. of Information Technology, Lund University, P.O. Box 118, 221 00 Lund, Sweden {martin,thomas}@it.lth.se
Improved Multi-Dimensional Meet-in-the-Middle Cryptanalysis of KATAN
Improved Multi-Dimensional Meet-in-the-Middle Cryptanalysis of KATAN Shahram Rasoolzadeh and Håvard Raddum Simula Research Laboratory {shahram,haavardr}@simula.no Abstract. We study multidimensional meet-in-the-middle
Improved Multi-Dimensional Meet-in-the-Middle Cryptanalysis of KATAN
Improved Multi-Dimensional Meet-in-the-Middle Cryptanalysis of KATAN Shahram Rasoolzadeh and Håvard Raddum Simula Research Laboratory Abstract. We study multidimensional meet-in-the-middle attacks on the
Cryptography BITS F463 S.K. Sahay
Cryptography BITS F463 S.K. Sahay BITS-Pilani, K.K. Birla Goa Campus, Goa S.K. Sahay Cryptography 1 Terminology Cryptography: science of secret writing with the goal of hiding the meaning of a message.
Algebraic-Differential Cryptanalysis of DES
Algebraic-Differential Cryptanalysis of DES Jean-Charles FAUGÈRE, Ludovic PERRET, Pierre-Jean SPAENLEHAUER UPMC, Univ Paris 06, LIP6 INRIA, Centre Paris-Rocquencourt, SALSA Project CNRS, UMR 7606, LIP6
Side-Channel Attacks on RSA with CRT. Weakness of RSA Alexander Kozak Jared Vanderbeck
Side-Channel Attacks on RSA with CRT Weakness of RSA Alexander Kozak Jared Vanderbeck What is RSA? As we all know, RSA (Rivest Shamir Adleman) is a really secure algorithm for public-key cryptography.
Cryptography. Summer Term 2010
Cryptography Summer Term 2010 Harald Baier Chapter 3: Pseudo Random Bit Generators and Stream Ciphers Contents Random bits and pseudo random bits Stream ciphers Harald Baier Cryptography h_da, Summer Term
cube attack on stream cipher Trivium and quadraticity test
The cube attack on stream cipher Trivium and quadraticity tests Piotr Mroczkowski Janusz Szmidt Military Communication Institute Poland 17 sierpnia 2010 Cube Attack- Papers and Preprints Itai Dinur and
Block Ciphers Tutorial. c Eli Biham - May 3, Block Ciphers Tutorial (5)
Block Ciphers Tutorial c Eli Biham - May 3, 2005 146 Block Ciphers Tutorial (5) A Known Plaintext Attack on 1-Round DES After removing the permutations IP and FP we get: L R 48 K=? F L R c Eli Biham -
Breaking Grain-128 with Dynamic Cube Attacks
Breaking Grain-128 with Dynamic Cube Attacks Itai Dinur and Adi Shamir Computer Science department The Weizmann Institute Rehovot 76100, Israel Abstract. We present a new variant of cube attacks called
Differential Cryptanalysis
Differential Cryptanalysis See: Biham and Shamir, Differential Cryptanalysis of the Data Encryption Standard, Springer Verlag, 1993. c Eli Biham - March, 28 th, 2012 1 Differential Cryptanalysis The Data
Stream Ciphers and Block Ciphers
Stream Ciphers and Block Ciphers Ruben Niederhagen September 18th, 2013 Introduction 2/22 Recall from last lecture: Public-key crypto: Pair of keys: public key for encryption, private key for decryption.
Advanced WG and MOWG Stream Cipher with Secured Initial vector
International Journal of Scientific and Research Publications, Volume 5, Issue 12, December 2015 471 Advanced WG and MOWG Stream Cipher with Secured Initial vector Dijomol Alias Pursuing M.Tech in VLSI
Cipher Suite Configuration Mode Commands
The Cipher Suite Configuration Mode is used to configure the building blocks for SSL cipher suites, including the encryption algorithm, hash function, and key exchange. Important The commands or keywords/variables
in a 4 4 matrix of bytes. Every round except for the last consists of 4 transformations: 1. ByteSubstitution - a single non-linear transformation is a
Cryptanalysis of Reduced Variants of Rijndael Eli Biham Λ Nathan Keller y Abstract Rijndael was submitted to the AES selection process, and was later selected as one of the five finalists from which one
A Related-Key Attack on TREYFER
The Second International Conference on Emerging Security Information, Systems and Technologies A Related-ey Attack on TREYFER Aleksandar ircanski and Amr M Youssef Computer Security Laboratory Concordia
Weak Keys of the Full MISTY1 Block Cipher for Related-Key Cryptanalysis
3. 2 13.57 Weak eys for a Related-ey Differential Attack Weak eys of the Full MISTY1 Block Cipher for Related-ey Cryptanalysis Institute for Infocomm Research, Agency for Science, Technology and Research,
Stream Ciphers and Block Ciphers
Stream Ciphers and Block Ciphers 2MMC10 Cryptology Fall 2015 Ruben Niederhagen October 6th, 2015 Introduction 2/32 Recall: Public-key crypto: Pair of keys: public key for encryption, private key for decryption.
Improved Algebraic Cryptanalysis of QUAD, Bivium and Trivium via Graph Partitioning on Equation Systems
Improved Algebraic of QUAD, Bivium and Trivium via on Equation Systems Kenneth Koon-Ho Wong 1, Gregory V. Bard 2 1 Information Security Institute Queensland University of Technology, Brisbane, Australia
Symmetric Cryptography. CS4264 Fall 2016
Symmetric Cryptography CS4264 Fall 2016 Correction: TA Office Hour Stefan Nagy (snagy2@vt.edu) Office hour: Thursday Friday 10-11 AM, 106 McBryde Hall 2 Slides credit to Abdou Illia RECAP AND HIGH-LEVEL
International Journal for Research in Applied Science & Engineering Technology (IJRASET) Performance Comparison of Cryptanalysis Techniques over DES
Performance Comparison of Cryptanalysis Techniques over DES Anupam Kumar 1, Aman Kumar 2, Sahil Jain 3, P Kiranmai 4 1,2,3,4 Dept. of Computer Science, MAIT, GGSIP University, Delhi, INDIA Abstract--The
The RAKAPOSHI Stream Cipher
The RAKAPOSHI Stream Cipher Carlos Cid 1, Shinsaku Kiyomoto 2, and Jun Kurihara 2 1 Information Security Group, Royal Holloway, University of London Egham, United Kingdom carlos.cid@rhul.ac.uk 2 KDDI R
PRNGs & DES. Luke Anderson. 16 th March University Of Sydney.
PRNGs & DES Luke Anderson luke@lukeanderson.com.au 16 th March 2018 University Of Sydney Overview 1. Pseudo Random Number Generators 1.1 Sources of Entropy 1.2 Desirable PRNG Properties 1.3 Real PRNGs
A Differential Fault Attack against Early Rounds of (Triple-)DES
A Differential Fault Attack against Early Rounds of (Triple-)DES Ludger Hemme Giesecke & Devrient GmbH Prinzregentenstr. 159, 81677 Munich, Germany ludger.hemme@de.gi-de.com Abstract. Previously proposed
Public-Key Cryptography
Computer Security Spring 2008 Public-Key Cryptography Aggelos Kiayias University of Connecticut A paradox Classic cryptography (ciphers etc.) Alice and Bob share a short private key using a secure channel.
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 7 February 5, 2013 CPSC 467b, Lecture 7 1/45 Stream cipher from block cipher Review of OFB and CFB chaining modes Extending chaining
VHDL for RSA Public Key System
VHDL for RSA Public Key System Rui He, Jie Gu, Liang Zhang, Cheng Li Engineering and Applied Science Memorial University of Newfoundland St. John s, NL, Canada, A1B3X5 E-mail: {ruihe, jiegu, lzhang, licheng}@engr.mun.ca
Outline. Data Encryption Standard. Symmetric-Key Algorithms. Lecture 4
EEC 693/793 Special Topics in Electrical Engineering Secure and Dependable Computing Lecture 4 Department of Electrical and Computer Engineering Cleveland State University wenbing@ieee.org Outline Review
SAT Solvers in the Context of Cryptography
SAT Solvers in the Context of Cryptography v2.0 Presentation at Montpellier Mate Soos UPMC LIP6, PLANETE team INRIA, SALSA Team INRIA 10th of June 2010 Mate Soos (UPMC LIP6, PLANETE team SAT INRIA, solvers
Susceptibility of estream Candidates towards Side Channel Analysis
Susceptibility of estream Candidates towards Side Channel Analysis Benedikt Gierlichs 1, Lejla Batina 1, Christophe Clavier 2, Thomas Eisenbarth 3, Aline Gouget 4, Helena Handschuh 5, Timo Kasper 3, Kerstin
Network Security. Lecture# 6 Lecture Slides Prepared by: Syed Irfan Ullah N.W.F.P. Agricultural University Peshawar
Network Security Lecture# 6 Lecture Slides Prepared by: Syed Irfan Ullah N.W.F.P. Agricultural University Peshawar Modern Block Ciphers now look at modern block ciphers one of the most widely used types
Fault-Based Attack of RSA Authentication
Fault-Based Attack of RSA Authentication, Valeria Bertacco and Todd Austin 1 Cryptography: Applications 2 Value of Cryptography $2.1 billions 1,300 employees $1.5 billions 4,000 employees $8.7 billions
ECE596C: Handout #7. Analysis of DES and the AES Standard. Electrical and Computer Engineering, University of Arizona, Loukas Lazos
ECE596C: Handout #7 Analysis of DES and the AES Standard Electrical and Computer Engineering, University of Arizona, Loukas Lazos Abstract. In this lecture we analyze the security properties of DES and
Vulnerability of Certain Stream Ciphers Based on k-normal Boolean Functions
Vulnerability of Certain Stream Ciphers Based on k-normal Boolean Functions Miodrag Mihaljevic RCIS-AIST, Tokyo A Seminar Lecture at CCRG School of Physics and Mathematical Sciences Nanyang Technological
Cryptanalysis of ORYX
Cryptanalysis of ORYX D. Wagner 1, L. Simpson 2, E. Dawson 2, J. Kelsey 3, W. Millan 2, and B. Schneier 3 1 University of California, Berkeley daw@cs.berkeley.edu 2 Information Security Research Centre,
Fault Detection of the Camellia Cipher against Single Byte Differential Fault Analysis
Appl. Math. Inf. Sci. 6-3S, No. 3, 951-957 (2012) 951 Applied Mathematics & Information Sciences An International Journal Fault Detection of the Camellia Cipher against Single Byte Differential Fault Analysis
Classic Cryptography: From Caesar to the Hot Line
Classic Cryptography: From Caesar to the Hot Line Wenyuan Xu Department of Computer Science and Engineering University of South Carolina Overview of the Lecture Overview of Cryptography and Security Classical
Fault Sensitivity Analysis
Fault Sensitivity Analysis Yang Li 1, Kazuo Sakiyama 1, Shigeto Gomisawa 1, Toshinori Fukunaga 2, Junko Takahashi 1,2,andKazuoOhta 1 1 Department of Informatics, The University of Electro-Communications
Cryptanalysis of KeeLoq with COPACOBANA
Cryptanalysis of KeeLoq with COPACOBANA Martin Novotný 1 and Timo Kasper 2 1 Faculty of Information Technology Czech Technical University in Prague Kolejní 550/2 160 00 Praha 6, Czech Republic email: novotnym@fit.cvut.cz
Weak Keys. References
Weak Keys The strength of the encryption function E K (P) may differ significantly for different keys K. If for some set WK of keys the encryption function is much weaker than for the others this set is
A Related Key Attack on the Feistel Type Block Ciphers
International Journal of Network Security, Vol.8, No.3, PP.221 226, May 2009 221 A Related Key Attack on the Feistel Type Block Ciphers Ali Bagherzandi 1,2, Mahmoud Salmasizadeh 2, and Javad Mohajeri 2
Introduction to Cryptography. Lecture 3
Introduction to Cryptography Lecture 3 Benny Pinkas March 6, 2011 Introduction to Cryptography, Benny Pinkas page 1 Pseudo-random generator seed s (random, s =n) Pseudo-random generator G Deterministic
Piret and Quisquater s DFA on AES Revisited
Piret and Quisquater s DFA on AES Revisited Christophe Giraud 1 and Adrian Thillard 1,2 1 Oberthur Technologies, 4, allée du doyen Georges Brus, 33 600 Pessac, France. c.giraud@oberthur.com 2 Université
Introduction to Cryptographic Systems. Asst. Prof. Mihai Chiroiu
Introduction to Cryptographic Systems Asst. Prof. Mihai Chiroiu Vocabulary In cryptography, cyphertext is the result of encryption performed on plaintext using an algorithm, called a cipher. Decryption