Hitag 2 Hell Brutally Optimizing Guess-and-Determine Attacks
|
|
|
- Veronica Hardy
- 5 years ago
- Views:
Transcription
1 Hitag 2 Hell Brutally Optimizing Guess-and-Determine Attacks Aram Verstegen and Roel Verdult and Wouter Bokslag FactorIT B.V. August 14th 2018 Verstegen, Verdult, Bokslag (FactorIT) Hitag 2 hell August 14th / 20
2 Overview 1 Introduction 2 LFSR-based stream ciphers 3 Hitag2 4 Guess-and-determine attacks 5 Performance optimization 6 Performance evaluation 7 Takeaways 8 End-to-end demonstration Verstegen, Verdult, Bokslag (FactorIT) Hitag 2 hell August 14th / 20
3 Remote Keyless Entry UHF frame format Contains 32-bit MAC (KS) on frame data KS is a 32-bit sample of Hitag2 keystream Determined by the public UID, secret 48-bit key and partly public 32-bit nonce 28-bit counter is incremented after each press Verstegen, Verdult, Bokslag (FactorIT) Hitag 2 hell August 14th / 20
4 LFSR-based stream ciphers LFSR State register is initialized with secret key Round function shifts register by one bit Feedback function computes new bit to shift in, based on state Verstegen, Verdult, Bokslag (FactorIT) Hitag 2 hell August 14th / 20
5 LFSR-based stream ciphers LFSR State register is initialized with secret key Round function shifts register by one bit Feedback function computes new bit to shift in, based on state Cryptanalysis Try to find state at any point in time Construct inverse round function, roll back to initial state Verstegen, Verdult, Bokslag (FactorIT) Hitag 2 hell August 14th / 20
6 Hitag2 Hitag2 filter function Keystream generated by nonlinear filter function Consists of two layers of boolean operations Keystream bit value is determined by 20 state bits Verstegen, Verdult, Bokslag (FactorIT) Hitag 2 hell August 14th / 20
7 Hitag2 Leakage of state information Keystream bit reveals information about cipher state bits 2 20 candidates, but only 2 19 generate observed bit Eliminate half the possibilities for each keystream bit Verstegen, Verdult, Bokslag (FactorIT) Hitag 2 hell August 14th / 20
8 Guess-and-determine Propagate guesses over multiple layers Several of the input bits for f can overlap with previous guesses Fewer guesses to make on the state for each subsequent keystream bit tested Still eliminate half the guesses in each layer Layer guesses can be expressed as bit masks Verstegen, Verdult, Bokslag (FactorIT) Hitag 2 hell August 14th / 20
9 Guess-and-determine Propagate guesses over multiple layers Several of the input bits for f can overlap with previous guesses Fewer guesses to make on the state for each subsequent keystream bit tested Still eliminate half the guesses in each layer Layer guesses can be expressed as bit masks Verstegen, Verdult, Bokslag (FactorIT) Hitag 2 hell August 14th / 20
10 Guess-and-determine Propagate guesses over multiple layers Several of the input bits for f can overlap with previous guesses Fewer guesses to make on the state for each subsequent keystream bit tested Still eliminate half the guesses in each layer Layer guesses can be expressed as bit masks Verstegen, Verdult, Bokslag (FactorIT) Hitag 2 hell August 14th / 20
11 Guess-and-determine Propagate guesses over multiple layers Several of the input bits for f can overlap with previous guesses Fewer guesses to make on the state for each subsequent keystream bit tested Still eliminate half the guesses in each layer Layer guesses can be expressed as bit masks Verstegen, Verdult, Bokslag (FactorIT) Hitag 2 hell August 14th / 20
12 Guess-and-determine Full state is determined at layer states reach this point on average Test 23 more keystream bits to reduce to 2 16 Internal states can be rolled back to initial state with inverse LFSR Verstegen, Verdult, Bokslag (FactorIT) Hitag 2 hell August 14th / 20
13 Performance optimization Trivial optimizations Pre-compute filter function outputs through lookup tables Pre-compute state bit guesses Unroll 9 layers of recursion as 9 nested loops Verstegen, Verdult, Bokslag (FactorIT) Hitag 2 hell August 14th / 20
14 Performance optimization Trivial optimizations Pre-compute filter function outputs through lookup tables Pre-compute state bit guesses Unroll 9 layers of recursion as 9 nested loops Advanced optimizations Only generate ideal guesses Pre-compute and cache the results for later computations in earlier ones Bit-slice the implementation Verstegen, Verdult, Bokslag (FactorIT) Hitag 2 hell August 14th / 20
15 Performance optimization Generating ideal guesses Use known state information and expected result to generate ideal lookup tables per layer Can test first 9 keystream bits without relying on f entirely 23 MB tables too large to fit in cache negative trade-off Verstegen, Verdult, Bokslag (FactorIT) Hitag 2 hell August 14th / 20
16 Performance optimization Memoization From layer 2 onwards, some subfilters for upcoming layers are entirely determined Keep memos of the evaluation of these subfilters (memoization) Verstegen, Verdult, Bokslag (FactorIT) Hitag 2 hell August 14th / 20
17 Performance optimization naive memoized to subfilters computed keystream bit test Verstegen, Verdult, Bokslag (FactorIT) Hitag 2 hell August 14th / 20
18 Performance optimization Bit-slicing Parallelize to native register width Transpose multiple states over multiple v-bit registers Verstegen, Verdult, Bokslag (FactorIT) Hitag 2 hell August 14th / 20
19 Performance evaluation Optimization type Platform Cores Running time Naive BF (Immler 2012) Tesla C CUDA 660 minutes 32-way bit-sliced (Benadjila et al. 2017) GTX780Ti 2880 CUDA 1080 minutes 32-way bit-sliced (Benadjila et al. 2017) 16 x Tesla K CUDA 45 minutes Naive guess-and-determine i7 3700K 4 Intel 127 minutes Avoiding impossible guesses i7 3700K 4 Intel 96 minutes 256-way bit-sliced, memoized to depth 12 i7 3700K 4 Intel 59 minutes 32-way bit-sliced, memoized to depth 17 GTX1080Ti 3584 CUDA 1.2 minutes Table: Performance evaluation of average running time compared to related work. Performance Two previous publications implement naive brute force Guess-and-determine offers serious performance improvement Factor 500 performance improvement a a Normalizing for cuda core count and gpu base clock speed Verstegen, Verdult, Bokslag (FactorIT) Hitag 2 hell August 14th / 20
20 Takeaways Guess-and-determine optimization techniques Conceptual (predetermine guesses, memoized) Implementational (unrolled recursion, lookups, bit-sliced) Proof of concept on Hitag2 stream cipher Recovers internal state in roughly 1 minute Applicable in RKE as well as in immobilizer context Verstegen, Verdult, Bokslag (FactorIT) Hitag 2 hell August 14th / 20
21 Demonstration Verstegen, Verdult, Bokslag (FactorIT) Hitag 2 hell August 14th / 20
22 Demonstration Verstegen, Verdult, Bokslag (FactorIT) Hitag 2 hell August 14th / 20
23 Demonstration Verstegen, Verdult, Bokslag (FactorIT) Hitag 2 hell August 14th / 20
24 Demonstration Keystream: 0x74136f48 Verstegen, Verdult, Bokslag (FactorIT) Hitag 2 hell August 14th / 20
25 Demonstration $./hitag2_cracker 74136f48 [+] FactorIT HITAG2 state finder [i] Using platform: NVIDIA CUDA [+] Cracker started [i] Running Hitag2 on 1 device (25.00%) [i] Running Hitag2 on 1 device (50.00%) [i] Running Hitag2 on 1 device (75.00%) [+] Cracker finished Writing outfile 74136f48.txt $ head 74136f48.txt 09a0245fcb f0481 0f000ef0b3e3... Verstegen, Verdult, Bokslag (FactorIT) Hitag 2 hell August 14th / 20
26 Download Verstegen, Verdult, Bokslag (FactorIT) Hitag 2 hell August 14th / 20
Cracking HiTag2 Crypto
Cracking HiTag2 Crypto Weaponising Academic Attacks for Breaking and Entering Kev Sheldrake rtfcode@gmail.com @kevsheldrake github/rtfcode rtfc.org.uk Kev Sheldrake Hacker Researcher Reverse engineer Maker
CRYPTOGRAPHIC ENGINEERING ASSIGNMENT II Theoretical: Design Weaknesses in MIFARE Classic
CRYPTOGRAPHIC ENGINEERING ASSIGNMENT II Theoretical: Design Weaknesses in MIFARE Classic Özgecan Payzin, s4159721 ozgecan.payzin@student.ru.nl April 1, 2013 1 Introduction The MIFARE Classic is one of
LOCK IT AND STILL LOSE IT ON THE (IN)SECURITY OF AUTOMOTIVE REMOTE KEYLESS ENTRY SYSTEMS
LOCK IT AND STILL LOSE IT ON THE (IN)SECURITY OF AUTOMOTIVE REMOTE KEYLESS ENTRY SYSTEMS FLAVIO GARCIA, DAVID OSWALD, TIMO KASPER, PIERRE PAVLIDES PRESENTED BY JACOB BEDNARD, WAYNE STATE UNIVERSITY CSC5991
CHAPTER 2. KEYED NON-SURJECTIVE FUNCTIONS IN STREAM CIPHERS54 All bytes in odd positions of the shift register are XORed and used as an index into a f
CHAPTER 2. KEYED NON-SURJECTIVE FUNCTIONS IN STREAM CIPHERS53 is 512. Λ This demonstrates the contribution to the security of RC4 made by the simple swapping of S table entries in the memory update function.
Dismantling MIFARE Classic
Institute for Computing and Information Sciences, Radboud University Nijmegen, The Netherlands. ESORICS 2008 Joint work with: Gerhard de Koning Gans, Ruben Muijrers, Peter van Rossum, Roel Verdult, Ronny
Breaking Hitag 2 Revisited
Breaking Hitag 2 Revisited Vincent Immler Ruhr University Bochum, Germany vincent.immler+space2012@rub.de Abstract. Many Radio Frequency IDentification (RFID) applications such as car immobilizers and
AEGIS. A Fast Authenticated Encryption Algorithm. Nanyang Technological University KU Leuven and iminds DIAC 2014 AEGIS 1
AEGIS A Fast Authenticated Encryption Algorithm Hongjun Wu Bart Preneel Nanyang Technological University KU Leuven and iminds 1 AEGIS: A shield carried by Athena and Zeus 2 Different Design Approaches:
Lock It and S,ll Lose It - On the (In)Security of Automo,ve Remote Keyless Entry Systems
Lock It and S,ll Lose It - On the (In)Security of Automo,ve Remote Keyless Entry Systems Flavio D. Garcia 1, David Oswald 1, Timo Kasper 2 and Pierre Pavlidès 1 1. University of Birmingham, UK 2. Kasper
ENGI 8868/9877 Computer and Communications Security III. BLOCK CIPHERS. Symmetric Key Cryptography. insecure channel
(a) Introduction - recall symmetric key cipher: III. BLOCK CIPHERS k Symmetric Key Cryptography k x e k y yʹ d k xʹ insecure channel Symmetric Key Ciphers same key used for encryption and decryption two
TWO GENERIC METHODS OF. Chinese Academy of Sciences
TWO GENERIC METHODS OF ANALYZING STREAM CIPHERS Lin Jiao, Bin Zhang, Mingsheng Wang Chinese Academy of Sciences Outline Introduction Time Memory Data Tradeoff Attack against Grain v1 Security Evaluation
Symmetric Key Algorithms. Definition. A symmetric key algorithm is an encryption algorithm where the same key is used for encrypting and decrypting.
Symmetric Key Algorithms Definition A symmetric key algorithm is an encryption algorithm where the same key is used for encrypting and decrypting. 1 Block cipher and stream cipher There are two main families
SAT Solvers in the Context of Cryptography
SAT Solvers in the Context of Cryptography v2.0 Presentation at Montpellier Mate Soos UPMC LIP6, PLANETE team INRIA, SALSA Team INRIA 10th of June 2010 Mate Soos (UPMC LIP6, PLANETE team SAT INRIA, solvers
3 Symmetric Key Cryptography 3.1 Block Ciphers Symmetric key strength analysis Electronic Code Book Mode (ECB) Cipher Block Chaining Mode (CBC) Some
3 Symmetric Key Cryptography 3.1 Block Ciphers Symmetric key strength analysis Electronic Code Book Mode (ECB) Cipher Block Chaining Mode (CBC) Some popular block ciphers Triple DES Advanced Encryption
The Salsa20 Family of Stream Ciphers
The Salsa20 Family of Stream Ciphers Based on [Bernstein, 2008] Erin Hales, Gregor Matl, Simon-Philipp Merz Introduction to Cryptology November 13, 2017 From a security perspective, if you re connected,
CIS 6930/4930 Computer and Network Security. Topic 3.1 Secret Key Cryptography (Cont d)
CIS 6930/4930 Computer and Network Security Topic 3.1 Secret Key Cryptography (Cont d) 1 Principles for S-Box Design S-box is the only non-linear part of DES Each row in the S-Box table should be a permutation
Cryptanalysis of KeeLoq code-hopping using a Single FPGA
Cryptanalysis of KeeLoq code-hopping using a Single FPGA Idan Sheetrit and Avishai Wool Computer and Network Security Lab School of Electrical Engineering Tel-Aviv University, Ramat Aviv 69978, Israel
Vulnerability of Certain Stream Ciphers Based on k-normal Boolean Functions
Vulnerability of Certain Stream Ciphers Based on k-normal Boolean Functions Miodrag Mihaljevic RCIS-AIST, Tokyo A Seminar Lecture at CCRG School of Physics and Mathematical Sciences Nanyang Technological
COS433/Math 473: Cryptography. Mark Zhandry Princeton University Spring 2018
COS433/Math 473: Cryptography Mark Zhandry Princeton University Spring 2018 Previously on COS 433 Confusion/Diffusion Paradigm f 1 f 2 f 3 f 4 f 5 f 6 Round π 1 f 7 f 8 f 9 f 10 f 11 f 12 π 2 Substitution
Secret Key Algorithms (DES)
Secret Key Algorithms (DES) G. Bertoni L. Breveglieri Foundations of Cryptography - Secret Key pp. 1 / 34 Definition a symmetric key cryptographic algorithm is characterized by having the same key used
Stream ciphers. Lecturers: Mark D. Ryan and David Galindo. Cryptography Slide: 91
Stream ciphers Lecturers: Mark D. Ryan and David Galindo. Cryptography 2017. Slide: 91 Lecturers: Mark D. Ryan and David Galindo. Cryptography 2017. Slide: 92 Stream Cipher Suppose you want to encrypt
Symmetric key cryptography
The best system is to use a simple, well understood algorithm which relies on the security of a key rather than the algorithm itself. This means if anybody steals a key, you could just roll another and
7. Symmetric encryption. symmetric cryptography 1
CIS 5371 Cryptography 7. Symmetric encryption symmetric cryptography 1 Cryptographic systems Cryptosystem: t (MCKK GED) (M,C,K,K,G,E,D) M, plaintext message space C, ciphertext message space K, K, encryption
AEGIS. A Fast Authenticated Encryption Algorithm. Nanyang Technological University KU Leuven and iminds DIAC 2015 AEGIS 1
AEGIS A Fast Authenticated Encryption Algorithm Hongjun Wu Bart Preneel Nanyang Technological University KU Leuven and iminds 1 AEGIS: A shield carried by Athena and Zeus 2 Different Design Approaches:
Differential Fault Analysis of Trivium
Differential Fault Analysis of Trivium Michal Hojsík 1, 3 and Bohuslav Rudolf 2, 3 1 The Selmer Center, University of Bergen, Norway 2 National Security Authority, Czech Republic 3 Department of Algebra,
CIS 4360 Introduction to Computer Security Fall WITH ANSWERS in bold. First Midterm
CIS 4360 Introduction to Computer Security Fall 2010 WITH ANSWERS in bold Name:.................................... Number:............ First Midterm Instructions This is a closed-book examination. Maximum
CUBE-TYPE ALGEBRAIC ATTACKS ON WIRELESS ENCRYPTION PROTOCOLS
CUBE-TYPE ALGEBRAIC ATTACKS ON WIRELESS ENCRYPTION PROTOCOLS George W. Dinolt, James Bret Michael, Nikolaos Petrakos, Pantelimon Stanica Short-range (Bluetooth) and to so extent medium-range (WiFi) wireless
High-Performance Cryptography in Software
High-Performance Cryptography in Software Peter Schwabe Research Center for Information Technology Innovation Academia Sinica September 3, 2012 ECRYPT Summer School: Challenges in Security Engineering
FPGA Implementation of an Improved Attack Against the DECT Standard Cipher
FPGA Implementation of an Improved Attack Against the DECT Standard Cipher Michael Weiner, Erik Tews, Benedikt Heinz, Johann Heyszl , , ,
RSA Timing Attack. Chen Yang Eric Hsieh Xiaoxi Liu. Advised by: Vinnie Hu
RSA Timing Attack Chen Yang Eric Hsieh Xiaoxi Liu Advised by: Vinnie Hu Abstract The Rivest, Shamir Adleman (RSA) public key cryptosystem is the industry standard for protecting both the confidentiality
An Introduction to new Stream Cipher Designs
An Introduction to new Stream Cipher Designs Ways of Turning Your Data into Line Noise T. E. Bjørstad The Selmer Center, Department of Informatics University of Bergen, Norway 25th Chaos Communications
Automotive Security: The Bad and the Ugly. Flavio Garcia University of Birmingham
Automotive Security: The Bad and the Ugly Flavio Garcia University of Birmingham The automotive industry has undergone a major transformation Digital Mechanical Shift in Responsibility and Culture Mechanical
Don t Don t Trust Satellite Phones
Don t Don t Trust Satellite Phones Digital HGI Kolloquium, Voodoo Forensics 2.2.2012 Workshop 0x7db Benedikt Driessen, Ralf Hund, Carsten Willems, Thorsten Christof Holz Paar, and Christof Thorsten Paar
Solutions to exam in Cryptography December 17, 2013
CHALMERS TEKNISKA HÖGSKOLA Datavetenskap Daniel Hedin DIT250/TDA351 Solutions to exam in Cryptography December 17, 2013 Hash functions 1. A cryptographic hash function is a deterministic function that
A New Architecture of High Performance WG Stream Cipher
A New Architecture of High Performance WG Stream Cipher Grace Mary S. 1, Abhila R. Krishna 2 1 P G Scholar, VLSI and Embedded Systems, Department of ECE T K M Institute of Technology, Kollam, India 2 Assistant
Computer Security. 08r. Pre-exam 2 Last-minute Review Cryptography. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 08r. Pre-exam 2 Last-minute Review Cryptography Paul Krzyzanowski Rutgers University Spring 2018 March 26, 2018 CS 419 2018 Paul Krzyzanowski 1 Cryptographic Systems March 26, 2018 CS
ECE 646 Lecture 8. Modes of operation of block ciphers
ECE 646 Lecture 8 Modes of operation of block ciphers Required Reading: I. W. Stallings, "Cryptography and Network-Security," 5 th and 6 th Edition, Chapter 6 Block Cipher Operation II. A. Menezes, P.
An Improved Cryptanalysis of Lightweight Stream Cipher Grain-v1
An Improved Cryptanalysis of Lightweight Stream Cipher Grain-v1 Miodrag J. Mihaljević 1, Nishant Sinha 2, Sugata Gangopadhyay 2, Subhamoy Maitra 3, Goutam Paul 3 and Kanta Matsuura 4 1 Mathematical Institute,
Cryptanalytic Attacks on MIFARE Classic Protocol
Cryptanalytic Attacks on MIFARE Classic Protocol Jovan Dj. Golić Security Lab, Telecom Italia IT Via Reiss Romoli 274, 10148 Turin, Italy {jovan.golic}@it.telecomitalia.it Abstract. MIFARE Classic is the
IDEA, RC5. Modes of operation of block ciphers
C 646 - Lecture 8 IDA, RC5 Modes of operation of block ciphers Required Reading: I. W. Stallings, "Cryptography and Network-Security," 5th dition, Chapter 6 Block Cipher Operation II. A. Menezes, P. van
Cache Timing Analysis of LFSR-based Stream Ciphers
Cache Timing Analysis of LFSR-based Stream Ciphers Gregor Leander, Erik Zenner and Philip Hawkes Technical University Denmark (DTU) Department of Mathematics e.zenner@mat.dtu.dk Cirencester, Dec. 17, 2009
Correlated Keystreams in Moustique
, Vincent Rijmen, Tor Bjørstad, Christian Rechberger, Matt Robshaw and Gautham Sekar K.U. Leuven, ESAT-COSIC The Selmer Center, University of Bergen Graz University of Technology France Télécom Research
Content of this part
UNIVERSITY OF MASSACHUSETTS Dept. of Electrical & Computer Engineering Introduction to Cryptography ECE 597XX/697XX Part 5 More About Block Ciphers Israel Koren ECE597/697 Koren Part.5.1 Content of this
Introduction to Modern Cryptography. Lecture 2. Symmetric Encryption: Stream & Block Ciphers
Introduction to Modern Cryptography Lecture 2 Symmetric Encryption: Stream & Block Ciphers Stream Ciphers Start with a secret key ( seed ) Generate a keying stream i-th bit/byte of keying stream is a function
A Cache Timing Analysis of HC-256
A Cache Timing Analysis of HC-256 Erik Zenner Technical University Denmark (DTU) Institute for Mathematics e.zenner@mat.dtu.dk SAC 2008, Aug. 14, 2008 Erik Zenner (DTU-MAT) A Cache Timing Analysis of HC-256
T Cryptography and Data Security
T-79.159 Cryptography and Data Security Lecture 10: 10.1 Random number generation 10.2 Key management - Distribution of symmetric keys - Management of public keys Kaufman et al: Ch 11.6; 9.7-9; Stallings:
AEGIS. A Fast Authenticated Encryption Algorithm. Nanyang Technological University KU Leuven and iminds DIAC 2016 AEGIS 1
AEGIS A Fast Authenticated Encryption Algorithm Hongjun Wu Bart Preneel Nanyang Technological University KU Leuven and iminds DIAC 2016 AEGIS 1 AEGIS: A shield carried by Athena and Zeus DIAC 2016 AEGIS
Secret Key Algorithms (DES) Foundations of Cryptography - Secret Key pp. 1 / 34
Secret Key Algorithms (DES) Foundations of Cryptography - Secret Key pp. 1 / 34 Definition a symmetric key cryptographic algorithm is characterized by having the same key used for both encryption and decryption.
Some Aspects of Block Ciphers
Some Aspects of Block Ciphers Palash Sarkar Applied Statistics Unit Indian Statistical Institute, Kolkata India palash@isical.ac.in CU-ISI Tutorial Workshop on Cryptology, 17 th July 2011 Palash Sarkar
Overview of some automotive RKE systems
Overview of some automotive RKE systems Pierre Pavlidès OWASP Gothenburg Day 2016 November 24, 2016 Pierre Pavlidès Overview of some automotive RKE systems 1 / 42 Before we start Slides at http://r.rogdham.net/26
Stream Ciphers An Overview
Stream Ciphers An Overview Palash Sarkar Indian Statistical Institute, Kolkata email: palash@isicalacin stream cipher overview, Palash Sarkar p1/51 Classical Encryption Adversary message ciphertext ciphertext
AES Cryptosystem Acceleration Using Graphics Processing Units. Ethan Willoner Supervisors: Dr. Ramon Lawrence, Scott Fazackerley
AES Cryptosystem Acceleration Using Graphics Processing Units Ethan Willoner Supervisors: Dr. Ramon Lawrence, Scott Fazackerley Overview Introduction Compute Unified Device Architecture (CUDA) Advanced
Broken keys to the kingdom
Broken keys to the kingdom Security and privacy aspects of RFID-based car keys Jos Wetzels a.l.g.m.wetzels@student.tue.nl Abstract. This paper presents an overview of the current state-of-the-art of security
CSC 474/574 Information Systems Security
CSC 474/574 Information Systems Security Topic 2.2 Secret Key Cryptography CSC 474/574 Dr. Peng Ning 1 Agenda Generic block cipher Feistel cipher DES Modes of block ciphers Multiple encryptions Message
Survey of Codebreaking Machines. Swathi Guruduth Vivekanand Kamanuri Harshad Patil
Survey of Codebreaking Machines Swathi Guruduth Vivekanand Kamanuri Harshad Patil Contents Introduction Motivation Goal Machines considered Comparison based on technology used Brief description of machines
T Cryptography and Data Security
T-79.4501 Cryptography and Data Security Lecture 10: 10.1 Random number generation 10.2 Key management - Distribution of symmetric keys - Management of public keys Stallings: Ch 7.4; 7.3; 10.1 1 The Use
CAESAR: Cryptanalysis of the Full AES Using GPU-Like Hardware
CAESAR: Cryptanalysis of the Full AES Using GPU-Like Hardware Alex Biryukov and Johann Großschädl Laboratory of Algorithmics, Cryptology and Security University of Luxembourg SHARCS 2012, March 17, 2012
Cryptanalysis of ORYX
Cryptanalysis of ORYX D. Wagner 1, L. Simpson 2, E. Dawson 2, J. Kelsey 3, W. Millan 2, and B. Schneier 3 1 University of California, Berkeley daw@cs.berkeley.edu 2 Information Security Research Centre,
Advanced WG and MOWG Stream Cipher with Secured Initial vector
International Journal of Scientific and Research Publications, Volume 5, Issue 12, December 2015 471 Advanced WG and MOWG Stream Cipher with Secured Initial vector Dijomol Alias Pursuing M.Tech in VLSI
Attack on DES. Jing Li
Attack on DES Jing Li Major cryptanalytic attacks against DES 1976: For a very small class of weak keys, DES can be broken with complexity 1 1977: Exhaustive search will become possible within 20 years,
Side channel attack: Power Analysis. Chujiao Ma, Z. Jerry Shi CSE, University of Connecticut
Side channel attack: Power Analysis Chujiao Ma, Z. Jerry Shi CSE, University of Connecticut Conventional Cryptanalysis Conventional cryptanalysis considers crypto systems as mathematical objects Assumptions:
Report on Present State of CIPHERUNICORN-A Cipher Evaluation (full evaluation)
Report on Present State of CIPHERUNICORN-A Cipher Evaluation (full evaluation) January 28, 2002 Masayuki Kanda, Member Symmetric-Key Cryptography Subcommittee 1 CIPHERUNICORN-A CIPHERUNICORN-A was presented
Identifying Performance Limiters Paulius Micikevicius NVIDIA August 23, 2011
Identifying Performance Limiters Paulius Micikevicius NVIDIA August 23, 2011 Performance Optimization Process Use appropriate performance metric for each kernel For example, Gflops/s don t make sense for
Stream Ciphers and Block Ciphers
Stream Ciphers and Block Ciphers 2MMC10 Cryptology Fall 2015 Ruben Niederhagen October 6th, 2015 Introduction 2/32 Recall: Public-key crypto: Pair of keys: public key for encryption, private key for decryption.
Trivium. 2 Specifications
Trivium Specifications Christophe De Cannière and Bart Preneel Katholieke Universiteit Leuven, Dept. ESAT/SCD-COSIC, Kasteelpark Arenberg 10, B 3001 Heverlee, Belgium {cdecanni, preneel}@esat.kuleuven.be
Stream Ciphers and Block Ciphers
Stream Ciphers and Block Ciphers Ruben Niederhagen September 18th, 2013 Introduction 2/22 Recall from last lecture: Public-key crypto: Pair of keys: public key for encryption, private key for decryption.
The MD6 Hash Function (aka Pumpkin Hash ) Ronald L. Rivest MIT CSAIL CRYPTO 2008
The MD6 Hash Function (aka Pumpkin Hash ) Ronald L. Rivest MIT CSAIL CRYPTO 2008 MD6 Team Dan Bailey Sarah Cheng Christopher Crutchfield Yevgeniy Dodis Elliott Fleming Asif Khan Jayant Krishnamurthy Yuncheng
An Overview of Cryptanalysis Research for the Advanced Encryption Standard
An Overview of Cryptanalysis Research for the Advanced Encryption Standard Alan Kaminsky, Rochester Institute of Technology Michael Kurdziel, Harris Corporation Stanisław Radziszowski, Rochester Institute
SNOW 3G Stream Cipher Operation and Complexity Study
Contemporary Engineering Sciences, Vol. 3, 2010, no. 3, 97-111 SNOW 3G Stream Cipher Operation and Complexity Study Ghizlane ORHANOU ghizlane.orhanou@gmail.com Said EL HAJJI elhajji@fsr.ac.ma Youssef BENTALEB
Modes of Operation. Raj Jain. Washington University in St. Louis
Modes of Operation Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at : http://www.cse.wustl.edu/~jain/cse567-06/
Block Cipher Operation. CS 6313 Fall ASU
Chapter 7 Block Cipher Operation 1 Outline q Multiple Encryption and Triple DES q Electronic Codebook q Cipher Block Chaining Mode q Cipher Feedback Mode q Output Feedback Mode q Counter Mode q XTS-AES
Permutation-based Authenticated Encryption
Permutation-based Authenticated Encryption Gilles Van Assche 1 1 STMicroelectronics COST Training School on Symmetric Cryptography and Blockchain Torremolinos, Spain, February 2018 1 / 44 Outline 1 Why
page 1 Introduction to Cryptography Benny Pinkas Lecture 3 November 18, 2008 Introduction to Cryptography, Benny Pinkas
Introduction to Cryptography Lecture 3 Benny Pinkas page 1 1 Pseudo-random generator Pseudo-random generator seed output s G G(s) (random, s =n) Deterministic function of s, publicly known G(s) = 2n Distinguisher
Cryptanalysis of KeeLoq with COPACOBANA
Cryptanalysis of KeeLoq with COPACOBANA Martin Novotný 1 and Timo Kasper 2 1 Faculty of Information Technology Czech Technical University in Prague Kolejní 550/2 160 00 Praha 6, Czech Republic email: novotnym@fit.cvut.cz
Power Analysis of MAC-Keccak: A Side Channel Attack. Advanced Cryptography Kyle McGlynn 4/12/18
Power Analysis of MAC-Keccak: A Side Channel Attack Advanced Cryptography Kyle McGlynn 4/12/18 Contents Side-Channel Attack Power Analysis Simple Power Analysis (SPA) Differential Power Analysis (DPA)
Symmetric Encryption. Thierry Sans
Symmetric Encryption Thierry Sans Design principles (reminder) 1. Kerkoff Principle The security of a cryptosystem must not rely on keeping the algorithm secret 2. Diffusion Mixing-up symbols 3. Confusion
COS433/Math 473: Cryptography. Mark Zhandry Princeton University Spring 2017
COS433/Math 473: Cryptography Mark Zhandry Princeton University Spring 2017 Previously on COS 433 Pseudorandom Permutations unctions that look like random permutations Syntax: Key space K (usually {0,1}
Computer and Data Security. Lecture 3 Block cipher and DES
Computer and Data Security Lecture 3 Block cipher and DES Stream Ciphers l Encrypts a digital data stream one bit or one byte at a time l One time pad is example; but practical limitations l Typical approach
Chosen-IV Correlation Power Analysis on KCipher-2 and a Countermeasure
Fourth International Workshop on Constructive Side-Channel Analysis and Secure Design (COSADE 2013) Chosen-IV Correlation Power Analysis on KCipher-2 and a Countermeasure Takafumi Hibiki*, Naofumi Homma*,
Improved Attack on Full-round Grain-128
Improved Attack on Full-round Grain-128 Ximing Fu 1, and Xiaoyun Wang 1,2,3,4, and Jiazhe Chen 5, and Marc Stevens 6, and Xiaoyang Dong 2 1 Department of Computer Science and Technology, Tsinghua University,
Susceptibility of estream Candidates towards Side Channel Analysis
Susceptibility of estream Candidates towards Side Channel Analysis Benedikt Gierlichs 1, Lejla Batina 1, Christophe Clavier 2, Thomas Eisenbarth 3, Aline Gouget 4, Helena Handschuh 5, Timo Kasper 3, Kerstin
POMELO A Password Hashing Algorithm (Version 2)
POMELO A Password Hashing Algorithm (Version 2) Designer and Submitter: Hongjun Wu Division of Mathematical Sciences Nanyang Technological University wuhongjun@gmail.com 2015.01.31 Contents 1 Specifications
force cracker on an NVidia Fermi GPU
Author Fredrik Robertsén One Author Two Author Three Author Four Author Five Title Implementing of the Technical a DES Report brute force cracker on an NVidia Fermi GPU Turku Centre for Computer Science
Introduction to Network Security Missouri S&T University CPE 5420 Data Encryption Standard
Introduction to Network Security Missouri S&T University CPE 5420 Data Encryption Standard Egemen K. Çetinkaya Egemen K. Çetinkaya Department of Electrical & Computer Engineering Missouri University of
CSC574: Computer & Network Security
CSC574: Computer & Network Security Lecture 3 Prof. William Enck Spring 2016 (Derived from slides by Micah Sherr, Patrick McDaniel, and Peng Ning) Modern Cryptography 2 Kerckhoffs Principles Modern cryptosystems
Jordan University of Science and Technology
Jordan University of Science and Technology Cryptography and Network Security - CPE 542 Homework #III Handed to: Dr. Lo'ai Tawalbeh By: Ahmed Saleh Shatnawi 20012171020 On: 8/11/2005 Review Questions RQ3.3
Power Analysis of Atmel CryptoMemory Recovering Keys from Secure EEPROMs
Power Analysis of Atmel CryptoMemory Recovering Keys from Secure EEPROMs Josep Balasch 1, Benedikt Gierlichs 1, Roel Verdult 2, Lejla Batina 1,2, and Ingrid Verbauwhede 1 1 ESAT/COSIC, KU Leuven 2 ICIS/Digital
International Journal for Research in Applied Science & Engineering Technology (IJRASET) Performance Comparison of Cryptanalysis Techniques over DES
Performance Comparison of Cryptanalysis Techniques over DES Anupam Kumar 1, Aman Kumar 2, Sahil Jain 3, P Kiranmai 4 1,2,3,4 Dept. of Computer Science, MAIT, GGSIP University, Delhi, INDIA Abstract--The
CHAPTER Combining Block Ciphers DOUBLE ENCRYPTION TRIPLE ENCRYPTION
CHAPTER 15... 356 Combining Block Ciphers... 356 DOUBLE ENCRYPTION... 356 TRIPLE ENCRYPTION... 357 Triple Encryption Two Keys... 357 Triple Encryption with Three Keys... 359 Triple Encryption with Minimum
CSCI 454/554 Computer and Network Security. Topic 3.2 Secret Key Cryptography Modes of Operation
CSCI 454/554 Computer and Network Security Topic 3.2 Secret Key Cryptography Modes of Operation Processing with Block Ciphers Most ciphers work on blocks of fixed (small) size How to encrypt long messages?
FPGA Implementation of WG Stream Cipher
FPGA Implementation of WG Stream Cipher Anna Johnson Assistant Professor,ECE Department, Jyothi Engineering College,Thrissur Abstract Cryptography is the technique of providing security to a network. The
Embarquez votre Intelligence Artificielle (IA) sur CPU, GPU et FPGA
Embarquez votre Intelligence Artificielle (IA) sur CPU, GPU et FPGA Pierre Nowodzienski Engineer pierre.nowodzienski@mathworks.fr 2018 The MathWorks, Inc. 1 From Data to Business value Make decisions Get
PRNGs & DES. Luke Anderson. 16 th March University Of Sydney.
PRNGs & DES Luke Anderson luke@lukeanderson.com.au 16 th March 2018 University Of Sydney Overview 1. Pseudo Random Number Generators 1.1 Sources of Entropy 1.2 Desirable PRNG Properties 1.3 Real PRNGs
Network Security Essentials Chapter 2
Network Security Essentials Chapter 2 Fourth Edition by William Stallings Lecture slides by Lawrie Brown Encryption What is encryption? Why do we need it? No, seriously, let's discuss this. Why do we need
Introduction to Cryptography. Lecture 3
Introduction to Cryptography Lecture 3 Benny Pinkas March 6, 2011 Introduction to Cryptography, Benny Pinkas page 1 Pseudo-random generator seed s (random, s =n) Pseudo-random generator G Deterministic
c Eli Biham - March 13, Cryptanalysis of Modes of Operation (4) c Eli Biham - March 13, Cryptanalysis of Modes of Operation (4)
Single Modes: the S Modes of Operation Modes of Operation are used to hide patterns in the plaintexts, protect against chosen plaintext attacks, and to support fast on-line encryption with precomputation.
Full Plaintext Recovery Attack on Broadcast RC4
11 March, 2013 FSE 2013 @ Singapore Full Plaintext Recovery Attack on Broadcast RC4 Takanori Isobe () Toshihiro Ohigashi (Hiroshima University) Yuhei Watanabe () Masakatu Morii () Target Broadcast setting
CSE509: (Intro to) Systems Security
CSE509: (Intro to) Systems Security Fall 2012 Radu Sion Ciphers 2005-12 Portions copyright by Matt Bishop. Used with permission Ciphers Overview Naïve Usage Types of Ciphers Systems Security September
Introduction to Cryptography. Lecture 3
Introduction to Cryptography Lecture 3 Benny Pinkas March 6, 2011 Introduction to Cryptography, Benny Pinkas page 1 Pseudo-random generator seed s (random, s =n) Pseudo-random generator G Deterministic
Implementation Tradeoffs for Symmetric Cryptography
Implementation Tradeoffs for Symmetric Cryptography Télécom ParisTech, LTCI Page 1 Implementation Trade-offs Security Physical attacks Cryptanalysis* Performance energy Throughput Latency Complexity *
On the Applicability of Distinguishing Attacks Against Stream Ciphers
On the Applicability of Distinguishing Attacks Against Stream Ciphers Greg Rose, Philip Hawkes QUALCOMM Australia {ggr, phawkes}@qualcomm.com Abstract. We demonstrate that the existence of distinguishing