Introduction to cryptology (GBIN8U16)

Transcription

1 Introduction to cryptology (GBIN8U16) Finite fields, block ciphers Pierre Karpman Finite fields, block ciphers /31

2 Bits as field elements Digital processing of information dealing with bits Error-correcting codes, crypto need analysis maths bits (no structure) field elements (math object) Natural match: {0, 1} F2 Z/2Z (natural) integers modulo 2 F2 : two elements (0, 1), two operations (+, ) Finite fields, block ciphers /31

3 What s F 2 like? Addition exclusive or (XOR ( )) Multiplication logical and ( ) Boolean arithmetic Fact: any Boolean function f {0, 1} n {0, 1} can be computed using only and Fact 2: ditto, g {0, 1} n {0, 1} m Fact 3: ditto, using NAND ( ) Finite fields, block ciphers /31

4 One bit is nice, but... We rather need bit strings {0, 1} n than single bits Now two natural matches: F n 2 (vectors over F 2 ) Can add two vectors Cannot multiply internally (but there s a dot/scalar product) Z/2 n Z (natural integers modulo 2 n ) Can add, multiply Not all elements are invertible (e.g. 2) only a ring Finite fields, block ciphers /31

5 A third way Also possible: F2 n: an extension field Addition like in F n 2 Plus an internal multiplication All elements (except zero) are invertible Not for today! Finite fields, block ciphers /31

6 Why are these useful? Allows to perform operations on inputs E.g. adding two messages together Vector spaces linear algebra (matrices) Powerful tools to solve easy problems (Intuition: crypto shouldn t be linear) Fields polynomials With one or more variable Can compute differentials Can mix F n 2, Z/2 n Z to make things hard Popular ARX strategy in symmetric cryptography (FEAL/MD5/HA-1/Chacha/peck/...) Finite fields, block ciphers /31

7 Block ciphers: simple binary mappings Block ciphers A block cipher is a mapping E K M M s.t. k K, E(k, ) is invertible In practice, most of the time: Note Keys K = {0, 1} κ, with κ {64, 80, 96, 112, 128, 192, 256} (but e.g. 64 s too short) Plaintexts/ciphertexts M = M = {0, 1} n, with n {64, 128, 256} Block cipher inputs are bits, not vectors; field, ring elements Finite fields, block ciphers /31

8 Block ciphers: for what? Ultimate goal: symmetric encryption plaintext + key ciphertext ciphertext + key plaintext ciphertext??? With arbitrary plaintexts {0, 1} Block ciphers: do that for plaintexts {0, 1} n (Very) small example: 32 randomly shuffled cards = 5-bit block cipher Typical block sizes n = what s easy to implement Finite fields, block ciphers /31

9 Block ciphers: only a building block A vanilla block cipher is useless Only works on fixed-size inputs Is not randomized (remember?) Fix k, x E(k, x) always the same leaks information about repeated messages (Does not authenticate coms) Use block ciphers with a mode of operation Finite fields, block ciphers /31

10 Encryption modes Randomized encryption scheme An encryption scheme is a mapping E K R M M s.t. k K, r R, E(k, r, ) is invertible With e.g. plaintexts/ciphertexts M = M = l 2 40{0, 1} 128l keys K public randomness R Encryption scheme block cipher + mode of operation Finite fields, block ciphers /31

11 Criteria for a mode Not all modes are equivalent How much can you encrypt? (In function of {0, 1} n ) With what security? With what performance? (Do you get auth?) Classical examples: ECB (not a mode), CBC, CTR Finite fields, block ciphers /31

12 ECB (not a mode, for reference) Electronic Code Book mode m 0 m 1... E(k, m 0 ) E(k, m 1 )... Vanilla use of the block cipher Efficient No security Finite fields, block ciphers /31

13 CBC (classical, not so great) Cipher Block Chaining mode r m 0 m 1... c 0 = E(k, m 0 r) c1 = E(k, m 1 c 0 )... Chain blocks together (duh) Output block i (ciphtertext) added (XORed) w/ input block i + 1 (plaintext) For first (m 0 ) block: use random IV r equential not so efficient Need E 1 to decrypt ecurity in the square root of the block size = birthday bound (no details for now) E.g., 128-bit blocks change key before encrypting 2 64 blocks Finite fields, block ciphers /31

14 CBC: need random IVs CBC is not IND-CPA if the IVs are not random Attacker asks E CBC(m), gets r, c = E(k, m r) Knows that next IV = x ends two challenges m0 = m r x, m 1 $ M Gets cb = E CBC(m b ), b $ {0, 1} If cb = c, guess b = 0, else b = 1 Finite fields, block ciphers /31

15 CTR mode (classical, better) Counter mode r m 0 m 1... E(k, r) m 0 E(k, r + 1) m 1... Like a stream cipher Encrypt a public counter pseudo-random keystream Add (XOR) the keystream and the message Parallel efficient (multi-core, pipelining & all) Inverse-free : don t need E 1 to decrypt ecurity up to the birthday bound (like CBC) This time, r can be known in advance (but cannot repeat!) Finite fields, block ciphers /31

16 Other nice modes CENC (CTR-like, beyond birthday ) OCB (Authenticated-Encryption (AE) mode) GCM (ditto) TAE (OCB-like w/ tweakable block ciphers) OTR (OCB-like, inverse-free) Maybe for another day... Finite fields, block ciphers /31

17 Back to BCs: how do you build one? Many design strategies Different choices possible at high level (main structure) low level (tiny building blocks) Two brief examples today: Feistel, PN In both cases: define a round function, iterate it many times Finite fields, block ciphers /31

18 Feistel ladder/networks A framework to extend the domain of a function (not necessarily invertible) Very versatile, can be used to build Block ciphers (obvs.) / Hash functions Modes of operation (e.g. OTR) Padding schemes (e.g. OAEP) -boxes (part of block ciphers) Etc. Finite fields, block ciphers /31

19 Feistels: main idea Basic equations (two-branch Feistel): (L, R) (L = R, R = L F (R)) (forward) (L, R ) (L = R F (L ), R = L ) (backward) Don t need F 1 to invert (does not need to be defined!) Can iterate to many rounds, with possibly different F s Then, can extend (in many ways) to more than two branches! Finite fields, block ciphers /31

20 A Feistel, in picture L 0 R 0 F 1 F 2 F 3 L 3 R 3 Figure: 3-Round Feistel ( Finite fields, block ciphers /31

21 We re not done, tho Q.1 How to build F? Q.2 How to add a key? No single answer, but for instance A.1.1 Use random-looking small tables (-boxes) A.1.2 Mix operations in F n 2, Z/2 n Z, Boolean functions (ARX) A.2.1 Add a key before/after F A.2.2 Use key-dependent F Etc. Finite fields, block ciphers /31

22 The TWINE round function x i 0 x i 1 x i 2 x i 3 x i 4 x i 5 x i 6 x i 7 x i 8 x i 9 x i 10 x i 11 x i 12 x i 13 x i 14 x RK i i 15 0 RK1 i RK2 i RK3 i RK4 i RK5 i RK6 i RK7 i F i 0 F i 2 F i 4 F i 6 F i 8 F i 10 F i 12 F i 14 x i+1 0 x i+1 1 x i+1 2 x i+1 3 x i+1 4 x i+1 5 x i+1 6 x i+1 7 x i+1 8 x i+1 9 x i+1 10 x i+1 11 x i+1 12 x i+1 13 x i+1 14 x i+1 15 Figure: One round of TWINE ( Finite fields, block ciphers /31

23 One HA-1 step A i B i C i D i E i φ i W i K i 20 A i+1 B i+1 C i+1 D i+1 E i+1 Figure: One HA-1 step (compression function, block cipher) Finite fields, block ciphers /31

24 Another way: ubstitution Permutation Networks One round: compose and P where: P is an invertible matrix over F2 (i.e. P GL n (F 2 )) Often is not F2 -linear (Plus add a key at some point) P is a permutation matrix Or a sparse matrix (e.g. composition of block diagonal and permutation) is made of small invertible -boxes Finite fields, block ciphers /31

25 mall drawing: better than long description x / n = 7 b / b / b / b / b / b / b / b / b / b / b / b / b / b / b / n P y Figure: PN, still quite abstract Finite fields, block ciphers /31

26 Finite fields, block ciphers /31 Example: PREENT k i k i+1 Figure: Two rounds of PREENT (

27 Example: AE blackboard Finite fields, block ciphers /31

28 Why not a single block cipher? It s all about context objectives? Fast? mall? ecure? (LOL) Versatile? Dedicated? oftware/hardware? Etc. We ve barely scratched the surface Finite fields, block ciphers /31

29 Anyways, what s a secure one? Let Perm(M) be the set of the (#M)! permutations of M $ Ideally, k, E(k, ) Perm(M) In practice, good enough if E is a good pseudo-random permutation (PRP): An adversary has access to an oracle O $ In one world, O Perm(M) $ In another, k K, O = E(k, ) The adversary cannot tell in which world he leaves Example: E cannot be F2 -linear (or even close to ) Finite fields, block ciphers /31

30 Next week Extensions of F2 LFRs MACs Finite fields, block ciphers /31

31 References Knudsen & Robshaw, The Block Cipher Companion Daemen & Rijmen, The Design of Rijndael Finite fields, block ciphers /31