Applications of SAT Solvers in Cryptanalysis: Finding Weak Keys and Preimages

Abstract

This paper investigates the power of SAT solvers in cryptanalysis. The contributions are twofold and are relevant to both theory and practice. First, we introduce an efficient, generic and automated method for generating SAT instances encoding a wide range of cryptographic computations. This method can be used to automate the first step of algebraic attacks, i.e. the generation of a system of algebraic equations. Second, we illustrate the limits of SAT solvers when attacking cryptographic algorithms, with the aim of finding weak keys in block ciphers and preimages in hash functions. SAT solvers allowed us to find, or prove the absence of, weak-key classes under both differential and linear attacks of full-round block ciphers based on the International Data Encryption Algorithm (IDEA), namely, WIDEA-n for n ∈ {4, 8}, and MESH-64(8). In summary: (i) we have found several classes of weak keys for WIDEA-n and (ii) proved that a particular class of weak keys does not exist in MESH-64(8). SAT solvers provided answers to two complementary open problems (presented in Fast Software Encryption 2009): the existence and non-existence of such weak keys. Although these problems were supposed to be difficult to answer, SAT solvers provided an efficient solution. We also report on experimental results about the performance of a modern SAT solver as the encoded cryptanalytic tasks become increasingly hard. The tasks correspond to preimage attacks on reduced MD4 algorithm.

Complete SAT based Cryptanalysis of RC5 Cipher

“…This idea supplements other classic methods of cryptanalysis [5,6,13,20,21]. In the literature can be still found new papers devoted to this topic [7,10,11,16,17,18,19,22,24].…”

CryptoSAT: a tool for SAT‐based cryptanalysis

“…CryptoSAT has already been used in order to (i) find weak keys in idea variants [29], (ii) prove that similar weak keys do not exist in other variants [29], (iii) verify potential flaws of the stream cipher ZUC that are due to its implementation [23]. These results show that CRYPTOSAT is a valuable tool for cryptanalysts, designers, and implementors, respectively.…”

sboxgates: A program for finding low gate count implementations of S-boxes

“…In algebraic cryptanalysis, one attack method is to model a cipher along with its inputs and outputs as a SAT problem. This can be used to find, for example, weak keys in block ciphers or preimages in hash functions (Lafitte et al, 2014). SAT problems are typically expressed in conjunctive normal form (CNF) and logic circuits can quickly be converted into CNF using the Tseytin transform (Knuth, 2015).…”

“…Thus, an efficient logic gate representation of an S-box can be transformed into an efficient CNF representation. CNF representations can in turn be transformed into a system of equations in GF(2) (Lafitte et al, 2014).…”