Computing AES related-key differential characteristics with constraint programming

Self Cite

Constraint Programming models have been recently proposed to solve cryptanalysis problems for symmetric block ciphers such as AES. These models are more efficient than dedicated approaches but their design is difficult: straightforward models do not scale well and it is necessary to add advanced constraints derived from cryptographic properties. We introduce a global constraint which simplifies the modelling step and improves efficiency. We study its complexity, introduce propagators and experimentally evaluate them on two cryptanalysis problems (single-key and related-key) for two block ciphers (AES and Midori). 1 Motivations Symmetric bloc ciphers use a secret key K to cipher an input text X 0 into a cipher text X r in such a way that X r can be deciphered back into X 0 with the same key K. Differential cryptanalysis aims at evaluating if we can guess K by studying difference propagation during ciphering [6]. These differences are obtained by applying a XOR (bitwise exclusive or, denoted ⊕) between two input texts. In the related-key attack [5], differences are also introduced in keys. For mounting these attacks, we must compute Maximum Differential Characteristics (MDCs), i.e., most probable differences. A widely used symmetric block cipher is AES [10]. However, AES is rather time consuming, and lighter ciphers must be designed for devices with limited computational resources. Each time a new cipher is designed, we must compute MDCs to evaluate its robustness with respect to differential attacks. In this section, we illustrate MDCs on Midori128 [2], which is a lighweight cipher simpler to explain than AES. However, all models can be extended to AES and to other existing symmetric block ciphers, and we experimentally evaluate our approach on both Midori and AES. Midori128. The ciphering iterates r rounds and each round is composed of four operations: SubBytes replaces every byte with another byte according to a given lookup table; ShuffleCells moves bytes; and MixColumns and AddKey perform XORs. For each round i ∈ [0, r − 1], X i denotes the text state at the beginning of round i, and S i , Y i , and Z i denote intermediate text states after each operation: S i is the result of applying Sub-Bytes on X i ; Y i is the result of applying ShuffleCells on S i ; Z i is the result of applying MixColumns on Y i ; and X i+1 is the result of applying AddKey on Z i and K. The goal of the MDC problem is to compute differences. We denote δK the differences in the key (i.e., δK is the result of applying a XOR between two keys), and δX i

Section: Related-key MDC For Midorimentioning

confidence: 99%

Section: Related-key MDC For Aesmentioning

confidence: 99%

Section: Related-key MDC For Aesmentioning

confidence: 99%

“…CP has been used to compute MDCs for AES [14,15], Midori [13], and SKINNY [25]. These CP models are very efficient.…”

mentioning

confidence: 99%

mentioning

confidence: 99%

See 3 more Smart Citations

abstractXOR: A global constraint dedicated to differential cryptanalysis

Rouquette

Solnon

2020

Self Cite

Parity (XOR) Reasoning for the Index Calculus Attack

Trimoska¹,

Ionica²,

Dequen³

2020

Models for cryptographic problems are often expressed as boolean polynomial systems, whose equivalent logical formulas can be treated using SAT solvers. Given the algebraic nature of the problem, the use of the logical XOR operator is common in SAT-based cryptanalysis. Recent works have focused on advanced techniques for handling parity (XOR) constraints, such as the Gaussian Elimination technique. First, we propose an original XOR-reasoning SAT solver, named WD-Sat, dedicated to a specific cryptographic problem. Secondly, we show that in some cases Gaussian Elimination on SAT instances does not work as well as Gaussian Elimination on algebraic systems. We demonstrate how this oversight is fixed in our solver, which is adapted to read instances in algebraic normal form (ANF). Finally, we propose a novel preprocessing technique based on the Minimal Vertex Cover Problem in graph theory. Our benchmarks use a model obtained from cryptographic instances for which a significant speedup is achieved using the findings in this paper. We further explain how our preprocessing technique can be used as an assessment of the security of a cryptographic system.

Efficient Methods to Search for Best Differential Characteristics on SKINNY

Delaune

Derbez

Huynh

et al. 2021

Self Cite

Evaluating resistance of ciphers against differential cryptanalysis is essential to define the number of rounds of new designs and to mount attacks derived from differential cryptanalysis. In this paper, we propose automatic tools to find the best differential characteristics on the SKINNY block cipher. As usually done in the literature, we split this search in two stages denoted by Step 1 and Step 2. In Step 1, we aim at finding all truncated differential characteristics with a low enough number of active Sboxes. Then, in Step 2, we try to instantiate each difference value while maximizing the overall differential characteristic probability. We solve Step 1 using an ad-hoc method inspired from the work of Fouque et al. whereas Step 2 is modelized for the Choco-solver library as it seems to outperform all previous methods on this stage. Notably, for SKINNY-128 in the SK model and for 13 rounds, we retrieve the results of Abdelkhalek et al. within a few seconds (to compare with 16 days) and we provide, for the first time, the best differential relatedtweakey characteristics up to 14 rounds for the TK1 model. Regarding the TK2 and the TK3 models, we were not able to test all the solutionsStep 1, and thus the differential characteristics we found up to 16 and 17 rounds are not necessarily optimal.