Galaxy: A Family of Stream-Cipher-Based Space-Hard Ciphers

Koike, Yuji; Sakamoto, Kosei; Hayashi, Takuya; Isobe, Takanori

doi:10.1007/978-3-030-55304-3_8

Cited by 5 publications

(7 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this section, we present experimental measurements for Yoroi, SPACE [BI15], WhiteBlock [FKKM16], SPNbox [BIT16], WEM [CCD + 17], and Galaxy [KSHI20] both in the blackbox setting and the whitebox setting.…”

Section: Methodsmentioning

confidence: 99%

“…We have employed AES implemented with AES-NI [Gue10] as the underlying block cipher for SPACE [BI15] and WhiteBlock [FKKM16], and WEM [CCD + 17], and use chacha [Ber08] for Galaxy [KSHI20]. For the small-scale block cipher E K and D K , we have utilized SmallPresent-3 [Lea10] and SmallPresent-7 [Lea10] for Yoroi-16 and Yoroi-32, respectively.…”

Section: Methodsmentioning

confidence: 99%

“…They show that Yoroi provides sufficient security both in the blackbox setting and whitebox setting, and ensures the longevity without the significant performance loss. Note that we exclude WEM [CCD + 17] and Galaxy [KSHI20] from our comparison in the blackbox setting, as they use Fisher-Yates shuffle and chacha as underlying ciphers, which is significantly slow in the blackbox implementation.…”

Section: Methodsmentioning

confidence: 99%

See 2 more Smart Citations

Yoroi: Updatable Whitebox Cryptography

Koike

Isobe

2021

TCHES

Self Cite

View full text Add to dashboard Cite

Whitebox cryptography aims to provide security in the whitebox setting where the adversary has unlimited access to the implementation and its environment. In order to ensure security in the whitebox setting, it should prevent key extraction attacks and code-lifting attacks, in which the adversary steals the original cryptographic implementation instead of the key, and utilizes it as a big key. Although recent published ciphers such as SPACE, SPNbox, and Whiteblock successfully achieve security against the key extraction attacks, they only provide mitigation of codelifting attack by the so-called space hardness and incompressibility properties of the underlying tables as the space-hard/incompressible table might be eventually stolen by continuous leakage. The complete prevention of such attacks may need to periodically update the secret key. However, that entails high costs and might introduce an additional vulnerability into the system due to the necessity for the reencryption of all data by the updated key. In this paper, we introduce a new property, denominated longevity, for whitebox cryptography. This property enhances security against code-lifting attacks with continuous leakage by updating incompressible tables instead of the secret key. We propose a family of new whitebox-secure block ciphers Yoroi that has the longevity property in addition to the space hardness. By updating its implementation periodically, Yoroi provides constant security against code-lifting attacks without key updating. Moreover, the performance of Yoroi is competitive with existing ciphers implementations in the blackbox and whitebox context.

show abstract

Section: Methodsmentioning

confidence: 99%

Section: Methodsmentioning

confidence: 99%

Section: Methodsmentioning

confidence: 99%

See 1 more Smart Citation

Yoroi: Updatable Whitebox Cryptography

Koike

Isobe

2021

TCHES

Self Cite

View full text Add to dashboard Cite

show abstract

“…Then, it cannot hope for a space hardness better than Z = n − log(T ) when the attacker can leak (T × n) bits. Recently published space-hard block ciphers such as Galaxy [KSHI20] or Yoroi [KI21] mainly focus on the space hardness against the KSA/CSA.…”

Section: Space Hardness and Space-hard Block Ciphermentioning

confidence: 99%

“…Considering the table size ranges from KB to GB orders in common space-hard block ciphers, even the partial data (usually, quarter-size, i.e., M/T = 2 −2 ) is large, and leaking them is not easy to hide from users. Nowadays, many space-hard block ciphers have been proposed [BIT16, FKKM16, CCD + 17, KSHI20,KLLM20].…”

Section: Introductionmentioning

confidence: 99%

Hybrid Code Lifting on Space-Hard Block Ciphers

Todo¹,

Isobe

2022

ToSC

Self Cite

View full text Add to dashboard Cite

There is a high demand for whitebox cryptography from the practical use of encryption in untrusted environments. It has been actively discussed for two decades since Chow et al. presented the whitebox implementation of DES and AES. The goal is to resist the key extraction from the encryption program and mitigate the code lifting of the program. At CCS2015, Bogdanov and Isobe proposed space-hard block ciphers as a dedicated design of whitebox block ciphers. It ensures that the key extraction is as difficult as the key recovery in the standard blackbox model. Moreover, to mitigate code lifting, they introduce space hardness, a kind of leakage-resilient security with the incompressibility of a huge program. For space-hard ciphers, code lifting (a partial leakage of the entire program) is useless to copy the functionality.In this paper, we consider a new attack model of space-hard block ciphers called hybrid code lifting. Space-hard block ciphers are intended to ensure security under a size-bounded leakage. However, they do not consider attackers (in the standard blackbox model) receiving the leakage by code lifting. If such attackers can recover the encryption program of a space-hard block cipher, such a cipher does not always satisfy the intention. We analyze Yoroi proposed in TCHES 2021. We introduce the canonical representation of Yoroi. Using the representation enables the recovery of the programs of Yoroi-16 and Yoroi-32 with 233 and 265.6 complexities, respectively, in spite of slight leakage. The canonical representation causes another attack against Yoroi. It breaks an authors’ security claim about the “longevity”. We additionally analyzed SPNbox proposed in Asiacrypt 2016. As a result, considering security on the hybrid code lifting, the original number of rounds is insufficient to achieve 128-bit security under quarter-size leakage.

show abstract