32
Algebraic Attack on Stream Ciphers MSIS 7 IS department MCS NUST

Introduction

  • Upload
    yuma

  • View
    28

  • Download
    0

Tags:

Embed Size (px)

DESCRIPTION

Introduction. In this type of attack which is applicable both to stream ciphers and block ciphers, ciphers are rewritten to systems of multivariate equations Solving the system of equations will give unknown Thus in short An algebraic attack consists of these two steps: - PowerPoint PPT Presentation

Citation preview

Page 1: Introduction

Algebraic Attack on Stream Ciphers

MSIS 7 IS department MCS NUST

Page 2: Introduction

In this type of attack which is applicable both to stream ciphers and block ciphers, ciphers are rewritten to systems of multivariate equations

Solving the system of equations will give unknown

Thus in short An algebraic attack consists of these two steps:◦ Set up system of equations in key bits and

output bits◦ Solve it

Introduction

Page 3: Introduction

Algebraic equations of LFSR

Page 4: Introduction

Algebraic equations of LFSR

Page 5: Introduction

Algebraic equations of LFSR

Page 6: Introduction

Algebraic equations of LFSR with combiner function

Page 7: Introduction

Algebraic equations of LFSR with combiner function

Using direct algebraic approach we can derive equations in key bits k0, k1,…. kn-1 as

Page 8: Introduction

Algebraic equations of LFSR with combiner function

In general we cannot expect to find an efficient solver for all kinds of systems of equations.

But the situation changes if the system is over defined.

In these cases the linearization is used. This method has the advantage of solving an over-defined system of nonlinear equations in polynomial time if enough linearly independent equations are given. Principle for the Linearization algorithm is:◦ Use an over-defined equation◦ Replace each monomial with a new variable◦ Solve as linear system

Page 9: Introduction

Algebraic equations of LFSR with combiner function

In general we cannot expect to find an efficient solver for all kinds of systems of equations.

But the situation changes if the system is over defined.

In these cases the linearization is used. This method has the advantage of solving an over-defined system of nonlinear equations in polynomial time if enough linearly independent equations are given. Principle for the Linearization algorithm is:◦ Use an over-defined equation◦ Replace each monomial with a new variable◦ Solve as linear system

Page 10: Introduction

LinearizationExample Solve following quadratic equation of

GF(7)

x2 +4y2 + z2 +5xy +2xz +6yz +5x +3y +5z +1 = 03x2 +2y2 +3z2 +4xy +6xz +2yz +6x +4y +3z +2 = 02x2 +3y2 +2z2 +5xy +2yz + 4x + y + z + 4 = 06x2 +3y2 +3z2 +5xz + yz + 5y + 2z + 2 = 0

Page 11: Introduction

Linearizationx2 y2 z2 xy xz yz A B C D E F A +4B + C +5D +2E +6F +5x +3y +5z +1 = 03A +2B +3C +4D +6E +2F +6x +4y +3z +2 = 02A +3B +2C +5D +2F + 4x + y + z + 4 = 06A +3B +3C +5E + F + 5y + 2z + 2 = 0

Page 12: Introduction

Add Extra Equations # {variables} >> # {equations}

There are too many solutions to the system of linear equations.

Add relations of new variables to reduce the number of solutions. For example, Dz = Ey = Fx [since (xy)z = (xz)y = (yz)x] Ay = Dx , ... [since (x2)y = (xy)x, ...] DE = AF , ... [since (xy)(xz) = (x2)(yz), ...]

Page 13: Introduction

Relinearization Consider each quadratic monomial as a new

variable and linearize again. In general, with more variables: (ab)(cd ) = (ac)(bd ) = (ad )(bc) (ab)(cd )(ef ) = (ad )(cf )(eb) = … This idea was used by: Kipnis and Shamir,

Cryptanalysis of the HFE Public Key Cryptosystem by Relinearization, Crypto '99, LNCS 1666, pp. 19-30.

Relinearization is not as efficient as expected.

Page 14: Introduction

XL EXtended Linearization Previous system of quadratic equations:

l1 : x2 +4y2 + z2 +5xy +2xz +6yz +5x +3y +5z +1 = 0l2 : 3x2 +2y2 +3z2 +4xy +6xz +2yz +6x +4y +3z +2 = 0l3 : 2x2 +3y2 +2z2 +5xy +2yz + 4x + y + z + 4 = 0l4 : 6x2 +3y2 +3z2 +5xz + yz + 5y + 2z + 2 = 0

Try degree D = 3: Multiply each li by x, y, z respectively. Linearize: Consider all monomials as variables.

How many equations now? 44 = 16 And Number of variables = 20

Page 15: Introduction

Matrix of Coefficientsx2y x2z xy2 xyz xz2 y2z yz2 xy xz yz x3 x2 x y3 y2 y z3 z2 z 1 0 0 0 0 0 0 0 5 2 6 0 1 5 0 4 3 0 1 5 1 0 0 0 0 0 0 0 4 6 2 0 3 6 0 2 4 0 3 3 2 0 0 0 0 0 0 0 5 0 2 0 2 4 0 3 1 0 2 1 4 0 0 0 0 0 0 0 0 5 1 0 6 0 0 3 5 0 3 2 2 5 2 4 6 1 0 0 3 5 0 1 5 1 0 0 0 0 0 0 0 1 0 5 2 0 6 1 5 0 5 0 0 0 4 3 1 0 0 0 0 0 1 0 5 2 4 6 0 5 3 0 0 0 0 0 0 1 5 1 0 4 6 2 2 3 0 0 4 3 0 3 6 2 0 0 0 0 0 0 0 3 0 4 6 0 2 3 6 0 3 0 0 0 2 4 2 0 0 0 0 0 3 0 4 6 2 2 0 6 4 0 0 0 0 0 0 3 3 2 0 5 0 3 2 2 0 0 1 1 0 2 4 4 0 0 0 0 0 0 0 2 0 5 0 0 2 2 4 0 1 0 0 0 3 1 4 0 0 0 0 0 2 0 5 0 3 2 0 4 1 0 0 0 0 0 0 2 1 4 0 0 5 3 1 3 0 0 5 2 0 6 0 2 0 0 0 0 0 0 0 6 0 0 5 0 1 3 0 0 2 0 0 0 3 5 2 0 0 0 0 0 6 0 0 5 3 1 0 0 5 0 0 0 0 0 0 3 2 2 0

Page 16: Introduction

Gaussian Elimination x2y x2z xy2 xyz xz2 y2z yz2 xy xz yz x3 x2 x y3 y2 y z3 z2 z 1 5 2 4 6 1 0 0 3 5 0 1 5 1 0 0 0 0 0 0 0 0 1 0 5 4 6 1 3 6 5 4 6 4 4 3 1 0 0 0 0 0 0 3 6 0 3 4 1 2 6 0 5 6 2 5 4 0 0 0 0 0 0 0 1 0 2 3 4 5 3 0 2 1 2 4 2 0 0 0 0 0 0 0 0 5 5 5 4 6 5 3 1 3 3 4 6 1 5 1 0 0 0 0 0 0 5 3 2 4 0 0 1 4 1 2 1 0 2 6 0 0 0 0 0 0 0 6 4 2 0 5 1 5 6 5 6 1 0 0 0 0 0 0 0 0 0 0 5 0 2 0 2 4 0 3 1 0 2 1 4 0 0 0 0 0 0 0 0 5 1 0 6 0 0 3 5 0 3 2 2 0 0 0 0 0 0 0 0 0 2 0 4 0 0 3 0 0 2 4 2 0 0 0 0 0 0 0 0 0 0 6 0 6 3 1 0 4 1 6 1 0 0 0 0 0 0 0 0 0 0 0 2 1 0 0 0 0 4 3 1 0 0 0 0 0 0 0 0 0 0 0 0 3 1 2 4 2 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 4 6 0 0 1 5 0 0 0 0 0 0 0 0 0 0 0 0 0 0 6 3 6 1 5 5 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 5 2 1 6

Page 17: Introduction

XL Algorithm The last row in the previous matrix represents 5z3 +

2z2 + z + 6 = 0. Its solutions in GF(7) are z = 1, z = 2, and z = 5.

Solve the remaining variables recursively: 2 row: 6y2 + 3y + 6z3 + z2 + 5z + 5 = 0 4 row: 3x + y3 + 2y2 + 4y + 2z3 + z = 0

Use other equations to erase all extraneous solutions.

This system has a unique solution: x = 1 , y = 3 , and z = 5.

Page 18: Introduction

Gaussian Elimination

Page 19: Introduction

XL Algorithm The complexity of the algorithm mainly depends on the

time it takes to row reduce the final matrix. Therefore the number of equations and distinct monomials in the expanded system will determine the complexity.

The authors of XL claimed that their algorithm solves a randomly generated system of polynomial equations in sub-exponential time when the number of equations slightly exceeds the number of variables. These claims are still impractical but better than the theoretical worst case.

Page 20: Introduction

Complexity of the attack

Page 21: Introduction

Algebraic Attacks If we can set up a true system of lower degree

r < d complexity becomes smaller,

So need is to decrease the degree of the system

Page 22: Introduction

Annihilators of a function Let f(x1; x2; x3) = x1x2 +x2x3 +x3

Let and

0.,,, gfiffofrannihilatoisgthenfunctionsBooleanbeBgf n

}0.|{)( gfBgfAn n

Page 23: Introduction

Attack using Annihilators

Page 24: Introduction

Attack using Annihilators

Page 25: Introduction
Page 26: Introduction
Page 27: Introduction
Page 28: Introduction
Page 29: Introduction
Page 30: Introduction

A=

Page 31: Introduction
Page 32: Introduction

Fast algebraic attacks: reducing thedegree


 · Contents INTRODUCTION Introduction

 · Contents INTRODUCTION Introduction

Documents
voip-iptel-introduction-SRK1.ppt voip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-ip

voip-iptel-introduction-SRK1.ppt voip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-ip

Documents
1. Introduction 1. Introduction 1. Introduction 1 ... · Introduction 1. Introduction 1. Introduction 1. Introduction 6061B0242401. The Phone Screen From the Phone screen, you can

1. Introduction 1. Introduction 1. Introduction 1 ... · Introduction 1. Introduction 1. Introduction 1. Introduction 6061B0242401. The Phone Screen From the Phone screen, you can

Documents
Introduction to Databases: Introduction

Introduction to Databases: Introduction

Documents
Introduction to Logic Introduction

Introduction to Logic Introduction

Documents
VisionaryScancombinesarichsetofqualitycontrolandproductivi ... · Introduction Introduction VisionaryScancombinesarichsetofqualitycontrolandproductivityfeatureswithasimpleinterfacedesignedspecificallyforscanningandcodingdepositionexhib-

VisionaryScancombinesarichsetofqualitycontrolandproductivi ... · Introduction Introduction VisionaryScancombinesarichsetofqualitycontrolandproductivityfeatureswithasimpleinterfacedesignedspecificallyforscanningandcodingdepositionexhib-

Documents
INTRODUCTIONS (LEADS) Academic introduction Creative introduction Action introduction Dialogue introduction Overarching societal statements Personal introduction

INTRODUCTIONS (LEADS) Academic introduction Creative introduction Action introduction Dialogue introduction Overarching societal statements Personal introduction

Documents
Introduction to Elasticsearch and Logstash. - KIT · PDF fileOutline 1 Introduction 2 Logstash Introduction 3 Elasticsearch Introduction 4 Conclusions Introduction Logstash ElasticsearchConclusions

Introduction to Elasticsearch and Logstash. - KIT · PDF fileOutline 1 Introduction 2 Logstash Introduction 3 Elasticsearch Introduction 4 Conclusions Introduction Logstash ElasticsearchConclusions

Documents
Introduction 1. Introduction

Introduction 1. Introduction

Documents
1. INTRODUCTION • INTRODUCTION • EINFÜHRUNG • INLEIDING • INTRODUCCIÓN … · 2016-12-16 · 1. INTRODUCTION • INTRODUCTION • EINFÜHRUNG • INLEIDING • INTRODUCCIÓN

1. INTRODUCTION • INTRODUCTION • EINFÜHRUNG • INLEIDING • INTRODUCCIÓN … · 2016-12-16 · 1. INTRODUCTION • INTRODUCTION • EINFÜHRUNG • INLEIDING • INTRODUCCIÓN

Documents
Introduction to Transducers, Introduction to Transducers ...engtech.weebly.com/.../more_on_transducers_sensors_actuators.pdf · Introduction to Transducers, Introduction to Transducers,

Introduction to Transducers, Introduction to Transducers ...engtech.weebly.com/.../more_on_transducers_sensors_actuators.pdf · Introduction to Transducers, Introduction to Transducers,

Documents
Introduction to Transducers, Introduction to Transducers ... on... · Introduction to Transducers, Introduction to Transducers, Sensors and ActuatorsSensors and Actuators Introduction

Introduction to Transducers, Introduction to Transducers ... on... · Introduction to Transducers, Introduction to Transducers, Sensors and ActuatorsSensors and Actuators Introduction

Documents
1 Introduction INTRODUCTION - MICROCSB

1 Introduction INTRODUCTION - MICROCSB

Documents
CrowPiwithMineCraftPiEdition · 2 CrowPiwithMineCraftPiEdition-Introduction-MinecraftPiEdition-Introduction-Whatyouwillneed-Introduction-RunningMinecraft-Introduction

CrowPiwithMineCraftPiEdition · 2 CrowPiwithMineCraftPiEdition-Introduction-MinecraftPiEdition-Introduction-Whatyouwillneed-Introduction-RunningMinecraft-Introduction

Documents
Introduction - daks2k3a4ib2z.cloudfront.net€¦ · Introduction Establishedin1974MarbleHillFireplacesofferoneofthelargestandmostcomprehensiveselectionsof …

Introduction - daks2k3a4ib2z.cloudfront.net€¦ · Introduction Establishedin1974MarbleHillFireplacesofferoneofthelargestandmostcomprehensiveselectionsof …

Documents
Systems Analysis I introduction I introduction. 2Systems Analysis - Introduction Contents Introduction Introduction 3 classic phases 3 classic phases

Systems Analysis I introduction I introduction. 2Systems Analysis - Introduction Contents Introduction Introduction 3 classic phases 3 classic phases

Documents
Introduction and Welcome€¦ · Introduction and Welcome Introduction 4

Introduction and Welcome€¦ · Introduction and Welcome Introduction 4

Documents
Introduction Introduction to Brittle Deformation

Introduction Introduction to Brittle Deformation

Documents
Introducción / Introduction / Introduction

Introducción / Introduction / Introduction

Documents
1. INTRODUCTION INTRODUCTION - Deusto

1. INTRODUCTION INTRODUCTION - Deusto

Documents
Topics Introduction 1 / 3 Introduction 2 / 3 Introduction 3 / 3

Topics Introduction 1 / 3 Introduction 2 / 3 Introduction 3 / 3

Documents
Introduction Introduction Introduction Introduction

Introduction Introduction Introduction Introduction

Documents
An Introduction for An Introduction for Introduction for ......An Introduction for An Introduction for Introduction for TeachersTeachersTeachers . exChange, Blackburn Cathedral’s

An Introduction for An Introduction for Introduction for ......An Introduction for An Introduction for Introduction for TeachersTeachersTeachers . exChange, Blackburn Cathedral’s

Documents
Introduction Introduction (ctnd.)

Introduction Introduction (ctnd.)

Documents
R as a Web Service Introduction Introduction Introduction

R as a Web Service Introduction Introduction Introduction

Documents
1 Introduction t 1. Introduction to Nanotechnology - UFAMhome.ufam.edu.br/berti/nanomateriais/Introduction to Nanotechnology... · Introduction t 1. Introduction to Nanotechnology

1 Introduction t 1. Introduction to Nanotechnology - UFAMhome.ufam.edu.br/berti/nanomateriais/Introduction to Nanotechnology... · Introduction t 1. Introduction to Nanotechnology

Documents
§1.1.1 INTRODUCTION: 1. INTRODUCTION

§1.1.1 INTRODUCTION: 1. INTRODUCTION

Documents
INTRODUCTION SPECIFICATIONS INTRODUCTION

INTRODUCTION SPECIFICATIONS INTRODUCTION

Documents
An Introduction to NSAn Introduction to NS2An Introduction

An Introduction to NSAn Introduction to NS2An Introduction

Documents
PRODUCT INTRODUCTION Company Introduction

PRODUCT INTRODUCTION Company Introduction

Documents