BOGI 전략으로 설계된 블록 암호의 차분 공격에 대한 안전성 분석
Security Analysis of Block Ciphers Designed with BOGI Strategy against Differential Attacks
2
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
블록 암호를 설계할 때, 설계자는 주로 차분 특성 확률의 상한을 이용하여 라운드 수를 결정한다. 라운드 수는 블록 암호의 성능에 영향을 미치므로, 더 적은 라운드를 갖기 위해 차분 특성 확률의 상한을 정밀하게 계산하는 것이중요하다. 이전까지의 활성 S-box의 최소 개수를 탐색하는 방법들은 비선형 연산과 선형 연산을 각각 제약식으로 구성하여 차분 특성 확률의 상한을 계산하였다. 하지만 선형 연산이 비선형 연산에 의존적으로 선택되는 BOGI 설계전략(Bad-Output Good-Input Design Strategy)의 경우 이전 탐색방법으로 구한 상한은 정밀하지 않을 수 있다. 본 논문에서는 BOGI 전략의 성질을 이용하여 기존의 방법보다 더 정밀한 차분 특성 확률의 상한을 구하는 새로운방법을 제안한다. 그리고 이 방법을 이용하여 구한 상한의 타당성을 수학적으로 증명한다. 제안한 방법을 BOGI가사용된 GIFT-64와 GIFT-128에 각각 적용하여 9라운드까지 차분 특성 확률의 상한을 탐색하였다. GIFT-64의 7라운드와 GIFT-128의 9라운드에 대해 기존의 방법을 적용하면 차분 특성 확률의 상한이 각각 2^-18.395와 2^-26.885이었으나, 제안한 방법을 적용하면 각각 2^-19.81 과 2^-28.3으로 더 정밀하게 계산된다.
Abstract
The upper bound of differential characteristic probability is mainly used to determine the number of rounds whenconstructing a block cipher. As the number of rounds affects the performance of block cipher, it is critical to evaluate thetight upper bound in the constructing process. In order to calculate the upper bound of differential characteristic probability,the previous searching methods for minimum number of active S-boxes constructed constraint equations for non-linearoperations and linear operations, independently. However, in the case of BOGI design strategy, where linear operation isdependent on non-linear operation, the previous methods may present the less tight upper bound. In this paper, we exploitthe properties of BOGI strategy to propose a new method to evaluate a tighter upper bound of differential characteristicprobability than previous ones. Additionally, we mathematically proved the validity of our method. Our proposed method wasapplied to GIFT-64 and GIFT-128, which are based on BOGI strategy, and the upper bounds of differential characteristicprobability were derived until 9 round. Previously, the upper bounds of differential characteristic probability for 7-round GIFT-64 and 9-round GIFT-128 were 2^-18.395 and 2^-26.885 , respectively, while we show that the upper bounds ofdifferential characteristic probability are more tight as 2^-19.81 and 2^-28.3 , respectively.
참고문헌 (14)
- Biham, Eli, "Differential cryptanalysis of DES-like cryptosystems", Journal of CRYPTOLOGY, 4(1), pp.3~72 (1991)
- Daemen, Joan, "The design of Rijndael: AES-the advanced encryption standard" (2013), Springer Science & Business Media
- Bogdanov, Andrey, "PRESENT:An ultra-lightweight block cipher", International workshop on cryptographic hardware and embedded systems, pp.450~466 (2007), Springer
- Shirai, Taizo, "The 128-bit blockcipher CLEFIA", International workshop on fast software encryption, pp.181~195 (2007), Springer
- Mouha, Nicky, "Differential and linear cryptanalysis using mixedinteger linear programming", International Conference on Information Security and Cryptology, pp.57~76 (2011), Springer
- Sun, Siwei, "Automatic security evaluation of block ciphers with S-bP structures against related-key differential attacks", International Conference on Information Security and Cryptology, pp.39~51 (2013), Springer
- Sun, Siwei, "Automatic security evaluation and (related-key) differential characteristic search: application to SIMON, PRESENT, LBlock, DES (L) and other bit-oriented block ciphers", International Conference on the Theory and Application of Cryptology and Information Security, pp.158~178 (2014), Springer
- Towards finding the best characteristics of some bit-oriented block ciphers and automatic enumeration of (related-key)differential and linear characteristics with predefined properties, "Sun, Siwei", Cryptology ePrint Archive, ~, pp.Cryptology ePrint Archive, Report 747(2014) (2014)
- Banik, Subhadeep, "GIFT: a small present", International Conference on Cryptographic Hardware and Embedded Systems, pp.321~345 (2017), Springer
- Bertoni, Guido, "Sponge functions", ECRYPT hash workshop, 2007(9) (2007)
- Nyberg, Kaisa, "Differentially uniform mappings for cryptography", Workshop on the Theory and Application of Cryptographic Techniques, pp.55~64 (1993), Springer
- Sasaki, Yu, "New algorithm for modeling S-box in MILP based differential and division trail search", International Conference for Information Technology and Communications, pp.150~165 (2017), Springer
- Brayton, Robert K., "Logic minimization algorithms for VLSI synthesis", Springer Science &Business Media, 2 (1984)
- Ullrich, Markus, "Finding optimal bitsliced implementations of 4× 4-bit S-boxes", SKEW 2011Symmetric Key Encryption Workshop (2011)