recursive diffusion layers for block ciphers and hash ... · conclusion • we introduced some...
TRANSCRIPT
Recursive Diffusion Layers foryBlock Ciphers and Hash Functions
Mahdi Sajadieh, Mohammad Dakhilalian, Hamid Mala and Pouyan SepehrdadPouyan Sepehrdad
Isfahan University of Technology, Isfahan, IranIsfahan University, Isfahan, Iran
EPFL, Lausanne, Switzerland
Happy Persian New Year!
Outline
• Lightweight Algorithms and Diffusion Layers• Lightweight Algorithms and Diffusion Layers
• Designing A Recursive Diffusion LayerDesigning A Recursive Diffusion Layer
• Designing A Diffusion Layer with One Linear Function
• Designing A Diffusion Layer with Two Linear Functions
• Conclusion
3
Lightweight Algorithms and Diffusion Layersy
• Most block ciphers: A round consists of confusion and pdiffusion layers.
• The confusion layer: often uses small S-boxes.
• The diffusion layer: plays an efficacious role in providing• The diffusion layer: plays an efficacious role in providing resistance against DC and LC.
• Diffusion layers must– have large branch numbers.
b ffi i b h h l d i– be efficient, both the layer and its reverse.
4
Lightweight Algorithms and Diffusion Layersy
• Lightweight block ciphers:g g p– New ciphers appear everyday in the literature.– Compete over the throughput and GE.
Not providing the same level of security (LC DC AC)– Not providing the same level of security (LC, DC, AC).– Does the comparison make sense?
• Designing lightweight and efficient diffusion layers:– Efficient and perfect recursive Feistel-like diffusion layers. – We design one without any finite fields operationsWe design one without any finite fields operations.– Only have “XOR”s and “Shift” or “Rotations”.– LED and PHOTON: a nice and efficient MDS diffusion layer.
5
Designing A Recursive Diffusion Layer
• Maximal branch number• Length of the input words be changeable• Have a very simple inverse• An efficient linear functions F.
6
Designing A Recursive Diffusion Layer
7
Some Instances of Recursive Diffusion Layersy
• Feistel with a linear F
• Salsa20 (non linear )
• PHOTON matrixPHOTON matrix
8
The Proposed Regular s n-bit Words Diffusion Layery
• In the main pseudo code: ),...,,(),...,,( 1210121 −− = ssi xxxFxxxF
9
A Regular 4×4 In/Out Diffusion Layerwith Perfect Diffusion
⎪⎧ ⊕⊕⊕⊕=
⎪⎧ ⊕⊕⊕⊕= )()( 201233313200 yyLyyyxxxLxxxy
⎪⎪⎩
⎪⎪⎨
⊕⊕⊕⊕=⊕⊕⊕⊕=⊕⊕⊕⊕=
⇒
⎪⎪⎩
⎪⎪⎨
⊕⊕⊕⊕=⊕⊕⊕⊕=⊕⊕⊕⊕= −
)()()(
:
)()()(
:
312300
023011
1301221
202133
131022
020311
xxLxxyxyxLxyyxyxLyyyx
D
yyLyyxyyxLyyxyyxLyxxy
D
10
A Regular 4×4 In/Out Diffusion Layerwith Perfect Diffusion
11
Conditions on L: Maximal Branch Number
• Outputs based on inputs
• The linear functions must be invertible for maximal branch number:
12
Some Linear Functions1))3(()( >>>>>⊕= xxxL 1)1)2&(()( >>>>>⊕= xxxL 1))15(()( >>>>>⊕= xxxL 15))31(()( >>>>>⊕= xxxL 1))63(()( >>>>>⊕= xxxL
• Large number of linear functions satisfying the conditions, some are:some are:
• Without any circular shift:
13
Replacement of Some Diffusion Layers
• MDS_H of Hierocrypt– Performance two times better
• Binary matrix of MMBBinary matrix of MMB– Branch number of the MMB diffusion layer increases to 5.
• prevents the attacks [SAC’09] presented on this block cipher.P f i d d b 10%– Performance is decreased by 10%.
• PHOTON ⎞⎜⎛⎞
⎜⎛ 3 1 2 10 0 1 0
– If L(x)=2x in GF(24) , the matrix is:
⎟⎟⎟⎟
⎠⎜⎜⎜⎜⎜
⎝
=⇒
⎟⎟⎟⎟
⎠⎜⎜⎜⎜⎜
⎝
=
20 6 30 13
13 3 11 4
4 1 7 3 B
3 1 2 1
1 0 0 0
0 1 0 0 B 4
14
All Other Regular Diffusion Layers
For s > 4, no diffusion layer was found with only one linear function.
15
All Other Regular Diffusion Layers
.
16
Non-regular Recursive Diffusion Layers
• In the non-regular diffusion layers: Fi’s are different.– Use only one linear function.y
• The space for a complete search is for an s input/output diffusion layer.
22s2
17
Non-regular Recursive Diffusion Layers
• After a complete search
– For s = 3, the one with the least number of XORs:
⎪⎧ ⊕⊕= 2100 xxxy
For s = 4 the one with the least number of XORs:
⎪⎩
⎪⎨
⊕⊕=⊕⊕⊕=
1022
20211
yyxy)xL(yxxy:D
– For s = 4, the one with the least number of XORs:
⎪⎪⎨
⎧⊕⊕⊕⊕=
⊕⊕⊕=)(
)(
: 020311
32100
yxLyxxyxLxxxy
D
⎪⎪⎩
⎨
⊕⊕⊕=⊕⊕⊕⊕=)(
)(
02133
130322
yLyyxyyxLyxxy
• For s > 4, a complete search is too costly.18
Regular Recursive Diffusion Layers with Two Linear Functions
• If L1 and L2 do not have any relation, the analysis is hard.
or
19
Regular Diffusion Layer for s > 4
• The linear functions which must be invertible:
20
Conclusion
• We introduced some efficient and perfect recursive diffusion layers.
• Found all regular s input/output recursive diffusion layers with s < 8 and one linear function.
• Found all non-regular s input/output recursive diffusion layers with • s < 5 and one linear function.
• Found some efficient regular s input/output recursive diffusion layers with s < 9 and two linear function.
• A good candidate for designing new block ciphers or hash functions.
21
Q i ?Questions?