Introduction Low Data Complexity Cryptanalysis Symbolic Tools Results Conclusion

Introduction Low-Data Complexity Cryptanalysis Symbolic Tools Results Conclusion
Symbolic Methods for the Automatic Search
of Attacks Against Some Block Ciphers
Charles Bouillaguet
(joint work with Patrick Derbez and Pierre-Alain Fouque)
Université de Versailles St-Quentin en Yvelines
LSV Seminar
November 15, 2011Introduction Low-Data Complexity Cryptanalysis Symbolic Tools Results Conclusion
A(VeryBrief)IntroductiontoCryptography: Encryption
5c14ff5cc3225fb9e5ae8919671e23b6
K K
??
???Introduction Low-Data Complexity Cryptanalysis Symbolic Tools Results Conclusion
Block-CipherCryptanalysis: theObject
a Block Cipher
k n nE :f0, 1g f0, 1g !f0, 1g
| {z } | {z } | {z }
key plaintext ciphertext
plaintext
key
ciphertextIntroduction Low-Data Complexity Cryptanalysis Symbolic Tools Results Conclusion
Block-CipherCryptanalysis: theObject
Plaintext
k0
Round
k1
Round
k2
RoundKey ScheduleK
kr
Round
CiphertextIntroduction Low-Data Complexity Cryptanalysis Symbolic Tools Results Conclusion
Block-CipherCryptanalysis: theObject
Plaintext
k0
Round
k1
Round
k2
RoundKey ScheduleK
kr
Round
CiphertextIntroduction Low-Data Complexity Cryptanalysis Symbolic Tools Results Conclusion
Block-CipherCryptanalysis: theSubject
an Attacker
I Goal :
I In Theory: distinguishfromrandompermutation
I In Practice: recoverthesecretkey
I Resources:
kI Time: less than 2 encryptions
nI Data: less than 2 plaintext/ciphertext pairsIntroduction Low-Data Complexity Cryptanalysis Symbolic Tools Results Conclusion
Block-CipherCryptanalysis: theGame
?? ?
? ? plaintext
ciphertextIntroduction Low-Data Complexity Cryptanalysis Symbolic Tools Results Conclusion
Block-CipherCryptanalysis: theGame
?? ?
? ? plaintext
ciphertextIntroduction Low-Data Complexity Cryptanalysis Symbolic Tools Results Conclusion
Block-CipherCryptanalysis: theGame
?? ?
? ? plaintext
K
ciphertextIntroduction Low-Data Complexity Cryptanalysis Symbolic Tools Results Conclusion
WhatCanWeDoWhenBlockCiphersAreTooStrongForUs?
I Solution#1:
I weakenit, thenbreakit
PlaintextI reduce number of rounds
k0
Round
k1
Round
k2
RoundKey ScheduleK
kr
Round
Ciphertext