Determining whether a given cryptographic function is a permutation of another given cryptographic function—A problem in intellectual property

Abstract

Imagine that, in order to avoid patent fees, licensing agreements, or export restrictions, someone permutes the plaintext bits, ciphertext bits, or key bits of a block cipher. All security properties of the block cipher would be preserved. There are many possible such permutations (e.g. 23116.32 for the Advanced Encryption Standard, AES-256). It might seem infeasible to detect this fraud, and even harder to determine the permutation matrices used. Instead of a block cipher, it could be the compression function of a cryptographic hash, or any other cryptographic function.This paper presents an algorithm whereby this fraud could be easily detected, by means of a SAT-Solver—a standard off-the-shelf software package that solves small-to-medium sized instances of the logical satisfiability problem. This paper also presents how this problem can be modeled in a system of polynomial equations (e.g. in the context of algebraic cryptanalysis). Moreover, this problem is related to the “isomorphism of polynomials” problem and that connection is explored at length.