64-bit Block Research Articles

Security Analysis of Block Cipher LED

A 64-bit block cipher LED proposed in CHES 2011 is suitable for the efficient implementation in constrained hardware environments such as WSN. It supports 64-, 80-, 96- and 128-bit secret keys. In this paper, we propose a differential fault analysis on LED. In order to recover the secret key of LED supporting the 64-bit secret key, this attack requires only one random nibble fault and an exhaustive search of 2^8. In other versions, that are LED supporting 80/96/128-bit secret keys, we require two random nibble faults and an exhaustive search of 2^16. These results are superior to known differential fault analytic results on LED.

Security analysis of block cipher Piccolo suitable for wireless sensor networks

Piccolo is a 64-bit block cipher suitable for the constrained environments such as wireless sensor network environments. In this paper, we propose differential fault analysis on Piccolo. Based on a random byte fault model, our attack can recover the secret key of Piccolo-80 by using an exhaustive search of $2^{24}$ and six random byte fault injections on average. It can be simulated on a general PC within a few seconds. In the case of Piccolo-128, we require an exhaustive search of $2^{40}$ and eight random byte fault injections on average. This attack can be simulated on a general PC within 1 day. These results are the first known side-channel attack results on them.

An 8-Bit ROM-Free AES Design for Low-Cost Applications

We have presented a memory-less design of the advanced encryption standard (AES) with 8-bit data path for applications of wireless communications. The design uses the minimal 160 clock cycles to process a 128-bit data block. For achieving the requirements of low area cost and high performance, new design methods are used to optimize the MixColumns (MC) and Inverse MixColumns (IMC) and ShiftRows (SR) and Inverse ShiftRows (ISR) transformations. Our methods can efficiently reduce the required clock cycles, critical path delays, and area costs of these transformations compared with previous designs. In chip realization, our design with both encryption and decryption abilities has a 29% area increase but achieves 4.85 times improvement in throughput/area compared with the best 8-bit AES design reported before. For encryption only, our AES occupies 3.5 k gates with the critical delay of 12.5 ns and achieves a throughput of 64 Mbps which is the best design compared with previous encryption-only designs.

The Synchronous 8th-Order Differential Attack on 12 Rounds of the Block Cipher HyRAL

We study the synchronous 8th-order differential attack on the 128-bit block cipher HyRAL proposed by Hirata of Laurel Intelligent Systems in 2010. HyRAL supports 128, 192, 256 bits of secret keys. We found the new synchronous 8th-order differential characteristics of HyRAL in the 8th round of data-mixing part. Exploiting the characteristics we show that 12 rounds of HyRAL can be attacked with 2 blocks of chosen plain text and 2 times of data encryption. We have reduced data complexity to 1/2 and reduced computational complexity to 1/2 compared to the conventional attack.

The Improved 96th-Order Differential Attack on 11 Rounds of the Block Cipher CLEFIA

CLEFIA is a 128-bit block cipher proposed by Shirai of SONY et al. in 2007. Its key size is 128, 192, or 256 bits. The number of the round of data processing part depends on a key size, viz. it is 18, 22, or 26 rounds for 128, 192, or 256 bits of a key size, respectively. Such a characteristic of CLEFIA have been known that the 96th- order differential of 64 bits out of 128 bits of the 8th-round's output is zero. With this characteristic, we reported the 96th-order differential attack on 11 rounds of CLEFIA that requires 2 98.3 blocks of plain text and 2 159 times of data encryption. In this paper, we reduce this number of the times of the encryption, (viz. computational complexity) by applying a partial sum technique proposed by Ferguson et al. With the technique, we sequentially derive a modulo 2 occurrence distribution of intermediate data of cryptanalysis. We also reduce the complexity by introducing a nested structure of iterative computations to the attack algorithm. As a result we reduce the complexity to 2 106.6 , which is 1/2 52.4 of the conventional complexity. 

Fault Detection of The SMS4 Cipher Against Single Byte Differential Fault Analysis

The Camellia is a 128-bit block cipher published by NTT and Mitsubishi in 2000. Since the research of differential fault analysis against Camellia was proposed, much work has been devoted to realizing a more efficient different fault analysis. It is a very strong analysis for ciphers when a single fault is injected into the last several rounds of encryption and the whole secret key could be recovered. Thus, how to detect the faults injected into the Camellia cipher with low overhead of complexity is an open problem. This paper gives an answer to this problem by presenting a fault detection of the Camellia block cipher in the single-byte fault model. Our result in this study could detect the faults with negligible cost when faults are even injected into the last three rounds.

다양한 환경에 적용 가능한 블록 암호 Piccolo-128에 대한 안전성 분석

64-비트 블록 암호 Piccolo-128은 무선 센서 네트워크 환경과 같이 제한된 환경에 적합하도록 설계된 경량 블록 암호이다. 본 논문에서는 Piccolo-128에 대한 biclique 공격을 제안한다. 본 논문에서 제안하는 공격은 <TEX>$2^{24}$</TEX>개의 선택 평문과 약 <TEX>$2^{127.35}$</TEX>의 계산 복잡도를 이용하여 Piccolo-128의 비밀키를 복구한다. 본 논문의 공격 결과는 Piccolo-128의 전체 라운드에 대한 첫 번째 이론적인 분석 결과이다. Piccolo-128 is a 64-bit ultra-light block cipher suitable for the constrained environments such as wireless sensor network environments. In this paper, we propose biclique cryptanalysis on the full Piccolo-128. To recover the secret key of Piccolo-128, the proposed attack requires <TEX>$2^{24}$</TEX> chosen plaintexts and the computational complexity of about <TEX>$2^{127.35}$</TEX>. This result is the first known theoretical attack result on the full Piccolo-128.

경량 블록 암호 LBlock에 대한 차분 오류 공격

64-비트 블록 암호 LBlock은 무선 센서 네트워크 환경과 같이 제한된 환경에 적합하도록 설계된 경량 블록 암호이다. 본 논문에서는 LBlock에 대한 차분 오류 공격을 제안한다. 랜덤 니블 오류 주입 가정에 기반을 둔 이 공격은 평균 5개의 랜덤 니블 오류와 <TEX>$2^{25}$</TEX>의 전수조사를 이용하여, LBlock의 비밀키를 복구한다. 이는 일반적인 수 초 내에 가능함을 의미한다. 본 논문의 공격 결과는 기제안된 LBlock에 대한 차분 오류 공격 결과보다 더 효율적이다. LBlock is a 64-bit ultra-light block cipher suitable for the constrained environments such as wireless sensor network environments. In this paper, we propose a differential fault analysis on LBlock. Based on a random nibble fault model, our attack can recover the secret key of LBlock by using the exhaustive search of <TEX>$2^{25}$</TEX> and five random nibble fault injection on average. It can be simulated on a general PC within a few seconds. This result is superior to known differential fault analytic result on LBlock.

Cryptanalysis of reduced versions of the Camellia block cipher

The Camellia block cipher has a 128-bit block length, a user key 128, 192 or 256 bits long and a total of 18 rounds for a 128-bit key and 24 rounds for a 192 or 256-bit key. It is a Japanese CRYPTREC-recommended e-government cipher, a European new European schemes for signatures, integrity and encryption (NESSIE) selected cipher and an ISO international standard. In this study, the authors describe a flaw in the approach used to choose plaintexts or ciphertexts in certain previously published square-like cryptanalytic results for Camellia and give two possible approaches to correct them. Finally, by taking advantage of the early abort technique and a few observations on the key schedule of Camellia, the authors present impossible differential attacks on 10-round Camellia with the FL/FL−1 functions under 128 key bits, 11-round Camellia with the FL/FL−1 functions under 192 key bits, 14-round Camellia without the FL/FL−1 functions under 192 key bits and 16-round Camellia without the FL/FL−1 functions under 256 key bits.

Differential Cryptanalysis on S-DES

In this paper differential attack on S-DES is carried out. S-DES is the reduced version of DES algorithm. This algorithm operates on 8-bit message block with 10-bit key and DES operates on 64-bit message block with 56-bit key. This paper analyzed the differential attack on S-DES. Differential attack is used to break a cipher by trying each possible key.

블록 암호 Piccolo-80에 대한 차분 오류 공격

Piccolo-80 is a 64-bit ultra-light block cipher suitable for the constrained environments such as wireless sensor network environments. In this paper, we propose a differential fault analysis on Piccolo-80. Based on a random byte fault model, our attack can the secret key of Piccolo-80 by using the exhaustive search of and six random byte fault injections on average. It can be simulated on a general PC within a few seconds. This result is the first known side-channel attack result on Piccolo-80.

A NEW BLOCK CIPHER (NAHRAINFISH)BASED ON SOME AES FINALISTS

In this work, we present some deeper insights in the state-of-the-art in block cipher design. This is mainly achieved by assessment of the evaluation process of the AES (Advanced Encryption Standard). We conclude (with may be a little bit surprising result) that the required security level, for a block cipher to be used for the present and foreseeable future, may be underestimated during AES evaluation. In accordance, we propose a new block cipher that we call Nahrainfish, which we believe that it offers the required security level without a big sacrifice in efficiency and other related criteria. Instead of building Nahrainfish totally from scratch, we have made a benefit mainly from some AES finalists to develop the new cipher by an over-engineering approach leading to the required higher security level. Nahrainfish is a classical Feistel network based on a novel combination of both key-dependent S-boxes and data-dependent rotations. It operates on 128-bit blocks and accepts a variable key length up to 1024 bits. The paper also includes some important notes on the security and performance of the cipher.

블록 암호 HIGHT를 위한 암·복호화기 코어 설계

대칭형 블록 암호 시스템은 암호화와 복호화 과정에서 동일한 암호키를 사용한다. HIGHT 암호 알고리즘은 2010년 ISO/IEC에서 국제표준으로 승인된 모바일용 64비트 블록 암호기술이다. 본 논문에서는 HIGHT 블록 암호 알고리즘을 Verilog-HDL을 이용하여 설계하였다. ECB, CBC, OFB 및 CTR과 같은 블록 암호용 4개의 암호 운영모드를 지원하고 있다. 고정된 크기의 연속적인 메시지 블록을 암 복호화할 때, 매 34클럭 사이클마다 64비트 메시지 블록을 처리할 수 있다. Xilinx사의 vertex 칩에서 144MHz의 동작 주파수를 가지며, 최대 처리율은 271Mbps이다. 설계된 암호 프로세서는 PDA, 스마트 카드, 인터넷 뱅킹 및 위성 방송 등과 같은 분야의 보안 모듈로 응용이 가능할 것으로 사료된다. A symmetric block cryptosystem uses an identical cryptographic key at encryption and decryption processes. HIGHT cipher algorithm is 64-bit block cryptographic technology for mobile device that was authorized as international standard by ISO/IEC on 2010. In this paper, block cipher HIGHT algorithm is designed using Verilog-HDL. Four modes of operation for block cipher such as ECB, CBC, OFB and CTR are supported. When continuous message blocks of fixed size are encrypted or decrypted, the desigend HIGHT core can process a 64-bit message block in every 34-clock cycle. The cryptographic processor designed in this paper operates at 144MHz on vertex chip of Xilinx, Inc. and the maximum throughput is 271Mbps. The designed cryptographic processor is applicable to security module of the areas such as PDA, smart card, internet banking and satellite broadcasting.

Advanced encryption standard and its software implementation on ARM processor

To improve the efficiency of Advanced Encryption Standard(AES) algorithm on ARM processor,aiming at AES algorithm with 128-bit block length and key length,an optimization method was proposed.The method can speed up execution efficiently on ARM processor while consuming less ROM memory.A theoretical analysis of the Rijndael algorithm and of the proposed optimization was discussed.S box was generated by real-time calculation.The MixColumns and InvMixColumns transformations were amended to execute efficiently on 32-bit processor.On-the-fly key expansion was adapted.Simulation results of the optimized algorithm on S3C2440 processor were presented.The experimental results show that the optimization of AES algorithm can execute efficiently on S3C2440 and consume less ROM memory.The method can be applied to embedded systems with memory constraints.

무선 센서 네트워크 환경에 적합한 블록 암호 LED-64에 대한 안전성 분석

CHES 2011에 제안된 64-비트 블록 암호 LED-64는 WSN과 같은 제한된 환경에서 효율적으로 구현이 가능하도록 설계된 블록 암호이다. 본 논문에서는 LED-64에 대한 차분 오류 공격을 제안한다. 본 논문에서 소개하는 공격은, 1개의 랜덤 니블 오류와 <TEX>$2^8$</TEX>의 전수조사를 이용하여, LED-64의 비밀키를 복구한다. 본 논문의 공격 결과는 LED-64에 대한 첫 번째 공격 결과이다. LED-64 is a 64-bit block cipher proposed in CHES 2011 and suitable for the efficient implementation in constrained hardware environments such as WSN. In this paper, we propose a differential fault analysis on LED-64. In order to recover the secret key of LED-64, this attack requires only one random nibble fault and an exhaustive search of <TEX>$2^8$</TEX>. This work is the first known cryptanalytic result on LED-64.

블록 암호 KT-64에 대한 안전성 분석

64-비트 블록 암호 KT-64는 CSPNs (Controlled Substitution-Permutation Networks)를 사용하여 FPGA와 같은 하드웨어 구현에 적합하도록 설계된 블록 암호이다. 본 논문에서는 블록 암호 KT-64의 전체 라운드에 대한 확장된 연관키 부메랑 공격을 제안한다. 본 논문에서 소개하는 공격은 KT-64에 대한 최초의 공격이며, <TEX>$2^{45.5}$</TEX>개의 연관키 선택 평문을 이용하여 <TEX>$2^{65.17}$</TEX>의 KT-64 암호화 연산을 수행하여 KT-64의 비밀키를 복구한다. KT-64 is a 64-bit block cipher which use CSPNs suitable for the efficient FPGA implementation. In this paper, we propose a related-key amplified boomerang attack on the full-round KT-64. The attack on the full-round KT-64 requires <TEX>$2^{45.5}$</TEX> related-key chosen plaintexts and <TEX>$2^{65.17}$</TEX> KT-64 encryptions. This work is the first known cryptanalytic result on KT-64.

Known-Key Attacks on Rijndael with Large Blocks and Strengthening ShiftRow Parameter

In this paper, we present known-key attacks on block cipher Rijndael for 192-bit block and 256-bit block. Our attacks work up to 8 rounds for 192-bit block and 9 rounds for 256-bit block, which are one round longer than the previous best known-key attacks. We then search for the parameters for the ShiftRow operation which is stronger against our attacks than the one in the Rijndael specification. Finally, we show a parameter for 192-bit block which forces attackers to activate more bytes to generate a truncated differential path, and thus enhances the security against our attacks.

High-Performance Symmetric Block Ciphers on Multicore CPU and GPUs

As the data protection with encryption becomes important day by day, the encryption processing using General Purpose computation on a Graphic Processing Unit (GPGPU) has been noticed as one of the methods to realize high-speed data protection technology. GPUs have evolved in recent years into powerful parallel computing devices, with a high cost-performance ratio. However, many factors affect GPU performance. In earlier work to gain higher AES performance using GPGPU in various ways, we obtained the following two technical viewpoints: (1) 16 Bytes/Thread is the best granularity (2) Extended key and substitution table stored in shared memory and plaintext stored in register are the best memory allocation style. However, AES is not the only cipher algorithm widely used in the real world. For this reason, this study was undertaken to test the hypothesis that these two findings are applicable to implementation of other symmetric block ciphers on two generation of GPU. In this study, we targeted five 128-bit symmetric block ciphers, AES, Camellia, CIPHERUNICORN-A, Hierocrypt-3, and SC2000, from an e-government recommended ciphers list by the CRYPTography Research and Evaluation Committees (CRYPTREC) in Japan. We evaluated the performance of these five symmetric block ciphers on the machine including a 4-core CPU and each GPU using three method: (A) throughput without data transfer, (B) throughput with data transfer and overlapping encryption processing on GPU, (C) throughput with data transfer and non-overlapping encryption processing on GPU. Results demonstrate that the throughput of implementation of SC2000 in method (A) on Tesla C2050 achieved extremely high 73.4 Gbps. Additionally, the throughput obtained using methods (B) and (C) deteriorated to 33.4 Gbps and 18.3 Gbps, respectively. Method (B) showed effective throughput with an approximately 4.7 times higher speed compared to that obtained when using 8 threads on a 4-core CPU.

Some Saturation Characteristics of XOR Sum of Balance Functions

CLEFIA is a 128-bit block cipher proposed by Shirai et al. in 2007. On its saturation attack, Tsunoo et al. reported peculiar saturation characteristics in 2010. They formulated some hypotheses on the existence of the characteristics with no proof. In this paper we have theoretically proved their hypotheses. In their attack scenario, we show that the mod-2 distribution is a code word of Extended Hamming code, and then proof is given by using the property of Hadamard transform.

Finding Higher Order Differentials of MISTY1

MISTY1 is a 64-bit block cipher that has provable security against differential and linear cryptanalysis. MISTY1 is one of the algorithms selected in the European NESSIE project, and it is recommended for Japanese e-Government ciphers by the CRYPTREC project. In this paper, we report on 12th order differentials in 3-round MISTY1 with FL functions and 44th order differentials in 4-round MISTY1 with FL functions both previously unknown. We also report that both data complexity and computational complexity of higher order differential attacks on 6-round MISTY1 with FL functions and 7-round MISTY1 with FL functions using the 46th order differential can be reduced to as much as 1/22 of the previous values by using multiple 44th order differentials simultaneously.