Design Of Ciphers Research Articles

LRBC: a lightweight block cipher design for resource constrained IoT devices

The internet of things (IoT) is now an in-demand technology that has been adopted in various applications and includes various embedded devices, sensors and other objects connected to the Internet. Due to the rapid development of this technology, it covers a significant portion of the research interests nowadays. IoT devices are typically designed for collecting different types of data from various sources and transmitting them in digitized form. However, data security is the burning issue in the IoT technology, which can broadly impact the privacy of crucial data. In this regard, a new lightweight encryption method called LRBC has been proposed in this work for resource constraint IoT devices which can provide data security at the sensing level. The LRBC has used the structural advantages of both substitution–permutation network (SPN) and Feistel structure together to achieve better security. Furthermore, the proposed method has been tested on NEXYS 4 DDR FPGA (Artix-7) trainer kit and implemented for application specific integrated circuit (ASIC) chip on TSMC 65 nm technology. The proposed algorithm consumes very less power of 11.40 μW and occupies a 258.9 GE (Gate Equivalent) area. Besides, a thorough security analysis shows that the proposed scheme ensures high security against various attacks with robustness. Moreover, the average avalanche effect of LRBC is found to be 58% and 55.75% concerning plaintext and key, respectively.

A New Upper Bound on the Order of Affine Sub-families of NFSRs

Nonlinear feedback shift registers (NFSRs) are widely used as building blocks in the design of stream ciphers. Let NFSR(f) be an NFSR with the characteristic function f and let G(f) be the set of output sequences of NFSR(f). For a given NFSR(f), if there exists an affine Boolean function l such that G(l) ⊆ G(f), then G(l) is called an affine sub-family of NFSR(f). In this paper, by skillfully combining previous ideas, the authors give a new upper bound on the order of affine sub-families of NFSR(f). Compared with the four known bounds, the bound is better than three of them, and in some cases is also better than the rest one.

New Mathblocks-Based Feistel-Like Ciphers for Creating Clone-Resistant FPGA Devices

The Secret Unknown Cipher (SUC) concept was introduced a decade ago as a promising technique for creating pure digital clone-resistant electronic units as alternatives to the traditional non-consistent Physical Unclonable Functions (PUFs). In this work, a very special unconventional cipher design is presented. The design uses hard-core FPGA (Field Programmable Gate Arrays) -Mathblocks available in modern system-on-chip (SoC) FPGAs. Such Mathblocks are often not completely used in many FPGA applications; therefore, it seems wise to make use of such dead (unused) modules to fabricate usable physical security functions for free. Standard cipher designs usually avoid deploying multipliers in the cipher mapping functions due to their high complexity. The main target of this work is to design large cipher classes (e.g., cipher class size >2600) by mainly deploying the FPGA specific mathematical cores. The proposed cipher designs are novel hardware-oriented and new in the public literature, using fully new unusual mapping functions. If a random unknown selection of one cipher out of 2600 ciphers is self-configured in a device, then a Secret Unknown Cipher module is created within a device, making it physically hard to clone. We consider the cipher module for free (for zero cost) if the major elements in the cipher module are making use of unused reanimated Mathblocks. Such ciphers are usable in many future mass products for protecting vehicular units against cloning and modeling attacks. The required self-reconfigurable devices for that concept are not available now; however, they are expected to emerge in the near future.

A Novel Architecture for Low Power Adiabatic Cipher

AES stands for Advanced Encryption Standard. It is widely used in today’s various security applications. S-box method is the most common and important in today’s data security and embedded applications.. This S-box consumes a considerable percentage of power of the whole system. S-box is very prone to differential power attacks(DPA). DPA is the most threatening types of attacks in cryptographic systems. In this paper, we have implemented one positive polarity Reed Muller type S-box is implemented using adiabatic logic. Efficient charge recovery logic(ECRL)is used here. FinFET based ECRL is used to implement the S-box has been observed and calculated .The performance of ECRL based S-box is compared with conventional CMOS based S-box. The statistical parameters for DPA cipher design are also analyzed.

Provable one-XOR matrices for construction of 4 × 4 hardware-oriented MDS diffusion layers

MDS diffusion layers are critical in the design of modern symmetric ciphers. Lightweight MDS matrices are studied for designing ciphers targeting hardware-oriented applications. In 2016, Beierle, Kranz, and Leander studied elements for which x → ax could be implemented with only one XOR in hardware. Then, they searched for such a’s satisfying the desired conditions for MDS-ness of some constructions. We adopt an opposite approach: we fix the conditions that A, A 3⊕ I and A 7 ⊕ I are n × n invertible binary matrices and then give provable binary n × n one-XOR matrices for which the mentioned conditions hold. Note that these conditions are sufficient ones for MDS-ness of many well-known constructions of 4 × 4 MDS matrices over n-bit words such as some recursive MDS diffusion layers as well as circulant AES-like MDS matrices.

Randomized nonlinear software-oriented MDS diffusion layers

Abstract MDS diffusion layers are critical components in the design of symmetric ciphers. In this paper, after introducing some new algebraic structures, we provide new MDS matrices over special types of R-modules. With the help of the proposed methodology, we have more flexibility in designing software-oriented diffusion layers. Most notably, we construct randomized and/or nonlinear MDS diffusion layers, based upon the presented theoretical results, and discuss the resistance of the presented diffusion layers against various kinds of cryptanalysis, compared with classical linear diffusion layers.

How Many Weak-Keys Exist in T-310 ?

Abstract T-310 is an important Cold War cipher. The cipher is extremely complex and it outputs extremely few bits from the internal state. A recent paper [Courtois, N. T.: Decryption oracle slide attacks on T-310, Cryptologia, 42 (2018), no. 3, 191–204] shows an example of a highly anomalous key such that T-310 can be broken by a slide attack with a decryption oracle. In this paper, we show that the same attacks are ALSO possible for regular keys which satisfy all the official KT1 requirements. Two other recent papers [Courtois, N. T.—Georgiou, M.—Scarlata, M.: Slide attacks and LC-weak keys in T-310, Cryptologia 43 (2019), no. 3, 175–189]; [Courtois, N. T.—Oprisanu, M. B.—Schmeh, K.: Linear cryptanalysis and block cipher design in East Germany in the 1970s, Cryptologia (published online), December 5, 2018] show that some of the KT1 keys are very weak w.r.t. Linear Cryptanalysis. In this paper, we show that a vast number of such weak keys exist and study the exact pre-conditions which make them weak. In addition we introduce a new third class of weak keys for RKDC (Related-Key Differential Cryptanalysis). We show that the original designers in the 1970s have ensured that these RKDC properties cannot happen for 4 rounds. We have discovered that these properties can happen for as few as 5 rounds for some keys, and for 10 to 16 rounds they become hard to avoid. The main reason why we study weak keys is to show that none of these properties occur by accident, rather that they are governed by precise pre-conditions which guarantee their existence, and countless other keys with the same properties exist. Eventually, this is how interesting attacks can be found.

Design Considerations of Lightweight Block Ciphers for Low-Cost Embedded Devices

In the 21st century, Internet of Things (IoT) has become pivotal technology and has attracted worldwide attention in the smart computing environment. In order to enjoy the benefits of this new environment, security is considered as the main aspect in constrained end nodes. Ordinary cryptographic solutions are not sufficient for resource constraint devices. To fulfill this gap, a relatively new field of cryptography called lightweight cryptography came into existence. Furthermore, designing lightweight ciphers especially software oriented poses some significant limits and inherent conditions. Some design considerations of a lightweight encryption algorithm and tradeoffs for minimizing resource requirements are presented in this paper. Also, for a cipher, it is necessary to provide strong resistance against attacks. In this paper different countermeasures to prevent from attacks is also presented. By considering the performance-enhancing ideas presented in this paper, a new GFN based lightweight block cipher is proposed. A cipher design has two main parts; internal structure and key schedule. The internal structure of the proposed design has three layers in which operations are so arranged that it utilizes small code size and has fast diffusion. Besides, design of newly proposed cipher is such that it thwarts the effect of most of the attacks. In the nutshell, this paper serves as a base for designing good lightweight cipher for resource constraint smart IOT environment.

Fully Automated Differential Fault Analysis on Software Implementations of Block Ciphers

Differential Fault Analysis (DFA) is considered as the most popular fault analysis method. While there are techniques that provide a fault analysis automation on the cipher level to some degree, it can be shown that when it comes to software implementations, there are new vulnerabilities, which cannot be found by observing the cipher design specification.This work bridges the gap by providing a fully automated way to carry out DFA on assembly implementations of symmetric block ciphers. We use a customized data flow graph to represent the program and develop a novel fault analysis methodology to capture the program behavior under faults. We establish an effective description of DFA as constraints that are passed to an SMT solver. We create a tool that takes assembly code as input, analyzes the dependencies among instructions, automatically attacks vulnerable instructions using SMT solver and outputs the attack details that recover the last round key (and possibly the earlier keys). We support our design with evaluations on lightweight ciphers SIMON, SPECK, and PRIDE, and a current NIST standard, AES. By automated assembly analysis, we were able to find new efficient DFA attacks on SPECK and PRIDE, exploiting implementation specific vulnerabilities, and previously published DFA on SIMON and AES. Moreover, we present a novel DFA on multiplication operation that has never been shown for symmetric block ciphers before. Our experimental evaluation also shows reasonable execution times that are scalable to current cipher designs and can easily outclass the manual analysis. Moreover, we present a method to check the countermeasure-protected implementations in a way that helps implementers to decide how many rounds should be protected. We note that this is the first work that automatically carries out DFA on cipher implementations without any plaintext or ciphertext information and therefore, can be generally applied to any input data to the cipher.

Secure Symmetric Block Cipher Design for Encrypting the Bitcoin Wallets in Cryptocurrencies Applications

This paper proposes a new symmetric secret-key cipher for construction of block cipher model. This new approach is considered as a smart step that can be applied to the long process research of modern designing methods used in developing earlier symmetric algorithms. The present cipher can encrypt block lengths of 128-bit by employing Substitution-Permutation Network (SPN) structure. The present cipher uses three options of strong ciphering-key along with variable lengths of 192-bit for 12 rounds, 128-bit for 10 rounds and long ciphering key of 256-bit for 14 rounds similar to standard ciphers. The proposed algorithm has been designed to trust applications that are based on Bitcoin and crypto-currencies. The current algorithm intended to encrypt addresses of Bitcoin wallet that work quite similar to the e-mail address. The bitcoin wallet includes sensitive information like private secret keys and derived password that are highly confidential. The Advance Encryption Standard (AES) is employed to encrypt most of the bitcoin wallet database. The proposed cipher can act as a good substitute for the standard cipher that allows trusting the Bitcoin wallet database with high security and with a much more complex scheme. The key goal of the submitted algorithm is to build a new enhanced modern cipher with a secure and efficient applicable algorithm that can be used for crypto currencies applications employing a wide trail design strategy.

Zero-correlation attacks on tweakable block ciphers with linear tweakey expansion

The design and analysis of dedicated tweakable block ciphers is a quite recent and very active research field that provides an ongoing stream of new insights. For instance, results of Kranz, Leander, and Wiemer from FSE 2017 show that the addition of a tweak using a linear tweak schedule does not introduce new linear characteristics. In this paper, we consider – to the best of our knowledge – for the first time the effect of the tweak on zero-correlation linear cryptanalysis for ciphers that have a linear tweak schedule. It turns out that the tweak can often be used to get zero-correlation linear hulls covering more rounds compared to just searching zero-correlation linear hulls on the data-path of a cipher. Moreover, this also implies the existence of integral distinguishers on the same number of rounds. We have applied our technique on round reduced versions of Qarma, Mantis, and Skinny. As a result, we can present – to the best of our knowledge – the best attack (with respect to number of rounds) on a round-reduced variant of Qarma.

On the extension and security of key schedule of GOST

A type of simple key schedule especially suitable for lightweight block ciphers is defined as straightforward key schedule in this study. As a typical example, GOST-type key schedule, which is an extension of the key schedules of Russian Standard GOST and its newly modified version GOST2, is introduced and classified. GOST2 is designed based on the GOST encryption structure with different but the same type of key schedule to overcome the weakness of GOST against self-similarity properties-based attacks. However, it has been shown in Fast Software Encryption 2017, the simple change in the key schedule is insufficient to offer 256-bit security. By constructing an evaluation framework combining self-similarity properties and meet-in-the-middle attack, properties of GOST-type key schedules are evaluated, and candidate key schedules are provided in this work. These candidate key schedules are able to provide much better security for GOST and GOST2 ciphers than their original key schedules, and the pre-existing self-similarity properties-based attacks of full round GOST and GOST2 can be avoided. The designers of GOST and GOST2 should have been more cautious choosing the parameters of key schedules. The evaluation framework proposed can be used for reference in the design of other Feistel ciphers with straightforward key schedules.

FPGA Modeling and Optimization of a SIMON Lightweight Block Cipher.

Security of sensitive data exchanged between devices is essential. Low-resource devices (LRDs), designed for constrained environments, are increasingly becoming ubiquitous. Lightweight block ciphers provide confidentiality for LRDs by balancing the required security with minimal resource overhead. SIMON is a lightweight block cipher targeted for hardware implementations. The objective of this research is to implement, optimize, and model SIMON cipher design for LRDs, with an emphasis on energy and power, which are critical metrics for LRDs. Various implementations use field-programmable gate array (FPGA) technology. Two types of design implementations are examined: scalar and pipelined. Results show that scalar implementations require 39% less resources and 45% less power consumption. The pipelined implementations demonstrate 12 times the throughput and consume 31% less energy. Moreover, the most energy-efficient and optimum design is a two-round pipelined implementation, which consumes 31% of the best scalar’s implementation energy. The scalar design that consumes the least energy is a four-round implementation. The scalar design that uses the least area and power is the one-round implementation. Balancing energy and area, the two-round pipelined implementation is optimal for a continuous stream of data. One-round and two-round scalar implementations are recommended for intermittent data applications.

Recent Results on Constructing Boolean Functions with (Potentially) Optimal Algebraic Immunity Based on Decompositions of Finite Fields

Boolean functions with optimal algebraic immunity (OAI functions) are important cryptographic primitives in the design of stream ciphers. During the past decade, a lot of work has been done on constructing such functions, among which mathematics, especially finite fields, play an important role. Notably, the approach based on decompositions of additive or multiplicative groups of finite fields turns out to be a very successful one in constructing OAI functions, where some original ideas are contributed by Tu and Deng (2012), Tang, et al. (2017), and Lou, et al. (2015). Motivated by their pioneering work, the authors and their collaborators have done a series of work, obtaining some more general constructions of OAI functions based on decompositions of finite fields. In this survey article, the authors review our work in this field in the past few years, illustrating the ideas for the step-by-step generalizations of previous constructions and recalling several new observations on a combinatorial conjecture on binary strings known as the Tu-Deng conjecture. In fact, the authors have obtained some variants or more general forms of Tu-Deng conjecture, and the optimal algebraic immunity of certain classes of functions we constructed is based on these conjectures.

New observation on the key schedule of RECTANGLE

We evaluate the security of RECTANGLE from the perspective of actual key information (AKI). Insufficient AKI permits the attackers to deduce some subkey bits from some other subkey bits, thereby lowering the overall attack complexity or getting more attacked rounds. By considering the interaction between the key schedule’s diffusion and the round function’s diffusion, we find there exists AKI insufficiency in 4 consecutive rounds for RECTANGLE-80 and 6 consecutive rounds for RECTANGLE-128, although the master key bits achieve complete diffusion in 2 and 4 rounds, respectively. With such weakness of the key schedule, we give a generic meet-in-the-middle attack on 12-round reduced RECTANGLE-128 with only 8 known plaintexts. Moreover, we calculate AKI of variants of RECTANGLE as well as PRESENT. Surprisingly we find that both RECTANGLE-128 and PRESENT-128 with no key schedule involve more AKI than the original one. Based on this finding, we slightly modify the key schedule of RECTANGLE-128. Compared with the original one, this new key schedule matches better with the round function in terms of maximizing AKI. Our work adds more insight to the design of block ciphers’ key schedule.

Parallel Platform for Supporting Stream Ciphers Over Multi-core Processors

Designing secure and fast cryptographic primitives is one of the critical issues in the current era. Several domains, including Internet of Things (IoT), military and banking, require fast and secure data encryption over public channels. Most of the existing stream ciphers are designed to work sequentially and therefore not utilizing available computing power. Also, other stream ciphers are designed based on complex mathematical problems which makes these ciphers slower due to the complex computations. For this purpose, a novel parallel platform for enhancing the performance of stream ciphers is presented. The platform is designed to work efficiently over multi-core processors using multithreading techniques. The architecture of the platform relies on independent components that can operate over multiple cores available on the corresponding communication ends. Two groups of stream ciphers were considered as case studies in our experiments. The first category includes stream ciphers of a sequential design, while the second category includes parallelizable stream ciphers. Performance tests and analysis shows that the parallel platform was able to maximize the encryption throughput of the selected stream ciphers dramatically. The enhancements on the encryption throughput is relative to the constructional design of the stream ciphers. Parallelized stream ciphers (Salsa20, DSP-128, and ECSC-128) was able to achieve higher throughput compared to other sequentially designed stream ciphers.

Linear cryptanalysis and block cipher design in East Germany in the 1970s

Linear cryptanalysis (LC) is an important codebreaking method that became popular in the 1990s and has roots in the earlier research of Shamir in the 1980s. In this article we show evidence that linear cryptanalysis is even older. According to documents from the former East Germany cipher authority ZCO, the systematic study of linear characteristics for nonlinear Boolean functions was routinely performed in the 1970s. At the same time East German cryptologists produced an excessively complex set of requirements known as KT1, which requirements were in particular satisfied by known historical used in the 1980s. An interesting line of inquiry, then, is to see if KT1 keys offer some level of protection against linear cryptanalysis. In this article we demonstrate that, strangely, this is not really the case. This is demonstrated by constructing specific counterexamples of pathologically weak keys that satisfy all the requirements of KT1. However, because we use T-310 in a stream cipher mode that uses only a tiny part of the internal state for actual encryption, it remains unclear whether this type of weak key could lead to key recovery attacks on T-310.

Information leakage of 1-Nested-Feistel network

Impossible differential cryptanalysis is a powerful tool to evaluate the strength of a block cipher structure. In this paper, we investigate the impossible differential property of Nested-Feistel networks, which is a famous block cipher network used in lightweight block cipher design. We propose a 3-round 1-probability differential of 1-Nested-Feistel structures, which is a special case of Nested-Feistel network, by using this result, we can construct impossible differentials for any round of Nested-Feistel networks.

Towards Low Energy Stream Ciphers

Energy optimization is an important design aspect of lightweight cryptography. Since low energy ciphers drain less battery, they are invaluable components of devices that operate on a tight energy budget such as handheld devices or RFID tags. At Asiacrypt 2015, Banik et al. presented the block cipher family Midori which was designed to optimize the energy consumed per encryption and which reduces the energy consumption by more than 30% compared to previous block ciphers. However, if one has to encrypt/decrypt longer streams of data, i.e. for bulk data encryption/decryption, it is expected that a stream cipher should perform even better than block ciphers in terms of energy required to encrypt. In this paper, we address the question of designing low energy stream ciphers. To this end, we analyze for common stream cipher design components their impact on the energy consumption. Based on this, we give arguments why indeed stream ciphers allow for encrypting long data streams with less energy than block ciphers and validate our findings by implementations. Afterwards, we use the analysis results to identify energy minimizing design principles for stream ciphers.

Dismantling the AUT64 Automotive Cipher

AUT64 is a 64-bit automotive block cipher with a 120-bit secret key used in a number of security sensitive applications such as vehicle immobilization and remote keyless entry systems. In this paper, we present for the first time full details of AUT64 including a complete specification and analysis of the block cipher, the associated authentication protocol, and its implementation in a widely-used vehicle immobiliser system that we have reverse engineered. Secondly, we reveal a number of cryptographic weaknesses in the block cipher design. Finally, we study the concrete use of AUT64 in a real immobiliser system, and pinpoint severe weaknesses in the key diversification scheme employed by the vehicle manufacturer. We present two key-recovery attacks based on the cryptographic weaknesses that, combined with the implementation flaws, break both the 8 and 24 round configurations of AUT64. Our attack on eight rounds requires only 512 plaintext-ciphertext pairs and, in the worst case, just 237.3 offline encryptions. In most cases, the attack can be executed within milliseconds on a standard laptop. Our attack on 24 rounds requires 2 plaintext-ciphertext pairs and 248.3 encryptions to recover the 120-bit secret key in the worst case. We have strong indications that a large part of the key is kept constant across vehicles, which would enable an attack using a single communication with the transponder and negligible offline computation.