Linear Attacks Research Articles

Efficient uses of FPGAs for implementations of DES and its experimental linear cryptanalysis

In its basic version, linear cryptanalysis is a known-plaintext attack that uses a linear relation between input-bits, output-bits, and key-bits of an encryption algorithm that holds with a certain probability. If enough plaintext-ciphertext pairs are provided, this approximation can be used to assign probabilities to the possible keys and to locate the most probable one. Matsui (1993) applied it to DES, becoming the best known attack against DES. Knudsen (2000) proposed three chosen-plaintext linear attacks, the third one becoming the best chosen-plaintext attack. This paper presents two original FPGA implementations of a DES encryption/decryption core that work at data rates up to 21.3 Gbps (333 MHz). We believe that our implementations are the fastest ones known nowadays. In our design, the plaintext, the key, and the mode (encryption/decryption) can be changed with no dead cycles. Based on one of our fast DES implementations, we present an FPGA implementation of the known-plaintext linear cryptanalysis of DES. The resulting design is deployed on eight FPGAs and allows us to find 12+1 key bits in about 2.3 hours. As a comparison, the fastest software implementation known so far (in 2000) used the idle time of 18 Intel Pentium III MMX and broke a DES key in 4.32 days. Our fast linear cryptanalysis implementation made the performing of practical tests possible, allowing a comparison with Matsui's theoretical estimations.

The secret‐key block cipher MKC1

AbstractThis paper proposes a new secret‐key block cipher algorithm called MKC1. MKC1 is a Feistel‐type block cipher with variable block length, key length, and number of rounds. The merits of this algorithm are that numerous structures can be formed by selecting the encryption functions and that cellular automata, which can ensure an immense number of structures, and power functions over a finite field, which have strong resistance to differential and linear attacks, are used for the encryption functions. These features increase MKC1's resistance to exhaustive key searches and analytical cryptanalysis. In addition, rules that are relatively powerful as encryption functions among the total of 256 rules for one‐dimensional, two‐state, neighborhood‐three cellular automata were found to practically correspond to Class 3 of Wolfram's classification scheme. The results of computer experiments indicate that MKC1 is several times faster than DES. The industrial value of this algorithm was confirmed by implementing it in an automatic electronic ticket system using a contactless IC card. © 2003 Wiley Periodicals, Inc. Electron Comm Jpn Pt 2, 86(2): 68–83, 2003; Published online in Wiley InterScience (www.interscience.wiley.com). DOI 10.1002/ecjb.10123

Differential and linear probabilities of a block-encryption cipher

We establish that the block-encryption algorithm proposed recently by Jakimoski and Kocarev (see ibid., vol.48, no.2, p.163-169, 2001) is secure against differential and linear attacks.

Variant of DES-128, 192, 256

After Rijndael was selected as AES in October, 2000, DES was announced to completely face out. But triple DES is still used. We may propose a variant of DES with 16 S-boxes and 32 rounds. In this paper, the similar and semi-similar types of an S-box are defined and some mathematical properties are introduced. We will enforce this scheme against differential attack and linear attack.

Relating Differential Distribution Tables to Other Propertiesof of Substitution Boxes

Due to the success of differential and linear attacks on a large number of encryption algorithms, it is important to investigate relationships among various cryptographic, including differential and linear, characteristics of an S-box (substitution box). After discussing a precise relationship among three tables, namely the difference, auto-correlation and correlation immunity distribution tables, of an S-box, we develop a number of results on various properties of S-boxes. More specifically, we show (1) close connections among three indicators of S-boxes, (2) a tight lower bound on the sum of elements in the leftmost column of its differential distribution table, (3) a non-trivial and tight lower bound on the differential uniformity of an S-box, and (4) two upper bounds on the nonlinearity of S-boxes (one for a general, not necessarily regular, S-box and the other for a regular S-box).

On finite automaton public-key cryptosystem

In this paper, we propose a finite-automaton public-key cryptosystem. The compound finite automaton of the public key of this cryptosystem consists of n+1 finite automata, where n is an arbitrary positive integer. This cryptosystem contains FAPKC3 and FAPKC4 as special cases, and can be used for encryption and for digital signature. We deal with the problem of generating safe keys. Some results on generating finite automata with desired properties on invertibility are briefly mentioned. Relations of R a R b transformation sequences with linear R a are characterized. We prove that for inversion of finite automata by linear R a R b transformation method, in a sense, only one linear R a R b transformation sequence is enough. We give a feasible inversion algorithm for compound finite automaton, of which one component belongs to quasi-linear finite automata and the other component belongs to a kind of weakly invertible or weak inverse finite automata generated by linear R a R b inverse transformation. Some applications to the key-generator of FAPKCs are discussed and several linear attacks are considered.

A linear attack on the random generator by a nonlinear combiner

We propose a linear attack on random generators by a nonlinear combiner. This attack assumes that the attacker knows the nonlinear function f(•) and generator polynomials of the LFSR in the random generator. It estimates the initial value of the LFSR from the tapped bits. The linear attack is as follows. (1) For each linear approximate function of f(•), make a candidate attacking equation. It is composed of the initial state of one LFSR by eliminating the variables of the other LFSRs by using their generator polynomials. (2) Evaluate the probabilities with which the candidate equations hold and select the maximum one as the attacking equation. By mutual information analysis of the attacking equation, it is estimated that the number of tapped bits for the successful attack is much smaller than the period of the random generator. Computer simulations show that the estimated number is enough for successful attack. © 1999 Scripta Technica, Electron Comm Jpn Pt 3, 82(5): 72–79, 1999

A linear attack on the random generator by a nonlinear combiner

A linear attack on the random generator by a nonlinear combiner

Resistance of a CAST-Like Encryption Algorithm to Linearand Differential Cryptanalysis

Linear cryptanalysis and differential cryptanalysis are two recently introduced, powerful methodologies for attacking private-key block ciphers. In this paper, we examine the application of these two cryptanalysis techniques to a CAST-like encryption algorithm. It is shown that, when randomly generated substitution boxes (s-boxes) are used in a CAST-like encryption algorithm, the resulting cipher is resistant to both the linear attack and the differential attack.

Practically Secure Feistel Ciphers

In this paper we give necessary design principles to be used, when constructing secure Feistel ciphers. We introducee a new concept, <strong> practical security</strong> against linear and differential attacks on Feistel ciphers. We give examples of such Feistel ciphers (practically) resistant to differential attacks, linear attacks and other attacks.

Encryption Schemes for Computer Confidentiality

This is a first attempt to develop shift-register-based encryption methods with nonlinear characteristics. We propose some new stream enciphering schemes composed of standard components which are easy to implement and appear to be difficult to break by either a linear attack or statistical analysis.

Classroom Notes A linear algebra approach to complex analysis

This note contains a linear algebra attack on elementary complex analysis which leads to a three‐fold unification between linear algebra, multivariable calculus and complex analysis.

Corrosion of superpure aluminium in distilled water at high temperature

The kinetics of high temperature corrosion of superpure aluminium in distilled water have been investigated. A rapid initial attack is followed by a pause, which is followed by a steady linear attack which does not slow down; this stage, which has not previously been reported, is accompanied by a uniform growth of the oxide layer. The oxide was uniform in thickness throughout, in contrast with the findings of other investigators. At each of the three stages of corrosion, the oxide is in a different state of hydration, and the pause after stage 1 may be due to a crystallization of the oxide. Intercrystalline attack commonly accompanied the uniform attack; detailed aspects of this attack were studied metallographically.

Discriminability of Differences in the Rise Time of a Tone

An experiment was conducted, using tones generated by the computer, to determine the just-noticeable differences in the rise time of a 1000-cycle pure tone with a duration of 1 sec, and with a linear (not exponential) attack, a steady-state portion, and a 100-msec decay. A forced choice, paired-comparison test was run with 10 different subjects. Fourteen different rise times were used, ranging from 2 to 50 msec. A clear time-order effect appeared which, although it is of considerable interest in itself, made the results of the test somewhat inconclusive. Still, a rough estimate of the results indicate that, within the range of rise times from 8 to 50 msec, the jnd approximates a constant proportion of a given rise time. Within this range, the smallest ratio of two rise times that can be judged correctly 75% of the time is roughly 3 : 2. Below this range (i.e., from 2 to 6 msec), the smallest difference that can be discriminated is 3 or 4 msec, so that the constant-proportionality relation no longer holds.