Key Schedule Research Articles

An efficient differential fault attack against SIMON key schedule

SIMON, a family of lightweight block ciphers, has received much attention from the cryptology community due to its improved performance for hardware compared with that of other ciphers. A popular physical attack method, differential fault attack (DFA), works for SIMON. With the aim of improving the efficiency of attacks applied to the SIMON family, in this work, an efficient DFA against SIMON key schedule is presented under a random bit fault model. First, we analyze in detail how to identify the fault induction position. Then, on the basis of the position, we show in detail how to recover 4 bits, 7.5 bits, and 2 bits of KT-1 (the (T-1)th round key), KT-2 (the (T-2)th round key) and KT-3 (the (T-3)th round key), respectively, by inducing a one-bit fault on average in KT-5 (the (T-5)th round key). As a result, by inducing one round of faults, our attack can recover three rounds of keys. Compared with previously developed DFAs on SIMON under the random bit fault model, to recover the full keys of the SIMON family, our attack requires the fewest fault inductions and locations of the induced fault. Moreover, when the value of key words m is 2 or 3, our attack can reduce the number of required rounds of fault induction to one. Finally, simulation experiments and comparisons are carried out to demonstrate the correctness and effectiveness of our attack.

The mF mode of authenticated encryption with associated data

Abstract In recent years, the demand for lightweight cryptographic protocols has grown immensely. To fulfill this necessity, the National Institute of Standards and Technology (NIST) has initiated a standardization process for lightweight cryptographic encryption. NIST’s call for proposal demands that the scheme should have one primary member that has a key length of 128 bits, and it should be secure up to 2 50 − 1 {2}^{50}-1 byte queries and 2 112 {2}^{112} computations. In this article, we propose a tweakable block cipher (TBC)-based authenticated encryption with associated data (AEAD) scheme, which we call mF {\mathsf{mF}} . We provide authenticated encryption security analysis for mF {\mathsf{mF}} under some weaker security assumptions (stated in the article) on the underlying TBC. We instantiate a TBC using block cipher and show that the TBC achieves these weaker securities, provided the key update function has high periodicity. mixFeed {\mathsf{mixFeed}} is a round 2 candidate in the aforementioned lightweight cryptographic standardization competition. When we replace the key update function with the key scheduling function of Advanced Encryption Standard (AES), the mF {\mathsf{mF}} mode reduces to mixFeed {\mathsf{mixFeed}} . Recently, the low periodicity of AES key schedule is shown. Exploiting this feature, a practical attack on mixFeed {\mathsf{mixFeed}} is reported. We have shown that multiplication by primitive element satisfies the high periodicity property, and we have a secure instantiation of mF {\mathsf{mF}} , a secure variant of mixFeed {\mathsf{mixFeed}} .

Comparing Environmental Financial Guarantee Schemes in Kenya and South Africa

Kenya and South Africa have enacted some laws that inculcate economic incentives schemes as key elements of their environmental regulatory terrain. While Kenya has advanced the use of Environmental Performance Deposits (EPDBs), South Africa has adopted the use of the Financial Provisioning Regulations, applied specifically for the upstream mining sector. This article reviews the use of financial assurance schemes in environmental management and their specific application to the upstream mining sectors in the two countries. The data used in the analysis is from literature review, key informant interviews, interview schedules, and focus group discussions. Results indicate that while the use of financial provisioning is a well-established practice in South Africa, in Kenya only one company has deposited funds to the environmental regulator as a security for good environmental practices. A comparative analysis of the regulatory framing for financial assurance instruments in Kenya and South Africa demonstrates some similarities in terms of requirement for public participation, requirement for periodic review of the bonds, use of the bonds for environmental rehabilitation; and some differences such as requirement for use of cash and/or financial instruments, how to treat the accrued interest from the deposited funds, and how the deposit bond amounts are set. Largely, both countries acknowledge the importance of economic incentives in their environmental management frameworks. The article recommends strengthened regional cooperation to enhance the application of financial assurance in the law for effective environmental management in Africa.

Quantum Attacks on Sum of Even-Mansour Construction with Linear Key Schedules.

Shinagawa and Iwata are considered quantum security for the sum of Even–Mansour (SoEM) construction and provided quantum key recovery attacks by Simon’s algorithm and Grover’s algorithm. Furthermore, quantum key recovery attacks are also presented for natural generalizations of SoEM. For some variants of SoEM, they found that their quantum attacks are not obvious and left it as an open problem to discuss the security of such constructions. This paper focuses on this open problem and presents a positive response. We provide quantum key recovery attacks against such constructions by quantum algorithms. For natural generalizations of SoEM with linear key schedules, we also present similar quantum key recovery attacks by quantum algorithms (Simon’s algorithm, Grover’s algorithm, and Grover-meet-Simon algorithm).

Differential Fault Analysis on the Key Schedule of the LBlock Algorithm

In 2011,Wu and Zhang proposed a lightweight block cipher named LBlock, whose plaintext size and key size are 64 bits and 80 bits, respectively. As they said, LBlock can be efficiently implemented in constrained hardware environments, such as wireless sensor network. In this paper, we study the security of LBlock against the differential fault analysis (DFA) on its key scheduling. As far as we know, this is the first time the DFA on key schedule is used to analyze LBlock. More concretely, our DFA attack adopts the random nibble fault model. When the fault is injected in the subkeys in round 30 and 31, most bits of the subkeys in round 31 and 32 can be recovered, which leads to the leakage of the bits of master secret key according to the key scheduling. A quantitative analysis of the input-output differentials of the S-boxes in LBlock shows that our attack reduces the searching space of master key from 2⁸⁰ to 2²³. Then the exhaustive search of all 2²³ possible keys can uniquely determine the true master key. Finally, we also implement LBlock and simulate the DFA on its key scheduling. The experiment results show that our attack is effective.

Report on the First DES Fixed Points for Non-Weak Keys: Case-Study of Hacking an IoT Environment

Fixed points can be defined as <i>E_K</i>(<i>P</i>) = <i>P</i> for a key <i>K</i> and plaintext <i>P</i> where <i>E</i> is the encryption function. For the Data Encryption Standard (DES) algorithm there are four weak keys, such that <i>E_K</i>(<i>E_K</i>(<i>P</i>)) = <i>P</i> for all <i>P</i>. For each weak key there are 2³² fixed points where all the sixteen round keys are the same. While there is a high probability that DES has fixed points for non-weak keys, nobody has reported such (<i>P,K</i>) pairs until now. Performing 1000 &#x00D7; 2⁵⁶ DES encryption operations using 256 Xlinix Spartan-6 parallel cost-effective FPGAs we answer the question of Judy H. Moore and Gustavus J. Simmons: we report the first known DES fixed points where all round keys are different. A case study is presented where an IoT based Sensor Device Authentication Algorithm (<i>SDAA</i>) can be exploited using DES fixed points.

CF блокты шифрлау алгоритмi және оны биттiк шашырау эффектiне зерттеу

The article is about the importance, features and scope of symmetric block ciphers used to ensure theconfidentiality of data in the era of rapid development of modern computing technologies. In this paper, the structure ofthe symmetric block encryption algorithm CF, developed in the "Laboratory of Information Security" of the "Institute ofInformation and Computational Technologies", the round keys generating mechanism based on it’s secret key are described. A computer program of the created encryption algorithm was developed, on the basis of which the performance was studiedand the bit scattering between the plaintext and the ciphertext (the property of the "avalanche effect" and "strong avalancheeffect") was checked. In order to optimize the hardware implementation of the algorithm, the conversion of the S-block,which is considered as a nonlinear node, was obtained in 4x4 bit size.

Optimized Implementation of SM4 on AVR Microcontrollers, RISC-V Processors, and ARM Processors

At 2003, the SM4 block cipher was introduced that is a Chinese domestic cryptographic. It is mandated in the Chinese National Standard for Wireless LAN Wired Authentication and Privacy Infrastructure (WAPI), because the algorithm was developed for use in wireless sensor networks to provide safety network environment. The SM4 block cipher uses a 128-bit block size and a 32-bit round key. It consists of 32 rounds and one reverse translation R. In this paper, we present the optimized implementation of the SM4 block cipher on 8-bit AVR microcontrollers, which are widely used in wireless sensor devices; the optimized implementation of the SM4 block cipher on 32-bit RISC-V processors, which are open-source-based computer architectures, and the optimized implementation of SM4 on 64-bit ARM processors with parallel computation, which are widely used in smartphones and tablets. In the AVR microcontroller, three versions are implemented for various purposes, including speed-optimization, memory-optimization, and code size-optimization. As a result, the speed-optimization, memory-optimization, and code size-optimization versions achieved 205.2 cycles per byte, 213.3 cycles per byte, and 207.4 cycles per byte, respectively. This is faster than the reference implementation written in C language (1670.7 cycles per byte). The implementation on 32-bit RISC-V processors achieved 128.8 cycles per byte. This is faster than the reference implementation written in C language (345.7 cycles per byte). The implementation on 64-bit ARM processors achieved 8.62 cycles per byte. This is faster than the reference implementation written in C language (120.07 cycles per byte).

Trusted Execution Environment Hardware by Isolated Heterogeneous Architecture for Key Scheduling

A Trusted Execution Environment (TEE) sets a platform to secure applications based on the Chain-of-Trust (CoT). The starting point of the CoT is called the Root-of-Trust (RoT). However, the RoT implementation often relies on obscurity and provides little flexibility when generating keys to the system. In this paper, a TEE System-on-a-Chip (SoC) architecture is proposed based on a heterogeneous design by combining 64-bit Linux-capable processors with a 32-bit Micro-Controller Unit (MCU). The TEE is built on the 64-bit cores, while the 32-bit MCU takes care of sensitive data and activities. The MCU is isolated from the TEE side by an Isolated Bus (IBus) that sits above the conventional System Bus (SBus). Besides the 32-bit processor, the isolated sub-system contains a Random Access Memory (RAM), a Read-Only Memory (ROM) for storing the boot program, and another ROM for storing root keys. For cryptography accelerators, we have 512-bit Secure Hashing Algorithm 3 (SHA3-512), 128/256-bit Advanced Encryption Standard (AES-128/256), Ed25519, and True Random Number Generator (TRNG) attached to the Peripheral Bus (PBus). Additionally, besides the public channel, the TRNG module also has a private channel that goes directly to the IBus. With RoT implemented inside the isolated sub-system, the RoT is inaccessible from the TEE side after boot. Furthermore, the hidden MCU’s secure boot program makes the key generation flexible and could be updated for many security schemes. To summarize, the proposed design features a flexible and secure boot procedure with complete isolation from the TEE domain. Moreover, exclusive secure storage for the root key and cryptographic accelerators are available for the boot process. The implementation was tested on a Virtex-7 XC7VX485T Field-Programmable-Gate-Array (FPGA). It was also synthesized in a Very Large-Scale Integrated (VLSI) circuit with the ROHM-180nm process library.

Optimized Implementation of PIPO Block Cipher on 32-Bit ARM and RISC-V Processors

A lightweight block cipher PIPO-64/128 was presented in ICISC’2020. PIPO of the 8-bit unit using an unbalanced-bridge S-box showed better performance than other lightweight block cipher algorithms on an 8-bit AVR environment. So far, optimization methods for implementing PIPO have been proposed in various environments; however, no optimization research has been conducted for two popular 32-bit based processors: ARM Cortex-M4 and RISC-V. Since RISC-V and ARM Cortex-M series platforms do not support bit-based Single Instruction Multiple Data (SIMD) instructions, several aspects should be considered to apply a forced parallelization strategy. In this article, we discuss the implementation methodology of PIPO for 32-bit RISC-V and ARM Cortex-M4 environments. We optimize the performance of S-Layer via proposed register-scheduling and masking technique while we maintain parallelism to the R-Layer implementation. Moreover, we propose an on-the-fly key scheduling technique for further performance improvement. Finally, compared to the existing reference implementations in RISC-V and ARM Cortex-M4 platforms, when 4 plaintext encrypted simultaneously, our software achieved performance of 229% and 370%, respectively.

Improving recent side-channel attacks against the DES key schedule

Recent publications consider side-channel attacks against the key schedule of the Data Encryption Standard (DES). These publications identify a leakage model depending on the XOR of register values in the DES key schedule. Building on this leakage model, we first revisit a discrete model which assumes that the Hamming distances between subsequent round keys leak without error. We analyze this model formally and provide theoretical explanations for observations made in previous works. Next we examine a continuous model which considers more points of interest and also takes noise into account. The model gives rise to an evaluation function for key candidates and an associated notion of key ranking. We develop an algorithm for enumerating key candidates up to a desired rank which is based on the Fincke–Pohst lattice point enumeration algorithm. We derive information-theoretic bounds and estimates for the remaining entropy and compare them with our experimental results. We apply our attack to side-channel measurements of a security controller. Using our enumeration algorithm we are able to significantly improve the results reported previously for the same measurement data.

CTET+: A Beyond-Birthday-Bound Secure Tweakable Enciphering Scheme Using a Single Pseudorandom Permutation

In this work, we propose a construction of 2-round tweakable substitutionpermutation networks using a single secret S-box. This construction is based on non-linear permutation layers using independent round keys, and achieves security beyond the birthday bound in the random permutation model. When instantiated with an n-bit block cipher with ωn-bit keys, the resulting tweakable block cipher, dubbed CTET+, can be viewed as a tweakable enciphering scheme that encrypts ωκ-bit messages for any integer ω ≥ 2 using 5n + κ-bit keys and n-bit tweaks, providing 2n/3-bit security.Compared to the 2-round non-linear SPN analyzed in [CDK+18], we both minimize it by requiring a single permutation, and weaken the requirements on the middle linear layer, allowing better performance. As a result, CTET+ becomes the first tweakable enciphering scheme that provides beyond-birthday-bound security using a single permutation, while its efficiency is still comparable to existing schemes including AES-XTS, EME, XCB and TET. Furthermore, we propose a new tweakable enciphering scheme, dubbed AES6-CTET+, which is an actual instantiation of CTET+ using a reduced round AES block cipher as the underlying secret S-box. Extensivecryptanalysis of this algorithm allows us to claim 127 bits of security.Such tweakable enciphering schemes with huge block sizes become desirable in the context of disk encryption, since processing a whole sector as a single block significantly worsens the granularity for attackers when compared to, for example, AES-XTS, which treats every 16-byte block on the disk independently. Besides, as a huge amount of data is being stored and encrypted at rest under many different keys in clouds, beyond-birthday-bound security will most likely become necessary in the short term.

Low area field‐programmable gate array implementation of PRESENT image encryption with key rotation and substitution

Lightweight ciphers are increasingly employed in cryptography because of the high demand for secure data transmission in wireless sensor network, embedded devices, and Internet of Things. The PRESENT algorithm as an ultra-lightweight block cipher provides better solution for secure hardware cryptography with low power consumption and minimum resource. This study generates the key using key rotation and substitution method, which contains key rotation, key switching, and binary-coded decimal-based key generation used in image encryption. The key rotation and substitution-based PRESENT architecture is proposed to increase security level for data stream and randomness in cipher through providing high resistance to attacks. Lookup table is used to design the key scheduling module, thus reducing the area of architecture. Field-programmable gate array (FPGA) performances are evaluated for the proposed and conventional methods. In Virtex 6 device, the proposed key rotation and substitution PRESENT architecture occupied 72 lookup tables, 65 flip flops, and 35 slices which are comparably less to the existing architecture.

Modification of the key schedule of the 2-GOST block cipher and its implementation on FPGA

For 2-GOST block lightweight cipher we will consider the Ashur-Bar-On-Dunkelman attack, show that its time complexity is underestimated and propose a modification of this attack with lower time and memory complexity ( $$2^{2.49}$$ and $$2^{6.15}$$ times smaller respectively). A new key schedule for $${\text {2-GOST}}$$ will be proposed to counteract attacks using key schedule features such as fixed points, sliding pairs and so on. It will be shown that the new key schedule of 2-GOST leave it in the class of lightweight ciphers.

Multidimensional linear cryptanalysis with key difference invariant bias for block ciphers

For block ciphers, Bogdanov et al. found that there are some linear approximations satisfying that their biases are deterministically invariant under key difference. This property is called key difference invariant bias. Based on this property, Bogdanov et al. proposed a related-key statistical distinguisher and turned it into key-recovery attacks on LBlock and TWINE-128. In this paper, we propose a new related-key model by combining multidimensional linear cryptanalysis with key difference invariant bias. The main theoretical advantage is that our new model does not depend on statistical independence of linear approximations. We demonstrate our cryptanalysis technique by performing key recovery attacks on LBlock and TWINE-128. By using the relations of the involved round keys to reduce the number of guessed subkey bits. Moreover, the partial-compression technique is used to reduce the time complexity. We can recover the master key of LBlock up to 25 rounds with about 260.4 distinct known plaintexts, 278.85 time complexity and 261 bytes of memory requirements. Our attack can recover the master key of TWINE-128 up to 28 rounds with about 261.5 distinct known plaintexts, 2126.15 time complexity and 261 bytes of memory requirements. The results are the currently best ones on cryptanalysis of LBlock and TWINE-128.

The security of RC4 algorithm using keys generation depending on user's retina

Digital technologies grow more rapidly; information security threats are becoming increasingly dangerous. Advanced and various cyber-attacks and security threats, like targeted emails, and information exploitation, pose a critical threat that basically undermines our trust in the digital society. Rivest cipher 4 (RC4) algorithm is a significant cipher of a stream that could be utilized with protocols of the internet, the advantage of the RC4 algorithm is that it is simple and effective. There are several weak, especially after the pseudo-random generation algorithm (PRGA), PRGA's initially 256 rounds (the amount of the RC4 permutation). Several modified RC4 studies have been published thus far, however, they all face either standard privacy or achievement evaluation issues. This paper proposes a new RC4 algorithm that is based on the user's retina (RC4-Retina), which has solved both of these weak points it was indicated in the standard RC4 algorithm. The novelty of retina key scheduling algorithm (RKSA), which is generated by relying on the user's retina of the algorithm will modify the matrix of permutation used to configure the keys. The efficiency of the improved algorithm was measured by depending on the average security of ciphertext of different keys and different messages, results were good compared to the standard algorithm.

Extended of TEA: A 256 bits block cipher algorithm for image encryption

&lt;p&gt;This paper introduces an effective image encryption approach that merges a chaotic map and polynomial with a block cipher. According to this scheme, there are three levels of encryption. In the first level, pixel positions of the image are scuffled into blocks randomly based on a chaotic map. In the second level, the polynomials are constructed by taking N unused pixels from the permuted blocks as polynomial coefficients. Finally, the third level a proposed secret-key block cipher called extended of tiny encryption algorithm (ETEA) is used. The proposed ETEA algorithm increased the block size from 64-bit to 256-bit by using F-function in type three Feistel network design. The key schedule generation is very straightforward through admixture the entire major subjects in the identical manner for every round. The proposed ETEA algorithm is word-oriented, where wholly internal operations are executed on words of 32 bits. So, it is possible to efficiently implement the proposed algorithm on smart cards. The results of the experimental demonstration that the proposed encryption algorithm for all methods are efficient and have high security features through statistical analysis using histograms, correlation, entropy, randomness tests, and the avalanche effect.&lt;/p&gt;

On the Probability and Automatic Search of Rotational-XOR Cryptanalysis on ARX Ciphers

Abstract Rotational-XOR cryptanalysis is a very recent technique for ARX ciphers. In this paper, the probability propagation formula of RX-cryptanalysis in modular addition is extended, and the calculation of RX-difference probability for any rotation parameter ($0&amp;lt;k&amp;lt;n$) can be realized. By proposing a concept of RX-offset and constructing the corresponding distribution table, the propagation of RX-difference in modular addition can be derived from the propagation of XOR-difference. Combined with the improvement of the automatic search tool for XOR-differential characteristics of ARX ciphers, we only need to add one more operation in each round, i.e. traverse the possible value of RX-offset and XOR it with the output XOR-difference of modular addition, thus it can achieve the search for RX-differential characteristics. With this method, the RX-differential distinguisher of ARX-C primitives without or with linear key schedule can be searched. For the applications, we have obtained the third-party RX-cryptanalysis results for Alzette and CHAM for the first time as far as we know.

New Approach towards Generalizing Feistel Networks and Its Provable Security

This paper proposes a new approach to generalizing Feistel networks, which unifies the classical (balanced) Feistel network and the Lai–Massey structure. We call the new structure extended Feistel (E-Feistel) network. To justify its soundness, we investigate its indistinguishability using Patarin’s H-coefficient technique. As a result, it is proved that the 4-round key-alternating E-Feistel (KAEF) cipher with adequately derived keys and identical round functions is secure up to 2 n / 2 queries, i.e., birthday-bound security. In addition, when adjacent round keys are independent and independent round functions are used, the 6-round KAEF is secure up to beyond-birthday-bound 2 2 n / 3 queries. Our results indicate that the E-Feistel structure is secure and reliable and can be adopted in designing practical block ciphers.

A new ASIC implementation of an advanced encryption standard (AES) crypto-hardware accelerator

Single-chip hardware implementation of Advanced Encryption Standard (AES) offers a low-power and low-area design that is suitable for portable devices. It is widely applicable for numerous encryption needs such as in Bluetooth controller, wireless communication and secure Internet transactions. This paper proposes a new full-custom compact 8-bit data-path architecture core for a single-chip VLSI AES crypto-hardware accelerator. In order to optimize chip-area, power and performance, novel circuit-level techniques, logic minimization, resource sharing and low supply-voltage has been employed. The proposed design is implemented in 130 nm CMOS process and supports both encryption and decryption in Electronic-Codebook-Mode (EBC) using 128-bit keys. Novel S-box/InvS-box, MixColumn/InvMixColumn and ShiftRow/InvShiftRow using low-power Exclusive-OR (XOR) gate is employed to minimize the power consumption. This design utilized 3120 gate-equivalents (GE), including an on-the-fly key scheduling unit with an active chip-area of 640μm × 325 μm (0.208 sq. mm) excluding the bonding pads. It has a power consumption of 4.23 μW/MHz and a throughput of 0.05 Gbit/s (at 100 MHz clock). The proposed AES design thus achieved low-power dissipation, higher throughput with a compact chip-size (silicon-area) compared to other recent implementations.