State Bits Research Articles

Tightening Leakage Resilience of the Suffix Keyed Sponge

Lightweight cryptographic constructions are often optimized on multiple aspects that put the security bounds to the limit. In this respect, it is important to obtain security bounds that are tight and give an accurate and exact indication of the generic security. However, whereas for black-box security bounds it has become common practice to argue tightness of security bounds, for leakage resilience security bounds this is not the case. This is unfortunate, as for leakage resilience results, tightness is even more important as there is already a lossiness incurred in capturing the actual leakage by a theoretical model in the first place.In this work, we consider the SuKS (Suffix Keyed Sponge) PRF construction and investigate tightness of the leakage resilience bound of Dobraunig and Mennink (ToSC 2019). We observe that, although their black-box security result is tight, their leakage resilience bound is not tight in their bounded leakage term λ. We observe that this is caused by the fact that parts of the security bound contain a term covering multicollisions and a term covering leakage, but an adversary is unable to combine both. We next consider improved security of the SuKS for two types of leakage: fixed position leakage, where the adversary directly learns the value of λ bits of a secret state, and Hamming weight leakage, where the Hamming weight of a fixed part of the state is leaked. For fixed position leakage, a very generous form of bounded leakage, we improve the original bound by making wise use of the multicollision limit function of Daemen et al. (ASIACRYPT 2017). For the more realistic setting of Hamming weight leakage, we structurally revisit the multicollision limit function analysis by including Hamming weight in the computation, a problem that is difficult on its own due to the non-uniform character of this type of leakage. In both cases, we improve and tighten the leakage resilience bound of Dobraunig and Mennink. The improved bound for the SuKS has immediate consequences for the leakage resilience of the NIST lightweight cryptography competition finalist ISAP v2, an authenticated encryption scheme that uses the SuKS internally.

Description, Implementation and Performance/Security Analysis of ASCON128

The aim of the report is to introduce detailed description of the functioning of and to provide an efficient implementation (using bit-sliced implementation of S-Box) in C of encryption, decryption and authentication of the lightweight authenticated encryption algorithm ASCON 128 (sponge based SPN network based on Keccak like operations) as per the v 1.2 submitted to NIST. This is achieved using a sponge construction by setting up initialization state and performing 12 rounds of permutations, XORing consecutively the plaintext blocks (encryption) or ciphertext blocks (decryption) with first 64 bits of the state (after 6 rounds of sponge permutations) and after all consecutive operations on ciphertext/plaintext blocks, XORing the last 128 bits of the resultant state with the secret Key (after 12 rounds of final permutation operations) to produce/re-create the tag. Discussions on Key Features, Performance Analysis (comparison of ASCON 128 v/s AES 128 in GCM mode on our own PC), Performance Comparisons with other NIST lightweight cryptography contest finalists on ARM Cortex M3, and discussions on the Security Analysis (side channel attacks: fault injection and power analysis) of ASCON are included in this report.

Conditional TMDTO as a MILP Instance

Conditional Time-Memory-Data Trade-off (TMDTO) attack given by Biryukov and Shamir can be reduced to the following problem: “Find the minimum number of state bits that should be fixed in order to recover the maximum number of state bits by utilizing the keystream bits and value of rest of the state bits”. As per our literature survey, existing algorithms search for state bits that should be fixed (as minimum as possible) in order to recover the maximum possible state bits directly through the keystream bits. However, those algorithms are cipher specific and require extensive manual effort in analyzing the keystream bit equations. In this manuscript, we have constructed an automated framework that is easy to implement and solves the above problem (for the case when bits are fixed to 0) for any NLFSR based stream cipher with better complexity, thereby reducing manual efforts. However, we do not claim any global optimum for fixed bits. We tried to reduce the number of fixed bits as much as possible. To show that our algorithm is applicable to a majority of NLFSR based stream ciphers, we implement it on three different stream ciphers: LIZARD, GRAIN-128a and ESPRESSO. It improves all existing TMDTO results on these ciphers. The framework involves modelling keystream bit equations into a set of linear constraints, which is then solved by using a Mixed Integer Linear Programming (MILP) solver, Gurobi. The advantages of our automated framework over other methods are that we can achieve better results with far less effort, and it can be applied to any stream cipher of a similar structure with very ease. To the best of our knowledge, our MILP model is the first work that converts the conditional TMDTO of a stream cipher into a linear optimization problem. As a consequence, for LIZARD cipher, we reduce the number of fixed bits by 20 bits from the previous best result when the number of recovered bits is 18. In the case of GRAIN-128a, the highest reduction in the number of fixed bits is by 34 bits when the number of recovered bits is 35. Lastly, for ESPRESSO cipher, the reduction is by 7 bits when the number of recovered bits is 35.

북한의 시대별 권력구조(당을 중심으로) 변화에 대한 연구

The above paper is a party-centered research and analysis of the power structure of each era in North Korea. North Korea does not seem to maintain its normal state in the North’s special political environment, which actually leads to the third succession of Kim Il-sung, Kim Jong-il and Kim Jong-un, with the 8th Party congress held in 2021 in the Notth. It can be said that the Kim Il-sung era, when North Korea was founded, was some what close to the socialist state centered on the party, but the importance of the party was recognized due to the military-first politics during the Kim Jong-il era, but its role was very weak. But forming the third-generation hereditary state to Kim Jong-un, whose origins are unknown in any country, the North’s leader is trying to rule the countty today by a system based on a party-state power structure based on patriotism with in the or bit of a normal socialist state. It can be tnought that the 8th Party Congress held in North Korea in 2021 represents that. There fore, this paper predicts the relationship hetween the North Korea in 2021 represents that. There fore, this paper predicts the relationship between the North Korea party, government, and military durint North Korea’s three hereditary governance and how they will change around Rodongdang through review of existing reseaech papers, analysis of recent situation in North Korea, and analysis of nuclear power plant data related to North Korea.

Quantum Guess and Determine Attack on Stream Ciphers

Abstract To guarantee the security of symmetric key schemes against quantum adversary, developing quantum cryptanalytic techniques becomes a major worldwide challenge in the post-quantum world. In this paper, we present a general framework of classical guess and determine attack on stream ciphers, and then convert it into quantum guess and determine attack. It shows that, for a given stream cipher with a key size of $k$ bits and an internal state size of $n$ bits, if a basic guess and determine attack with a time complexity below $O ( {{{2}^{{3k}/{2}}}}/{n} )$ is available, there is a quantum guess and determine attack with multiple data that can recover all $n$ internal state bits of the cipher with complexity below $O ( {{2^{k / 2}}} )$. As applications, we present quantum guess and determine attacks on the SNOW-like stream ciphers. The results show that all of SNOW 1.0 with 128-bit key, SNOW 2.0 with 128-bit key and SOSEMANUK are insecure against quantum guess and determine attack. The resource requirements for implementing a quantum guess and determine attack on SNOW 3G are evaluated as a case study. To the best of our knowledge, this is the first time that the general quantum guess and determine attack is formally proposed and applied to the SNOW-like stream ciphers.

A Cube Attack on a Reduced-Round Sycon

The cube attack was proposed at the 2009 Eurocrypt. The attack derives linear polynomials for specific output bits of a BlackBox cipher. Cube attacks target recovery keys or secret states. In this paper, we present a cube attack on a 5-round Sycon permutation and a 6-round Sycon permutation with a 320-bit state, whose rate occupies 96 bits, and whose capacity is 224 bits. We found cube variables related to a superpoly with a secret state. Within the cube variables, we recovered 32 bits of the secret state. The target algorithm was Sycon with 5-round and 6-round versions of permutation. For the 5-round Sycon, we found a cube variable and recovered a state with a total of 2192 Sycon computations and 237 bits of memory. For the 6-round Sycon, we found cube variables and recovered a state with a total of 2192 Sycon computations and 270 bits of memory. When using brute force in a 5-round attack, 2224 operations were required, but the cube attack proposed in this paper had 248 offline operations, and 232 operations were required. When using brute force in a 6-round attack, 2224 operations were required, but the cube attack proposed in this paper required 295 offline operations, and 263 operations were required. For both attacks, offline could be used continuously after performing only once. To the best of our knowledge, this is the first cube attack on Sycon.

Revisiting the Extension of Matsui’s Algorithm 1 to Linear Hulls: Application to TinyJAMBU

At EUROCRYPT ’93, Matsui introduced linear cryptanalysis. Both Matsui’s Algorithm 1 and 2 use a linear approximation involving certain state bits. Algorithm 2 requires partial encryptions or decryptions to obtain these state bits after guessing extra key bits. For ciphers where only part of the state can be obtained, like some stream ciphers and authenticated encryption schemes, Algorithm 2 will not work efficiently since it is hard to implement partial encryptions or decryptions. In this case, Algorithm 1 is a good choice since it only involves these state bits, and one bit of key information can be recovered using a single linear approximation trail. However, when there are several strong trails containing the same state bits, known as the linear hull effect, recovering key bits with Algorithm 1 is infeasible. To overcome this, Röck and Nyberg extended Matsui’s Algorithm 1 to linear hulls. However, Röck and Nyberg found that their theoretical estimates are quite pessimistic for low success probabilities and too optimistic for high success probabilities. To deal with this, we construct new statistical models where the theoretical success probabilities are in a good accordance with experimental ones, so that we provide the first accurate analysis of the extension of Matsui’s Algorithm 1 to linear hulls. To illustrate the usefulness of our new models, we apply them to one of the ten finalists of the NIST Lightweight Cryptography (LWC) Standardization project: TinyJAMBU. We provide the first cryptanalysis under the nonce-respecting setting on the full TinyJAMBU v1 and the round-reduced TinyJAMBU v2, where partial key bits are recovered. Our results do not violate the security claims made by the designers.

Differential Trail Search in Cryptographic Primitives with Big-Circle Chi:

Proving upper bounds for the expected differential probability (DP) of differential trails is a standard requirement when proposing a new symmetric primitive. In the case of cryptographic primitives with a bit-oriented round function, such as Keccak, Xoodoo and Subterranean, computer assistance is required in order to prove strong upper bounds on the probability of differential trails. The techniques described in the literature make use of the fact that the non-linear step of the round function is an S-box layer. In the case of Keccak and Xoodoo, the S-boxes are instances of the chi mapping operating on l-bit circles with l equal to 5 and 3 respectively. In that case the differential propagation properties of the non-linear layer can be evaluated efficiently by the use of pre-computed difference distribution tables.Subterranean 2.0 is a recently proposed cipher suite that has exceptionally good energy-efficiency when implemented in hardware (ASIC and FPGA). The non-linear step of its round function is also based on the chi mapping, but operating on an l = 257-bit circle, comprising all the state bits. This making the brute-force approach proposed and used for Keccak and Xoodoo infeasible to apply. Difference propagation through the chi mapping from input to output can be treated using linear algebra thanks to the fact that chi has algebraic degree 2. However, difference propagation from output to input is problematic for big-circle chi. In this paper, we tackle this problem, and present new techniques for the analysis of difference propagation for big-circle chi.We implemented these techniques in a dedicated program to perform differential trail search in Subterranean. Thanks to this, we confirm the maximum DP of 3-round trails found by the designers, we determine the maximum DP of 4-round trails and we improve the upper bounds for the DP of trails over 5, 6, 7 and 8 rounds.

A state bit recovery algorithm with TMDTO attack on Lizard and Grain-128a

A state bit recovery algorithm with TMDTO attack on Lizard and Grain-128a

Security analysis of Subterranean 2.0

Subterranean 2.0 is a cipher suite that can be used for hashing, authenticated encryption, MAC computation, etc. It was designed by Daemen, Massolino, Mehrdad, and Rotella, and has been selected as a candidate in the second round of NIST’s lightweight cryptography standardization process. Subterranean 2.0 is a duplex-based construction and utilizes a single-round permutation in the duplex. It is the simplicity of the round function that makes it an attractive target of cryptanalysis. In this paper, we examine the single-round permutation in various phases of Subterranean 2.0 and specify three related attack scenarios that deserve further investigation: keystream biases in the keyed squeezing phase, state collisions in the keyed absorbing phase, and one-round differential analysis in the nonce-misuse setting. To facilitate cryptanalysis in the first two scenarios, we novelly propose a set of size-reduced toy versions of Subterranean 2.0: Subterranean-m. Then we make an observation for the first time on the resemblance between the non-linear layer in the round function of Subterranean 2.0 and SIMON’s round function. Inspired by the existing work on SIMON, we propose explicit formulas for computing the exact correlation of linear trails of Subterranean 2.0 and other ciphers utilizing similar non-linear operations. We then construct our models for searching trails to be used in the keystream bias evaluation and state collision attacks. Our results show that most instances of Subterranean-m are secure in the first two attack scenarios but there exist instances that are not. Further, we find a flaw in the designers’ reasoning of Subterranean 2.0’s linear bias but support the designers’ claim that there is no linear bias measurable from at most 2^{96} data blocks. Due to the time-consuming search, the security of Subterranean 2.0 against the state collision attack in keyed modes still remains an open question. Finally, we observe that one-round differentials allow to recover state bits in the nonce-misuse setting. By proposing nested one-round differentials, we obtain a sufficient number of state bits, leading to a practical state recovery with only 20 repetitions of the nonce and 88 blocks of data. It is noted that our work does not threaten the security of Subterranean 2.0.

Enhanced serial RRAM cell for unpredictable bit generation

In this letter, the serial configuration of two RRAMs is used as a basic cell to generate an unpredictable bit. The basis of the operation considers starting from the Low Resistive State (LRS) in both devices (initialization step), then, one of them is switched to the High Resistive State (HRS) (bit generation step) without knowing, in advance, which one is the switching device (unmasking step). In this proposal, the larger resistance variability of HRS compared to LRS is considered to improve the masking performance of the cell (masking step). The presented experimental results are a proof-of-concept of the applicability of the proposal.

Changed Perspectives and Conflicting Treaty Obligations: What Is the Message of the CJEU Achmea Decision and the 2020 Plurilateral Termination Agreement for Candidate Countries such as Serbia?

The authors analyse the changed landscape of the EU BIT policy following the Achmea decision and the 2020 Termination Agreement, in particular, their relevance for candidate countries such as Serbia. The perceived risks strongly suggest that some action must be taken before the accession to avoid becoming caught between conflicting obligations under EU law and the BITs, as happened to respondent countries in the cases of Micula and Magyar Farming Company. The potential for conflicts exists in the case of Serbia as well because it already has an obligation to comply with EU law in areas such as competition and state aid law, which may cause it to inadvertently breach investors’ rights under the BITs. Various options that a candidate country can pursue to adjust its bilateral investment treaties to EU law standards are considered in search of the best approach. Difficulties that may be encountered due to the premature termination of sunset clauses and the retroactive termination of arbitration clauses in pending arbitrations lead the authors to conclude that certain adjustments to the course of action adopted within the EU are called for. The proposed action in the case of Serbia consists of consensually amending the 22 Serbia-EU member state BITs following a two-step procedure so that the sunset clauses are terminated at once, whereas the remaining provisions of the BITs are designated by the contracting parties to be terminated on the date of accession. To prevent treaty shopping, these amendments need to be accompanied by comprehensive reform of Serbia’s other BITs that contain overly broad definitions of investors and investments. Some alternative approaches are also taken into consideration, such as the replacement of ISDS with other forms of dispute resolution and the replacement of the Serbia-EU member state BITs with other types of agreements. The candidate countries are advised to adjust their pre-accession commitments, both procedural and substantive, in a timely manner with the incoming EU obligations. These inevitable adjustments should be pursued cautiously by candidate countries to minimise risks and maximise their bargaining power.

An Observation of Non-randomness in NFSR-Based Stream Ciphers with Reduced Initialization Round

The key scheduling phase (KSP) of a stream cipher expands the uniformly chosen key (K) and initialization vector (IV) to a larger uniform looking state. The existence of non-randomness in KSP results in a non-randomness in the final keystream. In this paper, we observe a non-randomness in the KSP of the nonlinear feedback-based stream ciphers Grain-v1, Grain-128AEAD and Fountain-v1 of reduced round R. However, we could not exploit the non-randomness into an attack. It can be claimed that if the KSP generates a pseudorandom state, then the probability of generating a valid state T (i.e., in the range set of KSP function) of a cipher must be $$2^{-\delta }$$ , where $$\delta$$ is the length of padding bits. We show that a new valid state can be constructed by flipping a few bits of a given state of the cipher with a probability higher than $$2^{-\delta }$$ . We show that the non-randomness happens for $$R \le 129$$ , $$R\le 208$$ and $$R \le 193$$ rounds of KSP of Grain-v1, Grain-128AEAD, and Fountain-v1, respectively. Further, in the case of Grain-v1 and Grain-128AEAD, we also found non-randomness in some key, IV bits from the experiment.

Some Conditional Cube Testers for Grain-128a of Reduced Rounds

In this paper, a new strategy, maximum last round, is proposed to select cubes for cube attacks. This strategy considers the cubes in a particular round where the probability of its superpoly to be 1 is at most, where is a very small number. A heuristic method to find a number of suitable cubes using this strategy and the previously used strategies (i.e., maximum initial zero, maximum last zero) are proposed. To get a bias at the higher rounds, the heuristic, too, imposes conditions on some state bits of the cipher to make the non-constant superpoly of a cube as zero for the first few rounds. Some cube testers are formed by using those suitable cubes to implement a distinguishing attack on Grain-128a of reduced KSA (or initialization) rounds. We present a distinguisher for Grain-128a of 191 (out of 256) KSA round in the single key setup and 201 (out of 256) KSA round in the weak key setup by using the cubes of dimension 5. The number of rounds is the highest till today, and the cube dimension is smaller than the previous results. Further, we tested our algorithm on Grain-128 and achieved good results by using small cubes.

Interpolation Attacks on Round-Reduced Elephant, Kravatte and Xoofff

Abstract We introduce an interpolation attack using the Moebius Transform. This can reduce the time complexity to get a linear system of equations for specified intermediate state bits, which is general to cryptanalysis of some ciphers with update function of low algebraic degree. Along this line, we perform an interpolation attack against Elephant-Delirium, a round 2 submission of the ongoing national institute of standards and technology (NIST) lightweight cryptography project. This is the first third-party cryptanalysis on this cipher. Moreover, we promote the interpolation attack by applying it to the Farfalle pseudo-random constructions Kravatte and Xoofff. Our attacks turn out to be the most efficient method for these ciphers thus far.

Linear Cryptanalysis of Reduced-Round Simon Using Super Rounds

We present attacks on 21-rounds of Simon 32/64, 21-rounds of Simon 48/96, 25-rounds of Simon 64/128, 35-rounds of Simon 96/144 and 43-rounds of Simon 128/256, often with direct recovery of the full master key without repeating the attack over multiple rounds. These attacks result from the observation that, after four rounds of encryption, one bit of the left half of the state of 32/64 Simon depends on only 17 key bits (19 key bits for the other variants of Simon). Further, linear cryptanalysis requires the guessing of only 16 bits, the size of a single round key of Simon 32/64. We partition the key into smaller strings by focusing on one bit of state at a time, decreasing the cost of the exhaustive search of linear cryptanalysis to 16 bits at a time for Simon 32/64. We also present other example linear cryptanalysis, experimentally verified on 8, 10 and 12 rounds for Simon 32/64.

Local Routing in Convex Subdivisions

In various wireless networking settings, node locations determine a network’s topology, allowing the network to be modelled by a geometric graph drawn in the plane. Without any additional information, local geometric routing algorithms can guarantee delivery to the target node only in restricted classes of geometric graphs, such as triangulations. In order to guarantee delivery on more general classes of geometric graphs (e.g., convex subdivisions or planar subdivisions), previous local geometric routing algorithms required [Formula: see text] state bits to be stored and passed with the message. We present the first local geometric routing algorithm using only one state bit to guarantee delivery on convex subdivisions and, when the algorithm has knowledge of the incoming port (the preceding node on the route), the first stateless local geometric routing algorithm that guarantees delivery on edge-augmented monotone subdivisions (including all convex subdivisions). We also show that [Formula: see text] state bits are necessary in planar subdivisions in which faces may have three or more reflex vertices.

Guess and determine cryptanalysis with variable sampling and its applications

Non-linear filtering generators, as a well-known family of stream ciphers, employ a filtering function F : GF ( 2 ) n → GF ( 2 ) m to process the secret state bits and thus outputs binary keystream blocks of length m. In this study, the authors extend the framework of a generic cryptanalytic method applicable to non-linear filtering generators called generalised filter state guessing attacks (GFSGA), introduced as a generalisation of the filter state guessing attack method, by applying a variable sampling of the keystream bits in order to retrieve as much information about the secret state bits as possible. Two different modes that use a variable sampling of keystream blocks are presented and it is shown that in many cases these modes may outperform the standard GFSGA mode. They also demonstrate the possibility of employing GFSGA-like attacks to other design strategies such as non-linear feedback shift register-based ciphers (Grain family for instance). It is also indicated that the tap positions of Grain-128 are not chosen optimally with respect to this generic cryptanalytic method and provide a better selection of taps that gives higher resistance to GFSGA-like attacks.

A New Adaptive Security Architecture with Extensible Computation Complexity for Generic Ciphers

Among recent developments on ciphers, attacks involving polynomial cryptanalysis have gained prominent attention in evaluating encryption algorithms for both stream and block ciphers. Algebraic cryptanalysis is also a tool to measure the strength of a cipher in terms of its resistance against different types of polynomial attacks. A contemporary way of representing such ciphers is in terms of multivariate equations over $\mathbb {GF}(2)$, which are highly vulnerable to algebraic cryptanalysis. Algebraic cryptanalysis, in its general form, aims to recover the internal secret state bits of the registers of the cipher by solving non-linear algebraic equations. Recent trends in algebraic cryptanalysis tend to use modular addition 2n over logic XOR as a mixing operator to guard against such malicious attacks. Nonetheless, it has been observed that the complexity of modular addition can be drastically decreased with the appropriate formulation of polynomial equations and probabilistic conditions. This article outlines a new design framework for modular addition with added security enhancements to address these issues. Inspiring from this framework, we show that the new design is characterized by user-specified extendable security for stronger encryption and does not impose changes in existing layout of ciphers including stream ciphers such as SNOW2.0, BIVIUM, and grain family, and block ciphers like IDEA, SAFER, AES, and DES. Our proposed design framework can be rapidly scaled to use-specific requirements which boosts the algebraic degree of the overall structure. This, in turn, thwarts the probabilistic conditions by retaining the original hardware complexity sans critical modifications of modular addition 2n.

Optimizing Fast Near Collision Attack on Grain Using Linear Programming

In 2018, an attack named fast-near-collision attack (FNCA) was proposed, which is an improved version of near-collision attack (NCA) on Grain-v1, one of the three hardware-oriented finalists of the eSTREAM project. FNCA is designed as a key recovery attack and takes a divide-and-conquer strategy that needs a merging phase. We propose an improved FNCA where the merging phase is optimized by a linear programming based strategy. It decreases the candidates of the internal state vectors (ISVs) in each step of merging and has a reduction in the overall time complexity. Since the merging phase is vital for a divide-and-conquer strategy, where the most of bits of the full internal state are recovered, other analyses on Grain family with FNCA can get optimized by our method in varying degrees. This paper offers an experiment on a reduced Grain and a theoretical analysis on Grain-v1 to confirm the results. In the case of the reduced Grain of an 80-bit internal state, the time complexity is 2 37.1096 , which has a 27.8% reduction. For Grain-v1, its theoretical time complexity is around 2 73.4 , which is reduced by 79.4% compared with the original one.