Time-memory Tradeoff Research Articles

Double Time-Memory Trade-Off in OSK RFID Protocol

The OSK/AO protocol has already demonstrated how the application of time-memory trade-off (TMTO) increases the efficiency of a hash chain-based RFID protocol. The complexity of this protocol, both in the preparatory phase and in the tag identification, is greatly influenced by chain generation procedure. Since the hash values in chain nodes are generated independently and randomly, the repetition of the same calculations impairs the protocol efficiency. This paper proposes an improved procedure for a faster chain generation by employing a special table with equidistant states from the tag state space. It provides that hash functions calculations for a node start not from the beginning but from a nearest state stored in the table. Consequently, the number of repeated hash calculations is significantly reduced. After the new OSK/TMTO2 protocol is precisely formalized, a complexity analysis is carried out with detailed consideration of two cases (with and without additional memory for the table). A comparison of the proposed protocol with OSK/AO is also conducted. The practical restrictions on configuration of an RFID system with the new protocol are stated as well. Finally, the conducted analysis is illustrated by numerous examples with wide spectrum of relevant parameter values.

Efficient Intrusion Detection With Bloom Filtering in Controller Area Networks

Due to its cost efficiency, the controller area network (CAN) is still the most wide-spread in-vehicle bus, and the numerous reported attacks demonstrate the urgency in designing new security solutions for CAN. In this paper, we propose an intrusion detection mechanism that takes advantage of Bloom filtering to test frame periodicity based on message identifiers and parts of the data-field which facilitates detection of potential replay or modification attacks. This proves to be an effective approach since most of the traffic from in-vehicle buses is cyclic in nature and the format of the data-field is fixed due to rigid signal allocation. Bloom filters provide an efficient time-memory tradeoff which is beneficial for the constrained resources of automotive grade controllers. We test the correctness of our approach and obtain good results on an industry-standard CANoe-based simulation for a J1939 commercial-vehicle bus and also on CAN with flexible data-rate traces obtained from a real-world high-end vehicle. The proposed filtering mechanism is straightforward to adapt for any other time-triggered in-vehicle bus, e.g., FlexRay, since it is built on time-driven characteristics.

An algorithmic framework for the generalized birthday problem

The generalized birthday problem (GBP) was introduced by Wagner in 2002 and has shown to have many applications in cryptanalysis. In its typical variant, we are given access to a function $$H:\{0,1\}^{\ell } \rightarrow \{0,1\}^n$$ (whose specification depends on the underlying problem) and an integer $$K>0$$ . The goal is to find K distinct inputs to H (denoted by $$\{x_i\}_{i=1}^{K}$$ ) such that $$\sum _{i=1}^{K}H(x_i) = 0$$ . Wagner’s K-tree algorithm solves the problem in time and memory complexities of about $$N^{1/(\lfloor \log K \rfloor + 1)}$$ (where $$N= 2^n$$ ). In this paper, we improve the best known GBP time-memory tradeoff curve (published independently by Nikolic and Sasaki and also by Biryukov and Khovratovich) for all $$K \ge 8$$ from $$T^2M^{\lfloor \log K \rfloor -1} = N$$ to $$T^{\lceil (\log K)/2 \rceil + 1 }M^{\lfloor (\log K)/2 \rfloor } = N$$ , applicable for a large range of parameters. We further consider values of K which are not powers of 2 and show that in many cases even more efficient time-memory tradeoff curves can be obtained. Finally, we optimize our techniques for several concrete GBP instances and show how to solve some of them with improved time and memory complexities compared to the state-of-the-art. Our results are obtained using a framework that combines several algorithmic techniques such as variants of the Schroeppel–Shamir algorithm for solving knapsack problems (devised in works by Howgrave-Graham and Joux and by Becker, Coron and Joux) and dissection algorithms (published by Dinur, Dunkelman, Keller and Shamir).

Estimates of the mean size of the subset image under composition of random mappings

AbstractLet XNbe a set ofNelements andF1,F2,… be a sequence of random independent equiprobable mappings XN→N. For a subsetS0⊂ XN, |S0|=m, we consider a sequence of its imagesSt=Ft(…F2(F1(S0))…),t=1,2… An approach to the exact recurrent computation of distribution of |St| is described. Two-sided inequalities forM{|St|||S0|=m} such that the difference between the upper and lower bounds iso(m)form,t,N→ ∞,mt=o(N) are derived. The results are of interest for the analysis of time-memory tradeoff algorithms.

Cryptanalytic time–memory trade-off for password hashing schemes

Increasing threat of password leakage from compromised password hashes demands a resource consuming password-hashing algorithm to prevent the precomputation of the password hashes. A class of password-hashing schemes (PHS) provides such a defense by making the design Memory hard. This ensures that any reduction in the memory consumed by the algorithm leads to an exponential increase in its runtime. The security offered by a memory-hard PHS design is measured in terms of its time–memory trade-off (TMTO) defense. Another important measure for a good PHS is its efficiency in utilizing all the available memory as quickly as possible, and fast running time when more than the required memory is available. In this work, we present a simple technique to analyze TMTO for a password-hashing scheme which can be represented as a directed acyclic graph (DAG). The nodes of the DAG correspond to the storage required by the algorithm and the edges correspond to the flow of the execution. Our proposed technique provides expected runtimes at varied levels of available storage utilizing the DAG representation of the algorithm. We show the effectiveness of our proposed technique by applying it on three designs from the “Password Hashing Competition" (PHC)—Argon2-Version 1.2.1 (the PHC winner), Catena-Version 3.2 and Rig-Version 2. Our analysis shows that Argon2i is not providing expected memory hardness which is also highlighted in a recent work by Corrigan-Gibbs et al. We analyze these PHS for performance under various settings of time and memory complexities. Our experimental results show (i) simple DAGs for PHS are efficient but not memory hard, (ii) complex DAGs for PHS are memory hard but less efficient, and (iii) combination of two simple graphs in the representation of a DAG for PHS achieves both memory hardness and efficiency.

A parallel time-memory tradeoff attack on the Hill cipher

ABSTRACTLeap et al. (2016) reduced the time complexity of the Bauer-Millward (2007) ciphertext-only attack on the Hill cipher from 𝒪(Ln) to 𝒪(Ln−1), where L is the length of the alphabet, and n is the block size. This article presents an attack that reduces the complexity to 𝒪(Ln−1−s), 0 ≤ s ≤ n − 1. The practical limitation on the size of s is the memory available on the computer being used for the attack. Specifically, the computer must be able to hold Ls integer arrays of length N, where N is the number of blocks of ciphertext. The key idea is not to iterate over potential rows of the decryption matrix, but to iterate over randomly chosen characters in the plaintext. This attack also admits a straightforward parallel implementation on multiple processors to further decrease the run time of the attack.

Fast batch modular exponentiation with common-multiplicand multiplication

We present an efficient algorithm for batch modular exponentiation which improves upon the previous generalized intersection method with respect to the cost of multiplications. The improvement is achieved by adopting an extended common-multiplicand multiplication technique that efficiently computes more than two multiplications at once. Our algorithm shows a better time-memory tradeoff compared to the previous generalized intersection method. We analyze the cost of multiplications and storage requirement, and show how to choose optimal algorithm parameters that minimize the cost of multiplications.

Mobile Phone Security Based New Strong Genetic Stream Cipher Design

Mobile phones are considered to be the most common communication devices in history. Recently, mobile phones are not only used for communication but also to send and receive important data such as social security numbers, bank account details and passwords. Mobile phone communication uses the encryption algorithms collectively called as A5 family which corresponds to symmetric-key Stream ciphers that generate pseudo-random binary sequences used to encrypt the message signals on bit-by-bit basis. Unfortunately all these algorithms that ensure the security of mobile communications are cryptanalyzed and suffer from several attacks. In this paper, a new genetic pseudo random bit generator (PRBG) based on genetic algorithm is proposed to make mobile phone encryption algorithm A5 robust and resistive to the attacks such as time memory trade off, divide and conquer. A basic security analysis shows that the proposed algorithm is more resistant for cryptanalysis with a good quality of bits stream produced by our generator called genetic A5.

A Proposed Lower Computational Complexity Secret Key Mirroring System on GSM

Global system for mobile communication is a wireless radio technology used mostly on network communication. It is designed to overcome the challenges of analog communication. GSM evolved from generation 1G to 4G LTE and uses protocols to protect transmissions, which have shown to be susceptible to attacks. This fact has been proven based on several attacks ranging from narrow pipe attack, guess, and determine attacks, side channel attacks, time memory tradeoff attacks and correlation attacks which have high computational complexities. The proposed system called GSM Traffic Monitoring System (GTMS) attempts to proffer a lower computational complexity attack. It uses a key retrieval and passive attack module to handle the mirroring of the secret key authentication procedure given a chosen random challenge on a SIM card through the injection of a malware. This research aims at drawing the attention of network providers- SIM configuration; an area that requires protection from attackers.

Automatic Search of Threshold Implementations of 4‐Bit S‐Boxes Resisting DPA

The threshold implementation method of Substitution box (S-box) has been proposed by Nikova et al. for resisting first-order Differential power attacks with glitches. To lower the time complexity for a threshold implementation of a specific non-linear function, one needs to decompose the function first and then search possible share methods for it. However, the time complexity for this search process is still non-trivial. In this paper, an effective method of searching threshold implementations of 4-bit S-boxes is proposed. It mainly consists of two stages. For the decomposing stage, an efficient way of decomposing an S-box is introduced. For the sharing stage, the search complexity is lowered by the technique of time memory trade-off. As a result, threshold implementations of various lightweight block ciphers’ S-boxes are given. Moreover, our method is applied to each 4-bit involutive S-box and some candidates of threshold implementations are presented.

Lyra2: Efficient Password Hashing with High Security against Time-Memory Trade-Offs

We present Lyra2, a password hashing scheme (PHS) based on cryptographic sponges. Lyra2 was designed to be strictly sequential for a given number of cores (i.e., not easily parallelizable beyond that number), providing strong security even against attackers using custom hardware or GPUs. At the same time, it is very simple to implement in software and allows legitimate users to fine tune its memory and processing costs according to the desired level of security against brute force password-guessing. Lyra2 is an improvement of the recently proposed Lyra algorithm, providing an even higher security level against different attack venues and overcoming some limitations of this and other existing schemes.

Computational aspects of correlation power analysis

Since the discovery of simple power attacks, the cryptographic research community has developed significantly more advanced attack methods. The idea behind most algorithms remains to perform a statistical analysis by correlating the power trace obtained when executing a cryptographic primitive to a key-dependent guess. With the advancements of cryptographic countermeasures, it is not uncommon that sophisticated (higher order) power attacks require computation on many millions of power traces to find the desired correlation. In this paper, we study the computational aspects of calculating the most widely used correlation coefficient: the Pearson product-moment correlation coefficient. We study various time–memory trade-off techniques which apply specifically to the cryptologic setting and present methods to extend already completed computations using incremental versions. Moreover, we show how this technique can be applied to second-order attacks, reducing the attack cost significantly when adding new traces to an existing dataset. We also present methods which allow one to split the potentially huge trace set into smaller, more manageable chunks to reduce the memory requirements. Our parallel implementation of these techniques highlights the benefits of this approach as it allows efficient computations on power measurements consisting of hundreds of gigabytes on a single modern workstation.

Choosing TMTO Parameters by means of Linear Optimization

In this paper we present a linear optimization model for choosing parameters in the Time Memory Trade Off method (TMTO). The restrictions of the given model are oriented to achieve a feasible TMTO for maximum time and memory given. Experiments confirmed that the proposed scheme determines the parameters in order to get high probability to invert a one-way function. The method can also be applied for combinations of time and memory not included in the reviewed literature.

Comparison of perfect table cryptanalytic tradeoff algorithms

The performances of three major time memory tradeoff algorithms were compared in a recent paper. The algorithms considered there were the classical Hellman tradeoff and the non-perfect table versions of the distinguished point method and the rainbow table method. This paper adds the perfect table versions of the distinguished point method and the rainbow table method to the list, so that all the major tradeoff algorithms may now be compared against each other. Even though there are existing claims as to the superiority of one tradeoff algorithm over another algorithm, the algorithm performance comparisons provided by the current work and the recent paper mentioned above are of higher practical value. We provide comparisons of algorithms at parameters that achieve a common success rate of inversion and which take both the cost of pre-computation and the efficiency of the online phase into account. The comparisons are based on the average case execution behaviors rather than the worst case situations, and non-negligible details such as the effects of false alarms and various storage optimization techniques are no longer ignored. A large portion of this paper is allocated to analyzing the execution behavior of the perfect table distinguished point method. In particular, we obtain a closed-form formula for the average length of chains associated with a perfect distinguished point table.

ANALYSIS OF POSSIBLE PRE-COMPUTATION AIDED DLP SOLVING ALGORITHMS

A trapdoor discrete logarithm group is a cryptographic primitive with many applications, and an algorithm that allows discrete logarithm problems to be solved faster using a pre-computed table increases the practicality of using this primitive. Currently, the distinguished point method and one extension to this algorithm are the only pre-computation aided discrete logarithm problem solving algorithms appearing in the related literature. This work investigates the possibility of adopting other pre-computation matrix structures that were originally designed for used with cryptanalytic time memory tradeoff algorithms to work as pre-computation aided discrete logarithm problem solving algorithms. We find that the classical Hellman matrix structure leads to an algorithm that has performance advantages over the two existing algorithms.

Time-memory trade-offs for index calculus in genus 3

Abstract In this paper, we present a variant of Diem's O ˜ ( q ) ${\widetilde{O}(q)}$ index calculus algorithm to attack the discrete logarithm problem (DLP) in Jacobians of genus 3 non-hyperelliptic curves over a finite field 𝔽 q . We implement this new variant in C++ and study the complexity in both theory and practice, making the logarithmic factors and constants hidden in the O˜-notation precise. Our variant improves the computational complexity at the cost of a moderate increase in memory consumption, but we also improve the computational complexity even when we limit the memory usage to that of Diem's original algorithm. Finally, we examine how parallelization can help to reduce both the memory cost per computer and the running time for our algorithms.

Efficient Accessing and Searching in a Sequence of Numbers

Accessing and searching in a sequence of numbers are fundamental operations in computing that are encountered in a wide range of applications. One of the applications of the problem is cryptanalytic time-memory tradeoff which is aimed at a one-way function. A rainbow table, which is a common method for the time-memory tradeoff, contains elements from an input domain of a hash function that are normally sorted integers. In this paper, we present a practical indexing method for a monotonically increasing static sequence of numbers where the access and search queries can be addressed efficiently in terms of both time and space complexity. For a sequence of n numbers from a universe U = {0, ..., m ? 1}, our data structure requires n lg(m/n) + O(n) bits with constant average running time for both access and search queries. We also give an analysis of the time and space complexities of the data structure, supported by experiments with rainbow tables.

Analysis of the Perfect Table Fuzzy Rainbow Tradeoff

Cryptanalytic time memory tradeoff algorithms are tools for inverting one-way functions, and they are used in practice to recover passwords that restrict access to digital documents. This work provides an accurate complexity analysis of the perfect table fuzzy rainbow tradeoff algorithm. Based on the analysis results, we show that the lesser known fuzzy rainbow tradeoff performs better than the original rainbow tradeoff, which is widely believed to be the best tradeoff algorithm. The fuzzy rainbow tradeoff can attain higher online efficiency than the rainbow tradeoff and do so at a lower precomputation cost.

An improved parallel implementation of RainbowCrack using MPI

Nearly three decades ago, Martin Hellman introduced a cryptanalytic time-memory trade-off algorithm which reduced the time of cryptanalysis by using precalculated data. Rivest shortly improved this technique by introducing distinguished points which significantly reduced the frequency of memory lookups during cryptanalysis. In 2003, Philip Oechslin proposed a new and improved algorithm which reduces the number of calculations during cryptanalysis by a factor of two. In this research we present the results of a parallel implementation of Oechslin's faster time-memory trade-off algorithm using MPI on a SHARCNET supercomputer. We use MS-Windows hashes (alphanumeric sequences of length 14 characters or less). We can construct 119GB of data in 6 days and crack 99.9% of all passwords hashes in 6s or less. On a standard desktop machine, the same task requires 2354 days (6 years!) to construct the data and 3–15min to crack the password.

Secure Route Optimization for MIPv6 Using Enhanced CGA and DNSSEC

With mobile phones evolving every year, it is no surprise that recent surveys have shown that the worldwide number of mobile phone subscriptions reached 5.6 billion in 2011, becoming the largest pool of interconnected devices. Since mobile IP is the most-used protocol by mobile operators, the obvious solution to support more users in their network would be to replace it with MIPv6. In addition to integrating the newest IP stack, MIPv6 adds an important feature meant to replace the inefficient triangle routing by allowing an MN to communicate bidirectionally with the CN without passing through its home agent. However, the lack of preshared information between the MN and CN makes security for this RO mechanism a difficult challenge. MIPv6 adopts the RR mechanism that is only to verify the MN reachability in both its home address and care-of address without being a security feature. Other works have attempted to solve the multiple security issues in RR, but either their design was flawed or their assumptions were unrealistic. This paper presents a secure MIPv6 with a secure and efficient RO that uses DNSSEC to validate CGAs from trusted domains and provides strong authentication rather than the weak sender invariance security property. It integrates an enhanced cryptographically generated address (ECGA) based on a backward key chain that offers support to bind multiple logically linked CGAs together. ECGA tackles the time-memory tradeoff attacks with high efficiency. The validation through both AVANTSSAR and AVISPA platforms show that the proposed solution has no security flaw while still being lightweight in signaling messages on the radio network.