Fast Software Encryption: 16th International Workshop, FSE 2009 Leuven, Belgium, February 22-25, 2009 Revised Selected Papers PDF
Preview Fast Software Encryption: 16th International Workshop, FSE 2009 Leuven, Belgium, February 22-25, 2009 Revised Selected Papers
Lecture Notes in Computer Science 5665 CommencedPublicationin1973 FoundingandFormerSeriesEditors: GerhardGoos,JurisHartmanis,andJanvanLeeuwen EditorialBoard DavidHutchison LancasterUniversity,UK TakeoKanade CarnegieMellonUniversity,Pittsburgh,PA,USA JosefKittler UniversityofSurrey,Guildford,UK JonM.Kleinberg CornellUniversity,Ithaca,NY,USA AlfredKobsa UniversityofCalifornia,Irvine,CA,USA FriedemannMattern ETHZurich,Switzerland JohnC.Mitchell StanfordUniversity,CA,USA MoniNaor WeizmannInstituteofScience,Rehovot,Israel OscarNierstrasz UniversityofBern,Switzerland C.PanduRangan IndianInstituteofTechnology,Madras,India BernhardSteffen UniversityofDortmund,Germany MadhuSudan MicrosoftResearch,Cambridge,MA,USA DemetriTerzopoulos UniversityofCalifornia,LosAngeles,CA,USA DougTygar UniversityofCalifornia,Berkeley,CA,USA GerhardWeikum Max-PlanckInstituteofComputerScience,Saarbruecken,Germany Orr Dunkelman (Ed.) Fast Software Encryption 16th International Workshop, FSE 2009 Leuven, Belgium, February 22-25, 2009 Revised Selected Papers 1 3 VolumeEditor OrrDunkelman ÉcoleNormaleSupérieure Départementd’Informatique 45rued’Ulm,75230ParisCEDEX05,France E-mail:[email protected] LibraryofCongressControlNumber:2009931058 CRSubjectClassification(1998):E.3,I.1,E.2,D.4.6,K.6.5 LNCSSublibrary:SL4–SecurityandCryptology ISSN 0302-9743 ISBN-10 3-642-03316-4SpringerBerlinHeidelbergNewYork ISBN-13 978-3-642-03316-2SpringerBerlinHeidelbergNewYork Thisworkissubjecttocopyright.Allrightsarereserved,whetherthewholeorpartofthematerialis concerned,specificallytherightsoftranslation,reprinting,re-useofillustrations,recitation,broadcasting, reproductiononmicrofilmsorinanyotherway,andstorageindatabanks.Duplicationofthispublication orpartsthereofispermittedonlyundertheprovisionsoftheGermanCopyrightLawofSeptember9,1965, initscurrentversion,andpermissionforusemustalwaysbeobtainedfromSpringer.Violationsareliable toprosecutionundertheGermanCopyrightLaw. springer.com ©InternationalAssociationforCryptologicResearch2009 PrintedinGermany Typesetting:Camera-readybyauthor,dataconversionbyScientificPublishingServices,Chennai,India Printedonacid-freepaper SPIN:12731466 06/3180 543210 Preface FastSoftwareEncryption2009wasthe16thinaseriesofworkshopsonsymmet- ric key cryptography. Starting from 2002, it is sponsored by the International Association for Cryptologic Research (IACR). FSE 2009 was held in Leuven, Belgium, after previous venues held in Cambridge, UK (1993, 1996), Leuven, Belgium (1994, 2002), Haifa, Israel (1997), Paris, France (1998, 2005), Rome, Italy (1999), New York, USA (2000), Yokohama, Japan (2001), Lund, Sweden (2003), New Delhi, India (2004), Graz, Austria (2006), Luxembourg, Luxem- bourg (2007), and Lausanne, Switzerland (2008). The workshop’s main topic is symmetric key cryptography, including the designoffastandsecuresymmetrickeyprimitives,suchasblockciphers,stream ciphers, hash functions, message authentication codes, modes of operation and iteration, as well as the theoretical foundations of these primitives. This year, 76 papers were submitted to FSE including a large portion of papers on hash functions, following the NIST SHA-3 competition, whose work- shop was held just after FSE in the same location. From the 76 papers,24 were accepted for presentation. It is my pleasure to thank all the authors of all sub- missions for the high-quality research, which is the base for the scientific value of the workshop. The review process was thorough (each submission received the attention of at least three reviewers), and at the end, besides the accepted papers,the Committeedecidedthatthemeritsofthepaper“Blockcipher-Based Hashing Revisited” entitled the authors to receive the best paper award. I wish to thank all Committee members and the referees for their hard and dedicated work. The workshop also featured two invited talks. The first was given by Shay Gueronabout“Intel’sNewAESInstructionsforEnhancedPerformanceandSe- curity”andthesecondwasgivenbyMattRobshawabout“LookingBackatthe eSTREAMProject.”Alongthepresentationofthepapersandtheinvitedtalks, the traditional rump session was organized and chaired by Dan J. Bernstein. I would like to thank Thomas Baign`eres for the iChair review management software, which facilitated a smooth and easy review process, and Shai Halevi for the Web Submission and Review Software for dealing with the proceedings. A special thanks is due to the organizing team. The COSIC team from Katholieke Universiteit Leuven, headed by Program Chair Bart Preneel, did a wonderfuljob inhosting the workshop.The warmwelcomethat awaitedmore than200delegatesfromallovertheworldwasunblemished.Thesupportgivento the FSE 2009 workshop by the sponsors Katholieke Universiteit Leuven, Price- WaterhouseCoppers,andOberthurtechnologiesisalsogratefullyacknowledged. May 2009 Orr Dunkelman Fast Software Encryption 2009 Leuven, Belgium, February 22–25,2009 Sponsored by the International Association for Cryptologic Research (IACR) Program and General Chairs ProgramChair Orr Dunkelman E´cole Normale Sup´erieure, France General Chair Bart Preneel Katholieke Universiteit Leuven, Belgium Program Committee Steve Babbage Vodafone Group R&D, UK Alex Biryukov University of Luxembourg, Luxembourg Dan J. Bernstein University of Illinois at Chicago, USA Joan Daemen STMicroelectronics, Belgium Christophe De Canni`ere E´cole Normale Sup´erieure, France and Katholieke Universiteit Leuven, Belgium Orr Dunkelman (Chair) E´cole Normale Sup´erieure, France Henri Gilbert Orange Labs, France Louis Granboulan EADS Innovation Works, France Helena Handschuh Spansion, France Tetsu Iwata Nagoya University, Japan Nathan Keller Hebrew University, Israel Stefan Lucks Bauhaus-University Weimar, Germany Mitsuru Matsui Mitsubishi Electric, Japan Willi Meier FHNW, Switzerland Kaisa Nyberg Helsinki University of Technology and NOKIA, Finland Raphael Phan LoughboroughUniversity, UK Bart Preneel Katholieke Universiteit Leuven, Belgium H˚avard Raddum University of Bergen, Norway Christian Rechberger Graz University of Technology, Austria Thomas Ristenpart UC San Diego, USA Greg Rose Qualcomm, Australia Serge Vaudenay EPFL, Switzerland Yiqun Lisa Yin Independent Consultant, USA VIII Organization Referees Elena Andreeva Mario Lamberger Kazumaro Aoki Changhoon Lee Frederik Armknecht David McGrew Jean-Philippe Aumasson Florian Mendel Guido Bertoni Nicky Mouha Olivier Billet Jorge Nakahara Jr. Billy Brumley Maria Naya-Plasencia Rafik Chaabouni Ivica Nikoli´c Donghoon Chang Khaled Ouafi Joo Yeon Cho Matthew Parker Shanshan Duan Sylvain Pasini Baha Dundar Chris Peikert Ewan Fleischmann Thomas Peyrin Chistian Forler Thomas Roche Pasqualina Fragneto Martin Schla¨ffer Benedikt Gierlichs Yannick Seurin Michael Gorski Zhijie Shi Jian Guo Thomas Shrimpton Risto Hakala Herv´e Sibert Miia Hermelin Dirk Stegemann Shoichi Hirose Daisuke Suzuki Michael Hutter Stefano Tessaro Sebastiaan Indesteege Stefan Tillich Kimmo Ja¨rvinen Elena Trichina PascalJunod Gilles Van Assche Charanjit Jutla Martin Vuagnoux Liam Keliher Ralf-Philipp Weinmann Shahram Khazaei Bo-Yin Yang Dmitry Khovratovich Scott Yilek Jongsung Kim Erik Zenner Matthias Krause Fan Zhang Sponsors Katholieke Universiteit Leuven, Belgium PriceWaterhouseCoppers,Belgium Oberthur technologies, Belgium Table of Contents Stream Ciphers Cube Testers and Key Recovery Attacks on Reduced-Round MD6 and Trivium ........................................................ 1 Jean-Philippe Aumasson, Itai Dinur, Willi Meier, and Adi Shamir An Efficient State Recovery Attack on X-FCSR-256 .................. 23 Paul Stankovski, Martin Hell, and Thomas Johansson Key Collisions of the RC4 Stream Cipher ........................... 38 Mitsuru Matsui Invited Talk Intel’s New AES Instructions for Enhanced Performance and Security ........................................................ 51 Shay Gueron Theory of Hash Functions Blockcipher-BasedHashing Revisited ............................... 67 Martijn Stam On the Security of Tandem-DM ................................... 84 Ewan Fleischmann, Michael Gorski, and Stefan Lucks Indifferentiability of Permutation-Based Compression Functions and Tree-Based Modes of Operation, with Applications to MD6 ........... 104 Yevgeniy Dodis, Leonid Reyzin, Ronald L. Rivest, and Emily Shen Hash Functions Analysis I Cryptanalysis of RadioGatu´n ...................................... 122 Thomas Fuhr and Thomas Peyrin Preimage Attacks on Reduced Tiger and SHA-2 ..................... 139 Takanori Isobe and Kyoji Shibutani Cryptanalysis of the LAKE Hash Family............................ 156 Alex Biryukov, Praveen Gauravaram, Jian Guo, Dmitry Khovratovich, San Ling, Krystian Matusiewicz, Ivica Nikoli´c, Josef Pieprzyk, and Huaxiong Wang X Table of Contents Block Ciphers Analysis New Cryptanalysis of Block Ciphers with Low Algebraic Degree ....... 180 Bing Sun, Longjiang Qu, and Chao Li Algebraic Techniques in Differential Cryptanalysis ................... 193 Martin Albrecht and Carlos Cid Multidimensional Extension of Matsui’s Algorithm 2 ................. 209 Miia Hermelin, Joo Yeon Cho, and Kaisa Nyberg Hash Functions Analysis II Meet-in-the-Middle Attacks on SHA-3 Candidates.................... 228 Dmitry Khovratovich, Ivica Nikoli´c, and Ralf-Philipp Weinmann Practical Collisions for EnRUPT................................... 246 Sebastiaan Indesteege and Bart Preneel The Rebound Attack: Cryptanalysis of Reduced Whirlpool and Grøstl ......................................................... 260 Florian Mendel, Christian Rechberger, Martin Schla¨ffer, and Søren S. Thomsen Block Ciphers Revisiting the IDEA Philosophy ................................... 277 Pascal Junod and Marco Macchetti Cryptanalysis of the ISDB Scrambling Algorithm (MULTI2) .......... 296 Jean-Philippe Aumasson, Jorge Nakahara Jr., and Pouyan Sepehrdad Beyond-Birthday-BoundSecurity Based on Tweakable Block Cipher ... 308 Kazuhiko Minematsu Theory of Symmetric Key Enhanced Target Collision Resistant Hash Functions Revisited ........ 327 Mohammad Reza Reyhanitabar, Willy Susilo, and Yi Mu Message Authentication Codes MAC Reforgeability.............................................. 345 John Black and Martin Cochran New Distinguishing Attack on MAC Using Secret-Prefix Method....... 363 Xiaoyun Wang, Wei Wang, Keting Jia, and Meiqin Wang Table of Contents XI Fast and Secure CBC-Type MAC Algorithms........................ 375 Mridul Nandi HBS: A Single-Key Mode of Operationfor Deterministic Authenticated Encryption...................................................... 394 Tetsu Iwata and Kan Yasuda Author Index.................................................. 417 Cube Testers and Key Recovery Attacks on Reduced-Round MD6 and Trivium Jean-Philippe Aumasson1,(cid:2), Itai Dinur2, Willi Meier1,(cid:2)(cid:2), and Adi Shamir2 1 FHNW,Windisch, Switzerland 2 Computer Science Department,The Weizmann Institute, Rehovot,Israel Abstract. CRYPTO 2008 saw the introduction of the hash function MD6andofcubeattacks,atypeofalgebraicattackapplicabletocrypto- graphicfunctionshavingalow-degreealgebraicnormalformoverGF(2). This paper applies cube attacks to reduced round MD6, findingthe full 128-bit key of a 14-round MD6 with complexity 222 (which takes less than a minute on a single PC). This is the best key recovery attack an- nouncedsofarforMD6.Wethenintroduceanewclassofattackscalled cube testers, based on efficient property-testing algorithms, and apply them to MD6 and to the stream cipher Trivium. Unlike the standard cube attacks, cube testers detect nonrandom behavior rather than per- forming key extraction, but they can also attack cryptographic schemes described by nonrandom polynomials of relatively high degree. Applied to MD6, cubetesters detect nonrandomness over18 roundsin 217 com- plexity; applied to a slightly modified version of the MD6 compression function,theycandistinguish66roundsfromrandomin224 complexity. Cubetestersgivedistinguishers on Triviumreducedto790 roundsfrom randomwith230 complexityanddetectnonrandomnessover885rounds in 227, improving on theoriginal 767-round cubeattack. 1 Introduction 1.1 Cube Attacks Cube attacks [29,9] are a new type of algebraic cryptanalysis that exploit im- plicit low-degree equations in cryptographic algorithms. Cube attacks only re- quire black box access to the target primitive, and were successfully applied to reduced versions of the stream cipher Trivium [6] in [9]. Roughly speaking, a cryptographic function is vulnerable to cube attacks if its implicit algebraic normal form over GF(2) has degree at most d, provided that 2d computations of the function is feasible. Cube attacks recover a secret key through queries to a black box polynomial with tweakable public variables (e.g. chosen plaintext or IV bits), followed by solving a linear system of equations in the secret key variables.Aonetimepreprocessingphaseisrequiredtodeterminewhichqueries should be made to the black box during the on-line phase of the attack. Low- degreeimplicitequationswerepreviouslyexploitedin[11,27,21,10]toconstruct (cid:2) Supportedby theSwiss National ScienceFoundation, project no. 113329. (cid:2)(cid:2) Supportedby GEBERT RU¨FSTIFTUNG, project no. GRS-069/07. O.Dunkelman(Ed.): FSE2009,LNCS5665,pp. 1–22,2009. (cid:2)c InternationalAssociationforCryptologicResearch2009
The list of books you might like
