Overview on S-Box Design Principles

Transcription

1 Overview o S-Box Desig Priciples Debdeep Mukhopadhyay Assistat Professor Departmet of Computer Sciece ad Egieerig Idia Istitute of Techology Kharagpur INDIA What is a S-Box? S-Boxes are Boolea mappigs from {0,1} m {0,1} m x mappigs Thus there are compoet fuctios each beig a map from m bits to 1 bit i other words, each compoet fuctio is a Boolea fuctio i m Boolea variables Security IIT Kharagpur 1

2 Boolea Fuctio A Boolea fuctio is a mappig from {0,1} m {0,1} A Boolea fuctio o -iputs ca be represeted i miimal sum (XOR +) of products (AND.) form: f(x 1,,x )=a 0 +a 1. x 1 + +a. x + a 1,2.x 1.x a -1,.x -1.x + +a 1,2,.., x 1.x 2...x The ANF form is caoical If the ad terms have all zero co-efficiets we have a affie fuctio If the costat term is further 0, we have a liear fuctio Boolea Fuctio A Boolea fuctio is a mappig from {0,1} m {0,1} f : Σ {0,1} be a Boolea Fuctio. Biary sequece ( f ( α0), f ( α1),..., f ( α )) 2 1 is called the Truth Table of f Sequece of a Boolea Fuctio: f ( 0 ) f ( ( ) 1) f α 2 1 α α {( 1),( 1),...,( 1) } is called sequece of f Security IIT Kharagpur 2

3 Balaced Fuctio A Boolea fuctio is said to be balaced if its truth table has equal umber of oes ad zeros. The Hammig weight of a biary sequece is the umber of oes Scalar Product of Sequeces Cosider f ad g as two Boolea fuctios. Cosider, η be the sequece of f ad ε be the sequece of g. Defie, < η, ε >= (# o of cases whe f=g)-(#o of cases whe f g) Security IIT Kharagpur 3

4 No-liearity The o-liearity of a Boolea fuctio ca be defied as the distace betwee the fuctio ad the set of all affie fuctios. N f = mi g Α d ( f, g) where A is the set of all affie fuctios over Σ 1 1 d( f, g) = 2 < ηε, > N f = 2 max 1{ η, l }, i= 0,1,...,2 i 2 where l is the sequece of a liear fuctio i x i A Compact Represetatio of all the liear fuctios Hadamard Matrix: Ay rxr matrix with elemets i {-1,1} if HH T =ri r, where I r is the idetity matrix of dimesio rxr. Walsh Hadamard Matrix: H 1 H 1 H0 = 1, H1 =, 1, 2,... H 1 H = 1 Each row of H is the sequece of a liear fuctio i x belogig to {0,1} Each row, l i is the sequece of the Boolea fuctio, gx ( ) =< αi, x>, αi is the biary represetatio of i Note that αi ad x are ot sequeces, but they are biary tuples of legth Security IIT Kharagpur 4

5 Effect of Iput Trasformatio o balaced-ess ad No-liearity If a Boolea fuctio, f(x) is balaced, the so is g=f(xb ^ A), A is a -bit vector ad B is a x 0-1 ivertible matrix No-liearity of f ad g are same. Strict Avalache Criteria Iformally, if oe bit iput is chaged i a S- Box, the half of the output bits should be chaged For a fuctio, f to satisfy SAC the followig coditio is satisfied: f ( x) f ( x α ) is balaced, where wt( α )=1 Higher order SAC, whe more tha oe iput bits chage Both the SAC ad the higher order SAC together make Propagatio Criteria (PC) Security IIT Kharagpur 5

6 How to make a Boolea Fuctio satisfy SAC? Cosider a Boolea fuctio, f(x) Cosider a o-sigular {0,1} matrix of dimesio x. If for each row of the matrix A if: f( x) f( x γ ) is balaced, γ is a row of the matrix A the g(x)=f(xa) satisfies the SAC. Example f(x)=x1x2 ^ x3 does ot satisfy SAC? Why? Cosider α=(001) f(x)^f(x^e1) is balaced, e1=(100) f(x)^f(x^e2) is balaced, e2=(010) f(x)^f(x^e3) is balaced, e3=(111) A= Check that g(x)=f(xa) satisfies SAC Security IIT Kharagpur 6

7 Bet Fuctios No-liearity of Boolea fuctios have a upper boud N f Fuctios which achieve this are called Bet fuctios They satisfy PC for all α But they are always ubalaced Bet fuctios exist for eve values of Example f(x)=x1x2 ^ x3x4 is a Bet fuctio i 4 variables If f is a Bet fuctio so is f ^ (affie fuctio) f(xa ^ B) for a o-sigular biary matrix A is also Bet Bet fuctios are ot balaced. Number of zeros, is 2-1 ±2 /2-1 Security IIT Kharagpur 7

8 Creatig Balaced No-liear fuctio Take 2 -k, k-variable liear fuctio, where k>/2 Cocateate the truth-tables Thus, we obtai a xk mappig which is o-liear N f k-1 Balaced Ca be made to satisfy SAC. Is the S-Box good agaist LC ad DC? Not oly the compoet fuctios are good: high o-liearity satisfy PC etc. but their o-zero liear combiatios also have to satisfy. Challegig problem Security IIT Kharagpur 8

9 Desig of S-Box is eve more complex Good S-Boxes from the cryptographic poit of view whe put i hardware are foud to leak iformatio, like power cosumptio etc They thus lead to attacks called Side Chael Attacks, which ca break ciphers i miutes after all the hard-work The there are Algebraic Attacks So, what to do? Ope Research Problem(s) Criteria of Good S-Box Balaced Compoet fuctios No-liearity of Compoet fuctios high No-zero liear combiatios of Compoet fuctios balaced ad highly o-liear Satisfies SAC High Algebraic degree Security IIT Kharagpur 9

10 Exercise Eumerate 8 distict liear fuctios i 5 variables, x 1, x 2, x 3, x 4, x 5 Cocateate their Truth-tables to obtai a 8 iput, 5 output fuctio. Store the resultat mappig as a 8x5 S- Box. What is the o-liearity of your SBox? Does is satisfy SAC? If ot, modify the fuctio to do so. Further Readig J. Seberry, Zhag, Zhag, Cryptographic Boolea Fuctios via Group Hadamard Matrices, AJC Joural of Combiatorics, vol 10, 1994 K. Nyberg, Differetially Uiform Mappigs for Cryptography, Eurocrypt 1993 K. Nyberg, Perfect No-liear SBoxes, Eurocrypt 1991 Security IIT Kharagpur 10

11 Next Days Topic Modes of operatio of Block Ciphers Security IIT Kharagpur 11