A New Class of Collision Attacks and Its Application to DES

Abstract

Abstract. Until now in cryptography the term collision was mainly associated with the surjective mapping of different inputs to an equal output of a hash function. Previous collision attacks were only able to detect collisions at the output of a particular function. In this publication we introduce a new class of attacks which originates from Hans Dobbertin and is based on the fact that side channel analysis can be used to detect internal collisions. We applied our attack against the widely used Data Encryption Standard (DES). We exploit the fact that internal collisions can be caused in three adjacent S-Boxes of DES [DDQ84] in order to gain information about the secret key-bits. As result, we were able to exploit an internal collision with a minimum of 140 encryptions 1 yielding 10.2 key-bits. Moreover, we successfully applied the attack to a smart card processor.

Enhancing Collision Attacks

“…For instance, we assume that a collision on the inputs of the round function F can be detected. This assumption has already been verified experimentally in [11,12,13]. In Section 4, we describe our own experimental results against DES implemented on a smart-card.…”

“…We built a set of 2 r+1 plaintexts among which 2 r pairs (P i , P i ⊕ x ) yield a collision on the input of the second round function. This method is much more efficient than the attack described in [12] (see the summary Table 1). In fact it is almost optimal since all available plaintexts can be useful to detect collisions.…”

“…In [12], it is described how to obtain and detect collisions on 3 adjacent S-boxes in the first round of DES. It is also suggested that the same method could be applied to other Feistel ciphers.…”

“…If this happens, we hope to detect collisions by looking at the power consumption during the second round. This scenario is summarized in Figure 1 The attack described in [12] is based on the extreme case ∆ = δ L = 0. This approach is successful in the case of DES.…”

“…Many new attacks combine "traditional" cryptanalysis techniques (coming from block cipher or hash function cryptanalysis for instance) with the use of side channel information. A good example was given in 2003 by Schramm, Wollinger and Paar [12]. They proposed a Collision Attack (CA) against DES [10] based on techniques from classical "collision attacks" against hash functions.…”