Bosphorus: Bridging ANF and CNF Solvers

Choo, Davin; Soos, Mate; Meel, Kuldeep S.

doi:10.23919/date.2019.8715061

Cited by 8 publications

(2 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…During the experiments, we found that if the ANF-to-CNF converter called Bosphorus [CSCM19] is used to convert the S-boxes, the performance may be improved in practice, which may be explained by its discovery implicit linearity and compression of the CNF formula. Bosphorus is an MIT-licensed open-source software, which is aimed at simplifying ANF-to-CNT conversion over GF (2).…”

Section: Evaluation Of Different Fault Modelsmentioning

confidence: 99%

RAFA: Redundancies-assisted Algebraic Fault Analysis and its implementation on SPN block ciphers

Qiu

Zhang

2023

TCHES

View full text Add to dashboard Cite

Algebraic Fault Analysis (AFA) is a cryptanalysis for block ciphers proposed by Courtois et al., which incorporates algebraic cryptanalysis to overcome the complexity of manual analysis within the context of Differential Fault Analysis (DFA). The effectiveness of AFA on lightweight block ciphers has been demonstrated. However, the complexity of the algebraic systems prevents it from attacking heavyweight block ciphers efficiently. In this paper, we propose a novel cryptanalysis called Redundancies-assisted Algebraic Fault Analysis (RAFA) to facilitate the solution of algebraic systems in the setting of heavyweight block ciphers. The core idea of RAFA is to expedite SAT solvers by modifying the algebraic systems, which is accomplished via two methods. The first method introduces redundant constraints, which is proposed for the first time in the context of algebraic cryptanalysis. The second one is a sophisticated linearization of the nonlinear Algebraic Normal Form (ANF). It takes RAFA for about 9.68 hours to attack AES-128. To the best of our knowledge, this is the first work that uses a general SAT solver to attack AES with only a single injection of byte-fault. Moreover, RAFA can attack AES-128 in 50.92 and 27.54 minutes for nibble- and bit-based fault model, respectively. In comparison, the traditional DFA algorithm implemented by pure C takes 4 ~ 5 hours under all three fault models investigated in this work. Moreover, in order to show the generality of RAFA, we also apply it to other heavyweight block ciphers. The best results show that RAFA could recover the key of Serpent-256 and SPEEDY-r-192 in 20.7 and 1.5 hours using only three faults, respectively. In comparison, AFA could not break these two ciphers even when 30 bits and 50 bits of their keys are known, respectively. Furthermore, no DFA work on Serpent or SPEEDY is known using comparable fault models.

show abstract

Section: Evaluation Of Different Fault Modelsmentioning

confidence: 99%

RAFA: Redundancies-assisted Algebraic Fault Analysis and its implementation on SPN block ciphers

Qiu

Zhang

2023

TCHES

View full text Add to dashboard Cite

show abstract

“…[15; 17; 16; 22; 21]. Recent work has also focused on combining algebraic and SAT solving techniques [7]. In public key cryptography, SAT solvers have been considered for attacking binary elliptic curve cryptosystems using the index calculus attack [13].…”

Section: Introductionmentioning

confidence: 99%

Parity (XOR) Reasoning for the Index Calculus Attack

Trimoska¹,

Ionica²,

Dequen³

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Models for cryptographic problems are often expressed as boolean polynomial systems, whose equivalent logical formulas can be treated using SAT solvers. Given the algebraic nature of the problem, the use of the logical XOR operator is common in SAT-based cryptanalysis. Recent works have focused on advanced techniques for handling parity (XOR) constraints, such as the Gaussian Elimination technique. First, we propose an original XOR-reasoning SAT solver, named WD-Sat, dedicated to a specific cryptographic problem. Secondly, we show that in some cases Gaussian Elimination on SAT instances does not work as well as Gaussian Elimination on algebraic systems. We demonstrate how this oversight is fixed in our solver, which is adapted to read instances in algebraic normal form (ANF). Finally, we propose a novel preprocessing technique based on the Minimal Vertex Cover Problem in graph theory. Our benchmarks use a model obtained from cryptographic instances for which a significant speedup is achieved using the findings in this paper. We further explain how our preprocessing technique can be used as an assessment of the security of a cryptographic system.

show abstract

Nullstellensatz-Proofs for Multiplier Verification

Kaufmann

Biere

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Bosphorus: Bridging ANF and CNF Solvers

Cited by 8 publications

References 27 publications

RAFA: Redundancies-assisted Algebraic Fault Analysis and its implementation on SPN block ciphers

RAFA: Redundancies-assisted Algebraic Fault Analysis and its implementation on SPN block ciphers

Parity (XOR) Reasoning for the Index Calculus Attack

Nullstellensatz-Proofs for Multiplier Verification

Contact Info

Product

Resources

About