Ciminion: Symmetric Encryption Based on Toffoli-Gates over Large Finite Fields

Dobraunig, Christoph; Grassi, Lorenzo; Guinet, Anna; Kuijsters, Daniël

doi:10.1007/978-3-030-77886-6_1

Cited by 39 publications

(9 citation statements)

References 51 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Several new ciphers and hash functions operating over fields of odd characteristic have then been proposed recently, including MiMC [AGR + 16] and its variants [AGP + 19], Poseidon [GKR + 21], Ciminion [DGGK21], ReinforcedConcrete [GKL + 22], Griffin [GHR + 23], AES-Prime [MMMS23], Anemoi [BBC + 23], or the arithmetizationoriented functions from the Marvellous family, especially Rescue [AAB + 20] and its different versions [SAD20, AKM + 22].…”

Section: Introductionmentioning

confidence: 99%

Propagation of Subspaces in Primitives with Monomial Sboxes: Applications to Rescue and Variants of the AES

Boeuf,

Canteaut,

Perrin

2023

ToSC

View full text Add to dashboard Cite

Motivated by progress in the field of zero-knowledge proofs, so-called Arithmetization-Oriented (AO) symmetric primitives have started to appear in the literature, such as MiMC, Poseidon or Rescue. Due to the design constraints implied by this setting, these algorithms are defined using simple operations over large (possibly prime) fields. In particular, many rely on simple low-degree monomials for their non-linear layers, essentially using x ↦ x3 as an S-box.In this paper, we show that the structure of the material injected in each round (be it subkeys in a block cipher or round constants in a public permutation) could allow a specific pattern, whereby a well-defined affine space is mapped to another by the round function, and then to another, etc. Such chains of one-dimensional subspaces always exist over 2 rounds, and they can be extended to an arbitrary number of rounds, for any linear layer, provided that the round-constants are well chosen.As a consequence, for several ciphers like Rescue, or a variant of AES with a monomial Sbox, there exist some round-key sequences for which the cipher has an abnormally high differential uniformity, exceeding the size of the Sbox alphabet.Well-known security arguments, in particular based on the wide-trail strategy, have been reused in the AO setting by many designers. Unfortunately, our results show that such a traditional study may not be sufficient to guarantee security. To illustrate this, we present two new primitives (the tweakable block cipher Snare and the permutation-based hash function Stir) that are built using state-of-the-art security arguments, but which are actually deeply flawed. Indeed, the key schedule of Snare ensures the presence of a subspace chain that significantly simplifies an algebraic attack against it, and the round constants of Stir force the presence of a subspace chain aligned with the rate and capacity of the permutation. This in turns implies the existence of many easy-to-find solutions to the so-called CICO problem.

show abstract

Section: Introductionmentioning

confidence: 99%

Propagation of Subspaces in Primitives with Monomial Sboxes: Applications to Rescue and Variants of the AES

Boeuf,

Canteaut,

Perrin

2023

ToSC

View full text Add to dashboard Cite

show abstract

“…1 ) Today, many of the mentioned applications operate on F p ≡ GF(p) for a large prime p ≥ 3 (usually, p is of order 2 64 , 2 128 or even bigger), hence having cryptographic schemes that have a natural description over F p is desirable. MPC-, FHE-and ZK-friendly symmetric-key primitives defined over F p include MiMC [AGR + 16], GMiMC [AGP + 19], HadesMiMC [GLR + 20], Rescue [AAB + 20], Poseidon [GKR + 21], Masta [HKC + 20], Ciminion [DGGK21], Pasta [DGH + 21], Grendel [Sze21], Reinforced Concrete [GKL + 21], Hydra [GØSW22], and Griffin [GHR + 22]. As designing symmetric-key primitives in this domain is relatively new and not well-understood, many of these schemes share some common features.…”

Section: Introductionmentioning

confidence: 99%

Invertible Quadratic Non-Linear Layers for MPC-/FHE-/ZK-Friendly Schemes over Fnp

Grassi

Onofri

Pedicini

et al. 2022

ToSC

Self Cite

View full text Add to dashboard Cite

Motivated by new applications such as secure Multi-Party Computation (MPC), Fully Homomorphic Encryption (FHE), and Zero-Knowledge proofs (ZK), many MPC-, FHE- and ZK-friendly symmetric-key primitives that minimize the number of multiplications over Fp for a large prime p have been recently proposed in the literature. This goal is often achieved by instantiating the non-linear layer via power maps x↦xd. In this paper, we start an analysis of new non-linear permutation functions over Fnp that can be used as building blocks in such symmetrickey primitives. Given a local map F : Fmp→ Fp, we limit ourselves to focus on S-Boxes over Fnp for n ≥ m defined as SF (x0, x1, . . . , xn−1) = y0|y1| . . . |yn−1 where yi := F(xi, xi+1, . . . , xi+m−1). As main results, we prove that• given any quadratic function F : F2p→ Fp, the corresponding S-Box SF over Fnp for n ≥ 3 is never invertible;• similarly, given any quadratic function F : F3p → Fp, the corresponding S-Box SF over Fnp for n ≥ 5 is never invertible.Moreover, for each p ≥ 3, we present (1st) generalizations of the Lai-Massey construction over Fnp defined as before via functions F : Fmp → Fp for each n = m ≥ 2 and (2nd) (non-trivial) quadratic functions F : F3p → Fp such that SF over Fnp for n ∈ {3, 4} is invertible. As an open problem for future work, we conjecture that for each m ≥ 1 there exists a finite integer nmax(m) such that SF over Fnp defined as before via a quadratic function F : Fmp →Fp is not invertible for each n ≥ nmax(m). Finally, as a concrete application, we propose Neptune, a variant of the sponge hash function Poseidon, whose non-linear layer is designed by taking into account the results presented in this paper. We show that this variant leads to a concrete multiplication reduction with respect to Poseidon.

show abstract

“…A direct approach to reach this goal is to use a low degree round function, as was done in Feistel-MiMC [AGR + 16], Poseidon [GKR + 21], and Ciminion [DGGK21]. A more sophisticated approach was introduced by the designers of Rescue [AAB + 20, SAD20], who remarked that such a low degree encoding was also possible if the inverse of the round function had a low degree.…”

Section: Introductionmentioning

confidence: 99%

Algebraic Attacks against Some Arithmetization-Oriented Primitives

Bariant

Bouvier

Leurent

et al. 2022

ToSC

View full text Add to dashboard Cite

Recent advanced Zero-Knowledge protocols, along with other high-level constructions such as Multi-Party Computations (MPC), have highlighted the need for a new type of symmetric primitives that are not optimized for speed on the usual platforms (desktop computers, servers, microcontrollers, RFID tags...), but for their ability to be implemented using arithmetic circuits.Several primitives have already been proposed to satisfy this need. In order to enable an efficient arithmetization, they operate over large finite fields, and use round functions that can be modelled using low degree equations. The impact of these properties on their security remains to be completely assessed. In particular, algebraic attacks relying on polynomial root-finding become extremely relevant. Such attacks work by writing the cryptanalysis as systems of polynomial equations over the large field, and solving them with off-the-shelf tools (SageMath, NTL, Magma, . . . ).The need for further analysis of these new designs has been recently highlighted by the Ethereum Foundation, as it issued bounties for successful attacks against round-reduced versions of several of them.In this paper, we show that the security analysis performed by the designers (or challenge authors) of four such primitives is too optimistic, and that it is possible to improve algebraic attacks using insights gathered from a careful study of the round function.First, we show that univariate polynomial root-finding can be of great relevance n practice, as it allows us to solve many of the Ethereum Foundation’s challenges on Feistel–MiMC. Second, we introduce a trick to essentially shave off two full rounds at little to no cost for Substitution-Permutation Networks (SPN). This can be combined with univariate (resp. multivariate) root-finding, which allowed to solve some challenges for Poseidon (resp. Rescue–Prime). Finally, we also find an alternative way to set up a system of equations to attack Ciminion, leading to much faster attacks than expected by the designers.

show abstract

Ciminion: Symmetric Encryption Based on Toffoli-Gates over Large Finite Fields

Cited by 39 publications

References 51 publications

Propagation of Subspaces in Primitives with Monomial Sboxes: Applications to Rescue and Variants of the AES

Propagation of Subspaces in Primitives with Monomial Sboxes: Applications to Rescue and Variants of the AES

Invertible Quadratic Non-Linear Layers for MPC-/FHE-/ZK-Friendly Schemes over Fnp

Algebraic Attacks against Some Arithmetization-Oriented Primitives

Contact Info

Product

Resources

About