ICEBERG : An Involutional Cipher Efficient for Block Encryption in Reconfigurable Hardware

Standaert, François‐Xavier; Piret, Gilles; Rouvroy, Gaël; Quisquater, Jean-Jacques; Legat, Jean-Didier

doi:10.1007/978-3-540-25937-4_18

Cited by 74 publications

(52 citation statements)

References 26 publications

(27 reference statements)

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…For example, S-Boxes used in Whirlpool [20], Zorro [38], Iceberg [39], Khazad [40], CLEFIA [41], and Robin and Fantomas [42] are permutations of 8 bits based on smaller S-Boxes. In many cases, such a structure is used to allow an efficient implementation of the S-Box in hardware or using a bit-sliced approach.…”

Section: Hardware Implementationmentioning

confidence: 99%

Reverse-Engineering the S-Box of Streebog, Kuznyechik and STRIBOBr1

Biryukov

Perrin

Udovenko

2016

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. The Russian Federation's standardization agency has recently published a hash function called Streebog and a 128-bit block cipher called Kuznyechik. Both of these algorithms use the same 8-bit S-Box but its design rationale was never made public. In this paper, we reverse-engineer this S-Box and reveal its hidden structure. It is based on a sort of 2-round Feistel Network where exclusive-or is replaced by a finite field multiplication. This structure is hidden by two different linear layers applied before and after. In total, five different 4-bit S-Boxes, a multiplexer, two 8-bit linear permutations and two finite field multiplications in a field of size 2 4 are needed to compute the S-Box. The knowledge of this decomposition allows a much more efficient hardware implementation by dividing the area and the delay by 2.5 and 8 respectively. However, the small 4-bit S-Boxes do not have very good cryptographic properties. In fact, one of them has a probability 1 differential. We then generalize the method we used to partially recover the linear layers used to whiten the core of this S-Box and illustrate it with a generic decomposition attack against 4-round Feistel Networks whitened with unknown linear layers. Our attack exploits a particular pattern arising in the Linear Approximations Table of such functions.

show abstract

Section: Hardware Implementationmentioning

confidence: 99%

Reverse-Engineering the S-Box of Streebog, Kuznyechik and STRIBOBr1

Biryukov

Perrin

Udovenko

2016

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…In Hardware Implementation [9] of CA, the experimental Result show that our cellular Automata produces better sequential fault convergence then the linear feedback shift register .Here we are applying the linear hybrid cellular automata rules [12].…”

Section: Sequential Fault Convergencementioning

confidence: 99%

Programmable Cellular Automata Based Efficient Parallel AES Encryption Algorithm

Das¹,

Misra²

2011

IJNSA

View full text Add to dashboard Cite

show abstract

“…exclusive-or with the round key introduces the key material. Recently, several SPN symmetric block ciphers that are composed of involution functions have been proposed and analyzed [10,11,12,13,14]. In an involutional SPN cipher, the non-linear S-Box layer and the linear diffusion layer are involutions.…”

Section: Involutional Block Ciphersmentioning

confidence: 99%

Concurrent Error Detection Schemes for Involution Ciphers

Joshi¹,

Wu²,

Karri³

2004

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Because of the rapidly shrinking dimensions in VLSI, transient and permanent faults arise and will continue to occur in the near future in increasing numbers. Since cryptographic chips are a consumer product produced in large quantities, cheap solutions for concurrent checking are needed. Concurrent Error Detection (CED) for cryptographic chips also has a great potential for detecting (deliberate) fault injection attacks where faults are injected into a cryptographic chip to break the key. In this paper we propose a low cost, low latency, time redundancy based CED technique for a class of symmetric block ciphers whose round functions are involutions. This CED technique can detect both permanent and transient faults with almost no time overhead. A function F is an involution if F(F(x))=x. The proposed CED architecture (i) exploits the involution property of the ciphers and checks if x=F(F(x)) for each of the involutional round functions to detect transient and permanent faults and (ii) uses the idle cycles in the design to achieve close to a 0% time overhead. Our preliminary ASIC synthesis experiment with the involutional cipher KHAZAD resulted in an area overhead of 23.8% and a throughput degradation of 8%. A fault injection based simulation shows that the proposed architecture detects all single-bit faults.

show abstract

ICEBERG : An Involutional Cipher Efficient for Block Encryption in Reconfigurable Hardware

Cited by 74 publications

References 26 publications

Reverse-Engineering the S-Box of Streebog, Kuznyechik and STRIBOBr1

Reverse-Engineering the S-Box of Streebog, Kuznyechik and STRIBOBr1

Programmable Cellular Automata Based Efficient Parallel AES Encryption Algorithm

Concurrent Error Detection Schemes for Involution Ciphers

Contact Info

Product

Resources

About