Linear Equivalence of Block Ciphers with Partial Non-Linear Layers: Application to LowMC

Dinur, Itai; Kales, Daniel; Promitzer, Angela; Ramacher, Sebastian; Rechberger, Christian

doi:10.1007/978-3-030-17653-2_12

Cited by 17 publications

(13 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We define one base permutation π = g (5,7,11,13,17,19,23,29,31,37,27) as discussed above. Note that the order of elements within g does not matter for our purpose and we decided to list first the primes in ascending order, followed by the non-primes.…”

Section: Defining the Instancementioning

confidence: 99%

“…We use the base permutation π = g (3,5,7,11,13,17,19,23,29,31,37,41,43,47,25) and, given the block counter i = √ D i 1 + i 0 we define…”

Section: Defining the Instancementioning

confidence: 99%

“…For LowMC, on the other hand, further optimizations have been applied in [Din+19]. The main idea is to join several matrices from consecutive rounds to speed-up the computation.…”

Section: Introductionmentioning

confidence: 99%

“…The permutation is given by π = g(5, 7, 11, 13,17,19, 23, 29, 31, 37, 27).Now with the use of Algorithm 2 we are able to easily compute Ψ({π t } t≤D ) = 38 and Ψ({π t } t≤ √ D ) = 114. For the entire set this implies a difference of Ψ(Dasta80-6) ≤ Ψ({π t } t≤D ) + 3 • Ψ({π t } t≤ √ D ) = 38 + 3 • 114 = 380 Here we have taken into account that the attacker is able to choose counters t = √ D t 1 + t 0 and s = √ D s 1 + s 0 such that t 0 = s 0 or t 1 = s 1 but not both by counting Ψ({π t } t≤ √ D ) only 3 times even so it appears in six bitpermutations.…”

mentioning

confidence: 99%

See 3 more Smart Citations

Dasta – Alternative Linear Layer for Rasta

Hebborn

Leander

2020

ToSC

View full text Add to dashboard Cite

Progress in the areas of multi-party computation (MPC) and fully homomorphic encryption (FHE) caused the demand of new design strategies, that minimize the number of multiplications in symmetric primitives. Rasta is an approach for a family of stream ciphers with an exceptional low AND depth, which equals the number of ANDs per encrypted bit. This is achieved in particular by randomizing parts of the computation with the help of a PRNG, implying that the security arguments rely on the provided randomness and the encryption/ decryption is potentially slowed down by this generation.In this paper we propose a variant of Rasta that achieves the same performance with respect to the AND depth and the number of ANDs per encrypted bit, but does not rely on a PRNG, i.e. is based on fixed linear layers.

show abstract

Section: Defining the Instancementioning

confidence: 99%

“…We use the base permutation π = g (3,5,7,11,13,17,19,23,29,31,37,41,43,47,25) and, given the block counter i = √ D i 1 + i 0 we define…”

Section: Defining the Instancementioning

confidence: 99%

“…For LowMC, on the other hand, further optimizations have been applied in [Din+19]. The main idea is to join several matrices from consecutive rounds to speed-up the computation.…”

Section: Introductionmentioning

confidence: 99%

mentioning

confidence: 99%

See 2 more Smart Citations

Dasta – Alternative Linear Layer for Rasta

Hebborn

Leander

2020

ToSC

View full text Add to dashboard Cite

show abstract

“…One of these implementations follows the cipher's specification directly. The second is based on the optimization introduced by Dinur et al [9]. This optimization reduces the time complexity and the required memory for the linear-layers from…”

Section: Previous Work 21 Hardware Implementations Of Lowmcmentioning

confidence: 99%

Lightweight Implementation of the LowMC Block Cipher Protected Against Side-Channel Attacks

Bahrami

Dang

Abdulgadir

et al. 2020

Proceedings of the 4th ACM Workshop on Attacks and Solutions in Hardware Security

View full text Add to dashboard Cite

LowMC is a parameterizable block cipher developed for use in Multi-Party Computation (MPC) and Fully Homomorphic Encryption (FHE). In these applications, linear operations are much less expensive in terms of resource utilization compared to the nonlinear operations due to their low multiplicative complexity. In this work, we implemented two versions of LowMC-unrolled and lightweight. Both implementations are realized using RTL VHDL. To the best of our knowledge, we report the first lightweight implementation of LowMC and the first implementation protected against side-channel analysis (SCA). For the SCA protection, we used a hybrid 2/3 shares Threshold Implementation (TI) approach, and for the evaluation, the Test Vector Leakage Assessment (TVLA) method, also known as the T-test. Our unprotected implementations show information leakage at 10K traces, and after protection, they could successfully pass the T-test for 1 million traces. The Xilinx Vivado is used for the synthesis, implementation, functional verification, timing analysis, and programming of the FPGA. The target FPGA family is Artix-7, selected due to its widespread use in multiple applications. Based on our results, the numbers of LUTs are 867 and 3,328 for the lightweight and the unrolled architecture with unrolling factor = 16, respectively. It takes 14.21 s for the lightweight architecture and 1.29 s for the unrolled design with = 16 to generate one 128-bit block of the ciphertext. The fully unrolled architecture beats the best previous implementation by Kales et al. in terms of the number of LUTs by a factor of 4.5. However, this advantage comes at the cost of having 2.9 higher latency.

show abstract