Multiple Differential Cryptanalysis: Theory and Practice

Blondeau, Céline; Gérard, Benoît

doi:10.1007/978-3-642-21702-9_3

Cited by 62 publications

(85 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Theoretical analysis of this method is done in [9]. Taking notations of the previous section, the scoring function is determined by A i=1 q i or equivalently by the value 1 − q 0 .…”

Section: The Sum-of-counters Scoring Functionmentioning

confidence: 99%

“…In this setting the scores cannot be approximated by a Gaussian distribution and even Poisson approximation leads to pessimistic results. This has been explained in [9] where a formula is given to obtain a better estimate than using Poisson distribution. For more details please refer to [9].…”

Section: The Sum-of-counters Scoring Functionmentioning

confidence: 99%

“…This has been explained in [9] where a formula is given to obtain a better estimate than using Poisson distribution. For more details please refer to [9].…”

Section: The Sum-of-counters Scoring Functionmentioning

confidence: 99%

“…Truncated differential cryptanalysis introduced by Knudsen [19] uses differentials with many output differences that are structured as a linear space. A theoretical framework have recently been proposed to analyze attacks using multiple differentials by summing the corresponding counters [9] 3 .…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Multiple Differential Cryptanalysis Using LLR and χ 2 Statistics

Blondeau

Gérard

Nyberg

2012

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Abstract. Recent block ciphers have been designed to be resistant against differential cryptanalysis. Nevertheless it has been shown that such resistance claims may not be as accurate as wished due to recent advances in this field. One of the main improvements to differential cryptanalysis is the use of many differentials to reduce the data complexity. In this paper we propose a general model for understanding multiple differential cryptanalysis and propose new attacks based on tools used in multidimensional linear cryptanalysis (namely LLR and χ 2 statistical tests). Practical cases to evaluate different approaches for selecting and combining differentials are considered on a reduced version of the cipher PRESENT. We also consider the accuracy of the theoretical estimates corresponding to these attacks.

show abstract

“…Theoretical analysis of this method is done in [9]. Taking notations of the previous section, the scoring function is determined by A i=1 q i or equivalently by the value 1 − q 0 .…”

Section: The Sum-of-counters Scoring Functionmentioning

confidence: 99%

Section: The Sum-of-counters Scoring Functionmentioning

confidence: 99%

“…This has been explained in [9] where a formula is given to obtain a better estimate than using Poisson distribution. For more details please refer to [9].…”

Section: The Sum-of-counters Scoring Functionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Multiple Differential Cryptanalysis Using LLR and χ 2 Statistics

Blondeau

Gérard

Nyberg

2012

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

“…When more characteristics are used, an attacker obtains different lists of subkeys and has to combine them. This is the case, for instance, in multiple differential cryptanalysis [4] and multiple linear cryptanalysis [3]. Both types of cryptanalyses belong to the same family of so-called last-rounds attacks that consist in partially decrypting the available ciphertexts (e.g.…”

Section: Other Applicationsmentioning

confidence: 99%

An Optimal Key Enumeration Algorithm and Its Application to Side-Channel Attacks

Veyrat-Charvillon

Gérard

Renauld

et al. 2013

Lecture Notes in Computer Science

Self Cite

102

View full text Add to dashboard Cite

Abstract. Methods for enumerating cryptographic keys based on partial information obtained on key bytes are important tools in cryptanalysis. This paper discusses two contributions related to the practical application and algorithmic improvement of such tools. On the one hand, we observe that modern computing platforms allow performing very large amounts of cryptanalytic operations, approximately reaching 2 50 to 2 60 block cipher encryptions. As a result, cryptographic key sizes for such ciphers typically range between 80 and 128 bits. By contrast, the evaluation of leaking devices is generally based on distinguishers with very limited computational cost, such as Kocher's Differential Power Analysis. We bridge the gap between these cryptanalytic contexts and show that giving side-channel adversaries some computing power has major consequences for the security of leaking devices. For this purpose, we first propose a Bayesian extension of non-profiled side-channel attacks that allows us to rate key candidates in function of their respective probabilities. Next, we investigate the impact of key enumeration taking advantage of this Bayesian formulation, and quantify the resulting reduction in the data complexity of the attacks. On the other hand, we observe that statistical cryptanalyses usually try to reduce the number and size of lists corresponding to partial information on key bytes, in order to limit the time and memory complexity of the key enumeration. Quite surprisingly, few solutions exist that allow an efficient merging of large lists of subkey candidates. We provide a new deterministic algorithm that significantly reduces the number of keys to test in a divide-and-conquer attack, at the cost of limited (practically tractable) memory requirements. It allows us to optimally enumerate key candidates from any number of (possibly redundant) lists of any size, given that the subkey information is provided as probabilities. As an illustration, we finally exhibit side-channel cryptanalysis experiments where the correct key candidate is ranked up to position 2 32 , in which our algorithm reduces the number of keys to test offline by an average factor 2 5 and a factor larger than 2 10 in the worst observed cases, compared to previous solutions. We also suggest examples of statistical attacks in which the new deterministic algorithm would allow improved results.

show abstract