Advances in Cryptology – ASIACRYPT 2018: 24th International Conference on the Theory and Application of Cryptology and Information Security, Brisbane, QLD, Australia, December 2–6, 2018, Proceedings, Part II Thomas Peyrin 2024 scribd download
Advances in Cryptology – ASIACRYPT 2018: 24th International Conference on the Theory and Application of Cryptology and Information Security, Brisbane, QLD, Australia, December 2–6, 2018, Proceedings, Part II Thomas Peyrin 2024 scribd download
Advances in Cryptology – ASIACRYPT 2018: 24th International Conference on the Theory and Application of Cryptology and Information Security, Brisbane, QLD, Australia, December 2–6, 2018, Proceedings, Part II Thomas Peyrin 2024 scribd download
com
https://textbookfull.com/product/water-utility-capital-financing-4th-
edition-american-water-works-association/
textbookfull.com
The Cambridge Companion to Narrative Theory Matthew
Garrett
https://textbookfull.com/product/the-cambridge-companion-to-narrative-
theory-matthew-garrett/
textbookfull.com
https://textbookfull.com/product/women-men-and-language-a-
sociolinguistic-account-of-gender-differences-in-language-3rd-edition-
coates/
textbookfull.com
https://textbookfull.com/product/electronic-devices-conventional-
current-version-10th-edition-thomas-l-floyd/
textbookfull.com
https://textbookfull.com/product/no-man-an-island-the-cinema-of-hou-
hsiao-hsien-second-edition-hou/
textbookfull.com
The Legacy of Marxism Contemporary Challenges Conflicts
and Developments 1st Edition Matthew Johnson
https://textbookfull.com/product/the-legacy-of-marxism-contemporary-
challenges-conflicts-and-developments-1st-edition-matthew-johnson/
textbookfull.com
Thomas Peyrin
Steven Galbraith (Eds.)
LNCS 11273
Advances in Cryptology –
ASIACRYPT 2018
24th International Conference on the Theory
and Application of Cryptology and Information Security
Brisbane, QLD, Australia, December 2–6, 2018, Proceedings, Part II
123
Lecture Notes in Computer Science 11273
Commenced Publication in 1973
Founding and Former Series Editors:
Gerhard Goos, Juris Hartmanis, and Jan van Leeuwen
Editorial Board
David Hutchison
Lancaster University, Lancaster, UK
Takeo Kanade
Carnegie Mellon University, Pittsburgh, PA, USA
Josef Kittler
University of Surrey, Guildford, UK
Jon M. Kleinberg
Cornell University, Ithaca, NY, USA
Friedemann Mattern
ETH Zurich, Zurich, Switzerland
John C. Mitchell
Stanford University, Stanford, CA, USA
Moni Naor
Weizmann Institute of Science, Rehovot, Israel
C. Pandu Rangan
Indian Institute of Technology Madras, Chennai, India
Bernhard Steffen
TU Dortmund University, Dortmund, Germany
Demetri Terzopoulos
University of California, Los Angeles, CA, USA
Doug Tygar
University of California, Berkeley, CA, USA
Gerhard Weikum
Max Planck Institute for Informatics, Saarbrücken, Germany
More information about this series at http://www.springer.com/series/7410
Thomas Peyrin Steven Galbraith (Eds.)
•
Advances in Cryptology –
ASIACRYPT 2018
24th International Conference on the Theory
and Application of Cryptology and Information Security
Brisbane, QLD, Australia, December 2–6, 2018
Proceedings, Part II
123
Editors
Thomas Peyrin Steven Galbraith
Nanyang Technological University University of Auckland
Singapore, Singapore Auckland, New Zealand
This Springer imprint is published by the registered company Springer Nature Switzerland AG
The registered company address is: Gewerbestrasse 11, 6330 Cham, Switzerland
Preface
ASIACRYPT 2018, the 24th Annual International Conference on Theory and Appli-
cation of Cryptology and Information Security, was held in Brisbane, Australia, during
December 2–6, 2018.
The conference focused on all technical aspects of cryptology, and was sponsored
by the International Association for Cryptologic Research (IACR).
Asiacrypt 2018 received a total of 234 submissions from all over the world. The
Program Committee selected 65 papers for publication in the proceedings of this
conference. The review process was made by the usual double-blind peer review by the
Program Committee, which consisted of 47 leading experts of the field. Each sub-
mission was reviewed by at least three reviewers and five reviewers were assigned to
submissions co-authored by Program Committee members. This year, the conference
operated a two-round review system with rebuttal phase. In the first-round review the
Program Committee selected the 145 submissions that were considered of value for
proceeding to the second round. In the second-round phase the Program Committee
further reviewed the submissions by taking into account their rebuttal letter from the
authors. The selection process was assisted by a total of 347 external reviewers. These
three-volume proceedings contain the revised versions of the papers that were selected.
The revised versions were not reviewed again and the authors are responsible for their
contents.
The program of Asiacrypt 2018 featured three excellent invited talks by Mitsuru
Matsui, Melissa Chase, and Vanessa Teague. The conference also featured a traditional
rump session that contained short presentations on the latest research results of the
field. The Program Committee selected the work “Block Cipher Invariants as Eigen-
vectors of Correlation Matrices” by Tim Beyne for the Best Paper Award of Asiacrypt
2018. Two more papers, “Learning Strikes Again: the Case of the DRS Signature
Scheme” by Yang Yu and Léo Ducas, and “Tighter Security Proofs for GPV-IBE in the
Quantum Random Oracle Model” by Shuichi Katsumata, Shota Yamada, and Takashi
Yamakawa, were solicited to submit the full versions to the Journal of Cryptology. The
program chairs selected Chris Brzuska and Bart Mennink for the Best PC Member
Award.
Many people contributed to the success of Asiacrypt 2018. We would like to thank
the authors for submitting their research results to the conference. We are very grateful
to all of the PC members as well as the external reviewers for their fruitful comments
and discussions on their areas of expertise. We are greatly indebted to Josef Pieprzyk,
the general chair, for his efforts and overall organization. We would also like to thank
Waleed Alkalabi, Niluka Arasinghe, Mir Ali Rezazadeh Baee, Lynn Batten, Xavier
Boyen, Ed Dawson, Ernest Foo, Mukhtar Hassan, Udyani Herath, Qingyi Li, Georg
Lippold, Matthew McKague, Basker Palaniswamy, Anisur Rahman, Leonie Simpson,
Shriparen Sriskandarajah, Gabrielle Stephens, and Chathurika Don Wickramage, the
VI Preface
local Organizing Committee for their continuous support. We thank Craig Costello,
Léo Ducas, and Pierre Karpman for expertly organizing and chairing the rump session.
Finally we thank Shai Halevi for letting us use his nice software for the paper
submission and review process. We also thank Alfred Hofmann, Anna Kramer, and
their colleagues for handling the editorial process of the proceedings published in
Springer’s LNCS series.
General Chair
Josef Pieprzyk CSIRO, Data61, Australia
Program Co-chairs
Thomas Peyrin Nanyang Technological University, Singapore
Steven Galbraith University of Auckland, New Zealand
Program Committee
Martin Albrecht Royal Holloway University of London, UK
Prabhanjan Ananth MIT, USA
Lejla Batina Radboud University, The Netherlands
Sonia Belaïd CryptoExperts, France
Daniel J. Bernstein University of Illinois at Chicago, USA
Chris Brzuska Aalto University, Finland
Bernardo David Tokyo Institute of Technology, Japan
Nico Döttling Friedrich-Alexander University Erlangen-Nürnberg, Germany
Léo Ducas CWI, The Netherlands
Jens Groth University College London, UK
Dawu Gu Shanghai Jiao Tong University, China
Goichiro Hanaoka AIST, Japan
Viet Tung Hoang Florida State University, USA
Takanori Isobe University of Hyogo, Japan
Jérémy Jean ANSSI, France
Stefan Kölbl Technical University of Denmark, Denmark
Ilan Komargodski Cornell Tech, USA
Kaoru Kurosawa Ibaraki University, Japan
Virginie Lallemand Ruhr-Universität Bochum, Germany
Gaëtan Leurent Inria, France
Benoît Libert CNRS and ENS de Lyon, France
Helger Lipmaa University of Tartu, Estonia
VIII ASIACRYPT 2018
External Reviewers
Advisors
Lynn Batten Deakin University, Australia
Ed Dawson QUT, Australia
Members
Waleed Alkalabi QUT, Australia
Niluka Arasinghe QUT, Australia
Mir Ali Rezazadeh QUT, Australia
Baee
Xavier Boyen QUT, Australia
Ernest Foo QUT, Australia
Mukhtar Hassan QUT, Australia
Udyani Herath QUT, Australia
Qingyi Li QUT, Australia
Georg Lippold Mastercard, Australia
Matthew McKague QUT, Australia
Basker Palaniswamy QUT, Australia
Anisur Rahman QUT, Australia
ASIACRYPT 2018 XIII
Symmetric-Key Cryptanalysis
Cryptanalysis of MORUS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Tomer Ashur, Maria Eichlseder, Martin M. Lauridsen, Gaëtan Leurent,
Brice Minaud, Yann Rotella, Yu Sasaki, and Benoît Viguier
Side-Channels
Signatures
Learning Strikes Again: The Case of the DRS Signature Scheme . . . . . . . . . 525
Yang Yu and Léo Ducas
Leakage-Resilient Cryptography
Danping Shi1,2 , Siwei Sun1,2,3(B) , Patrick Derbez4 , Yosuke Todo5 , Bing Sun6 ,
and Lei Hu1,2,3
1
State Key Laboratory of Information Security, Institute of Information
Engineering, Chinese Academy of Sciences, Beijing, China
{shidanping,sunsiwei,hulei}@iie.ac.cn
2
Data Assurance and Communication Security Research Center,
Chinese Academy of Sciences, Beijing, China
3
School of Cyber Security,
University of Chinese Academy of Sciences, Beijing, China
4
Univ Rennes, CNRS, IRISA, Rennes, France
[email protected]
5
NTT Secure Platform Laboratories, Tokyo, Japan
[email protected]
6
College of Liberal Arts and Sciences,
National University of Defense Technology, Changsha, China
happy [email protected]
1 Introduction
Cryptanalysis of block ciphers is a highly technical, time consuming and error-
prone process. On the one hand, the attackers have to perform a variety of
cryptanalytic techniques, including differential attack [1], linear attack [2], inte-
gral attack [3–5], etc., to see which technique leads to the best attack. On the
other hand, the designers need to repeat all these different attacks again and
again to identify the optimal choices of parameters and building blocks which
meet the security and implementation requirements. Therefore, automatic tools
are indispensable to the community, which significantly reduce the manual work
and make a thorough exploration of the design/analysis space possible.
One paradigm for automatic symmetric-key cryptanalysis getting increasing
popularity in recent years is to model the problem by means of constraints, which
includes the methods based on SAT/SMT (satisfiability modulo theory) [6–8],
MILP (mixed-integer linear programming) [9–13], and classical constraint pro-
gramming [14,15]. In this paper, these methods are collectively referred to as
the general constraint programming (CP) based approach, or just CP based app-
roach for short. So far, the CP based approach covers a wide range of symmetric-
key cryptanalysis techniques. For instance, we can determine the minimum num-
ber of differentially or linearly active S-boxes of a block cipher with MILP [9]; we
can search for actual differential characteristics, linear characteristics, and inte-
gral distinguishers with SAT/SMT, MILP or classical constraint programming
[8,10,11,14]; and we can search for impossible differentials and zero-correlation
linear approximations [12,16] in a similar way.
Compared with search algorithms implemented from scratch in general pur-
pose programming languages [17–24], the CP based approach allows the crypt-
analysts to state the problem very naturally, and at a high level without having
to say how it should be solved. The resolution of the problem is delegated to
generic solvers, and therefore decoupled from the formulation of the problem.
As Eugene C. Freuder stated [25]: Constraint programming represents one of the
closest approaches computer science has yet made to the Holy Grail of program-
ming : the user states the problem, the computer solves it.
However, the Demirci-Selçuk meet-in-the-middle attack (DS-MITM) attack
[26], introduced by Demirci and Selçuk at FSE 2008 to attack the famous
Advanced Encryption Standard (AES) [27], is one of the cryptanalytic tech-
niques which has not been automated with general constraint programming due
to its extraordinary sophistication. After a series of improvements of the attack
with various creative techniques [28–32], the DS-MITM attack reaches the best
known attack on 7-round AES-128, 9-round AES-256 and 10-round AES-256
Visit https://textbookfull.com
now to explore a rich
collection of eBooks, textbook
and enjoy exciting offers!
Programming the Demirci-Selçuk Meet-in-the-Middle Attack 5
in the single-key model. The attack has been applied to several specific block
ciphers [33–36] as well as on generic balanced Feistel constructions [37]. Most
recently, Guo et al. show generic attacks on unbalanced Feistel ciphers based on
the DS-MITM technique which penetrate a large number of rounds of some spe-
cific class of unbalanced Feistels [38]. Note that despite sharing the same name
with the traditional MITM attacks in some literature (the attacks on some block
ciphers [39,40] and on a number of hash functions, e.g. [41,42]), the DS-MITM
attack concerned in this paper follows a different and a more complex strategy.
Related Work and Our Contribution. In [30,31], Derbez and Fouque presented
a tool implemented in C/C++ for finding the DS-MITM attack with dedicated
search algorithm. In this paper, we present the first CP-based tool for finding
the DS-MITM attack automatically. Our approach is based on a novel modelling
technique in which we introduce several different types of variables for every
input/output word of all operations, and impose constraints on these variables
such that from a solution of these variables satisfying all the constraints we can
deduce a DS-MITM distinguisher or DS-MITM attack.
Compared with Derbez and Fouque’s tool [30,31] which was implemented
in the general purpose programming language C/C++, the CP based method
allows the cryptanalysts to state the problem at a high level very naturally,
without considering how to maintain the relationships between the variables
explicitly with dedicated algorithms. Therefore, our tool should be very useful
in fast prototyping in the process of block cipher design.
In [43], Lin et al. modeled the problem of searching for DS-MITM distin-
guishers as an integer programming model. However, their integer programming
model is incomplete and is solved by a dedicated search algorithm. Secondly,
Lin et al. ’s work only focuses on the distinguisher part. Our CP based approach
can not only enumerate distinguishers but also partly automate the key-recovery
process of the attack. Moreover, by applying our CP based approach to LBlock,
the same cipher targeted in [43], we show it finds better distinguishers as well
as better attacks. To demonstrate the effectiveness of our approach, we apply
it to SKINNY [44], TWINE [45], and LBlock [46]. We produce so far the best
DS-MITM attacks on these well-known ciphers automatically.
For LBlock, we can not only find an 11-round DS-MITM distinguisher
which is 2 rounds longer than the one(s) presented in [43], but also construct
the first DS-MITM attack on 21-round LBlock. We also rediscover the same
attack on TWINE-128 given in [34], and identify the first DS-MITM attack on
20-round TWINE-80. In addition, we report the first concrete DS-MITM analysis
of SKINNY. A remarkable fact is that our tool identify an 10.5-round DS-MITM
distinguisher in a few seconds, while its designers expect an upper-bound of 10
rounds against such distinguishers in [44]. A summary of these results are given
in Table 1.
We also show how helpful our tool can be in the block cipher design process
by searching for the best choices of block shuffles in LBlock and TWINE. We
scan over 40320 variants of LBlock, and 887040 variants of TWINE. We iden-
tify permutations which are potentially stronger than the permutations in the
original designs. We make the source code of this work publicly available at
6 D. Shi et al.
https://github.com/siweisun/MITM.
Table 1. A summary of the results. Though the focus of this paper is the DS-MITM
attack, we also list other types of attacks which achieve currently known best results
against the ciphers targeted. For the DS-MITM attack, the number of rounds attacked
is presented in the form of a + b, where a shows how many rounds are covered by the
underlying DS-MITM distinguisher, while b is the number orouter rounds added when
performing a key-recovery attack. Therefore, b = 0 indicates a distinguishing attack.
2 Notations
An n-bit state state with n = cnc is alternatively regarded as a sequence
(state[0], state[1], · · · , state[nc − 1]) of nc c-bit words. Let A = [j0 , j1 , · · · , js−1 ]
be an ordered set of integers such that 0 ≤ j0 < · · · < js−1 < nc . Then state[A]
is used to represent state[j0 ]|| · · · ||state[js−1 ], where state[j] is the j-th c-bit word
of state and || is the operation of bit string concatenation.
Programming the Demirci-Selçuk Meet-in-the-Middle Attack 7
Plaintext
state0
Ā NL
state1
L
k0
E0
state2
(0 → · · · → r0 − 1)
..
. Involved Key: kE
0
state2(r −1)
0
NL
state2(r −1)+1
0
L
kr −1
A 0
state2r
0
NL
state2r +1
0
L
kr 0
E1
state2(r +1)
0
(r0 → · · · → r0 + r1 − 1)
..
.
state2(r +r −1)
0 1
NL
state2(r +r −1)+1
0 1
L
kr +r −1
0 1
state2(r +r )
0 1
B
NL
state2(r +r )+1
0 1
L
kr +r
0 1
state2(r +r +1) E2
0 1
.. (r0 + r1 → · · · → r0 + r1 + r2 − 1)
. Involved Key: kE
2
state2(r +r +r −1)
0 1 2
NL
state2(r +r +r −1)+1
0 1 2
L
kr +r +r −1
0 1 2
state2(r +r +r )
0 1 2
Ciphertext
Fig. 1. An r-round SP block cipher E = E2 ◦E1 ◦E0 with r = r0 +r1 +r2 , whose round
function consists of a layer of nonlinear operation and a layer of linear operation. A
DS-MITM key-recovery attack is performed based on a DS-MITM distinguisher placed
at E1 . A more detailed explanation of this figure will be given in Sect. 3.2.
Q ⊕ Q (state2k ) with the knowledge of Q(state2k+1 [I]) and Q ⊕ Q (state2k+1 [I]).
In other words, we can derive the value of the output/input differences if we
know the value of input/output values and differences at the active positions.