Secure key-alternating Feistel ciphers without key schedule
Secure key-alternating Feistel ciphers without key schedule
复制标题
无需密钥时间表的安全密钥交替 Feistel 密码
DOI：
10.1007/s11432-019-9938-0
复制
发表时间：
2020-10
期刊：
影响因子：
--
通讯作者：
Lai Xuejia
中科院分区：
文献类型：
--
作者：
Shen Yaobin;Yan Hailun;Wang Lei;Lai Xuejia
分组密码是密码学在信息安全中的基础，通常由轮函数和密钥表组成。密钥调度作为分组密码的重要模块之一，一直没有得到应有的重视。通常，密钥调度将主密钥作为输入，并输出在每一轮中使用的所谓的轮密钥。在AES-128的情况下，主密钥是128位的字符串，轮密钥的总长度为11× 128= 1408位。AES-128密钥调度可以被视为从{0，1} 128到{0，1} 1408的函数。分组密码密钥调度部分的科学设计是一个重要但尚未完全理解的课题。总的来说，目前尚不清楚一个好的关键时间表必须遵循哪些实用和必要的原则。为了抵抗一些现有的攻击，有一些关于密钥调度不应该具有的属性，例如，避免（半）弱密钥，等价密钥，对称性和互补性[1]。此外，不应该进行琐碎的猜测和确定攻击、中间相遇攻击、相关密钥攻击、滑动攻击或不变子空间攻击。从可证明安全的角度考虑密钥调度是另一个方向。Chen等人[2]使用了一个可爱的密钥调度实例化的线性正形，以最小化两轮埃文曼苏尔密码从只有一个n位主密钥和一个n位置换。他们证明了这样的AES类结构可以实现超越生日界限的安全性。最近，Guo和Wang（GW）[3]也使用线性正形密钥调度从一个n位主密钥和一个n位函数获得了生日绑定安全的四轮密钥交替Feistel（KAF）密码。他们声称这种四轮结构在理论上是最小的，因为删除这种结构的任何组件都会破坏安全性。除了提供必要的密码安全性之外，密钥调度的效率也具有重要意义，特别是对于通常在诸如射频识别（RFID）标签和传感器网络之类的源受限环境中采用的轻量级分组密码。在这些轻量级密码中，密钥调度通常被高度简化以优化软件和硬件效率。一些密钥调度具有低扩散的逐轮迭代[4，5]，或者对主密钥进行简单的置换或线性运算[6]。特别是，一些轻量级密码具有超轻型（实际上不存在）密钥调度，并在每一轮中直接使用主密钥[7，8]。我们的贡献。我们从一个有趣的问题开始，即如何从可证明安全性的角度设计尽可能轻的密钥调度，并重新审视GW的四轮KAF（见图1（a））。虽然用线性正形映射实例化的密钥调度在某些情况下是有效的，但当应用于许多源受限环境时，它仍然不能满足轻量级密码。在这项研究中，我们优化了GW的建设，并提出了一个新的四轮KAF与超轻（不存在）的关键时间表。有趣的是，我们发现它们构造中的正形可以通过在第一轮中进行轻微修改来移除，即在第一轮函数之后应用一位旋转。我们证明了这种改进的结构可以实现生日绑定的安全。与GW的建设相比，我们的建议有两个优点。最重要的一点是密钥调度是超轻型的（不存在），不需要计算/内存成本。人们可以简单地按位异或（xor）在相应的回合中的n位主密钥，而无需麻烦任何回合密钥导出。
Blockciphers play an fundamental role for cryptography in information security, which usually consist of round functions and key schedules. As one of the significant modules in blockciphers, key schedules have not received deserved attention. Commonly, the key schedule takes as input a master key and outputs the so-called round keys that are used in each round. In the case of AES-128, the master key is a 128-bit string and the total length of the round keys is 11× 128= 1408 bits. The AES-128 key schedule can be seen as a function from {0, 1} 128 to {0, 1} 1408. Scientifically designing the key schedule part of block ciphers is an important but not well-understood subject. In general, it is not yet clear what practical and necessary principles a good key schedule has to follow. In order to resist some existing attacks, there are some properties on what a key schedule should not have, eg, avoiding (semi-) weak keys, equivalent keys, symmetry and complementation properties [1]. Moreover, it should not be possible to mount trivial guess-and-determine attack attacks, meet-in-the-middle attacks, related-key attacks, slide-attacks or invariant subspace attacks. Considering the key schedule from the view of provable security is another direction. Chen et al.[2] used a lovely key schedule instantiated with a linear orthomorphism to minimize a two-round Even-Mansour cipher from just one n-bit master key and one n-bit permutation. They proved such AES-like construction can achieve beyond the birthday bound security. Recently, Guo and Wang (GW)[3] also used a linear-orthomorphism key schedule to obtain a birthdaybound secure four-round key-alternating Feistel (KAF) cipher from just one n-bit master key and one n-bit function. They claimed this four-round construction is theoretically minimal in the sense that removing any component of this construction would ruin the security. In addition to providing necessary cryptographic security, the efficiency of the key schedule is also of great significance, especially for lightweight blockciphers which are often employed in source constrained environments such as radio-frequency identification (RFID) tags and sensor networks. In these lightweight ciphers, key schedules are commonly highly simplified to optimize the software and hardware efficiency. Some key schedules have round-by-round iterations with low diffusion [4, 5], or do simple permutation or linear operations on master keys [6]. In particular, some lightweight ciphers have ultra-light (in fact non-existent) key schedule, and directly use master keys in each round [7, 8].• Our contributions. We start with an interesting question of how to design a as light as possible key schedule from the view of provable security and revisit the four-round KAF by GW (see Figure 1 (a)). Although the key schedule instantiated with linear orthomorphism can be efficient in some instances, it is still unsatisfying for lightweight ciphers when applied in many source constrained environments. In this study, we optimize the construction by GW and propose a new four-round KAF with an ultra-light (non-existent) key schedule. Interestingly, we find the orthomorphism in their construction can be removed with a slight modification on the first round, ie, applying one-bit rotation after the first round function. We prove this refined construction can achieve the birthday-bound security. Compared with GW’s construction, our proposal has two advantages. The most significant one is that the key schedule is ultralight (non-existent), which needs no computation/memory costs. One can simply bitwise exclusive-or (xor) the n-bit master key in corresponding rounds without bothering to any round-key derive …
登录
查看更多内容
DOI：
10.1007/978-3-642-17401-8_7
发表时间：
2010-12
期刊：
--
影响因子：
--
作者：
M. Nandi
通讯作者：
M. Nandi
DOI：
10.1007/978-3-030-03326-2_8
发表时间：
2018-12
期刊：
IACR Cryptol. ePrint Arch.
影响因子：
--
作者：
Chun Guo;Lei Wang
通讯作者：
Chun Guo;Lei Wang
影响因子：
4.6
作者：
A. Bogdanov;L. Knudsen;G. Leander;C. Paar;A. Poschmann;M. Robshaw;Y. Seurin;C. Vikkelsoe
通讯作者：
A. Bogdanov;L. Knudsen;G. Leander;C. Paar;A. Poschmann;M. Robshaw;Y. Seurin;C. Vikkelsoe
DOI：
10.1007/s11432-018-9527-8
发表时间：
2019-01
期刊：
Science China Information Sciences
影响因子：
--
作者：
Hailun Yan;Yiyuan Luo;Mo Chen;Xuejia Lai
通讯作者：
Hailun Yan;Yiyuan Luo;Mo Chen;Xuejia Lai
DOI：
--
发表时间：
2002-02
期刊：
--
影响因子：
--
作者：
J. Daemen;V. Rijmen
通讯作者：
J. Daemen;V. Rijmen