Table Of ContentLecture Notes in Computer Science 1636
Editedby G.Goos,J. Hartmanisand J.van Leeuwen
3
Berlin
Heidelberg
NewYork
Barcelona
HongKong
London
Milan
Paris
Singapore
Tokyo
Lars Knudsen (Ed.)
Fast Software Encryption
6th International Workshop, FSE’99
Rome, Italy, March 24-26, 1999
Proceedings
1 3
SeriesEditors
GerhardGoos,KarlsruheUniversity,Germany
JurisHartmanis,CornellUniversity,NY,USA
JanvanLeeuwen,UtrechtUniversity,TheNetherlands
VolumeEditor
LarsKnudsen
UniversityofBergen,DepartmentofInformatics
N-5020Bergen,Norway
E-mail:[email protected]
Cataloging-in-Publicationdataappliedfor
DieDeutscheBibliothek-CIP-Einheitsaufnahme
Fastsoftwareencryption:6thinternationalworkshop;
proceedings/FSE’99Rome,Italy,March24-26,1999.Lars
Knudsen(ed.).-Berlin;Heidelberg;NewYork;Barcelona;Hong
Kong;London;Milan;Paris;Singapore;Tokyo:Springer,1999
(Lecturenotesincomputerscience;Vol.1636)
ISBN3-540-66226-X
CRSubjectClassification(1998):E.3,F.2.1,E.4,G.4
ISSN0302-9743
ISBN3-540-66226-X Springer-VerlagBerlinHeidelbergNewYork
Thisworkissubjecttocopyright.Allrightsarereserved,whetherthewholeorpartofthematerialis
concerned,specificallytherightsoftranslation,reprinting,re-useofillustrations,recitation,broadcasting,
reproductiononmicrofilmsorinanyotherway,andstorageindatabanks.Duplicationofthispublication
orpartsthereofispermittedonlyundertheprovisionsoftheGermanCopyrightLawofSeptember9,1965,
initscurrentversion,andpermissionforusemustalwaysbeobtainedfromSpringer-Verlag.Violationsare
liableforprosecutionundertheGermanCopyrightLaw.
(cid:1)c Springer-VerlagBerlinHeidelberg1999
PrintedinGermany
Typesetting:Camera-readybyauthor
SPIN10703422 06/3142–543210 Printedonacid-freepaper
Preface
TheFastSoftwareEncryptionWorkshop1999isthesixthinaseriesofworkshops
starting in Cambridge in December 1993.
The workshop was organized by General Chair William Wolfowicz, Fonda-
zione U. Bordoni, and Programme Chair Lars Knudsen, University of Bergen,
Norway, in cooperation with Securteam, as far as local arrangements were con-
cerned. The workshop was held March 24-26, 1999 in Rome, Italy.
The workshop concentrated on all aspects of fast secret key ciphers, inclu-
ding the design and cryptanalysis of block and stream ciphers, as well as hash
functions.
There were 51 submissions, all of them submitted electronically. One sub-
mission was later withdrawn by the authors, and 22 papers were selected for
presentation. All submissions were carefully reviewed by at least 4 committee
members. At the workshop, preliminary versions of all 22 papers were distribu-
tedtoallattendees.Aftertheworkshoptherewasa(cid:12)nalreviewingprocesswith
additional comments to the authors.
Ithasbeenachallengeformetochairthecommitteeofthisworkshop,andit
isapleasuretothankallthemembersoftheprogrammecommitteefortheirhard
work. The committee this year consisted of, in alphabetic order, Ross Ander-
son (Cambridge, UK), Eli Biham (Technion, Israel), Don Coppersmith (IBM,
USA), Cunsheng Ding (Singapore), Dieter Gollmann (Microsoft, UK), James
Massey (Denmark), Mitsuru Matsui (Mitsubishi, Japan), Bart Preneel (K.U.
Leuven, Belgium), Bruce Schneier (Counterpane, USA), and Serge Vaudenay
(ENS, France).
ItisagreatpleasuretothankWilliamWolfowiczfororganisingtheworkshop.
Also, it is a pleasure to thank Securteam for the logistics and Telsy and Sun for
supportingtheconference.Finally,abigthankyoutoallsubmittingauthorsfor
their contributions, and to all attendees (approximately 165) of the workshop.
Finally, I would like to thank Vincent Rijmen for his technical assistance in
preparing these proceedings.
April 1999 Lars Knudsen
Table of Contents
Advanced Encryption Standard
Improved Analysis of Some Simpli(cid:12)ed Variants of RC6.......................1
S. Contini, R.L. Rivest, M.J.B. Robshaw, and Y.L. Yin
Linear Cryptanalysis of RC5 and RC6......................................16
J. Borst, B. Preneel, and J. Vandewalle
A Revised Version of CRYPTON: CRYPTON V1.0.........................31
C.H. Lim
Attack on Six Rounds of CRYPTON.......................................46
C. D’Halluin, G. Bijnens, V. Rijmen, and B. Preneel
On the Security of the 128-bit Block Cipher DEAL.........................60
S. Lucks
Cryptanalysis of a Reduced Version of the Block Cipher E2.................71
M. Matsui and T. Tokita
On the Decorrelated Fast Cipher (DFC) and Its Theory....................81
L.R. Knudsen and V. Rijmen
Remotely Keyed Encryption
Scramble All, Encrypt Small................................................95
M. Jakobsson, J.P. Stern, and M. Yung
Accelerated Remotely Keyed Encryption..................................112
S. Lucks
Analysis of Block Ciphers I
Miss in the Middle Attacks on IDEA and Khufu...........................124
E. Biham, A. Biryukov, and A. Shamir
Mod n Cryptanalysis, with Applications against RC5P and M6............139
J. Kelsey, B. Schneier, and D. Wagner
The Boomerang Attack....................................................156
D. Wagner
Miscellaneous
Towards Making Luby-Racko(cid:11) Ciphers Optimal and Practical.............171
S. Patel, Z. Ramzan, and G.S. Sundaram
A New Characterization of Almost Bent Functions.........................186
A. Canteaut, P. Charpin, and H. Dobbertin
Imprimitive Permutation Groups and Trapdoors in Iterated Block Ciphers.201
K.G. Paterson
VIII Table of Contents
Modes of Operation
On the Security of Double and 2-Key Triple Modes of Operation...........215
H. Handschuh and B. Preneel
On the Construction of Variable-Input-Length Ciphers....................231
M. Bellare and P. Rogaway
Analysis of Block Ciphers II
Slide Attacks..............................................................245
A. Biryukov and D. Wagner
On the Security of CS-Cipher.............................................260
S. Vaudenay
Interpolation Attacks of the Block Cipher: SNAKE........................275
S. Moriai, T. Shimoyama, and T. Kaneko
Stream Ciphers
High-Speed Pseudorandom Number Generation with Small Memory.......290
W. Aiello, S. Rajagopalan, and R. Venkatesan
SOBER Cryptanalysis.....................................................305
D. Bleichenbacher and S. Patel
Author Index...........................................................317
Improved Analysis of
Some Simpli(cid:12)ed Variants of RC6
Scott Contini1, Ronald L. Rivest2, M.J.B. Robshaw1, and Yiqun Lisa Yin1
1 RSA Laboratories, 2955 Campus Drive
San Mateo, CA 94403, USA
fscontini,matt,[email protected]
2 M.I.T. Laboratory for Computer Science, 545 Technology Square
Cambridge, MA 02139, USA
[email protected]
Abstract. RC6 has been submitted as a candidate for the Advanced
Encryption Standard (AES). Two important features of RC6 that were
absent from its predecessor RC5 are a quadratic function and a (cid:12)xed
rotation. By examining simpli(cid:12)ed variants that omit these features we
clarify their essential contribution to the overall security of RC6.
1 Introduction
RC6 is an evolutionary improvement of the block cipher RC5 [9] that was de-
signed to meet the requirements of the Advanced Encryption Standard (AES).
Like RC5, RC6 makes essential use of data-dependent rotations, but it also in-
cludes new features such as the use of four working registers instead of two, and
theinclusionofintegermultiplicationasanadditionalprimitiveoperation.Two
components of RC6 that were absent from RC5 are a quadratic function to mix
bitsinawordmoree(cid:11)ectivelyanda(cid:12)xedrotationthatisusedbothtohinderthe
construction of good di(cid:11)erentials and linear approximations and also to ensure
that subsequent data dependent rotation amounts are more likely to be a(cid:11)ected
by any ongoing avalanche of change.
An initial analysis of the security of RC6 and its resistance to the basic
forms of di(cid:11)erential and linear cryptanalysis was given in [3]. Here we further
illustratehowthesenewoperationscontributetothesecurityofRC6bystudying
simpli(cid:12)edvariants(thatis,intentionallyweakenedforms)ofRC6.Inparticular,
our approach is to (cid:12)nd the best attack on the weakened forms and then try to
adapt the attack to the full cipher. Since one of the design principles of RC6
was to build on the experience gained with RC5, the focus of our analysis will
be in assessing the relevance to RC6 of the best existing cryptanalytic attacks
on RC5. We will often refer to the work of Knudsen and Meier [8] and that
of Biryukov and Kushilevitz [2]. These authors in particular have made very
signi(cid:12)cant advances in understanding the security of RC5.
Ourworksplitsnaturallyintotwoparts.The(cid:12)rstfocusesontheusefulnessof
the (cid:12)xed rotation and the second on the quadratic function. While our analysis
is targeted at RC6 and its simpli(cid:12)ed variants, some of the results might well be
L.Knudsen(Ed.):FSE’99,LNCS1636,pp.1{15,1999.
(cid:13)c Springer-VerlagBerlinHeidelberg1999
2 S. Contini et al.
ofindependentinterest.Ouranalysisstartsbyconsideringsomeoftheweakened
variants of RC6 that were introduced in [3]. More speci(cid:12)cally, by dropping the
(cid:12)xed rotation we derive a cipher that we will denote by RC6-NFR (where NFR
standsforno(cid:12)xedrotation),bydroppingthequadraticfunctionweobtainRC6-
I(whereIstandsfortheidentityfunction),andbydroppingbothoperationswe
have RC6-I-NFR.
We will consider characteristics and di(cid:11)erentials for RC6-I-NFR and RC6-
NFR that have already been described in [3]. We study the relations between
certain values of the subkeys and the probability of a characteristic and/or dif-
ferential. Such phenomena are similar to the \di(cid:11)erentially-weak keys" of RC5
observedbyKnudsenandMeier[8].Wedescribeourobservationsandprovidea
thoroughanalysiswhichsuggeststhatinclusionofthe(cid:12)xedrotationdestroysthe
structure required for such dependencies to form. As a consequence RC6-I and
RC6itselfseemtobeimmunefromanydirectextensionoftheresultspreviously
obtained on RC5.
Second, we examine the di(cid:11)usive properties of the quadratic function and
other operations that are used in RC6. In this analysis we track the Hamming
weight(thenumberof1’s)oftheexclusive-ordi(cid:11)erencebetweentwoquantitiesas
theyareencrypted.Quitenaturallythisleadstotheideaofdi(cid:11)erentialsthatare
constructed using such a measure of di(cid:11)erence and this notion is very similar
in spirit to earlier work on RC5 [2,8]. We show that the quadratic function
drastically increases the Hamming weight of some input di(cid:11)erence when the
Hamming weight of an input di(cid:11)erence is small. This indicates that the use
of both the quadratic function and data-dependent rotations in RC6 make it
unlikely that di(cid:11)erential attacks similar to those that were useful for RC5 [2,8]
can be e(cid:11)ectively extended to RC6.
2 Description of RC6 and Variants
A version of RC6 is speci(cid:12)ed as RC6-w/r/b where the word size is w bits, en-
cryption consists of a nonnegative number of roundsr, and b denotes the length
oftheencryptionkeyinbytes.Throughoutthispaperwewillsetw =32,r =20,
b = 16, 24, or 32 and we will use RC6 to refer to this particular version. The
base-two logarithm of w will be denoted by lgw and RC6 uses the following six
basic operations:
a+b integer addition modulo 2w
a−b integer subtraction modulo 2w
a(cid:8)b bitwise exclusive-or of w-bit words
a(cid:2)b integer multiplication modulo 2w
a<<<b rotate the w-bit word a to the left by the amount
given by the least signi(cid:12)cant lgw bits of b
a>>>b rotate the w-bit word a to the right by the amount
given by the least signi(cid:12)cant lgw bits of b
The user supplies a key of length k bytes which is then expanded to a set
of subkeys. The key schedule of RC6 is described in [10]. Since here we are
