Download Presentation
## Stream ciphers 2

- - - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - - -

**Stream ciphers 2**Session 2**Contents**• PN generators with LFSRs • Statistical testing of PN generator sequences • Cryptanalysis of stream ciphers**PN generators with LFSRs**• Computational complexity of the Berlekamp-Massey algorithm is quadratic in the length of the minimum LFSR capable of generating the intercepted sequence. • Thus, if the linear complexity is very high, then the task of predicting the next bits of the sequence is too complex.**PN generators with LFSRs**• Linear complexity achievable with a sole LFSR is small. • Then, in order to prevent the cryptanalysis of a pseudorandom sequence generator, we must design it in such a way that its linear complexity is too high for the practical application of the Berlekamp-Massey algorithm.**PN generators with LFSRs**• Since LFSRs have nice properties regarding statistics of their output sequences, a good idea is to base PN generators on LFSRs. • But to increase linear complexity, we have to combine outputs of several LFSRs in non-linear manner – through non-linear Boolean functions.**Algebraic normal form**• It is the form of a Boolean function that uses only the operations and • In the ANF, the product that includes the largest number of variables is denominated non linear orderof the function. • Example: The non linear order of the function f(x1,x2,x3)=x1x1x3x2x3 is 2.**Algebraic normal form**• The ANF of a Boolean function can be determined from its truth table. The Möbius transform**Algebraic normal form**• Example: n=3**Algebraic normal form**• u=000u=001 u=010 000 001 010 011 100 101 110 111 000 001 010 011 100 101 110 111 000 001 010 011 100 101 110 111 x x x a000=f(0,0,0)=0 a010=f(0,0,0)+ +f(0,1,0)=0+0=0 a001=f(0,0,0)+ +f(0,0,1)=0+1=1**Algebraic normal form**• u=011 u=100u=101 000 001 010 011 100 101 110 111 000 001 010 011 100 101 110 111 000 001 010 011 100 101 110 111 x x x a101=f(0,0,0)+ f(0,0,1) +f(1,0,0)+f(1,0,1)= 0+1+0+1=0 a011=f(0,0,0)+ f(0,0,1) +f(0,1,0)+f(0,1,1)= 0+1+0+1=0 a100=f(0,0,0)+ +f(1,0,0)=0+0=0**Algebraic normal form**• u=110u=111 000 001 010 011 100 101 110 111 a111=f(0,0,0)+ f(0,0,1) +f(0,1,0)+f(0,1,1)+ f(1,0,0) +f(1,0,1)+f(1,1,0)+ f(1,1,1) = 0 x Then: f(x0,x1,x2)=a001x2+a110x0x1=x2+x0x1 a110=f(0,0,0)+ f(0,1,0) +f(1,0,0)+f(1,1,0)= 0+0+0+1=1**Non-linear combiners**• In these generators, the keystream sequence is obtained by combining the output sequences of various LFSRs in a non linear manner. • Example – it is possible to use a Boolean function (without memory).**Non-linear combiners**• If F is a Boolean function of N periodic input sequences a1(t), a2(t), ..., aN(t), then the output sequence b(t) = F(a1(t), a2(t), ..., aN(t)) is a linear combination of various products of sequences. • These products are determined by determining the ANF of the function F.**Non-linear combiners**• Given the ANF of the function F, if we create a function F* from F in such a way that instead of the sum and product modulo 2 in F we use the sum and product of integers, for the linear complexity and the period of the output sequence of F the following holds:**Non-linear combiners**• Example (1) • If the characteristic polynomials of the input sequences are: All these polynomials are primitive!**Non-linear combiners**• Example (2) • Then**Non-linear combiners**• The sum of N sequences in GF(q) (1) • The equality holds if the characteristic polynomials of the input sequences do not have common factors.**Non-linear combiners**• The sum of N sequences in GF(q) (2) • Obviously, if the periods of the input sequences are mutually prime then**Non-linear combiners**• The sum of N sequences in GF(q) (3) • Example: Primitive! The periods are Mersenne primes**Non-linear combiners**• The product of N sequences in GF(q) (1) • Theorem (Golić, 1989) • If Per(ai) are mutually prime, then • Theorem (Lidl, Niedereiter) Per(ai) are mutually prime**Non-linear combiners**• Example Primitive! The periods are Mersenne primes**Non-linear combiners**• The general case (1) • Let be the Boolean function obtained by removing all the products from the function F except those of the maximum order. Let be the corresponding integer function.**Non-linear combiners**• The general case (2) • Theorem (Golić, 1989) • F depends on all the N input variables. • Per(ai) are mutually prime. • Then**Non-linear combiners**• The general case (3) • Example (1)**Non-linear combiners**• The general case (4) • Example (2) • If the characteristic polynomials of the input sequences are: • Then Primitive, periods Mersenne primes**Non-linear combiners**• The general case (5) • Example – Geffe’s generator (1)**Non-linear combiners**• The general case (6) • Example – Geffe’s generator (2) – • Equivalent scheme**Non-linear combiners**• The general case (7) • Example – Geffe’s generator (3) • If we set the feedback polynomials primitive, with periods that are Mersenne primes: • Then**Statistical testing of PN generators**• The output sequence of a generator of pseudorandom sequences looks random, but it is not. • Pseudorandom generators expand a truly random sequence (the key) to a much longer sequence, such that an adversary cannot distinguish between the pseudorandom sequence and a truly random sequence.**Statistical testing of PN generators**• In order to obtain a guarantee of the security of this type of generators, various statistical tests are applied, especially designed for this purpose. • The fact that a generator passes a set of statistical tests should be considered a necessary condition, although not a sufficient one, for the security of the generator.**Statistical testing of PN generators**• If the result X of an experiment can take any real value, then X is a continuous random variable. • The probability density function f(x) of a continuous random variable X can be integrated and the following holds: f(x)0, for all xR For all a, bR the following holds**Statistical testing of PN generators**• A continuous random variable has a normal distributionwith the mean and the variance 2 if its probability density function is: • We say that X is • If X is , then we say that X has a standard normal distribution.**Statistical testing of PN generators**• If the random variable X is , then the variable is . • The Euler’s gamma function:**Statistical testing of PN generators**• A continuous random variable X has a 2 distribution with degrees of freedom if its probability density function is**Statistical testing of PN generators**• A statistical hypothesis H is an affirmation about the distribution of one or more random variables. • A hypothesis test is a procedure based on the observed values of the random variable that leads to the acceptance or rejection of the hypothesis H.**Statistical testing of PN generators**• The test only provides a measure of the strength of evidence given by the data against the hypothesis. • The conclusion is probabilistic. • The level of significance of the test of the hypothesis H is the probability of rejecting the hypothesis H when it is true.**Statistical testing of PN generators**• The hypothesis to be tested is denominated the null hypothesis, H0. • The alternative hypothesisis denoted by H1 or Ha. • In cryptography: • H0 – the given generator is a random sequence generator. • is between 0,001 and 0,05.**Statistical testing of PN generators**• A test: • Determines a statistic for the sample of the output sequence. • This statistic is compared with the expected value for a random sequence.**Statistical testing of PN generators**• How is the comparison carried out? (1) • The computed statistic – X0 – follows (usually) a 2 distribution with degrees of freedom. • It is assumed that this statistic takes large values for non random sequences.**Statistical testing of PN generators**• How is the comparison carried out? (2) • In order to achieve , a threshold X is chosen (by means of the corresponding table), such that P(X0>X)=. • If the value of the statistic for the sample of the output sequence, Xs, satisfies Xs>X, then the sequence fails on the test.**Statistical testing of PN generators**• Basic tests for cryptographic use: • frequency test, • serial test, • poker test, • runs test, • autocorrelation test, • etc.**Statistical testing of PN generators**• Frequency test (1) • Purpose: determine if the number of zeros and ones in a sequence s is approximately the same. • n0 – number of zeros, n1 – number of ones. • The statistic:**Statistical testing of PN generators**• Frequency test (2) • The statistic follows a 2distribution with 1 degree of freedom. • The approximation is good enough if n10.**Statistical testing of PN generators**• Serial test (1) • Tries to determine if the number of occurrences of 00, 01, 10 and 11, as subsequences of s is approximately the same. • The statistic:**Statistical testing of PN generators**• Serial test (2) • The statistic follows a 2distribution with 2 degrees of freedom. • The approximation is good enough if n21.**Statistical testing of PN generators**• Poker test (1) • A positive integer m is considered such that • The sequence s is divided into k parts of size m. • ni is the number of occurrences of the type i of the sequence of length m, 1i2m (that is, i is the value of the integer whose binary representation is the sequence of length m.**Statistical testing of PN generators**• Poker test (2) • The test determines if every sequence of length m appears approximately the same number of times. • The statistic: • The statistic follows approximately a 2 distribution with 2m-1 degrees of freedom.**Statistical testing of PN generators**• Runs test (1) • A run of length i – a subsequence of s formed by i consecutive zeros or i consecutive ones that are neither preceded nor followed by the same symbol. • A run of zeros – gap • A run of ones – block**Statistical testing of PN generators**• Runs test (2) • Purpose: determine if the number of runs of different lengths in the sequence s is that expected in a random sequence. • The number of gaps (or blocks) of length i in a random sequence of length n is • It is considered that k is equal to the largest integer i for which ei5.**Statistical testing of PN generators**• Runs test (3) • We denote by Bi and Hi the number of blocks and gaps of length i in s, for each i, 1ik. • The statistic • The statistic follows approximately a 2distribution with 2k-2 degrees of freedom.