2008 Differential Distinguishing Attack on the Shannon Stream Cipher Based on Fault Analysis.ppt

Differential Distinguishing Attack on the Shannon Stream Cipher Based on Fault Analysis Outline Introduction Description of the Shannon Differential Properties of the f2 Function Fault Analysis Our Differential Distinguishing Attack Implementation Results Conclusion Introduction The Shannon stream cipher was proposed by Philip Hawkes et al. for Ecrypt/eStream competitive. A Brief Description Keystream Generation Mode 1) rt+1[i] ← rt[i+1] for i = 1...14 2) rt+1[15] ← f1(rt[12] ? rt[13] ? Konst) ? (rt[0] 1) f Function f : (A,B,C,D are fixed numbers) t ← w ? ((w A) | (w B)) f(w) = t ? (( t C) | (t D)) f1 : (A,B,C,D)=(5,7,19,22) f2 : (A,B,C,D)=(7,22,5,19) Differential Analysis for Stream Ciphers A differential of a stream cipher is a prediction that a given input difference (it can be the key, IV or internal state) produces some output difference (it can be the keystream or internal state) Differential Property of f2 Suppose that 31st bit of input is activated. W, W ? E31 9 bits of output from f2 function will be impressed by E31 The output differential of f2 function is determined bit by bit. Differential Property of f2 Theoretically: Shannon is a RNG, therefore the output bits of the Shannon are independent The output is generated by the output of f2 function the differential output bits of f2 function are 32 bit word ?M (i.e. 0from Table ) with the probability of Another Differential Property of the f2 Function ?M[t] appears as an input differential for the f2 function in the next time (t+1) Attack Scenario vt?vt=?t Differential properties of the output Differential Fault Analysis (1) By applying ionizing radiation, microwave radiation or some other environmental stress Occurs with reasonable probability Occurs in a random position If occurs in the suitable position, a special pattern will be appeared in the differential outputs Differential Fault