Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/417 Thanks!
So hello, good morning.
I know it's 4:00, but I still felt this
morning, and
I'm very happy to be in Himbo ATCC
to talk about Krypto again.
So talk about a project called SESAR
that's project initiated by by GIBI about
new finding new cryptograms.
I don't know how many of you have heard
about the competition.
Yeah, quite a few.
How many of you have heard about Norks.
Yes.
That's good. That's good.
So the thing is, Norks
may or may not be the the future
of authenticate and encryption, but
anyway, SISA will develop will select
the future of authentic encryption.
And we also here to convince you,
because we hear a lot about encryption,
ATCC, about how important it is to
protect your privacy and so on.
So we hope to convince you maybe to just
stop using encryption.
And do you think the encryption instead
of encryption?
So Philip will start with an
introduction.
The very basics, no many questions, no
matter what premise, and then will give
all the details about these two guys.
OK, so who are we?
We are a team of three people.
You've already met Philip.
My name is Philip.
And there is a third guy who
unfortunately cannot be here,
is not here today, Samuel, but I'm sure
he's watching the stream.
So, Samuel, um,
so and I want to start
the talk with a quote from a
cryptographer, Matthew Green.
And he said, Nearly all of the symmetric
encryption modes you learned about in
school textbooks and Wikipedia are
potentially insecure.
So this is a quote from
one of his blog posts about choosing
authenticated encryption modes.
But before we are going to dove
into authenticated encryption, we will
see what he meant with this quote.
So question to the audience,
what should not miss in any talk
about symmetric crypto?
Yes, I heard it right.
That used to be Penguin.
So most of you have already
heard about it.
What is the problem here with the ECB?
Moad ECB is a block for mode
where you that you can you you
plug in a block cipher and you can use it
to encrypt multiple blocks
that are then compose your message.
Um, but ECB mode
it does it block y so you take the first
block, put it through
your blocks for the next, the next
block and so on and so forth.
So when you the problem here
is when you give the two
same blocks to the block cipher you
will get the same uh
ciphertext.
And what that results to
you can see here very, very well.
You can still see the shape of the
penguin at this point.
I also want to thank all Bettini
for doing all this great
pictures.
He's also somewhere here in the audience.
Um, so but he did
not only do this picture, but also the
next one.
Uh, this is the CBC mode, which
is also widely used today.
And the problem here with CBC mode
is that it takes in, uh, and
so-called IVI and initialization
vector.
Uh, but the thing here is when you
encrypt, uh, your
message or two messages with the same
IV, then you might also run
into problems that you
can see here. For example, the
left pinguin here is missing one,
the left eye and the other the right eye.
And when you encrypt both of them, you
get perfectly fine ciphertext.
But when you throw them together,
you'll see that the first.
So the head of the penguin where
no differences are, are encrypted
to the same ciphertext again.
So what's really important for CBC is
that your IP is random
and this especially means that it
cannot be, uh, counter.
So as soon as your V
is predictable, you also run into
problems.
The next mode here is Khyam
or mode or counter mode.
It also uses a N.
This is something quite
similar to an initialization vector,
but it has to be just unique.
Nunc means no used once
so you can use a simple counter.
But again, when you use the same
counter and keep here to encrypt two
different messages, you also run into
problems because you get to
cipher text and you throw them together
and you suddenly end up with getting
information about your plaintext.
Can also see it here again with
the penguin on the bottom.
So when you sort of them, you don't see
anything. But then you can again see the
shape in some sense of the.
So these blogsite remotes, they were
designed in the 70s
and they were meant to be used
with the back then brand new Deetz
algorithm.
So there were a bunch of
those blocks for modes.
It was SBX
and C TTR and the
Goldsworthy's blogsite promotes.
There were, in some sense, a little bit
different from what we want to
from what we expect now from
cryptography.
So famous quote from
one of from Bruce Schneier in his
book, Applied Cryptography from nineteen
ninety six is a third consideration
is fault tolerance.
Some applications need to parallelize
encryption or decryption, while others
need to be able to preprocess as much
as much as possible.
And still others.
It is important that the encryption
process is able to recover from
errors in the ciphertext stream or it
dropped or edit bits.
So the concern of the time was
error, propagation and also how to
recover from those error propagations.
This is something that you don't expect
from an crypto algorithm, right?
So.
The thing that people somehow
don't had on their radar was a term
called malleability or
in German form, Buchheit, this
means that an
attacker that is intercepting
ciphertext passages, cipher text
messages, can somehow modify
these and then also modify
plaintext in some predictable way.
We already saw this for the ECB penguin,
where you can basically
the order of the the how
the blocks are encrypted is not a part
of the encryption process itself.
So you can rearrange or even replay
blocks or you can also replace
entire blocks without that,
the communication partners.
So the true communication partners will
ever notice.
The same problem is also with Keitaro
of remote, which in some sense
generate the ciphertext in
a streamside profession.
And you can do bitwise modifications
to also change the plain
text at the same positions.
Also, the CBC that we were already
talking about has
some problems because in decryption,
when you change one
ciphertext, you can predictably
change the next plain text, which
is also bad.
So again, the
two communication partners, they have no
way to detect if somebody
fiddled with the ciphertext on the
transportation way, then
there are other problems like Chozen
Boundary A, they also apply to some
of these modes like CBC, CBC or
CFP, which can be
used to decrypt messages.
Bye bye.
Bye bye bye.
For example, there is a paper called
Here Come the X or Ninja's, which
show which shows how
to decrypt encrypted
cookies that were encrypted with a CBC.
And this is also the issue because
of these partial
chozen plaintext control.
So what you really want to have is
authenticated encryption.
Um, we
already saw two days ago a very nice
introduction about I.C.C..
And unfortunately, I don't have
a clock example here, but I will
try to do my best to convince
you or to explain authenticated
encryption to you.
So what is it?
Imagine you have an algorithm that is an
authenticated encryption scheme and it
takes as input a key announce and a
message, and it uses
the key to the nonce to encrypt
the message to a cipher text and
authentication text and
the ciphertext.
It protects the confidentiality
and the authentication tech.
It protects the integrity and
authenticity.
So authenticated encryption is basically
the when you as
you already said, when we when we are
talking about encryption these days, we
usually mean authenticated encryption,
because once you send
data out over an unprotected
line, you want to also make sure
that the data is not
modified along the way.
So and this is what authenticated
encryption is needed for.
And it is used in many, many
protocols, IP addresses, tools
and so on and so forth.
And then there is a second variant, which
is called authenticated encryption, with
additional data
where you take
a message, but now you also have some
additional data as an input,
which is here symbolized as the
age.
And this data, again,
goes through the through the
year scheme and the cipher text.
An attack is produced.
But now the tech not only
protects the site, the message,
but also the header that
the header is communicated
in clear over the line.
So this is, for example,
important when you want to protect some
parts of your data.
That needs to remain clear.
For example, some routing information in
IP and IP packets.
There are a bunch of ways
how you can realize authenticated
encryption.
The first is so-called generic
competition.
And what you do here is you take
a symmetric cipher like a block cipher
in a certain mode, and you use a Mac
with a message authentication code
and you combine these two to form
an A or a
deconstruction.
And there are three ways to do it.
It is the three are encrypted
Mac Macs and encrypt and then Mac
encrypt. And Mac is basically you encrypt
plain text and you make your plain text
and then you send both along the way.
Mac then encrypt is your
first Mac, your plain
text, and then you encrypt the
Mac and the and
the plain text to form the ciphertext.
So the the text is
a part of the ciphertext which
lets led also to some problems.
And the third one is encrypt
then Mac, where you first encrypt your
plain text to the ciphertext and then you
compute the Mac over the ciphertext.
And over the years
it was shown time
and again that the first two options
are not good.
So don't use them in your applications.
Use encryption Mac when you have to use
generic competition.
And examples of such constructions
are for example, is one hundred twenty
eight CBC plus H.M.S.
two fifty six and Choucha 20
plus probably thirty five.
Another way to to construct
aid aid schemes
are dedicated methods, so
we already saw blogsite remote
way that enable you to
encrypt multiple
blocks with a block cipher.
And there are also blogsite cipher modes
where that transform
your blocks effort into an authenticated
mode. So you don't need a separate Mac
for it.
And four well-known
variants are AKM OCB,
an ex, the first to schemin
GCM are those that
were standardized by NYST and
GCM is the one that is
mostly used these days.
But both of them have minor issues.
J-P will later tell you a little
bit about that.
OCB is another block of integrated
encryption block for Mode, which is very
nice, but unfortunately
it is Paternot
and.
In recent years, the patterns
were somehow weakened a little bit.
So for I think for open
source software, you can use stuff
without problems, know the military can
use it for free as long as
you don't use it for military.
And I don't know what.
And the fourth one is yes.
Then there are other possibilities
where you basically have just
one primitive. So it's some kind
of mixture also of usually
it's a mixture of a streamside four plus
a mech.
And for variants are grainne
one hundred twenty eight a which was
for Grainne one hundred and twenty eight,
was a finalist of
the second last crypto competition
that Ustream project.
Then there is Helix and Felix and
Hummingbird one or two.
But the last one is the last
two are broken.
And a very new
way to construct ADR
schemes are response functions.
We will also see later what this means.
So but also using
authenticated encryption modes is not
without risks, so you have to
nevertheless be really careful
what you do with your scheme because
otherwise you run into problems.
So, for example, in the
case where you have this generic
competition where you combine a symmetric
cipher and a Mac,
it's not so easy to get the interaction
between those two primitives.
Right. So, for example, for
the Mac then encrypt
option, there was time and again,
it's the variant that is used in tools.
And there was time and again, there were
problems due to this Mac then encrypt
option that was used.
For example, if they would have used
encryption, Mac, then probably most of
the problems that we saw in the last
years would would have never been
a real problem.
So another thing is that we
already saw that SCM and GCM
are the only two real standards
out there that were standardized by NYST.
And if those two
variants do not fit your,
for example, for your product or
something, then often people invent
their own schemes and ciphers,
which is obviously also not the best
idea.
Then there is another thing
which is called misuse.
We also saw that in the very beginning
when you, for example, use twice
the same Nunc to encrypt your
encrypt your data, then
you can all run in these problems that
you showed you in the beginning, for
example, with your remote.
And then there are also bad parameter
choices, which, for example, also apply
to GSM.
J-P will also tell you about
that in a few moments.
And this led to all kinds of problems,
which all I'm sure have
heard about.
So what are those problems?
Let's have a look.
I probably don't have to say much about
that.
It's the Oracle ATEX
it was.
It was invented by a search
warrant in 2002
and it targeted the Mac then encrypt.
Remember, this is the Batmobile that I
explained earlier from the genetic
composition, and especially when it is
used together with CBC mode,
because you have some weird interaction
between the the the
cipher, the authentication tag
and the padding that is used to fill up,
uh, uh, blocks
that are not the same size as
the block size of your block cipher.
And in 2002,
people thought, yeah, OK, this is a
theoretical attack and
we cannot use this really to to
it against anything that
is in production.
But in 12 years,
from 2002 to 2004
14, it was repeatedly exploited,
for example, to mount attacks until
you've all heard about Beast
and Lucky 13.
And the latest variant is also depicted
here, its poodle, the padding
or on downgrade legacy encryption,
where you can attack
SLV three and Tlas,
basically.
I guess about this, you also have
already heard a lot, it's an attack
on the WP standard,
which is was used to
protect your Wi-Fi connection.
And in 2007, some
researchers.
Presented a key recovery attack where
you can within minutes really
decrypt the entire key stream
by reconstructing the secret key
and it exploits biases in the RC
four streams over that is
used there.
And then after
after a while, there was a tool which is
called and and everybody can download
that and correct their own.
Yeah. WI fi connection.
So try this at home,
then another attack
in to the 12 and 13
also targeted hours before where
so-called biases were detected
in the in the in
the ciphertext three.
I mean, it was already known that RC
four is not the best streamside
for out there, but
there in 2013, they
really showed. Yeah, you can really use
these biases.
So these are the spikes here in this
graph
to partially decrypt
a stream that is, for example,
encryption was used in Tlas
to decrypt your data.
So and another attack
on our CIFOR was just from this
year, where Kenny Patterson
from the University of London tweeted,
Folks really need to stop using our C4
we just broke and other
RC dependent system, which is called
high from next week's attacks.
So hiw is a hidden
volume encryption system.
And it was some in some
sense perfectly fine designed and also
came along with a with a security proof.
But the problem was that they were using
for the sort of random number generator,
the RC, for a strange cipher, and
that enabled the people
around Kennyi Pettersen to mount an
attack on this hiw system.
Yeah, so but who cares
about security when
our C4 is fast and swift?
Right.
So this is from this year's
keynote from Apple where they showed,
yeah, swift is the best and fastest
language when you use it with AC4
encryption.
So and now we will
see a bunch of things, what the crypto
community came up with to, uh,
somehow get rid of all these problems
that it was talking about earlier.
All right.
So I think it's pretty clear that we need
better ciphers.
And some people started to do something
about it. It's called SESAR.
So CCRC Crypto Competition is stands
for competition for authenticated
encryption, security applicability
and robustness.
First of all, what is a crypto
competition?
So you may have heard about a yes in
the 2000 Shastri
2010 around this time.
The concept, it's pretty simple.
So you are going to an organization, you
want to find a new cipher and you
hash function and you block cipher and
you don't have much time. You're not a
crypto expert. So you will ask people all
over the world, you guys are the expert
and you will work for free for us.
You will create your own cipher.
You will submit it to us.
Typically, we are honest and trustworthy.
So academics, people
from industry, people from government,
they walk maybe one year to
several teams of people.
They create a new cipher from scratch
specification and it is like
100 pages document.
And they do this for free from
the organizers and then
it publishes the designs.
And now everyone tries to break the other
guy's candidates because your incentive
is to want to win.
So you need to break the others like a
demolition derby.
And at the end of the competition, before
the end, the organizers, they maybe do
some shortly, some round of selection,
like we have 50 candidates list down
to 30, and then between now and then and
then we pick one.
So that's the idea.
That's how we select and that's how
she was selected.
And it was very well, because it's
completely transparent.
Everyone can contribute security,
analyzes implementations,
and this is much better than obscure
things like some other countries are
doing.
But that's the thing with SESAR.
So typically the goal is to replace
some old send on a yes was missing this.
She was replacing Shewan
and landing Shatto and she's
always about replacing
or doing better than a years GCM.
So GCM is essentially
the single authentication encryption
standard that we have.
So it's a yes, GCM stands
for Gaulois counter mod.
It's a mode where you do essentially
Niasse. Yes, counterparts.
And in parallel to this, you do some
putting them on multiplications
over a to characteristic to feel
and you compute an authentication tag
that depends on all the blocks that you
have processed.
So I will come back to this in the way we
want to be able to do better.
And GCM, some
details on CCAR.
So it started 2014
and March. Well, actually for scimitars,
it started one year before because they
published a call for submissions 2013,
but submissions were published
this year.
You can look them up online on this
webpage and it's
expected to finish in 2017.
So before that, there would have been
several rounds of selection.
I think the next one is of should
do fifteenth of January.
So it's initiated by Daniel Bersin.
We're a committee of twenty two
cryptographers and it's sponsored
by Nyst.
But this is not concerning the thing and
this is just giving the money.
So the winner will not necessarily be a
new standard.
Then this might care about what is going
on. But it's not
US government competition.
It's the Mensing.
All right, GCM.
So like I said, is use everywhere it's
in. These should be of ethnicity.
You may have heard about this recently.
And the use of a yes is
one of the.
For specifying in these special
publications, since using some it's
standard for Pisek deserted
SNH, only a few
items, not as well.
So it's already has the monopoly of
to get encryption.
So what's wrong with GCM?
One thing is that
if one of your cryptographers, it's a
necessary complex, it does
that the operation and use some
and multiplication and you can do
the same thing, the same, the same
functionality without using this
relatively complex mathematics.
So it's fast if you have a set of
instructions, if you have your
intel in the chips, you have this.
Yes.
And I say things that make a considerably
faster than normal implementation.
But if you don't have a hardware
accelerators and it's much, much slower,
so nothing is performance.
And also another issue is
sensational. And timing leaks
because if you don't have hardware
support, you want to have a fast a yes.
And typically what you will do, you will
create a huge table lookups.
And instead of doing the textbook,
yes, you can make a run by
doing essentially a few table lookups.
And as you may know,
this may lead to timing leaks and
eventually to recovery, depending on
on your model, on the attack capability.
Nothing is really talk about Misuzu.
What happens if you reuse the knowledge
that you're not supposed to use?
So what happens in HCM is that you
can recover the authentication key
to the thing, the secret thing that is
used to authenticate your message.
If you find this guy, then you can forge
watchdogs and you can compromise
authentication completely in
some cases.
All right. So what I talk about GCM.
I didn't talk about A-s yesterday.
People saying NSA is compromising.
Yes. And you've seen this
small screenshot.
So as far as I understood, I'm
I don't have access to the Snowden stock.
But my understanding is that this is an
undergrad project proposal, something
similar in terms of NSA
about applying some
very old statistical
techniques to.
Yes, but it's not a billion dollar
project aiming to break the record.
Yes.
And actually, it's no surprise that NSA
is trying to do understand or
to break. Yes, it's
part of the job. And I expect them as
well to try to break Shastri to
understand how securities and they're not
the only one to do this.
Academic researchers, every year
they publish very sophisticated research
where we get new insight about how
yes is working.
And what we get out of
this is that we better understand why a
yes is secure.
So the bottom line is, don't worry, it's
not broken.
Implementations may be broken, but the
algorithm,
it probably can be broken.
And that's my personal opinion.
So let's go back to Caesar.
There's has been exactly 57 submissions,
so it's less than three that received
the 63 or 64 submissions,
but many more than
than, uh, yes.
Well, they were only 15.
So one submissions.
There's acorn ey ey ey
ey ey ey ey C.A.C.
ey ey Escobar,
FBI, Shambu a yes or
a Z Artemia asking to
see the offices and
so on and so forth that
you might have heard the the what a yes.
And several times some e-mails
that a couple of those are based on the
block cipher and just
a submission of a mode of operation
that the proposed insensate with the
cipher is in some cases they do
some modifications to where.
Yes, but it's also espace.
So the motivation obviously here is to
take advantage of the high speed of a yes
in mainstream CPU's.
I think I counted yesterday.
That's approximate twenty five
submissions.
That use was a yes or some variant of a
yes.
Intisar towards the others.
Uh I don't know,
mambo kitty shall use.
I don't know how, how
are they working. But there is a
new block cipher created from scratch
or some, some sort of cipher
that uh has this authentication
feature or something
based on the function.
That's what Philip mentioned before.
I'll this punch function in exercise.
So how your day?
So some people have already tried to
break them.
We counted certain that have
been meaningful compromise.
And five, for which
imperfections or a little bit more
imperfections have been found
and thirty nine for which no
flow has been published.
So it doesn't mean there is nothing at
all but that nobody.
Nobody published it, so we see that
there's this guy Norks in blue.
So fortunately for us, it's not been
broken yet.
I'll try to convince you that it's
secure.
All right.
So before is any Norks I created,
um, which is a lot of people hash
function called Blak.
It was one of the finance industry.
And every time I presented Blake,
I talked about it. People had only one
very single question.
It was.
Why the name Blake, and it
was ridiculous because there was no real
good reason, but here I'm happy to to
have some explanation behind the name
Norks.
It's actually comes from not a
X.
So where does it stand for audition
or date X or it's
a type of cryptographic algorithm
where you just use this person.
So integer audition
rotation, of course, and XOL, and that's
sufficient to Brexit to make something
that is unbreakable
in terms of complexity or it's universal
so you can implement any function and any
computable functionality
using this for provisions.
Why did we choose to not
be IREX that we removed the
AI? You remove the addition.
So we use the with zero and only
bitwise operations.
So logical and logical all
there is, and it's not that that is
intrinsically more secure, is that it's
just easier to analyze, it's easier
to find mathematical results.
For example, for example, bones under
security, quantitative bounds
on the security of the cipher.
It's also much simpler to implement
in low. And Sebou is if you have like
eight or 16 resistors,
you don't have to care about the carries.
And it's much simpler to implement in
hardware. You don't have to
do is others to choose the right type of
others much more simpler in terms
of implementation.
All right. So what were our design goals?
So like in every engineering project
before starting doing things, we think
about what we'll be doing, what the
what's the objective?
So when it's safer to be secure,
obviously the most important criterion
to be fast in our platform.
So we did optimize specifically for
this model of cheap or for this
specific FPGA.
We want to be constantly fast across our
platforms because we want to be use
by any by any user
simplicity.
So people are sometimes impressed when
it's complex. We have a lot of questions
and great letters and stuff.
We want to make simple things as simple
as possible with the specification
or the code.
And we want people we're not experts in
cryptography. Why not crypto PhDs
to take this back and to implement it
in maybe one afternoon?
Simplicity also means some notions
of symmetry in the sense that if
you look at the NOx encryption and
the decryption, it's almost the same
function. You have just small tweaks,
but you don't have to implement something
completely different if you want to
decrypt or encrypt its
online one pass. So you have your data,
you process it once.
You don't have to process it to one for
encryption and one for indication.
I think the data
scalability in terms of prioritizing
horizontal scalability and
running credulity,
it means that unlike a yes, we don't have
a Slowikowski, we don't know where cycles
expanding the key and then starting in
the expanded Glenton,
we just inject the key very simply
and we try to minimize such analytics so
we can only do so much on the algorithm
level. But we try to make something
that is easy to implement in
Constantine, for example.
All right, so this is not
a single cipher. It's actually a family
of ciphers with a few parameters,
a few dimensions, and you can tune this
parameters to find the instance
that best suits your application.
Obligation to the first parameters is the
world size dimension to what size
32 or 64?
32 typically means that you will,
uh, make sure to be a tradition
started to be exhausting.
But obviously you can use to version
on a 64 bit CPU and the other way
around like
minutes in May, say first you can to the
number difference, the degree
of partizan.
So how many calls
do you have available for Knox
in order to take advantage
of your sleep? You can feel the taxes.
So there's a huge design space
for Knox. But for the sake of of
Caesar, we only submitted a few to
exactly five proposals.
We have No. 64 bit.
Also tidbit with four
rounds or six rounds
and one DeQuan one.
So when the Burzum degrees
one, it means it's completely surreal.
And you might ask the question, why did
you choose to have four hours and six
rounds?
I have no simple answer to this, but
let's say that we make we try to break n
we try to break one.
We're on around. And it's
a trade off between security, margin
between security and
efficiency.
All right.
So we have a version with 128
bickie or 256
bit.
So the demo is essentially
what we call a domain
extender.
In other words, a combination
of the core function to process
input a viable size from something
that takes input of fixes.
So here we have this function f
like something of a fixed size
and we combine it with it in such a way
that we can process messages of any
reasonable size
is derived from the response
function of shock, which is now
Szary and more specifically
what they call the monkey duplex and ask
me why we chose this name.
But the idea is to take a hash function
model and modify a bit so
that you can make an order to get a
cipher out of this hash function mode.
Yeah, if it's extremely simple, you
have this function F, which is a
permutation, so that's an input.
You transform it in some complicated
way and it creates something
of the same size and it is a permutation.
You can invert it.
It's hard to insert a bit contradictory
because you don't want to invert
things, materials.
That's really what we need.
So you see a bunch of examples.
What we're doing, we're inventing,
injecting the message and injecting
parameters.
So the message injection is very
simple. You just ignore the message.
Here is speech, for example.
You just up to the state and then you
transform the state at some point, which
or H which is the header, for
example.
So something that's not encrypted, we
inject it to the state. It would modify
the state, then you would get
a different state.
So all this is about
modifying the state in such a way that
you get something that's secure
for for some definition of security.
So I don't give all the details.
You can look like in the paper,
in the current mode,
it's essentially the same.
So you you Auxilium messages to
the state, you get a ciphertext
out, but different.
You have two branches in Portland that
are completely independent.
So like if you have to sepulchers,
you can own one branch on the turf, on
the first call and the other one on the
second go. And if you have 50, 60
course, you can make Sixten branching
in parallel and then optimize the
efficiency through
NOx. It's really about transforming a
state using a permutation.
So state is just a string of
bits and the string of bits
is seen as 16
words of either 32 or
64 bits.
And we view this array of words
as a matrix of four times four
four typed on four words
that might remind you at times to remind
you that at 20 your child
Cobbly two and we
have two different types of words.
So the words where we will inject the
message, which are the blue words here,
which we call the right words and
engrain the capacity words which we
never touch.
So if an adversary you can control
to some extent the blue words by choosing
your message words, but you can't control
the the green words.
And that's where the security comes from.
Simplify things.
The more green words you have, the more
capacity. Once you have, the more secure
in theory is the algorithm.
So we didn't make this was operating
capacities, external terminology from the
functional literature to
our two versions. The state is of
either fibrin 512
bits or one key.
And you said the right is adapted
accordingly.
So it's been you how we transform this
state to encrypt messages into
it and to get messages.
OK, so we already met
this guy.
And what you haven't seen
yet is that there are I mean,
he mentioned it, but there are a couple
of different faces, how the algorithm
works. And now we will have a look at the
different faces.
The first one is initialization
and it's in the Red Square over there.
So let's see how this works.
So at some point, you have to do
something with your secret key, right?
Because we have a symmetric key
algorithm.
And how it works is you take your
four by four matrix and you load
your key and the yellow part here.
OK, that's all the nonce,
the number used once that you need to
increase with every message that
you encrypt is
loaded into the green part and
the blue part. These are just constant.
Nothing else.
So and what else do you do after
you've loaded those basic
elements is you integrate
somehow your parameters into the initial
state because you want to make sure
that you already saw that Norks
is a huge family of cyphers
and you want to make sure that each of
each instance of such of
the family produces a unique
history.
And for this, we use the parameters to
and integrate them into the first
into the first state.
Because afterwards, when we transformed
the state, we ensure this way that
that the key stream that is produced
afterwards is really unique.
And the final step in the
in the initialization is just you apply
the round permutation after
the power of our.
This means just apply
the function f r times.
OK, this is the notation for that
to the initial state and you get a
new updated state here again.
So and this was the first
version of initialization.
But you see here this parameter
integration is a little bit
kind of a mess.
So we decided we make it much more
easier and now we integrate
the parameters just on the
lower row of the matrix.
So this is basically the same, but
the parameters now get integrated
into the initial state.
And in another way and
again, the final
step is also here.
Apply the round permutation.
So and that's it.
That's initialization.
The next part is absorbing header or
trailer data. So usually
authenticated encryption schemes that
they support additional data
and additional data here means usually
the support header data.
So which you usually process before
you process your ciphertext,
your plaintext. Sorry, but
in some protocols it's also useful to
have also a trailer which you
can somehow process
after your plaintext.
And Nortel's here these two phases
first for the header and then for the
trailer again and the red squares,
which basically work exactly
identical
except for a small constant,
which is called the domain separation
constant.
So the domain separation contents,
which is here 01 or 04.
And Hex just says,
OK, now I produce.
Now I absorb header data, which is the
014 or I
absorb trailor data, which is the
zero four four.
So after you have absorbed the
domain separation content, you again
apply your own permutation.
This is the middle part.
And then finally you take your
header or trailer block.
This is here, the yellow part and
exhausted on the blue part.
And what you get is the orange part.
And here you already see the important
thing is that the green part is not
touched by the data processing.
And that's it for headend trailer.
How to encrypt payload is
the in the middle here.
This is basically, again, very
similar to absorbing header and trailer
data. But now the domain,
uh, separation concept changes to
a zero two.
Then you apply again the the round
permutation absorb
your data.
Again, here, the message is now
the yellow part.
But what you also do is now you extract
your data, which is now the red part.
And you said this a red part
is the new ciphertext block
and that's it.
And the final the final
step in in your
data processing is to generate the
authentication tech.
This is here the last phase.
And again, you X or in
a domain separation concept, then
you apply the round permutation twice
and extract a part of your
state, which is again in this red part
or in the in the green blue
part that I showed you before.
And that this is tech here.
We usually use the first four words
of our state to set as tech.
So what I now you somehow
got a feeling how the the
mode itself works, but what I haven't
said yet is how does the permutation
work the after the power of our and
this basically transforms the
state. So one application of F transforms
the state into steps.
First, a column step.
This is here on the left and
where you apply a function G
onto the columns and then you
use the same function t afterwards to
apply to the to the diagonals.
So the chief
function is the
real core of our algorithm, and
it just as we said before, it's
not ARC's construction where you
use logical bitwise operations.
And you see here the eight
steps that are done in one application
of CZI and you see the H is
in some sense the the nonlinear function,
then the green one, the
ROTC.
There is a rotation.
Right.
You can see it here on the bottom where
you just use you rotate your
word to the right by a constant
R zero.
Then you do again the nonlinear
operation, a rotation, nonlinear
operation rotation and so on and so
forth. And the only thing that differs
here is that you use four
different rotation operations for
different rotation offsets.
OK, here, the red ones
and depending on the word
size, they also differ.
So for 32 bit, it's eleven, sixteen,
thirty one and four.
Sixty four. But it's eight.
Nineteen forty, sixty three.
And that's it basically.
And the here the the H
function.
This is the function that replaces
integer addition. OK, just to be clear
here.
So as we also already
mentioned, the properties
of these permutations, they were inspired
by Blake, too, and the Austrian cipher.
And as I also said,
the age replaces
integer addition and
in fact, it's almost an integer
edition. So a funny story here
is when we designed this permutation,
this core permutation, we
went along and we
already knew we wanted to somehow replace
integer additions, but we we didn't
know what to use.
So we used really, really many
bitwise logical operations and tried them
out on the cryptographic properties.
And at some point we were frustrated
because we couldn't find anything that
was really good for our for our purpose
until I think it was Samuel.
He came up with this
H function, which is basically
an approximation of integer edition.
So what he what he did is he found in an
old notebook, he found
this equation for
Integer Edition.
And you see it's X, X or Y
plus is here again, Integer Edition.
And then this part here.
The non-linear part in all that we did in
our function is just replace this
plus by an XOR and
suddenly there's also had very nice
cryptographic properties.
And so we went with this.
The nice thing is, as I
said, it is only bitwise operations you
have you don't have to worry about
KARIUS. You also don't have to worry
about lookups
in iceboxes.
It's easier
to get Konstantinov
operations out of this.
It's very hardware friendly and it's also
software friendly because of these, uh,
the layout of the functions.
You if you remember, you have four
parallel applications of each of the
columns and then to the diagonals,
which is very good for for software.
So the great question, of
course, is, is north secure
and here the main threat is
a technique called differential
cryptanalysis.
I won't go into the details here,
but it's basically the first
type of attack every cryptographic
primitive has to somehow
be resistant against.
And we did a lot of experiments
in our evaluation of the cryptographic
security of Norks.
And we found here
that for one round
there are characteristics which you
somehow can.
It's an analogy for these biases.
Remember this RC four picture where you
have these spikes and basically
a characteristic is in some sense
one of those spikes.
OK, and in one round of talks
only, there are those
biases appear with a probability
of greater than two to the power of minus
sixty four.
And in the 31 troubador version
and with a probability of
greater than two to the
power of minus or three in the 64
bit version. So there are no
characteristics that have a higher
probability than this.
And in four rounds
we found characteristics that are even
more insane, which have a probability
of two to the power of minus five hundred
eighty four and in the
two bit version and probability of
two to the power of minus eight hundred
something, which is really you
cannot exploit that.
And what I also want to mention here
is that in order to
find an attack on Norks, you
somehow have to get through
the initialization and
the initialization here uses at
least eight rounds and we already saw
that already for four rounds.
There are the probabilities of those
biases are really, really low.
So we are somewhat confident that it's
really hard to find good characteristics
or differentials in the initialization.
And also
kind of recent results there are
where we found out that the
the parameter choices that we had
were very conservative and we
even could trade some of those
capacity words, the security words,
to get to some rightwards,
to get a 60 percent speed up.
So this is also
included in the security margin
of Norks.
All right, so less than 10 minutes left
before concluding Michael must
have a very boring assignment.
My daughter is asleep.
I'm sorry. I must have brought everyone
in there. But amazing.
Very quickly, performance
on the next 86 in 64
with my Tipu as
fast as five hundred and ninety
three, maybe bytes per second.
So, Ben, one more than one
gigabyte per second.
You have the clock cycles figures here
is for the optimized implementations,
which means the one that you are
affixed to insertion extensions
or internship's.
What is great with NOx is the
reference code. So the simple portable
easy to read record is not
much lower than the optimized one on the
first case. On the left side, it's about
50 percent lower and about 80 percent
slower on the VIX to you and your husband
machine.
Yes, it's very different.
So in our platform.
So in the eight, which is
a non V seven architecture CPU,
it's about one hundred maybe bytes.
So the frequency is just one
gig. It uses the neon,
uh, the extension.
What is surprising here is you look at
the the A7 from up from the
by this number, the eight architecture,
the Fuster code is not the neon God, it's
the reference God.
Why. Because they have four parallel
integer arithmetic units
and this makes the code a little
bit faster than the neon God.
Uh, so how does NOx compare
to the other Caesar
constants?
So each column here is a
machine, a difference if you,
uh and the colored boxes
are NOx instances.
So you see that in many cases knocks on
the top in a couple of cases
noctis in the in the middle.
So these are the machines that have a set
of instructions and basically
that are much faster than us.
But so is not only very fast
compared to the others where you don't
have a yes instructions, it's
also the fastest sponged Bashkim.
It's even faster than the submissions
are based on get stuck in most
in most cases.
And like I said, the reference guide is
about as fast as the optimize one
if you compared to a year GCM that I
mentioned before, HCM
Reference Guide versus optimize code
and not reference God Rossotti.
Moscoso in some cases are a reference
guide is even faster
than the optimized.
Yes, GCM.
We do the opposite of Russian,
uh something similar on, on, uh
platforms from different regions.
Um so we see that for a yes you have to
work hard.
Right. Assembly use hardware accelerators
in NOx you can take the portable easy
to read God and you get competitive
speed.
We have another implementation.
So not a not just a simulation
and uh, in software but an actual chip
that was made by our friends from it.
So thank you for our connection.
And we students, uh,
it's been done on,
uh, um, see nanometer
Chip and Knox.
It goes up to about one hundred twenty
five megahertz and the aurora is
approximately sixty, sixty eight
which is good, which is.
And what is
this performance figures.
It reaches a throughput of
then gigabits Rustigan
which is much more than you need in any
application.
It's time to conclude.
So first, maybe if you've
said for all the talks, you may want to
remember that CSR is a new crypto
competition that started this year,
really did that in seventeen.
Oh, it's about to get an encryption or
dedicated deciphers and
there's been fifty seven submissions.
So in a few in a few weeks
they will submit, they will publish
the second round section.
So I don't know how many will be
selected, but it would be interesting.
You're going go to the official webpage,
to the non official Web pages and
some uh, personal blog.
There is another competition called See
about rushing with the URL
here.
Um, finally, the NOCs.
So it's a candidate in the
competition. I mentioned before
the main post about noctis.
Uh, it's quite innovative.
It's ARC's in a different way.
It's Producible was the
first one on purchasable.
We tried to minimize such and such
and leaks.
We don't need you to have a yes
instructions.
Obviously, if you're if you don't trust
NSA using this as a backdoor
yes. In some way, then
we don't use it. Yes.
Uh, it's straightforward to implement.
I think that I asked Philip why we don't
we need a better implementation and in
the couple of hours to get them to.
And walking, we have a website
now that I know we
have got available in C C++ go up
by the unrest.
It's completely free to use.
I don't recommend you to use it, but if
you want to use it is free.
There is no button, no, but an
application.
And our reference code is under zero
license. So which essentially means do
whatever you want with
one very last thing.
So we maybe will convince you that Knox
is the greatest life on earth, but
we wouldn't recommend you to use it
because we only publish it this year.
It takes time to gain confidence in a
or maybe it will be broken next week.
I don't know.
We're pretty confident, but really we
need to do it
a couple months or years before
it's been used in a very sensitive
applications.
So at least for now.
OK, so thank you very much.
Happy done some.
OK, so, Allan, thanks so far
for to speakers, we have
a few, maybe five minutes
left for questions.
So you have a question.
Just quickly line up at one of the
microphones and please be precise
and short.
So we'll just start with you.
I go, yeah.
Is it working? Yeah.
So I was just looking at your ABCs versus
Avista.
Uh, uh, difference there.
And I'm just sorry to interrupt.
If you're leaving the room, please
be quiet and maybe just stay for the last
four remaining minutes so we can have a
quiet Q&A session, please.
Yes, I was just looking at your ABCs
versus ABCs to, uh, implementation.
And I was the other day, I was struggling
with, I think, the same problem that you
were having, that the interviewer is not
the maybe X, which is completely dumb,
as we all know.
Um, but so I was doing
a B slicing of a cipher that shall
remain
and unmentioned.
But I realized
that actually ABC's original and ABC's
One has X or not.
And so basically everything I need
and I'm wondering why you don't have
that. So basically X2
is like maybe one if you all you need is
X or not.
Yeah.
And and or when
you're that extra would eventually come
out and when.
Well if not happens to be selected
in the suppose will have to on top
of X they didn't make much sense
to uh to optimize for a voice which has a
much more suited, I mean I
actually it's just an shit I'll send you.
It's a, it's a header file and basically
just use the ABC's OK one as
if it was ok.
OK,
OK.
So we'll do a quick question from the
IOC. We have one
because they can't ask it.
Person just go ahead.
No question.
Yeah, it's all
you.
I would be happy to take questions
offline anyway, so, yes, we can also
send us emails or via
Twitter or wherever you want
to
get the microphone is working just OK.
Let's just put it a little bit closer
to your mouth, please.
How many of these outside your team
have analyzed Norks for vulnerabilities?
How many?
Well, we only know the ones who publish
something.
We don't know the ones who did not find
anything.
But there's been there's there
was one work that we that we also
did together with some people from, uh,
from London, from, uh, and
where we basically showed this what I
meant before, that the parameters
are chosen very, uh,
uh, so that you can get a 60
percent speed up by trading this capacity
versus, uh, rightwards.
And this was basically done with
some people from somewhere where you
showed also security proofs for the mode
and so on and so forth.
I mean, targeted, uh, cryptanalysis
was not done yet by at least not
that we know of maybe is coming
something out in the next weeks.
Uh, so basically the results
that we showed until now were
our own that.
Yeah, that's it.
Basically, just
to my question is,
was the failure mode of Norks, if you
reuse key NIV
so you can keep the same
different plaintext with the same same
KNTV,
you know?
Well, if you reuse the the
the same I've, uh, you
don't recover the key.
But if you have two
different two different messages with the
same prefix, then you will be
able to figure out that you have the
same, the same prefix.
So it's it's a big security issue.
It doesn't compromise a cipher.
We try to minimize the compromise.
But, uh,
so what you basically get is you
can xor the ciphertext
blocks then and you get basically the
the X or off the plain text blocks.
That's what what's happening when you
uh, when you reuse key
and I v4 for two different messages.
So the failure mode is almost the same as
in the in the control mode.
Yeah.
So for uh for confidentiality,
how is this better than
you were asking will
this.
Because it is kind of like
OK, so we're just
one minute over time.
So we'll have to, uh, just stop the Q&A
session.
You're the two guys are gonna stick
around and are reachable via email.
So if you have remaining questions, just
let them know.
Uh, thanks so much for attending.
Please take your empty bottles with you.