Multidimensional Extension of Matsuis Algorithm 2

Miia Hermelin and Joo Yeon Cho and Kaisa Nyberg

Department of Information and Computer Science Helsinki University of Technology

FSE 2009, 24th February, Leuven Belgium

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

1 / 33

Abstract In the paper we studied different methods to extend Matsuis Alg. 2 to multiple dimensions. The efciency of the methods were compared by the advantage (Selcuk). This presentation will focus on the method based on the log-likelihood ratio.

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

2 / 33

Outline

1 2 3 4 5 6 7

Introduction Basic Concepts Multidimensional Linear Approximation Key Ranking Algorithm 2 Experiments Conclusions

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

3 / 33

Introduction

History - Multiple linear approximations

Matsui EUROCRYPT93: Uses one biased approximate linear equation to recover one bit information of the inner key (Alg. 1) or several bits of the last round key (Alg. 2) Robshaw and Kaliski CRYPTO94: Alg. 1 and Alg. 2 several linear approximations, obtain one bit of information of the inner key (assumes statistical independence) Biryukov, et al., CRYPTO04: Alg. 1 and Alg. 2 with multiple approximate linear equations (assumes statistical independence), recovers multiple bits of information of the key, success measured using gain Collard, et al., FSE 2008: Experiments of Biryukovs algorithms on Serpent

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

4 / 33

Introduction

History - Probability distributions of multidimensional linear approximations

` Baigneres, et al., ASIACRYPT04: Distinguishing probability distributions based on log-likelihood ratio LLR Maximov, 2006: Algorithms for computing large probability distributions of multidimensional approximate linear equations ` Baigneres and Vaudenay, ICITS08: Different scenarios in hypothesis testing Hermelin, et al., ACISP 2008: Multidimensional Alg. 1, using G-test and comparison with the algorithm of Biryukov, et al. Hermelin, et al., Dagstuhl 2009 (to appear): Multidimensional Alg. 1 with LLR and 2

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

5 / 33

Introduction

Assumption about statistical independence

Problem Customised special-purpose statistical test under the assumption about statistical independence of simultaneous 1D linear approximations

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

6 / 33

Introduction

Assumption about statistical independence

Problem Customised special-purpose statistical test under the assumption about statistical independence of simultaneous 1D linear approximations Our contribution Use of LLR (optimal distinguisher) and other known tools and no assumption about statistical independence

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

6 / 33

Introduction

Computing the multidimensional probability distribution

Problem Computing large probability distributions needed in the multidimensional attack

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

7 / 33

Introduction

Computing the multidimensional probability distribution

Problem Computing large probability distributions needed in the multidimensional attack Our contribution Use Cramer-Wold Theorem (1936) for computing efciently the probability distribution Only information essential to the attack is taken into account and probability distribution computed with smaller dimension

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

7 / 33

Introduction

Adding linearly or statistically dependent approximations

Problem Is it correct to use linearly or statistically dependent 1D approximations?

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

8 / 33

Introduction

Adding linearly or statistically dependent approximations

Problem Is it correct to use linearly or statistically dependent 1D approximations? Solution Theoretical justication for this enhancement

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

8 / 33

Basic Concepts

Outline

1 2 3 4 5 6 7

Introduction Basic Concepts Multidimensional Linear Approximation Key Ranking Algorithm 2 Experiments Conclusions

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

9 / 33

Basic Concepts

Boolean functions

Correlation between Boolean function f : Vn V and zero

c (f ) = c (f , 0) = 2n (#{ Vn | f () = 0} #{ Vn | f ()

0})

f = (f1 , . . . , fm ) : Vn Vm an m-dimensional vector Boolean function W = (w1 , . . . , wm ) : Vn Vm a linear Boolean function Wx = (w1 x , . . . , wm x )

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

10 / 33

Basic Concepts

Probability distribution

Probability distribution (p.d.) p = (p0 , . . . , pM ) of random variable Y taking values in the set {0, 1, . . . , M }: Pr(Y = y ) = py , y = 0, . . . , M , If random variable Y has p.d. p , denote Y p

uniform distribution
Let f : Vn Vm and X . If f (X ) p we call p the p.d. of f

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

11 / 33

Basic Concepts

Kullback-Leibler distance

Denition Let p = (p0 , . . . , pM ) and q = (q0 , . . . , qM ) be two p.d.s. Their relative entropy or Kullback-Leibler distance is
M

D (p ||q) =
=0

p log

p , q
0 and b log b /0 = .

where we use the convention 0 log 0/b = 0, b

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

12 / 33

Basic Concepts

Capacity

Close p.d.s We say that p.d p is close to p.d. q if |p q |

q , = 0, 1, . . . , M

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

13 / 33

Basic Concepts

Capacity

Close p.d.s We say that p.d p is close to p.d. q if |p q |

q , = 0, 1, . . . , M

Denition The capacity between two p.d.s p and q is dened by

M

C (p , q) =
=0

(p q )2 q

We denote C (p , ) by C (p ) and call C (p ) the capacity of p (cf. Biryukov, et al.). It is identical to the notion of squared Euclidean imbalance of p used ` by Baigneres, et al.

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

13 / 33

Basic Concepts

Log-likelihood ratio (LLR)

Independent and identically distributed data d1 , . . . , dN , di Vm , is drawn from p or q , p q
LLR is the optimal distinguisher between the two p.d.s (hypotheses)

Empirical p.d. q = (q0 , . . . , qM ), M = 2m 1, where 1 i = } are the relative observed frequencies q = N #{i = 1, . . . , N | d
We decide p if
M

LLR(q , p , q) =
=0

N q log

p q

and otherwise we decide q, where is a threshold, usually taken equal to zero

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

14 / 33

Multidimensional Linear Approximation

Outline

1 2 3 4 5 6 7

Introduction Basic Concepts Multidimensional Linear Approximation Key Ranking Algorithm 2 Experiments Conclusions

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

15 / 33

Multidimensional Linear Approximation

Linear approximation of a block cipher (Alg. 2)

. . .
z f y k

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

16 / 33

Multidimensional Linear Approximation

Linear approximation of a block cipher (Alg. 2)

Plaintext x , ciphertext y , last round key k Vl , all but last round key data K , last round function f , z = f 1 (y , k )

. . .
z f y k

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

16 / 33

Multidimensional Linear Approximation

Linear approximation of a block cipher (Alg. 2)

Plaintext x , ciphertext y , last round key k Vl , all but last round key data K , last round function f , z = f 1 (y , k )

Alg. 2 exploits 1D approximation u x + w z + v K with non-negligible correlation c

. . .
z f y k

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

16 / 33

Multidimensional Linear Approximation

Linear approximation of a block cipher (Alg. 2)

Plaintext x , ciphertext y , last round key k Vl , all but last round key data K , last round function f , z = f 1 (y , k )

. . .
z f y k

Usually one has multiple 1D approximations with large correlations: ui x + wi z + vi K , i = 1, . . . , m linearly independent base approximations

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

16 / 33

Multidimensional Linear Approximation

Linear approximation of a block cipher (Alg. 2)

Plaintext x , ciphertext y , last round key k Vl , all but last round key data K , last round function f , z = f 1 (y , k )

. . .
z f y k

Usually one has multiple 1D approximations with large correlations: ui x + wi z + vi K , i = 1, . . . , m linearly independent base approximations Q: How to efciently exploit them all?

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

16 / 33

Multidimensional Linear Approximation

Linear approximation of a block cipher (Alg. 2)

Plaintext x , ciphertext y , last round key k Vl , all but last round key data K , last round function f , z = f 1 (y , k )

. . .
z f y k

Usually one has multiple 1D approximations with large correlations: ui x + wi z + vi K , i = 1, . . . , m linearly independent base approximations Q: How to efciently exploit them all? A: Determine the p.d. p of Ux + Wz + VK , U = (u1 , . . . , um ), W = (w1 , . . . , wM ), V = (v1 , . . . , vm )
Multidimensional Alg. 2 FSE09 16 / 33

Hermelin (TKK)

Multidimensional Linear Approximation

From one to many

The p.d. p of Ux + Wz + VK and 1D correlations (a ) = c (a (Ux + Wz + VK )), a Vm are related as follows:

p = 2m
a Vm

(1)a (a ), Vm .

That is, p.d. is determined using 1D projections, a well-known statistical method due to Cramer and Wold (1936)

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

17 / 33

Multidimensional Linear Approximation

From one to many

The p.d. p of Ux + Wz + VK and 1D correlations (a ) = c (a (Ux + Wz + VK )), a Vm are related as follows:

p = 2m
a Vm

(1)a (a ), Vm .

That is, p.d. is determined using 1D projections, a well-known statistical method due to Cramer and Wold (1936) One can and must add all non-negligible 1D approximations when calculating p

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

17 / 33

Multidimensional Linear Approximation

From one to many

The p.d. p of Ux + Wz + VK and 1D correlations (a ) = c (a (Ux + Wz + VK )), a Vm are related as follows:

p = 2m
a Vm

(1)a (a ), Vm .

That is, p.d. is determined using 1D projections, a well-known statistical method due to Cramer and Wold (1936) One can and must add all non-negligible 1D approximations when calculating p To strengthen the attack one should choose the m base approximations such that there are as many as possible non-neglible correlations (a ), a Vm .

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

17 / 33

Multidimensional Linear Approximation

From one to many

The p.d. p of Ux + Wz + VK and 1D correlations (a ) = c (a (Ux + Wz + VK )), a Vm are related as follows:

p = 2m
a Vm

(1)a (a ), Vm .

That is, p.d. is determined using 1D projections, a well-known statistical method due to Cramer and Wold (1936) One can and must add all non-negligible 1D approximations when calculating p To strengthen the attack one should choose the m base approximations such that there are as many as possible non-neglible correlations (a ), a Vm . We do not assume statistical independence of base approximations!
Hermelin (TKK) Multidimensional Alg. 2 FSE09 17 / 33

Multidimensional Linear Approximation

Multidimensional linear approximation of a block cipher x

. . .
z f y k

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

18 / 33

Multidimensional Linear Approximation

Multidimensional linear approximation of a block cipher x Multidimensional linear approximation Ux + Wz + VK Vm with p.d. p

. . .
z f y k

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

18 / 33

Multidimensional Linear Approximation

Multidimensional linear approximation of a block cipher x Multidimensional linear approximation Ux + Wz + VK Vm with p.d. p

Parity bits g = VK called the inner key class

. . .
z f y k

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

18 / 33

Multidimensional Linear Approximation

Multidimensional linear approximation of a block cipher x Multidimensional linear approximation Ux + Wz + VK Vm with p.d. p

Parity bits g = VK called the inner key class

. . .
z f y k

For g = VK , the data U x + W z p g , a permutation of p dependent on g

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

18 / 33

Multidimensional Linear Approximation

Multidimensional linear approximation of a block cipher x Multidimensional linear approximation Ux + Wz + VK Vm with p.d. p

Parity bits g = VK called the inner key class

. . .
z f y k

For g = VK , the data U x + W z p g , a permutation of p dependent on g We have nice symmetry properties, e.g., C (p g ) = C (p ) for all g Vm

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

18 / 33

Multidimensional Linear Approximation

Multidimensional linear approximation of a block cipher x Multidimensional linear approximation Ux + Wz + VK Vm with p.d. p

Parity bits g = VK called the inner key class

. . .
z f y k

For g = VK , the data U x + W z p g , a permutation of p dependent on g We have nice symmetry properties, e.g., C (p g ) = C (p ) for all g Vm
g0 is the right inner key class k0 is the right last round key both unknown!

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

18 / 33

Key Ranking

Outline

1 2 3 4 5 6 7

Introduction Basic Concepts Multidimensional Linear Approximation Key Ranking Algorithm 2 Experiments Conclusions

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

19 / 33

Key Ranking

Key ranking as a statistical problem

Given key candidates k Vl we wish to nd the right key k0

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

20 / 33

Key Ranking

Key ranking as a statistical problem

Given key candidates k Vl we wish to nd the right key k0 Four phases:

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

20 / 33

Key Ranking

Key ranking as a statistical problem

Given key candidates k Vl we wish to nd the right key k0 Four phases:

On-line phase: collect data

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

20 / 33

Key Ranking

Key ranking as a statistical problem

Given key candidates k Vl we wish to nd the right key k0 Four phases:

On-line phase: collect data Off-line phase: using some statistic T , calculate mark T (k ) for each key k Vl using the empirical data

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

20 / 33

Key Ranking

Key ranking as a statistical problem

Given key candidates k Vl we wish to nd the right key k0 Four phases:

On-line phase: collect data Off-line phase: using some statistic T , calculate mark T (k ) for each key k Vl using the empirical data Sort phase: rank keys according to order statistic T (k )

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

20 / 33

Key Ranking

Key ranking as a statistical problem

Given key candidates k Vl we wish to nd the right key k0 Four phases:

On-line phase: collect data Off-line phase: using some statistic T , calculate mark T (k ) for each key k Vl using the empirical data Sort phase: rank keys according to order statistic T (k ) Search phase: run through the list to nd k0 which should be at the top of the list

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

20 / 33

Key Ranking

Key ranking as a statistical problem

Given key candidates k Vl we wish to nd the right key k0 Four phases:

On-line phase: collect data Off-line phase: using some statistic T , calculate mark T (k ) for each key k Vl using the empirical data Sort phase: rank keys according to order statistic T (k ) Search phase: run through the list to nd k0 which should be at the top of the list

How well T ranks? Measure using advantage

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

20 / 33

Key Ranking

Advantage

Denition (Selcuks a -bit advantage, JoC08) We say that a key recovery attack for an l -bit key achieves an advantage of a bits over exhaustive search, if the correct key is ranked among the top 2l a out of all 2l key candidates.

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

21 / 33

Key Ranking

Advantage

Denition (Selcuks a -bit advantage, JoC08) We say that a key recovery attack for an l -bit key achieves an advantage of a bits over exhaustive search, if the correct key is ranked among the top 2l a out of all 2l key candidates. We derived the relationship between the data complexity of the on-line phase and the advantage to describe the trade-off between search phase and data complexity.

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

21 / 33

Algorithm 2

Outline

1 2 3 4 5 6 7

Introduction Basic Concepts Multidimensional Linear Approximation Key Ranking Algorithm 2 Experiments Conclusions

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

22 / 33

Algorithm 2

On-line phase of Alg. 2

Draw data (xi , yi ), i = 1, . . . , N

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

23 / 33

Algorithm 2

On-line phase of Alg. 2

Draw data (xi , yi ), i = 1, . . . , N k k For each k Vl , calculate empirical p.d. qk = (q0 , . . . , qM ):

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

23 / 33

Algorithm 2

On-line phase of Alg. 2

Draw data (xi , yi ), i = 1, . . . , N k k For each k Vl , calculate empirical p.d. qk = (q0 , . . . , qM ): k q =

1 #{i = 1, . . . , N | U xi + W zik = }, where zik = f 1 (yi , k ) N

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

23 / 33

Algorithm 2

On-line phase of Alg. 2

Draw data (xi , yi ), i = 1, . . . , N k k For each k Vl , calculate empirical p.d. qk = (q0 , . . . , qM ): k q =

1 #{i = 1, . . . , N | U xi + W zik = }, where zik = f 1 (yi , k ) N

Decrypting with the right round key, we have empirical p.d. qk0 p g0 , where g0 Vm is unknown

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

23 / 33

Algorithm 2

On-line phase of Alg. 2

Draw data (xi , yi ), i = 1, . . . , N k k For each k Vl , calculate empirical p.d. qk = (q0 , . . . , qM ): k q =

1 #{i = 1, . . . , N | U xi + W zik = }, where zik = f 1 (yi , k ) N

Decrypting with the right round key, we have empirical p.d. qk0 p g0 , where g0 Vm is unknown
Decryption with wrong key k k0 means additional encryption such that qk , k k0 (Wrong-key Randomisation Hypothesis)

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

23 / 33

Algorithm 2

Wrong-key Randomisation Hypothesis

p g0

p g3

p g1

p g2

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

24 / 33

Algorithm 2

Wrong-key Randomisation Hypothesis

p g0

p g3

p g1

Ranking statistic (off-line): L (k ) = maxgVm L (k , g ), where L (k , g ) = LLR(qk , p g , )

p g2

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

24 / 33

Algorithm 2

Wrong-key Randomisation Hypothesis

p g0

q k0
p g3

p g1

Ranking statistic (off-line): L (k ) = maxgVm L (k , g ), where L (k , g ) = LLR(qk , p g , )

p g2

qk0 follows p g0 for some g0 Vm (an unknown permutation of p ) and not any other p g , g g0 or , then L (k0 , g0 ) > 0

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

24 / 33

Algorithm 2

Wrong-key Randomisation Hypothesis

p g0

q k0
p g3 p g1

Ranking statistic (off-line): L (k ) = maxgVm L (k , g ), where L (k , g ) = LLR(qk , p g , )

qk , k

k0

p g2

qk0 follows p g0 for some g0 Vm (an unknown permutation of p ) and not any other p g , g g0 or , then L (k0 , g0 ) > 0 qk , k k0 follows rather than p g , for any g Vm , then L (k , g ) < 0, k k0

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

24 / 33

Algorithm 2

Other approaches

We could also interpret the problem as a goodness-of-t test

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

25 / 33

Algorithm 2

Other approaches

We could also interpret the problem as a goodness-of-t test

2 -based ranking statistic

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

25 / 33

Algorithm 2

Other approaches

We could also interpret the problem as a goodness-of-t test

2 -based ranking statistic

Similar calculations

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

25 / 33

Algorithm 2

Other approaches

We could also interpret the problem as a goodness-of-t test

2 -based ranking statistic

Similar calculations A weaker method both in theory and in experiments

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

25 / 33

Algorithm 2

Other approaches

We could also interpret the problem as a goodness-of-t test

2 -based ranking statistic

Similar calculations A weaker method both in theory and in experiments Unlike LLR, does not benet from using (many) multiple approximations

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

25 / 33

Algorithm 2

Other approaches

We could also interpret the problem as a goodness-of-t test

2 -based ranking statistic

Similar calculations A weaker method both in theory and in experiments Unlike LLR, does not benet from using (many) multiple approximations Different ranking statistics are also possible, but the LLR is optimal and its statistical behaviour is well-known

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

25 / 33

Experiments

Outline

1 2 3 4 5 6 7

Introduction Basic Concepts Multidimensional Linear Approximation Key Ranking Algorithm 2 Experiments Conclusions

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

26 / 33

Experiments

Experimental results

Experiments on 5-round Serpent, 16 keys, k has 12 bits Comparison between LLR and 2 , in theory and practice LLR is more powerful Theoretical and experimental advantage behave similarly with dimension m of linear approximation For this cipher the optimal value for LLR is m = 12 and for 2 it is m=4

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

27 / 33

Advantage of LLR-method as a function of data complexity for different m

12

m=4, capacity=223 m=7, capacity=222 m=10, capacity=2

21 20.42

12

m=4, capacity=223 m=7, capacity=222 m=10, capacity=2

21 20.42

10

m=12, capacity=2 m=1, capacity=2

26

10

m=12, capacity=2 m=1, capacity=2

26

advantage

advantage
2^24 2^25 2^26 2^27 2^28 2^29 2^30

0 2^23

0 23

24

25

26

27

28

number of texts

number of texts

Theoretical prediction

Empirical results

Conclusions

Outline

1 2 3 4 5 6 7

Introduction Basic Concepts Multidimensional Linear Approximation Key Ranking Algorithm 2 Experiments Conclusions

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

29 / 33

Conclusions

Results

Multidimensional extensions of Matsuis Algorithm 2

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

30 / 33

Conclusions

Results

Multidimensional extensions of Matsuis Algorithm 2 No assumption about statistical independence of the 1D linear approximations

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

30 / 33

Conclusions

Results

Multidimensional extensions of Matsuis Algorithm 2 No assumption about statistical independence of the 1D linear approximations No need to compute huge distributions, just smaller distributions from 1D correlations

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

30 / 33

Conclusions

Results

Multidimensional extensions of Matsuis Algorithm 2 No assumption about statistical independence of the 1D linear approximations No need to compute huge distributions, just smaller distributions from 1D correlations Theoretical justication for the enhancement of Biryukovs method (adding linearly dependent strong 1D approximations)

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

30 / 33

Conclusions

Results

Multidimensional extensions of Matsuis Algorithm 2 No assumption about statistical independence of the 1D linear approximations No need to compute huge distributions, just smaller distributions from 1D correlations Theoretical justication for the enhancement of Biryukovs method (adding linearly dependent strong 1D approximations) Order statistics for measuring success of key ranking and to nd trade-off between search phase and data complexity

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

30 / 33

Conclusions

Results

Multidimensional extensions of Matsuis Algorithm 2 No assumption about statistical independence of the 1D linear approximations No need to compute huge distributions, just smaller distributions from 1D correlations Theoretical justication for the enhancement of Biryukovs method (adding linearly dependent strong 1D approximations) Order statistics for measuring success of key ranking and to nd trade-off between search phase and data complexity Estimates for data complexities calculated

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

30 / 33

Conclusions

Results

Multidimensional extensions of Matsuis Algorithm 2 No assumption about statistical independence of the 1D linear approximations No need to compute huge distributions, just smaller distributions from 1D correlations Theoretical justication for the enhancement of Biryukovs method (adding linearly dependent strong 1D approximations) Order statistics for measuring success of key ranking and to nd trade-off between search phase and data complexity Estimates for data complexities calculated Different methods and dimensions can be compared

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

30 / 33

Conclusions

Conclusions

For xed dimension m of linear approximation, LLR has higher advantage than 2 Advantage of LLR increases with m further than advantage of 2

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

31 / 33

Conclusions

Conclusions

For xed dimension m of linear approximation, LLR has higher advantage than 2 Advantage of LLR increases with m further than advantage of 2

If no reason to suspect a signicant error in p , we recommend using LLR rather than 2

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

31 / 33

Conclusions

Open questions and future work

Measure advantage for nding both last round key and inner key class ` Extensions to nonlinear cryptanalysis (cf. Baigneres, et al.2004)? Other ciphers? Stream ciphers?

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

32 / 33

Conclusions

Thank you!

Hermelin (TKK)

Multidimensional Alg. 2

FSE09

33 / 33