References of "Khovratovich, Dmitry 50002087"
     in
Bookmark and Share    
Full Text
Peer Reviewed
See detailRotational Cryptanalysis of ARX
Khovratovich, Dmitry UL; Nikolic, Ivica

in Fast Software Encryption 17th International Workshop, FSE 2010, Seoul, Korea (2010)

In this paper we analyze the security of systems based on modular additions, rotations, and XORs (ARX systems). We provide both theoretical support for their security and practical cryptanalysis of real ... [more ▼]

In this paper we analyze the security of systems based on modular additions, rotations, and XORs (ARX systems). We provide both theoretical support for their security and practical cryptanalysis of real ARX primitives. We use a technique called rotational cryptanalysis , that is universal for the ARX systems and is quite efficient. We illustrate the method with the best known attack on reduced versions of the block cipher Threefish (the core of Skein). Additionally, we prove that ARX with constants are functionally complete, i.e. any function can be real- ized with these operations. [less ▲]

Detailed reference viewed: 73 (0 UL)
Full Text
Peer Reviewed
See detailSpeeding up Collision Search for Byte-Oriented Hash Functions
Khovratovich, Dmitry UL; Biryukov, Alex UL; Nikolic, Ivica UL

in CT-RSA (2009)

We describe a new tool for the search of collisions for hash functions. The tool is applicable when an attack is based on a differential trail, whose probability determines the complexity of the attack ... [more ▼]

We describe a new tool for the search of collisions for hash functions. The tool is applicable when an attack is based on a differential trail, whose probability determines the complexity of the attack. Using the linear algebra methods we show how to organize the search so that many (in some cases — all) trail conditions are always satisfied thus significantly reducing the number of trials and the overall complexity. The method is illustrated with the collision and second preimage attacks on the compression functions based on Rijndael. We show that slow diffusion in the Rijndael (and AES) key schedule allows to run an attack on a version with a 13-round compression function, and the S-boxes do not prevent the attack. We finally propose how to modify the key schedule to resist the attack and provide lower bounds on the complexity of the generic differential attacks for our modification. [less ▲]

Detailed reference viewed: 110 (0 UL)
Full Text
Peer Reviewed
See detailRelated-Key Cryptanalysis of the Full AES-192 and AES-256
Biryukov, Alex UL; Khovratovich, Dmitry UL

in ASIACRYPT 2009 (2009)

In this paper we present two related-key attacks on the full AES. For AES-256 we show the first key recovery attack that works for all the keys and has 2^99.5 time and data complexity, while the recent ... [more ▼]

In this paper we present two related-key attacks on the full AES. For AES-256 we show the first key recovery attack that works for all the keys and has 2^99.5 time and data complexity, while the recent attack by Biryukov-Khovratovich-Nikolic works for a weak key class and has much higher complexity. The second attack is the first cryptanalysis of the full AES-192. Both our attacks are boomerang attacks, which are based on the recent idea of finding local collisions in block ciphers and enhanced with the boomerang switching techniques to gain free rounds in the middle. [less ▲]

Detailed reference viewed: 128 (1 UL)
Full Text
Peer Reviewed
See detailDistinguisher and Related-Key Attack on the Full AES-256
Biryukov, Alex UL; Khovratovich, Dmitry UL; Nikolic, Ivica UL

in Advances in Cryptology - CRYPTO (2009)

In this paper we construct a chosen-key distinguisher and a related-key attack on the full 256-bit key AES. We define a notion of differential q -multicollision and show that for AES-256 q-multicollisions ... [more ▼]

In this paper we construct a chosen-key distinguisher and a related-key attack on the full 256-bit key AES. We define a notion of differential q -multicollision and show that for AES-256 q-multicollisions can be constructed in time q·267 and with negligible memory, while we prove that the same task for an ideal cipher of the same block size would require at least $O(q\cdot 2^{\frac{q-1}{q+1}128})$ time. Using similar approach and with the same complexity we can also construct q-pseudo collisions for AES-256 in Davies-Meyer mode, a scheme which is provably secure in the ideal-cipher model. We have also computed partial q-multicollisions in time q·237 on a PC to verify our results. These results show that AES-256 can not model an ideal cipher in theoretical constructions. Finally we extend our results to find the first publicly known attack on the full 14-round AES-256: a related-key distinguisher which works for one out of every 2^{35} keys with 2^{120} data and time complexity and negligible memory. This distinguisher is translated into a key-recovery attack with total complexity of 2^{131} time and 2^{65} memory. [less ▲]

Detailed reference viewed: 142 (1 UL)
Full Text
Peer Reviewed
See detailCryptanalysis of the LAKE Hash Family
Biryukov, Alex UL; Gauravaram, Praveen; Guo, Jian et al

in Fast Software Encryption (2009)

We analyse the security of the cryptographic hash function LAKE-256 proposed at FSE 2008 by Aumasson, Meier and Phan. By exploiting non-injectivity of some of the building primitives of LAKE, we show ... [more ▼]

We analyse the security of the cryptographic hash function LAKE-256 proposed at FSE 2008 by Aumasson, Meier and Phan. By exploiting non-injectivity of some of the building primitives of LAKE, we show three different collision and near-collision attacks on the compression function. The first attack uses differences in the chaining values and the block counter and finds collisions with complexity 2^{33}. The second attack utilizes differences in the chaining values and salt and yields collisions with complexity 2^{42}. The final attack uses differences only in the chaining values to yield near-collisions with complexity 2^{99}. All our attacks are independent of the number of rounds in the compression function. We illustrate the first two attacks by showing examples of collisions and near-collisions. [less ▲]

Detailed reference viewed: 96 (0 UL)
Full Text
Peer Reviewed
See detailTwo New Techniques of Side-Channel Cryptanalysis
Biryukov, Alex UL; Khovratovich, Dmitry UL

in Cryptographic Hardware and Embedded Systems - CHES 2007 (2007)

We describe two new techniques of side-channel cryptanalysis which we call the impossible collision attack and the multiset collision attack. These are inspired by the state-of-the-art cryptanalytic ... [more ▼]

We describe two new techniques of side-channel cryptanalysis which we call the impossible collision attack and the multiset collision attack. These are inspired by the state-of-the-art cryptanalytic techniques of impossible differential attacks [BihamBS99] and partial-function collision attacks [GilbertM00] respectively. Using these techniques on an example of the AES we show that one has to mask all the rounds of a 128-bit key AES in order to prevent such attacks. For example these attacks can be used to break a recent proposal by Schramm et al. [SchrammP06] of high order masking for the AES, since it protects only 3 external rounds. [less ▲]

Detailed reference viewed: 131 (4 UL)
Full Text
Peer Reviewed
See detailCollision Attacks on AES-Based MAC: Alpha-MAC
Biryukov, Alex UL; Bogdanov, Andrey; Khovratovich, Dmitry UL et al

in Cryptographic Hardware and Embedded Systems - CHES 2007 (2007)

Message Authentication Code construction Alred and its AES-based instance Alpha-MAC were introduced by Daemen and Rijmen in 2005. We show that under certain assumptions about its implementation (namely ... [more ▼]

Message Authentication Code construction Alred and its AES-based instance Alpha-MAC were introduced by Daemen and Rijmen in 2005. We show that under certain assumptions about its implementation (namely that keyed parts are perfectly protected against side-channel attacks but bulk hashing rounds are not) one can efficiently attack this function. We propose a side-channel collision attack on this MAC recovering its internal state just after 29 measurements in the known-message scenario which is to be compared to 40 measurements required by collision attacks on AES in the chosen-plaintext scenario. Having recovered the internal state, we mount a selective forgery attack using new 4 to 1 round collisions working with negligible memory and time complexity. [less ▲]

Detailed reference viewed: 119 (0 UL)