High-Performance Reliable Block Encryption Algorithms Secured against Linear and Differential Cryptanalytic Attacks

Abstract

To be secure, modern information and communication technology (ICT) needs reliable encryption. Symmetric cryptography combines encryption algorithms that use the same cryptographic keys for both encryption of plaintext and decryption of ciphertext. These algorithms are used for confidentiality ensuring in different spheres but most of them are worn out and outdated. Modern encryption algorithms development is very actual task for ICT (up to date and next generation). In this paper to improve the security effectiveness of electronic information resources, two encryption algorithms have been developed based on fixed lookup tables with extended-bit depth and dynamic key-dependent lookup tables. The developed algorithms are at least two times faster than the previous national encryption standard and virtually secure to linear and differential cryptanalysis. Properties of random sequences formed using the proposed algorithms' encryption (in counter mode) were explored in the environment of NIST STS statistical tests, according to which they passed integrated control by mentioned tests with better results than other generators.

Keywords

• IT security
• confidentiality
• cryptography
• cipher
• block encryption algorithm
• cryptographic security
• reliable encryption
• algebraic coding theory

-

As a result of modern global challenges in information security on the state level, the requirements for state information resources security and other critical information (transferred and stored in information and communication systems) are constantly growing [ 1-2 ]. The cryptographic security of these resources is one of the most significant security measures (especially in critical information infrastructure protection [ 2-3 ]). Cryptographic security is one of the most reliable and effective methods of information security; its principal and undeniable advantage is the data protection without access to it. The principal criterion for choosing cryptosystems is security, but for some applications (e.g., Big Data encryption, online banking payment systems etc.) the key role played by cryptographic data processing is speed. Despite the wide variety of modern encryption methods and algorithms, not all have the necessary level of effectiveness (speed and security). In addition, the rapid development of computational tools and their simultaneous cost reduction have led to new requirements for both the security and the performance of cryptosystems–old cryptographic algorithms disappear, and new ones must pass specific competitive selection and prove their ability to provide security for a specific period of time in the future [ 4-10 ]. Algorithm 28147:2009 was Ukrainian National Encryption Standard until 2014. DSTU 7624:2014, the new Encryption Standard since 2015, has not been well investigated [ 6, 9 ]. However, considering the significant progress in the field of cryptanalysis methods and tools, Ukrainian National Encryption Standard 28147:2009 has become obsolete [ 9 ]. Thus, in accordance with the requirements of the New European Schemes for Signatures, Integrity, and Encryption (NESSIE) project [ 5 ], the algorithm of Ukrainian Encryption Standard 28147-2009 applies only to the third (lowest) class of security [ 8 ]. In addition, previous Ukrainian National Encryption Standard 28147-2009 does not satisfy the modern requirements for data encryption speed [ 7 ] that is important for mentioned tasks.

Additional disadvantages include complexity of hardware implementation and use of secret long-term key data, which are supplied in a prescribed manner [ 7 ]. Therefore, the development of new algorithms to improve the efficiency of information security is an important scientific task. The purpose of this work is to contribute to improvement in the efficiency of electronic information resources security through the development of modern secure high-performance reliable block ciphers. 2.

Method for Speed of Block Ciphers Increasing Consider a class of block ciphers with a set of open (encrypted) messages Vn  {0,1}n , n  128 p , p  N , a set of round keys K  Vn , and a family of cryptographic transformations Fk  fr ,kr ... f1,k1 , k  k1,..., kr   K r , where r is the number of encryption rounds.

The round transformation fi, k  x for any x Vn , k  K , and i 1, r is described as addition modulo 2 or 232l , l  N , l  n 32 . Substitutions   x and si  x are defined by the formulas   x  Ls i  x , x Vn , si  x  si  xc1 , ... , si  x0  , where x   xc1,..., x0  , x j Vt , t  4 , c  n / t , j  0, c 1 , si involves m lookup tables on the set Vt , used in the i-th round ( m 1, c ), аnd L x is a linear transformation used in a block cipher. si – one of m ( m N ) substitution tables on set Vt , that is using in i -th round, L x – linear transformation using in block cipher. For the above class of block ciphers there are fairly well known analytical upper estimates of the parameters [ 11, 12 ], characterizing practical security against linear [ 13, 15 ] and differential [ 13, 14 ] cryptanalysis attacks:

  x  k  , i  r fi,k   sr  x  k  , i  r , where  is defined separately for each round operation of

EDP   r1BL /21 ELP   r1BL /21 (1) (2) (3) where   maxds  ,  : , Vt \ 0 is the maximum probability difference of the substitution table s [ 11 ],   maxls  ,  : , Vt \0 is the maximum probability of linear approximation of the substitution table s [ 11 ], BL is the number of the revitalization branches of the following linear transformation L x ( BL  min wt  x  wt  xL1  ) [ 11 ], EDP  is the average differential characteristics probability of  characteristic probability of  [ 11 ].

[ 11 ], аnd ELP is the average linear Variables ds ( , ) and ls ( , ) are defined by the following formulas (if the operation “+” is addition modulo 2) [ 11, 12 ]: ds ( , )  2t  (s(k  )  s(k), ) , kVt

2 ls ( , )  2t   2t  (1) x s(xk)  (4) kVt  xVt  0, u   v where  is the Kronecker delta symbol,  (u, v)   . 1, u   v According to the standard methodology of constructing block ciphers [ 16 ], using linear transformations with a large parameter BL and substitution tables with smaller A)s a linear transformation of the considered maximum distance separable (MDS) codes, covering w bytes ( w  4, 8, 16 ) allows the number of activation branches BL  w 1 . We investigated the substitution table on the set Vq , where q  8, 16, 32 , for which the theoretically achievable levels of  and  are equal to 2q2 . According to Table 1, the performance of block ciphers (considered as a class) can be improved by taking the following steps: 1) Expand the variety of permutations to use the substitution table on the set V16 (most modern cryptographic algorithms use lookup tables on multiples of V8 ). Using such a table requires only 128 KB of memory, which is now acceptable. A substitution table on the set V32 requires much more memory, resulting in it being impractical for current use. 2) Replace some MDS codes to cover a larger number of bytes (this will increase the number of operations per round, but not significantly). 3) Reduce the number of block cipher rounds to improve performance. For example, this method can be applied to block cipher Kalyna encryption algorithms ( ,   25 , BL  9 , r  11 ) [ 11 ] and the Advanced Encryption Standard (AES) (     26 , BL  5 , r  11 ) [ 4 ], but in this case (with decreasing r ), investigating their security in regard to other methods of cryptanalysis is a very difficult task. However, the opportunity to enhance their performances deserves attention. 3.

New Block Encryption Algorithms Development On the basis of the described method for increasing the speed of block ciphers, two algorithms have been developed for encrypting the information using a fixed table lookup with an extended bit depth (Luna) and with dynamic key-dependent lookup tables (Neptune). The pseudocode for the algorithms is shown in Fig. 1a and 1b, respectively. Luna Neptune Input: 128-bit input data block state , Input: 128-bit input data block state , 128-bit extended keys subkey i , i  0, r  2 . 128-bit extended keys subkey i , i  0, 2  r .

Output: 128-bit output data block. 1. 2.

AddKeyMod 2state, subkey1 ;

For j  0, j  r 1, j   do 2.1. SubBytesLuna state ;

2.2. ShiftRows state ;

2.3. MixColumns state ;

2.4. AddKeyMod2state, subkey j  2 ;

3. SubBytesLuna state ;

4. ShiftRows state ;

AddKeyMod 2state, subkeyr 1 ;

6. return state ; a

Output: 128-bit output data block. 1. 2.

AddKeyMod 2  state, subkey 0 ;

For j  0, j  r 1, j   do 2.1. SubBytesNeptun state, subkey2 j 1 ;

2.2. ShiftRows state ;

2.3. MixColumns state ; 2.4. AddKeyMod2state, subkey2 j  2 ;

3. SubBytesNeptun state, subkey2 r 1 ;

4. ShiftRows state ;

5.

AddKeyMod2state, subkey2 r ;

6. return state ; b These algorithms use 128-bit data blocks (represented as 4  4 byte matrices) with secret-key lengths of 128, 256, and 512 bits, formed from the required number of 128bit extended keys represented as matrices of size 4  4 bytes. The number r of encryption rounds depends on the length of the secret key. With secret-key lengths of 128, 256, and 512 bits, r  7, 9, 13 in Luna and r  9, 13, 21 in Neptune, respectively.

The operation AddKeyMod 2state, subkeyi is bitwise addition modulo 2 of the corresponding bits of the extended subkey i key and a state data block. The MixColumns state operation is a linear state sequence transformation. In this operation, the state data block is split into two parts of eight bytes (the first two fourbyte columns form one eight-byte part, and the other eight – the second part), each of which is considered as a polynomial over the field GF 28  with eight terms, which are multiplied by x8 1 modulo a fixed polynomial c  x (see Fig. 2), thereby ensuring that the number of activation branches is nine. The polynomial c  x is given by c  x  3x7  7x6  x5  3x4  7x3  4x2 1Dx 1, where the coefficients are represented in base-16 forms. A not given polynomial chosen polynomial is m x  x8  x7  x5  x4  x 1 .

X1,1 X1,2 X1,3 X1,4

X2,1 X2,2 X2,3 X2,4

X3,1 X3,2 X3,3 X3,4

X4,1 X4,2 X4,3 X4,4 c(x)

X

= y1 ... y8 y1 ... y8 replaced according to each of the 16- and 8-bit data blocks with a specific table of substitutions (see Figs. 3a and 3b, respectively). Luna uses one 1616 substitution table, while Neptune uses 16 tables, with the choice of a particular table in each round depending on the expanded key (a dynamically changeable substitutions table complicates the cryptanalysis and will dynamically manage the information dispersion). The substitution table was constructed in such way that there were no fixed points, as well as to satisfy the respective equalities for the parameters,     214 for the Luna substitution table and     26 for each Neptune substitution table.

Sbox X   Y

X1,1 X1,2 X1,3 X1,4

X2,1 X2,2 X2,3 X2,4

X3,1 X3,2 X3,3 X3,4 A

X4,1 X4,2 X4,3 X4,4

X1,1 X1,2 X1,3 X1,4

X2,1 X2,2 X2,3 X2,4

X3,1 X3,2 X3,3 X3,4 b

X4,1 X4,2 X4,3 X4,4 C X 1  GF (2q ) and then performing affine transformations over the field GF (2) : S(X )  M  C X 1 V , where X , C,V  GF (2q ) , and M is not a singular square matrix over the GF (2) field of q  q size. For Luna, q  16 , and for Neptune, q  8 . The C , V , and M settings for the Neptune and Luna table lookup algorithms are shown in base-16 forms in Tables 2 and 3, respectively (each matrix row is shown in the form of one base-16 number). i ( i  2, 3 ) last string sequence state cyclically shifted right by 2 elements. The procedures of Neptune and Luna decoding are similar to the encryption procedure (see Figs. 1a and 1b), except that the extended keys are provided in reverse order, with the reverse substitution tables and a reversed MixColumns state operation being used (multiplication by a polynomial d  x  7Ax7  A1x6  F8x5  EEx4  20x3  89x2  EBx  51).

In the key expansion procedure, a128n -bit secret key K ( n  1, 2, 4 ) is divided into n parts of 128 bits ( al , l  1, n ) to formulate extended keys. Each of these is divided into four k li ( i  1, 4 ) parts that, together with the 32-bit variables A , B , C , D , E , F , and yi ( i  1, 4 ), are moved to the key expansion routine input, the pseudocode of which is shown in Fig. 4.

The Sbox  X  operation for Neptune and Luna performs tabular substitution in accordance with each 16 and 8 bits, respectively (Luna uses a substitution table based on the parameters from Table 2, while Neptune uses bases of the parameters from the first row of Table 3). Mix  y1, y2 , y3, y4  is the operation of linear dispersion. In this operation, variables yi are broken into two parts of eight bytes, each of which is considered as a polynomial over the field GF 28  with eight terms that are multiplied by x8 1 modulo a fixed c  x polynomial of order seven, where cx  3x7  7x6  x5 3x4  7x3  4x2 1Dx 1. As a polynomial that is not chosen, consider mx  x8  x7  x5  x4  x 1 . 2.1.1.5. y1  SboxSbox y1  kl2   kl1 E y4  ; 2.1.1.6. C  SboxC  F y1 D ; 2.1.1.7. y2  Sbox y2  C  kl2   kl1  ; 2.1.1.8. 2.1.1.9.

Mix y1, y2, y3, y4  ;

D  D  kl4    A kl3   y1 ; 2.1.1.10. kl3  SboxD  kl3   E ; 2.1.1.11. E  SboxE kl3   F kl1 ; 2.1.1.12. kl4  SboxE  kl4   kl2  D ; 2.1.1.13. y3  SboxSbox y3  kl4   kl3  B y2  ; 2.1.1.14. F  SboxF C y3  A; 2.1.1.15. y4  Sbox y4  F   kl4   kl3  ; 2.1.1.16. Mix y1, y2, y3, y4  ; 2.1.2 templk  y1 | y2 | y3 | y4 ;

2.1.3 subkeyk  subkeyktemplk.

Fig. 4. Pseudocode procedure for key expansion Initial values of the variables A , B , C , D , E , F , yi are listed in base-16 in Both Neptune and Luna utilize widely used algebraic operations in finite fields. Immediate execution of these operations would lead to extremely inefficient implementations. However, the byte-algorithm structure opens up opportunities for optimization. Thus, two-byte substitution can be implemented during Luna implementation, shifting and multiplying the result by the corresponding columns of the matrix M as one of substitution 16 bits on 64 bits, and Neptune implementation can be implemented as a bit-substitution shift, with a multiplication matrix state element on the column of the matrix M being implemented as 8-bit on 64-bit substitution. In that case, a complete round of Luna will consist of eight permutations of 16 on 64 bits and eight-bit addition modulo 2. Similarly, performing a full round of the Neptune algorithm requires only 16 substitutions of 8-bit on 64 bits and 16 additions modulo 2. Thus, by allocating a larger amount of RAM and performing preliminary calculations, it is possible to reduce the number of operations in the round and achieve a cryptographic processing speed boost.

Statistical Security Estimation using NIST STS Properties of pseudorandom sequences formed with the help of Neptune and Luna (in counter mode) have been studied in the environment of NIST STS statistical tests (testing technique described in [ 17 ]). Statistical portraits of Neptune and Luna software implementations are shown in Figs. 5-6, respectively. For comparison, Table 5 presents the results of testing sequences generated on the basis of the Luna, Neptune, Ukrainian Encryption Standard 28147-2009, Blum Blum Shub (BBS), and Kalyna algorithms. As can be seen from the results (Table 5), the Luna- and Neptune-based generators passed comprehensive testing using the NIST STS method and show better results than other algorithm-based generators.

Generator

BBS Kalyna Luna Neptune

Number of tests in which the test was conducted 99% sequence 133 (70,3%) 132 (69,8%) 136 (72,0%) 141 (74,6%) 140 (74,0%) 96% sequence 189 (100%) 188 (99,4%) 189 (100%) 189 (100%) 189 (100%)

Encryption Rate Estimation Based on the described optimization software, the Luna, Neptune, AES, and Kalyna encryption algorithms and Ukrainian Encryption Standard 28147-2009 were implemented in the C++ programming language. During the Luna implementation, two-byte substitution, shifting, and multiplying the result by the corresponding columns of the matrix as a 16-bit to 64-bit substitution were presented. Similarly, during the Neptune and Kalyna implementations, byte operation substitution, shift, and multiplication of elements of the matrix by a column matrix as one eight-bit to 64-bit substitution were presented. During the DSTU 28147-2009 implementation, every two four-by-four-bit substitution tables were combined as a table of eight by eight bits, allowing reduction of the number of lookup operations from eight to four. During AES implementation, the operations of byte substitution, shift, and Luna -128 Neptune -128

Security Estimation against Linear and Differential Cryptanalysis During calculation of the analytical upper bounds of the parameters characterizing practical security to linear and differential cryptanalysis using formulas (1) and (2),  and  must be calculated depending on the parameters’ lookup table. For this purpose, special software was developed and special tables were built using equations (3) and (4). Then, we determined the maximum value in these tables (except for the items in the zero-th row or column). As a result, it was determined that for Luna,     214 , and for each Neptune table,     26 .

Table 7 contains the analytical upper bounds of the parameters (using equations (1) (2)), characterizing the practical security of the Neptune and Luna encryption algorithms to differential and linear cryptanalysis.

EDP()  2512 EDP()  2770

ELP()  2512 ELP()  2770

EDP()  2330 EDP()  2546

ELP()  2330 ELP()  2546

Conclusions In this paper, two encryption algorithms were proposed to improve the efficiency of electronic information resources security from viewpoint of reliability, speed and security. As can be seen from the results of the experimental study, the proposed algorithms, Luna and Neptune, are at least two times faster than the previous Ukrainian National Encryption Standard 28147-2009 (in fact, this is the standard for all post-Soviet states). In addition, designed algorithms passed comprehensive control using the NIST STS technique and showed better results than other encryption algorithm-based generators. It was also shown that the proposed algorithms are practically secured against linear and differential cryptanalysis.

References

1. Gnatyuk , S. , Zhmurko , T. , Falat , P. : Efficiency increasing method for quantum secure direct communication protocols . In: Proceedings of the 2015 IEEE 8th International Conference on “Intelligent Data Acquisition and Advanced Computing Systems: Technology and Applications” (IDAACS' 2015 ), Warsaw, Poland, 468 - 472 ( September 24-26 , 2015 ).

2. Korchenko , O. , Vasiliu , Ye., Gnatyuk , S. : Modern quantum technologies of information security against cyber-terrorist attacks . Aviation 14 ( 2 ), 58 - 69 ( 2010 ).

3. Kovtun , M. , Kovtun , V. , Okrimenko , A. , Gnatyuk , S. : Search method development of birationally equivalent binary Edwards curves for binary Weierstrass curves from DSTU 4145- 2002 . In: Proceedings of 2nd International Scientific-Practical Conf. on the Problems of Infocommunications. Science and Technology, Kharkiv, Ukraine , 135 - 139 ( October 13-15 , 2015 ).

4. Advanced Encryption Standard (AES): FIPS 197 . Gaithersburg , Maryland, USA: NIST, 2001 . http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf.

5. NESSIE contest (The New European Signature Algorithms , Integrity and Encryption) Panasenko, S. http://old.cio-world.ru/bsolutions/e-safety/340556.

6. Position about carrying out of open competition of cryptographic algorithms, Institute of Cybernetics named after V. Glushkov of NASU . http://www.dstszi.gov.ua/dstszi/control/ru/ publish/article;jsessionid=EE63A37FEF8F5B34030F1E38D7247DBC?art_id=48387&cat_id= 92733 .

7. Gorbenko , I. , Lisitskaya I. : Encryption algorithms standardization . Project requirements of national standard for block symmetric encryption on the modern stage of cryptography development . Radio Engineering , 5 - 10 ( 2011 ).

8. Gorbenko , I. , Dolgov , V. , Oliynykov , R. et al: Principles of construction and properties of IDEA-like block symmetric ciphers . Applied Radio Electronics 6 ( 2 ), 158 - 173 ( 2007 ).

9. DSTU 7624: 2014 . Ukrainian National Encryption Standard “Kalyna”, 86 p. ( 2014 ).

10. Panasenko , S.: The encryption algorithms . Special guide, St. Petersburg, BHVPetersburg. 576 ( 2009 ).

11. Alekseichuk , A. , Kovalchuk , L. , Skrynnik , E. et al: Rating of practical resistance of Kalyna block cipher relative to the difference methods, linear cryptanalysis and algebraic attacks based on homomorphisms . Applied Radio Electronics 7 ( 3 ), 203 - 209 ( 2008 ).

12. Alekseichuk , A. , Kovalchuk , L. , Skrynnik , E. et al: Rating of practical resistance of “Kalyna” block cipher relative to the difference methods, linear cryptanalysis and algebraic attacks based on cryptanalysis . In: Proceedings of the 4th intern. conf. on security and countering terrorism . MSU, M. V. Lomonosov . 30 -31 Oct. 2008 , 2th ed, M.: MCCME , 15 - 20 ( 2009 ).

13. Alsalami Y. , Yeun C. Y. , Martin T. : Linear and differential cryptanalysis of small-sized random (n, m)-S-boxes . In: Proceedings of 2016 11th International Conference for Internet Technology and Secured Transactions , Barcelona, Spain. DOI: 10 .1109/ICITST. 2016 .7856751

14. Lai , X. , Massey , J. , Murphy , S. : Markov ciphers and differential cryptanalysis . Advances in Cryptology, EUROCRYPT'91, Proceedings , Springer Verlag, 17 - 38 ( 1991 ).

15. Matsui , M. : Linear cryptanalysis methods for DES cipher . EUROCRYPT , Springer Verlag ( 1998 ).

16. Daemen , J.: Cipher and hash function design strategies based on linear and differential cryptanalysis: Ph. D. Thesis , Katholieke Univ. Leuven ( 1995 ).

17. Narges , M. , Khayyambashi , M. Performance Evaluation of Authentication Encryption and Confidentiality Block Cipher Modes of Operation on Digital Image . International Journal of Computer Network and Information Security (IJCNIS) , Vol. 9 , No. 9 , pp. 30 - 37 , 2017 . DOI: 10 .5815/ijcnis. 2017 . 09 .04.