Skipjack's F-Table and S-Box Fun
Alex Biryukov, Léo Perrin
SnT, University of Luxembourg
FSE 2015 Rump Session
Alex Biryukov, Léo Perrin
(uni.lu)
Skipjack's F-Table and S-Box Fun
FSE 2015 Rump Session
1 / 13
Skipjack's F
Skipjack's F Is Not Good. . .
Di. Spec.
maxa,b≥ {`a,b }
1
0
2
4
6
8
10
12
Skipjack Random
AES
38849
39252 32640
20559
19962 32130
4855
4875
255
686
827
0
69
99
0
5
9
0
2
1
0
28
32
16
2 / 13
Skipjack's F
But Skipjack's F Doesn't Look Random Either!
Random permutation
Skipjack's F
Number of occurrences (log scale)
1,024
256
64
16
4
1
20
25
Absolute value of the coefficients in the LAT
30
3 / 13
Skipjack's F
Actually, Skipjack's F Certainly Isn't Random
Low highest `a,b :
P [`a,b ≤ 28 (always)] ≈ 2−
.
25 6
4 / 13
Skipjack's F
Actually, Skipjack's F Certainly Isn't Random
Low highest `a,b :
P [`a,b ≤ 28 (always)] ≈ 2−
.
25 6
Low number of occurrences of highest `a,b
P [`a,b = 28 at most 3 times] ≈ 2−
.
54 4
4 / 13
Skipjack's F
Actually, Skipjack's F Certainly Isn't Random
Low highest `a,b :
P [`a,b ≤ 28 (always)] ≈ 2−
.
25 6
Low number of occurrences of highest `a,b
P [`a,b = 28 at most 3 times] ≈ 2−
1
F
.
54 4
not picked uniformly at random.
4 / 13
Skipjack's F
Actually, Skipjack's F Certainly Isn't Random
Low highest `a,b :
P [`a,b ≤ 28 (always)] ≈ 2−
.
25 6
Low number of occurrences of highest `a,b
P [`a,b = 28 at most 3 times] ≈ 2−
1
2
F
F
.
54 4
not picked uniformly at random.
not picked (using some criteria) within a set of random S-Boxes.
4 / 13
Skipjack's F
Actually, Skipjack's F Certainly Isn't Random
Low highest `a,b :
P [`a,b ≤ 28 (always)] ≈ 2−
.
25 6
Low number of occurrences of highest `a,b
P [`a,b = 28 at most 3 times] ≈ 2−
1
2
3
F
F
.
54 4
not picked uniformly at random.
not picked (using some criteria) within a set of random S-Boxes.
Whatever was done improved the linear properties.
4 / 13
Skipjack's F
Actually, Skipjack's F Certainly Isn't Random
Low highest `a,b :
P [`a,b ≤ 28 (always)] ≈ 2−
.
25 6
Low number of occurrences of highest `a,b
P [`a,b = 28 at most 3 times] ≈ 2−
1
2
3
F
F
.
54 4
not picked uniformly at random.
not picked (using some criteria) within a set of random S-Boxes.
Whatever was done improved the linear properties.
Let us optimize for this quantity:
R=
X
2|`a,b |
(a,b )∈[1,255]2
4 / 13
Skipjack's F
The Imitation Game
Random permutation
Skipjack's F
Imitating F
Number of occurrences (log scale)
1,024
256
64
16
4
1
20
25
Absolute value of the coefficients in the LAT
30
5 / 13
Skipjack's F
The Optimization Game
Random permutation
Skipjack's F
Imitating F
Optimizing R to the max
Number of occurrences (log scale)
1,024
256
64
16
4
1
20
25
Absolute value of the coefficients in the LAT
30
6 / 13
Jackson Pollock's Pattern Recognition
Pictures for S-Box Analysis
And now for something...
7 / 13
Jackson Pollock's Pattern Recognition
Pictures for S-Box Analysis
And now for something...
... somewhat related.
7 / 13
Jackson Pollock's Pattern Recognition
Pictures for S-Box Analysis
And now for something...
... somewhat related.
Modern Art to the cryptographer's rescue!
7 / 13
Jackson Pollock's Pattern Recognition
CLEFIA's
S0 's
LAT, JP style
8 / 13
Jackson Pollock's Pattern Recognition
Skipjack's S-Box's LAT, JP style
9 / 13
Jackson Pollock's Pattern Recognition
From a Picture to a S-Box
10 / 13
Jackson Pollock's Pattern Recognition
Embedding Your Own Picture in a DDT
11 / 13
Jackson Pollock's Pattern Recognition
A Possible Replacement for Skipjack's F-Table
12 / 13
Jackson Pollock's Pattern Recognition
Conclusion
13 / 13