EPCBC - A Block Cipher Suitable for Electronic Product Code ...

More documents

Recommendations

Info

23. EPCglobal. EPC Radio-Frequency Identity Protocols Class-1 Generation-2 UHF RFID Protocol for Communications at 860 MHz - 960 MHz Version 1.2.0. EPCglobal Specification, May 2008. Available at www.gs1.org/gsmp/kc/epcglobal/uhfc1g2 24. Z. Gong, S. Nikova and Y.-W. Law. KLEIN, a new family of lightweight block ciphers. Available via http: //doc.utwente.nl/73129/. 25. Z. Gong, S. Nikova and Y.-W. Law. KLEIN, a new family of lightweight block ciphers. Proceedings of The 7th Workshop on RFID Security and Privacy 2011, LNCS, Springer. Available via http://rfid-cusp.org/ rfidsec/. 26. D. Henrici and P. Müller, “Hash-based enhancement of location privacy for radio-frequency identification devices using varying identifers”, In Proc. IEEE Intern. Conf. on Pervasive Computing and Communications (2004), pp. 149-153. 27. D. Hong, J. Sung, S. Hong, J. Lim, S. Lee, B. S. Koo, C. Lee, D. Chang, J. Lee, K. Jeong, H. Kim, J. Kim, and S. Chee. HIGHT: A New Block Cipher Suitable for Low-Resource Device. In Cryptographic Hardware and Embedded Systems - CHES 2006, number 4249 in LNCS, pages 46–59. Springer, 2006. 28. T. Jakobsen and L. R. Knudsen, “Attacks on Block Ciphers of Low Algebraic Degree”, Journal of Cryptology, Vol. 14, pp. 197-210, Springer, 2001. 29. A. Juels, “Minimalist cryptography for low-cost RFID tags”, In Proc. Intern. Conf. on Security in Communication Networks (SCN 2004), LNCS 3352, pp. 149-164, Springer, 2004. 30. J. Kelsey, B. Schneier, and D. Wagner, “Related-Key Cryptanalysis of 3-WAY, Biham-DES, CAST, DES-X, NewDES, RC2, and TEA”. ICICS ’97 Proceedings. Springer-Verlag. pp. 233-246. 31. L. Knudsen, D. Wagnger, J. Daemen and V. Rijmen. “Integral Cryptanalysis”, Proceedings of the 9th International Workshop on Fast Software Encryption (FSE 2003), LNCS 2365, Springer-Verlag, 2003, pp. 112-127. 32. L.R. Knudsen, G. Leander, and M.J.B. Robshaw. PRINTcipher: A Block Cipher for IC-Printing. In S. Mangard and F.-X. Standaert, editors, Cryptographic Hardware and Embedded Systems - CHES 2010, volume 6225 of LNCS, pages 16–32. Springer-Verlag, 2010. 33. G. Leander, “Small Scale Variants of the Block Cipher PRESENT”, Cryptology ePrint Archive, Report 2010/143, 2010. Available via http://eprint.iacr.org/2010/143.pdf. 34. G. Leander, C. Paar, A. Poschmann, and K. Schramm. New Lightweight DES Variants. In Fast Software Encryption 2007 - FSE 2007, volume 4593 of LNCS, pages 196–210. Springer, 2007. 35. S.-M. Lee, Y. J. Hwang, D. H. Lee, and J. I. Lim. Efficient Authentication for Low-Cost RFID Systems. In O. Gervasi, M. L. Gavrilova, V. Kumar, A. Laganà, H. P. Lee, Y. Mun, D. Taniar, and C. J. K. Tan, editors, ICCSA (1), volume 3480 of LNCS, pages 619–627. Springer, 2005. 36. C. Lim and T. Korkishko. mCrypton - a lightweight block cipher for security of low-cost RFID tags and sensors. In T. Kwon, J. Song, and M. Yung, editors, Workshop on Information Security Applications - WISA’05, volume 3786 of LNCS, pages 243–258. Springer-Verlag, 2005. 37. S. Lucks. “The Saturation Attack - A Bait for Twofish”. Proceedings of the 7th International Workshop on Fast Software Encryption (FSE 2001), Springer Verlag, 2001, pp. 1-15. 38. F. Mace, F.-X. Standaert, and J.-J. Quisquater. ASIC Implementations of the Block Cipher SEA for Constrained Applications. In RFID Security - RFIDsec 2007, Workshop Record, pages 103 – 114, Malaga, Spain, 2007. 39. MAGMA v2.12. Computational Algebra Group, School of Mathematics and Statistics, University of Sydney (2005), http://magma.maths.usyd.edu.au 40. A. Moradi, A. Poschmann, S. Ling, C. Paar and H. Wang. Pushing the Limits: A Very Compact and a Threshold Implementation of AES. In K. Paterson, editor, Advances in Cryptology - EUROCRYPT 2011, LNCS 6632, Springer, pp. 69-88, 2011. 41. J. Nakahara, V. Rijmen, B. Preneel and J. Vandewalle, “The MESH Block Ciphers”, WISA 2003, LNCS 2908, Springer, pp. 458-473, 2004 42. M. Ohkubo, K. Suzuki, and S. Kinoshita, “Cryptographic approach to “privacy-friendly” tags”, In Proc. RFID Privacy Workshop (2003). 43. Axel Poschmann. Lightweight Cryptography - Cryptographic Engineering for a Pervasive World. Number 8 in IT Security. Europäischer Universitätsverlag, 2009. Published: Ph.D. Thesis, Ruhr University Bochum. 44. C. Rolfes, A. Poschmann, G. Leander and C. Paar, “Ultra-Lightweight Implementations for Smart Devices - Security for 1000 Gate Equivalents”, CARDIS 2008, LNCS 5189, pp. 89-103, 2008.
45. Virtual Silicon Inc. 0.18 µm VIP Standard Cell Library Tape Out Ready, Part Number: UMCL18G212T3, Process: UMC Logic 0.18 µm Generic II Technology: 0.18µm, July 2004. 46. S. Sarma, S. A. Weiss and D. W. Engels, “RFID systems and security and privacy implications”, CHES 2002, LNCS 2523, Springer, pp. 454-469, 2003. 47. S. Weis, S. Sarma, R. Rivest, and D. Engels, “ Security and privacy aspects of low-cost radio frequency identification systems”, In Proc. Intern. Conf. on Security in Pervasive Computing (SPC 2003) (2003), LNCS 2802, Springer, pp. 201-212. 48. M. R. Z’aba, H. Raddum, M. Henricksen and E. Dawson, “Bit-Pattern Based Integral Attack”, FSE 2008, LNCS 5086, pp. 363-381, 2008. A Appendix A.1 Improved Differential and Linear Cryptanalysis of PR-n We first clarify the notations used. We use an unordered sequence to specify the number of differential/linear (depending on the context) active S-boxes in each round. For example, {1,1,2,3} is used to denote that there are two rounds with one active S-box each, one round with two active S-boxes and one round with three active S-boxes. On the other hand, the ordered sequence 1-1-2-3 is used to denote that there is one active S-box in the first and second rounds, third round has two active S-boxes while the fourth round has three active S-boxes. Differential cryptanalysis Lemma 1. Consider PR-n where n ≥ 64. Let Dj be the number of active S-boxes in round j. Suppose Di = 1 and Di+1 ≥ 2. Denote the total number of active S-boxes from round i to round (i+k−1) (both rounds inclusive) by nk, for k ≥ 1. Then n1 = 1, n2 ≥ 3, n3 ≥ 7, n4 ≥ 11, n5 ≥ 13, n6 ≥ 14, and nk ≥ 2k +1 for k = 7,8,9. Proof. n1 = 1 and n2 ≥ 3 are trivial. According to P3, the output bits from the active S-box in round i goes to different S-boxes of distinct groups. In particular, the active S-boxes of round i+1 have a single bit difference in their inputs. Together with P4, Di+2 ≥ 4. This implies that n3 ≥ 7. Again, because of P4, we see that the active S-boxes in round i+2 have a single bit difference in their inputs. Further, in round i+2, due to P3, there are at least two groups of S-boxes which contain at least one active S-box. This means that Di+3 ≥ 4. So, n4 ≥ 11. Because of P3, there must exist two active S-boxes in round i+3 such that these two S-boxes belong to different groups. By P4, Di+4 ≥ 2 and this yields n5 ≥ 13. Since Di+5 ≥ 1 trivially holds, n6 ≥ 14. n6 ≥ 14 implies that n7 ≥ 15. Suppose n8 = 16. Note that the sequence of ni is strictly increasing. Hence n7 = 15 and n6 = 14. It follows that Di+6 = Di+7 = 1. From the earlier argument, we see that the worst case of n6 = 14 is obtained when Di+5 = 1. However by S2 and P3, there cannot be exactly one active S-box for three consecutive rounds. Hence we must have Di+7 ≥ 2, i.e. n8 ≥ 17. Finally, in a similar but slightly more complicated fashion, suppose for a contradiction that n9 = 18. Then n8 = 17 and we have the following cases: Case 1: n6 = 14,n7 = 15. Then Di+8 ≥ 4 by applying the previous argument. So n8 ≥ 21. Case 2: n6 = 14,n7 = 16. Then Di+5 = 1, Di+6 = 2 and Di+7 = 1, but this violates S2 and is thus impossible. Case 3: n6 = 15,n7 = 16. Then there are three consecutive rounds with exactly one active S-box each, which is again not possible. Therefore nk ≥ 2k +1 for k = 7,8,9. ⊓⊔ Lemma 2. Consider PR-n where n ≥ 64. Let Dj be the number of active S-boxes in round j. Suppose Di = 1 and Di−1 ≥ 2. Denote the total number of active S-boxes from round i to round (i − k + 1)
Page 1 and 2: EPCBC - A Block Cipher Suitable for
Page 3 and 4: Section 5. Hardware implementation
Page 5 and 6: 4.1 Brief Description of PR-n The d
Page 7 and 8: Theorem 4. Let ǫr be the maximal b
Page 9 and 10: fourth round. The attacker launches
Page 11 and 12: data_out 4 data_in data_out 4 data_
Page 13: It is noteworthy to stress that EPC
Page 17 and 18: Proof. The result for k = 8 follows

EPCBC - A Block Cipher Suitable for Electronic Product Code ...

Create successful ePaper yourself

Delete template?

Save as template?