User:Topsoee/sandbox

Interpolation attack
After the two attacks, differential cryptanalysis and linear cryptanalysis, were presented on block ciphers, some new block ciphers were introduced, which were proven secure against differential and linear attacks. Among these there were some iterated block ciphers such as the KN-Cipher and the SHARK cipher. However, Thomas Jackobsen and Lars Knudsen showed in the late 90's that these ciphers were easy to break by introducing a new attack called the interpolation attack.

In its simplest version an interpolation attack expresses the ciphertext as a polynomial of the plaintext. If the polynomial has a relative low number of unknown coefficients, then with a collection of plaintext/ciphertext (p/c) pairs, the polynomial can be reconstructed. With the polynomial reconstructed the attacker then has a representation of the encryption, without exact knowledge of the secret key.

The interpolation attack can also be used to recover the secret key.

Example
Let an iterated cipher be given by
 * $$ c_i=(c_{i-1}\oplus k_i)^3,$$

where $$c_0$$ is the plaintext, $$k_i\in K$$ is the secret round key, and for a $$r$$-round iterated cipher, $$c_r$$ is the ciphertext.

Consider the 2-round cipher. Let $$x$$ denote the message, and $$c$$ denote the ciphertext.

Then the output of round 1 becomes
 * $$c_1=(x+ k_1)^3=(x^2+ k_1^2)(x + k_1)=x^3+ k_1^2x+ x^2k_1+ k_1^3,$$

and the output of round 2 becomes
 * $$ c_2=c=(c_1+ k_2)^3=(x^3+ k_1^2x+ x^2k_1+ k_1^3+ k_2)^3 $$
 * $$ =x^9+ x^8k_1+ x^6k_2+ x^4k_1^2k_2+ x^3k_2^2+ x^2(k_1k_2^2+k_1^4k_2)

+ x(k_1^2k_2^2+k_1^8)+ k_1^3k_2^2+ k_1^9+ k_2^3, $$ Express the ciphertext as a polynomial of the plaintext yields
 * $$p(x)=a_1x^9+ a_2x^8+ a_3x^6+ a_4x^4+ a_5x^3+ a_6x^2+ a_7x+ a_8,$$

where the $$a_i$$'s are key dependent constants.

Using as many plaintext/ciphertext pairs as the number of unknown coefficients in the polynomial $$p(x)$$, then we can construct the polynomial. This can for example be done by Lagrange Interpolation (see Lagrange polynomial). When the unknown coefficients have been determined, then we have an representation $$p(x)$$ of the encryption, without knowledge of the secret key $$K$$.

Existence
Considering an $$m$$-bit block cipher, then there are $$2^m$$ possible plaintexts, and therefore $$2^m$$ distinct $$p/c$$ pairs. Let there be $$n$$ unknown coefficients in $$p(x)$$. Since we require as many $$p/c$$ pairs as the number of unknown coefficients in the polynomial, then an interpolation attack exist only if $$n\leq 2^m$$.

Time complexity
Assume that the time to construct the polynomial $$p(x)$$ using $$p/c$$ pairs are small, in comparison to the time to encrypt the required plaintexts. Let there be $$n$$ unknown coefficients in $$p(x)$$. Then the time complexity for this attack is $$n$$, requiring $$n$$ known distinct $$p/c$$ pairs.

Interpolation attack by Meet-In-The-Middle
Often this method is more efficient. Here is how it is done.

Given an $$r$$ round iterated cipher with block length $$m$$, let $$z$$ be the output of the cipher after $$s$$ rounds with $$s<r$$. We will express the value of $$z$$ as a polynomial of the plaintext $$x$$, and as a polynomial of the ciphertext $$c$$. Let $$g(x)\in GF(2^m)[x]$$ be the expression of $$z$$ via $$x$$, and let $$h(c)\in GF(2^m)[c]$$ be the expression of $$z$$ via $$c$$. The polynomial $$g(x)$$ is obtain by computing forward using the iterated formula of the cipher until round $$s$$, and the polynomial $$h(c)$$ is obtain by computing backwards from the iterated formula of the cipher starting from round $$r$$ until round $$s+1$$.

So it should hold that
 * $$g(x)=h(c),$$

and if both $$g$$ and $$h$$ are polynomials with a low number of coefficients, then we can solve the equation for the unknown coefficients.

Time complexity
Assume that $$g(x)$$ can be expressed by $$p$$ coefficients, and $$h(c)$$ can be expressed by $$q$$ coefficients. Then we would need $$p+q$$ known distinct $$p/c$$ pairs to solve the equation by setting it up as a matrix equation. However, this matrix equation is solvable up to a multiplication and an addition. So to make sure that we get an unique and non-zero solution, we set the coefficient corresponding to the highest degree to one, and the constant term to zero. Therefore $$p+q-2$$ known distinct $$p/c$$ pairs are required. So the time complexity for this attack is $$p+q-2$$, requiring $$p+q-2$$ known distinct $$p/c$$ pairs.

By the Meet-In-The-Middle approach the total number of coefficients is usually smaller than using the normal method. This makes the method more efficient, since less $$p/c$$ pairs are required.

Key-recovery
We can also use the interpolation attack to recover the secret key $$K$$.

If we remove the last round of an $$r$$-round iterated cipher with block length $$m$$, the output of the cipher becomes $$\tilde{y}=c_{r-1}$$. Call the cipher the reduced cipher. The idea is to make a guess on the last round key $$k_r$$, such that we can decrypt one round to obtain the output $$\tilde{y}$$ of the reduced cipher. Then to verify the guess we use the interpolation attack on the reduced cipher either by the normal method or by the Meet-In-The-Middle method. Here is how it is done.

By the normal method we express the output $$\tilde{y}$$ of the reduced cipher as a polynomial of the plaintext $$x$$. Call the polynomial $$p(x)\in GF(2^m)[x]$$. Then if we can express $$p(x)$$ with $$n$$ coefficients, then using $$n$$ known distinct $$p/c$$ pairs, we can construct the polynomial. To verify the guess of the last round key, then check with one extra $$p/c$$ pair if it holds that
 * $$p(x)=\tilde{y}.$$

If yes, then with high probability the guess of the last round key was correct. If no, then make another guess of the key.

By the Meet-In-The-Middle method we express the output $$z$$ from round $$s<r$$ as a polynomial of the plaintext $$x$$ and as a polynomial of the output of the reduced cipher $$\tilde{y}$$. Call the polynomials $$g(x)$$ and $$h(\tilde{y})$$, and let them be expressed by $$p$$ and $$q$$ coefficients, respectively. Then with $$q+p-2$$ known distinct $$p/c$$ pairs we can find the coefficients. To verify the guess of the last round key, then check with one extra $$p/c$$ pair if it holds that
 * $$g(x)=h(\tilde{y}).$$

If yes, then with high probability the guess of the last round key was correct. If no, then make another guess of the key.

Once we have found the correct last round key, then we can continue in a similar fashion on the remaining round keys.

Time complexity
With a secret round key of length $$m$$, then there are $$2^m$$ different keys. Each with probability $$1/2^m$$ to be correct if chosen at random. Therefore we will on average have to make $$1/2\cdot 2^m$$ guesses before finding the correct key.

Hence, the normal method have average time complexity $$2^{m-1}(n+1)$$, requiring $$n+1$$ known distinct $$c/p$$ pairs, and the Meet-In-The-Middle method have average time complexity $$2^{m-1}(p+q-1)$$, requiring $$p+q-1$$ known distinct $$c/p$$ pairs.

Real world application
The Meet-in-the-middle attack can be used in a variant to attack S-boxes, which uses the inverse function, because with an $$m$$-bit S-box then $$S: f(x)=x^{-1}=x^{2^m-2}$$ in $$GF(2^m)$$.

The block cipher SHARK uses SP-network with S-box $$S:f(x)=x^{-1}$$. The cipher is resistant against differential and linear cryptanalysis after a small number of rounds. However it was broken in 1996 by Jakobsen and Knudsen, using interpolation attack. Denote by SHARK$$(n,m,r)$$ a version of SHARK with block size $$nm$$ bits using $$n$$ parallel $$m$$-bit S-boxes in $$r$$ rounds. Jakobsen and Knudsen found that there exist an interpolation attack on SHARK$$(8,8,4)$$ (64-bit block cipher) using about $$2^{21}$$ chosen plaintexts, and an interpolation attack on SHARK$$(8,16,7)$$ (128-bit block cipher) using about $$2^{61}$$ chosen plaintexts.

Reference "Fast Software Encryption": 4th International Workshop, FSE'97, Haifa, Israel January 1997,Springer, Capter 3: "The interpolation attack on block ciphers" by Thomas Jakobsen, Lars Knudsen