Information Leakage of VGF2 Structure

Abstract

The block cipher VGF2 was designed at Inscrypt 2009. It was based on a new variant of generalized Feistel structure. By checking the property of the linear permutation, we find a full round differential in VGF2 with probability 1. Since this differential cannot distinguish the correct unknown key from the wrong keys, we fail in launching a key-recovery attack on this structure. However, we may guess half part of the plaintext without calculating the key. And we notice that this weakness may cause insecurity in some special environments.

1. Introduction

The architecture is one of the most important parts of block ciphers. It will directly affect the implementation performance and the choice of round number. Architectures of block ciphers could be roughly classified by SP structure [1] and Feistel family structure [2, 3]. The SP structure can provide a fast diffusion, but usually its decryption and encryption processes cannot be similar. Feistel family structures is another important structure, and it provides flexibility in the design of round function and decryption-encryption similarity; however, since only part of the input data goes through the round function in each round, these structures need more rounds to achieve enough diffusion.

Reference [4] proposed a new block cipher called VGF2. Its architecture can be considered as an extension of combining the SPN structure and generalized Feistel network together. It keeps the advantages of both SPN structure and the generalized Feistel network. It can achieve full diffusion very quickly, and decryption-encryption processes of this structure are similar.

In the design of VGF2, the original idea to achieve better diffusion is to use an involutory transformation with good branch number to replace the switch transformation. In [4], security levels of the structure against many cryptanalysis such as differential, linear, impossible differential, and integral cryptanalysis are also estimated.

In this paper, we find some information leakage in VGF2 structure. For arbitrary rounds VGF2 structure, we obtain two differentials with probability 1. Since these differentials cannot distinguish the correct key from the wrong keys, we fail in launching a key-recovery attack on this structure. However, we may guess half part of the plaintext without calculating the key.

The rest of this paper is organized as follows. Section 2 provides a description of VGF2, Section 3 presents the differential properties of VGF2 structure, and Section 4 introduces the information leakage of VGF2 cipher. As an application, Section 5 launches an attack on VGF2-based CMAC whose underlying block cipher is VGF2; in this attack, we can find a fake “familiar” message within 2⁶⁴ CMAC operations, and the successful rate reaches 0.393. In Section 6, we conclude this paper.

2. Description of VGF2 Structure

Throughout this paper, ⊕ denotes the bitwise XOR and + denotes the addition over real number space.

Now we will give a brief description of VGF2 structure.

All the states in VGF2 are split into 4 subblocks of equal size, and then the input and output blocks of each round can be denoted as 𝑋=(𝑋₀,𝑋₁,𝑋₂,𝑋₃), and 𝑌=(𝑌₀,𝑌₁,𝑌₂,𝑌₃) respectively. For the sake of convenience, we will introduce two transformations as follows:(i)𝑅 layer: 𝑅(𝑋₀,𝑋₁,𝑋₂,𝑋₃)=(𝑍₀,𝑍₁,𝑍₂,𝑍₃)=(𝑋₀,𝐹_𝑘(𝑋₀)⊕𝑋₁,𝑋₂,𝐹_𝑘(𝑋₂)⊕𝑋₃), where 𝐹_𝑘 is the round function;(ii)𝑄 layer: 𝑄𝑍₀,𝑍₁,𝑍₂,𝑍₃=𝑌₀𝑌₁𝑌₂𝑌₃=𝑄_4×4⋅𝑍₀𝑍₁𝑍₂𝑍₃=⋅1011𝑍011111101101⁰𝑍₁𝑍₂𝑍₃. (1)

One round VGF2 structure is composed of two layers (see Figure 1); that is, round_VGF2𝑋₀,𝑋₁,𝑋₂,𝑋₃=𝑄∘𝑅𝑋₀,𝑋₁,𝑋₂,𝑋₃. (2)

Figure 1 

One round of VGF2 structure.

3. Differential Properties of VGF2 Structure

In this section, we will introduce the differential properties of VGF2 structure.

Lemma 1. Let 𝑅(𝑋₀,𝑋₁,𝑋₂,𝑋₃)=(𝑋₀,𝐹(𝑋₀)⊕𝑋₁,𝑋₂,𝐹(𝑋₂)⊕𝑋₃), where 𝐹 is a bijection. Then, both differentials are with probability 1 of the following:(1)(𝛼,𝛽,0,𝛼)→(𝛼,𝛾,0,𝛼), (2)(0,𝛼,𝛼,𝛽)→(0,𝛼,𝛼,𝛾).

Proof. Let (𝑥₀,𝑥₁,𝑥₂,𝑥₃) and (𝑥₀⊕𝛼,𝑥₁⊕𝛽,𝑥₂,𝑥₃⊕𝛼) be inputs of the 𝑅 layer. Then, output differential of the 𝑅 layer is calculated by 𝑅𝑥₀,𝑥₁,𝑥₂,𝑥₃⊕𝑅𝑥₀⊕𝛼,𝑥₁⊕𝛽,𝑥₂,𝑥₃=𝑥⊕𝛼₀,𝐹𝑥₀⊕𝑥₁,𝑥₂,𝐹𝑥₂⊕𝑥₃⊕𝑥₀⊕𝛼,𝐹𝑥₀⊕𝛼⊕𝑥₁⊕𝛽,𝑥₂,𝐹𝑥₂⊕𝑥₃=𝑥⊕𝛼𝛼,𝐹₀⊕𝐹𝑥₀⊕𝛼⊕𝛽,0,𝛼. (3) Assume that 𝐹(𝑥₀)⊕𝐹(𝑥₀⊕𝛼)⊕𝛽=𝛾, and we conclude that differential (𝛼,𝛽,0,𝛼)→(𝛼,𝛾,0,𝛼) is with probability 1. The second differential can be obtained in a similar way.

It is well known that if 𝑓(𝑥) is a linear transformation over 𝐹^𝑛_2𝑙, then 𝑓(Δ𝑥⊕𝑥)⊕𝑓(𝑥)=𝑓(Δ𝑥). Base on this rule, we have.

Theorem 2. For the VGF2 structure, there exists 1-round differential whose probability is equal to 1 as follows:(1)(𝑎,𝑏,0,𝑎)→(0,𝑐,𝑐,𝑑), (2)(0,𝑐,𝑐,𝑑)→(𝑎,𝑏,0,𝑎).

Proof. Since 1-round VGF2 structure can be expressed by 𝑄∘𝑅, by Lemma 1, we have (𝑎,𝑏,0,𝑎)−−−−−−−−→^1st𝑅layer(𝑎,𝑒,0,𝑎) with probability 1; hence, the output of the first round is 𝑎𝑒0𝑎=⋅𝑎𝑒0𝑎=0𝑒𝑄⋅1011011111101101𝑒⊕𝑎𝑒⊕𝑎. (4) Let 𝑒⊕𝑎=𝑐 and 𝑒=𝑑, then we obtain this theorem. Similarly, we can prove the second case.

Obviously, we have the following.

Theorem 3. For the VGF2 structure, if 𝑟≡0mod2, then 𝑟-round differential (𝑥,𝑦,0,𝑥)−−−−−→^{(𝑄∘𝑅)𝑟}(𝑢,𝑣,0,𝑢) and (0,𝑥,𝑥,𝑦)−−−−−→^{(𝑄∘𝑅)𝑟}(0,𝑢,𝑢,𝑣) are both with probability 1. If 𝑟≡1mod2, then 𝑟-round differential(𝑥,𝑦,0,𝑥)−−−−−→^{(𝑄∘𝑅)𝑟}(0,𝑢,𝑢,𝑣) and (0,𝑥,𝑥,𝑦)−−−−−→^{(𝑄∘𝑅)𝑟}(𝑢,𝑣,0,𝑢) are both with probability 1.

4. Information Leakage of VGF2 Structure

Base on the VGF2 structure, [4] proposed a 16-round and 256-bit block cipher VGF2 with the last 𝑄 layer omitted.

Since traditional differential cryptanalysis [5] uses high-probability characteristics or differentials to distinguish the correct unknown keys from the wrong keys. When a correct key is used to decrypt the last few rounds of many pairs of ciphertexts, it is expected that the difference predicted by the differential appears frequently, while when a wrong key is used, the difference occurs less frequently. However, differentials detected in this paper expose equal probability under any key; thus, we cannot launch a differential attack on this structure. But we may still conclude the following observation.

Observation 1. For VGF2 cipher, if we get a plain/ciphertext pair (𝑚₀,𝑚₁,𝑚₂,𝑚₃) and (𝑐₀,𝑐₁,𝑐₂,𝑐₃), then for any ciphertext in set {(𝑐₀⊕𝑢,𝑣,𝑐₂,𝑐₃⊕𝑢)∶𝑢,𝑣∈𝐹₂⁶⁴}, we can predict that the plaintext is in the set {(𝑚₀,𝑥⊕𝑚₁,𝑥⊕𝑚₂,𝑦)∶𝑥,𝑦∈𝐹₂⁶⁴}. When ciphertext is chosen from the set {(𝑐₀,𝑐₁⊕𝑢,𝑐₂⊕𝑢,𝑣)∶𝑢,𝑣∈𝐹₂⁶⁴}, we can affirm that the plaintext is from set {(𝑥⊕𝑚₀,𝑦,𝑚₂,𝑥⊕𝑚₀)∶𝑥,𝑦∈𝐹₂⁶⁴}.

This weakness may bring insecurity under some special environments, and in next section, we will provide an example.

5. An Example Attack on VGF2-Based CMAC

MAC functions based on block ciphers are of great practical significance. And it is a well-known method to generate a Message Authentication Code (MAC) based on a block cipher in CBC-like mode. In this section, we will attack VGF2-based CMAC [6], which is recommended by NIST. This way of implementing a block cipher is independent of the actual block cipher being used, and so we can restrict this mode of use on VGF2 cipher. The CMAC algorithm divides message 𝑃 into (𝑃₁,…,𝑃_𝑛−1,𝑃^∗_𝑛), where each 𝑃_𝑖 is 256 bits length, and if the length of 𝑃^∗_𝑛 is 256 bit, then 𝑃_𝑛=𝑘₁⊕𝑃^∗_𝑛; else, 𝑃_𝑛=𝑘₂⊕(𝑃^∗_𝑛⊕10^𝑗), where 𝑗=256×𝑛−(lengthofmessage𝑃)−1 (see Figure 2).

Figure 2 

CMAC algorithm.

Since the remaining part of CMAC does not affect the attack procedure, we just focus on the CBC core (see Figure 3). Our target is to fake a similar message of (𝑃₁,…,𝑃_𝑛−1,𝑃^∗_𝑛). In fact, the attack below can be extended to most CBC-like MACs.

Figure 3 

The CBC core.

Step 1. Choose any 1≤𝑖<𝑗≤𝑛−1, and replace 𝑃_𝑖 by 𝑃_𝑖^′=𝑃_𝑖⊕(𝑥,𝑦,0,𝑥), where 𝑥,𝑦 are randomly chosen from {0,1}⁶⁴ and (𝑥,𝑦)≠(0,0).

Step 2. If 𝑗−𝑖≡0mod2, we replace 𝑃_𝑗 by 𝑃^′_𝑗=𝑃_𝑗⊕(𝑢,𝑣,0,𝑢); otherwise, replace 𝑃_𝑗 by 𝑃^′_𝑗=𝑃_𝑗⊕(0,𝑢,𝑢,𝑣), where 𝑢,𝑣 are randomly chosen from {0,1}⁶⁴⧵{0}.

Step 3. Compute CMAC(𝑃₁,…,𝑃^′_𝑖,…,𝑃^′_𝑗,…,𝑃^∗_𝑛); if CMAC𝑃₁,…,𝑃^′_𝑖,…,𝑃^′_𝑗,…,𝑃^∗_𝑛=CMAC𝑃₁,…,𝑃^∗_𝑛, (5) the program output (𝑃₁,…,𝑃^′_𝑖,…,𝑃^′_𝑗,…,𝑃^∗_𝑛).

When we introduce a randomly chosen difference (𝑥,𝑦,0,𝑥) in the 𝑖th block, then by Observation 1, we may conclude that for any integer 𝑘≥0, output difference of the (𝑖+2𝑘−1)th and the (𝑖+2𝑘)th blocks are (0,𝑥^′,𝑥^′,𝑦^′) and (𝑥^′′,𝑦^′′,0,𝑥^′′), respectively, where 𝑥^′,𝑦^′,𝑥^′′,𝑦^′′ are randomly picked up from {0,1}⁶⁴. Consider 𝑗=(𝑖+2𝑘) case; only when 𝑃_𝑗⊕(𝑢,𝑣,0,𝑢)=𝑃^′_𝑗=𝑃_𝑗⊕𝐶^′_𝑗−1=𝑃_𝑗⊕(𝑥^′′,𝑦^′′,0,𝑥^′′),thatis,𝑢=𝑥^′′ and 𝑣=𝑦^′′, we can obtain a collision.

We choose 2⁶⁴ pairs of ((𝑥,𝑦),(𝑢,𝑣)). And the successful rate is calculated by the birthday paradox; that is, 1−²⁶⁴⁻¹_𝑖=02¹²⁸−𝑖2¹²⁸=1−²⁶⁴⁻¹_𝑖=0𝑖1−2¹²⁸≃1−𝑒^−2128/2129=1−𝑒^−0.5≃0.393. (6)

We can analyze 𝑗=(𝑖+2𝑘−1) case similarly.

Since all but two of the original message blocks are reserved, the fake message may probably be a meaningful message. And this may increase the risk of CMAC.

6. Conclusion

In this paper, we find two differentials in VGF2 structure whose probability is 1. Since these differentials cannot distinguish the correct key from wrong ones, we failed in launching a key-recovery attack on VGF2 structure. However, this property causes a significant information leakage; it allows us to obtain half part of the plaintext without calculating the key, and this may lead to some weakness in special environments.

In spite of the weakness presented in this paper, VGF2 structure retains some attractive features such as high diffusion and similarity in both decryption and encryption processes. And we believe that all these good features are caused by properties of matrix 𝑄; since its branch number reaches 4 [4], the whole structure can provide high diffusion, and also the involutory choice of matrix 𝑄 ensures the structure involutory. However, the binary matrix is not a good choice, which makes our attacks succeed. This motivates us to explore the possibility of improving 𝑄 that retains all the good properties of the VGF2 structure and yet is secure against our attacks. The best beneficial way to achieve this goal is to propose a new nonbinary matrix 𝑄, which can retain both large branch number and involution, for example, involutory MDS matrix. Then, the proof will be invalid for this case.

Acknowledgment

The work in this paper is supported by the Natural Science Foundation of China (Grant no. 61272488, 61272041, and 61202491).