86 lines
2.7 KiB
Markdown
86 lines
2.7 KiB
Markdown
# Modern Stream Ciphers
|
|
|
|
### Pseudo-randomness
|
|
|
|
- TRNGs - True Random Number Generators
|
|
- Not feasible at scale
|
|
- PRNGs - Pseudo-random Number Generators
|
|
- CSPRNGs - Cryptographically Secure Pseudo-random Number Generators
|
|
|
|
#### LFSRs
|
|
|
|
- A linear-feedback shift register is a register of bits whose positions shift to the right
|
|
- Usually comprised of flip-flops, the last bit represents the output
|
|
|
|
(Where the squares at the bottom are flip-flops)
|
|
|
|
- If initialised to `000`, nothing happens as $0\oplus0 = 0$.
|
|
- Therefore, we have $2^n-1$ states
|
|
- Statistical randomness
|
|
- To add more randomness to the setup, we can add another (more) `xor` gate
|
|
- However, we have fewer states
|
|
|
|
$$
|
|
s_m \equiv s_{m-1}p_{m-1} + ... + s_1p_1 + s_0p_0\space (mod \space 2)\\
|
|
s_{m+1} \equiv s_{m}p_{m-1} + ... + s_2p_1 + s_1p_0\space (mod \space 2)
|
|
$$
|
|
|
|
- We usually represent m-bit LFSRs using polynomials of degree m.
|
|
- In general $P(x)=x^m + p_{m-1}x^{m-1} + ... + p_1x + p_0$
|
|
- LFSRs that have primitive polynomials produce sequences of maximum length
|
|
- There are many, and they are easily computed
|
|
- $x^5 + x^2 + 1$ has 31 states
|
|
- $x^{10} + x^3 + 1$ has 1023
|
|
- $x^{85}+x^8+x^2+x+1$ has $10^{26}$ states
|
|
|
|
##### Attacking LFSRs
|
|
|
|
Suppose an attacker knows $2m-1$ plain text bits
|
|
|
|
**Step 1** Calculate key bits
|
|
|
|
$s_i \equiv y_i + x_i \space (mod\space 2), i=0,1,...2_{m-1}$
|
|
|
|
**Step 2** Reconstruct the LFSR
|
|
|
|
$s_m \equiv s_{m-1}p_{m-1} + ... + s_1p_1 + s_0p_0$
|
|
|
|
$s_{m+1} \equiv s_{m}p_{m-1} + ... + s_2p_1 + s_1p_0$
|
|
|
|
…
|
|
|
|
$s_{2m+1} \equiv s_{2m-1}p_{m} + ... + s_mp_1 + s_{m-1}p_0$
|
|
|
|
#### Trivium
|
|
|
|
- LFSRs are much more cryptographically secure if we combine more than one together in a non-linear way.
|
|
|
|
Trivium is 3 LFSRs in a row
|
|
|
|
- Feedback between each with non-linear AND gates
|
|
- Initialises the LFSR with an 80-bit key and 80-bit random value
|
|
|
|
### ChaCha20
|
|
|
|
- ChaCha is a stream cipher written by Daniel Bernstein
|
|
- A modification of a previous cipher, Salsa
|
|
- Very lightweight, using only `add`, `xor` and rotate operations
|
|
- One of two ciphers in `TLS 1.3`
|
|
- Dashes represent bit length
|
|
- Constants are not secret
|
|
- The block number can skip to anywhere
|
|
- Suppose someone skips ahead on a video stream, the cipher can skip unlike other synchronous stream ciphers
|
|
- Works well on low power devices, due to simplicity of encryption
|
|
- Once the input and the mixed words are added together it is hard to know what the starting thing was
|
|
- e.g. what two numbers have I added to make 100
|
|
|
|
ChaCha performs **20** rounds
|
|
|
|
- Alternates column and diagonal rounds
|
|
- Each round is 4 quarter rounds
|
|
|
|
#### Vulnerabilities
|
|
|
|
- Stream ciphers like ChaCha give us *confidentiality*, but *not integrity*
|
|
- Running a stream cipher by itself is not sufficient
|