Sistemas criptográficos como o RSA e o Diffie-Hellman sobre Curvas Elípticas (DHCE) têm fundamento em problemas computacionais considerados difíceis, por exemplo, o problema do logaritmo (PLD) e o problema da fatoração de inteiros (PFI). Diversos trabalhos têm relacionado a segurança desses sistemas com os problemas subjacentes. Também é investigada a segurança do LSB (bit menos significativo) da chave secreta no DHCE (no RSA é o LSB da mensagem) com relação à segurança de toda a chave. Nesses trabalhos são apresentados algoritmos que conseguem inverter os sistemas criptográficos citados fazendo uso de oráculos que predizem o LSB. Nesta dissertação, fazemos a implementação de dois desses algoritmos. Identificamos parâmetros críticos e mudamos a amostragem do formato original. Com essa mudança na amostragem conseguimos uma melhora significativa nos tempos de execução. Um dos algoritmos (ACGS), para valores práticos do RSA, era mais lento que a solução para o PFI, com nosso resultado passou a ser mais veloz. Ainda, mostramos como provas teóricas podem não definir de maneira precisa o tempo de execução de um algoritmo. / Cryptographic systems like RSA and Elliptic Curve Diffie-Hellman (DHCE) is based on computational problems that are considered hard, e.g. the discrete logarithm (PLD) and integer factorization (PFI) problems. Many papers investigated the relationship between the security of these systems to the computational difficulty of the underlying problems. Moreover, they relate the bit security, actually the LSB (Least Significant Bit), of the secret key in the DHCE and the LSB of the message in the RSA, to the security of the whole key. In these papers, algorithms are presented to invert these cryptographic systems making use of oracles that predict the LSB. In this dissertation we implement two of them. Critical parameters are identified and the original sampling is changed. With the modified sampling we achieve an improvement in the execution times. For practical values of the RSA, the algorithm ACGS becomes faster than the PFI. Moreover, we show how theoretical proofs may lead to inaccurate timing estimates.

Cette thèse s’intéresse à deux aspects de la cryptologie symétrique liés à l’utilisation de matrices MDS dans les couches de diffusion linéaires de primitives. Une première partie se fonde sur les conceptions de couches de diffusion linéaires de schémas de chiffrement symétrique à partir de matrices MDS. Les associations entre matrices récursives, respectivement circulantes, et polynômes sont calquées pour construire de nouvelles associations entre d’autres structures de matrices et des éléments d’anneaux de polynômes non commutatifs de Ore. À l’instar des matrices récursives et circulantes, ces structures bénéficient d’implémentations matérielles légères. Des codes de Gabidulin dérivent des méthodes de construction directe de telles matrices, optimales en termes de diffusion, proches d’involutions pour l’implémentation. La seconde partie développe une attaque par différenciation de permutations dont l’architecture s’inspire de l’AES. L’utilisation d’une couche de diffusion linéaire locale avec une matrice MDS induit une description macroscopique de la propagation de valeurs de différences à travers les étapes du chiffrement. Des chemins différentiels tronqués apparaissent, qui servent de point de départ à la conception d’attaques rebond. Les travaux présentés généralisent les attaques rebond connues à l’exploitation de chemins différentiels tronqués structurés non issus d’avalanches libres. Cette structure permet de ne pas consommer tous les degrés de libertés au cours d’une seule étape algorithmique mais de les répartir en trois étapes. Une attaque sur 11 tours d’une permutation de Grostl-512 est alors déployée. / This thesis focuses on two aspects of symmetric cryptology related to the use of MDS matrices as building blocks of linear layers for symmetric primitives. A first part handles designs of linear layers for symmetric ciphers based upon MDS matrices. Associations between recursive, respectively circulant, matrices and polynomials are reproduced between other matrix structures and elements in non-commutative polynomial rings of Ore. As for recursive and circulant matrices, those structures come along with lightweight hardware implementations. From Gabidulin codes are derived direct constructions of MDS matrices with properties close to involution from hardware perspectives. The second part is about distinguishing attacks on an exemple of AES-like permutations. The use of some MDS matrix to build the linear layer induces a macroscopic description of differential trails through the different steps of the algorithm computing the permutation. Truncated differential path appears, from which rebound attack are built. Original work here generalizes rebound attack applied on permutations of GROSTL-512 from structured differential path not raised from free propagations of differences. This structure allows not to consume all degrees of freedom in a simple algorithmic step but to divide this comsumption into three algorithmic steps. An attack of a reduced-round version with 11 rounds of one permutation of GROSTL-512 can then be mounted.

Les cryptosystèmes sont présents dans de nombreux appareils utilisés dans la vie courante, tels que les cartes à puces, ordiphones, ou passeports. La sécurité de ces appareils est menacée par les attaques par canaux auxiliaires, où un attaquant observe leur comportement physique pour obtenir de l’information sur les secrets manipulés. L’évaluation de la résilience de ces produits contre de telles attaques est obligatoire afin de s’assurer la robustesse de la cryptographie embarquée. Dans cette thèse, nous exhibons une méthodologie pour évaluer efficacement le taux de succès d’attaques par canaux auxiliaires, sans avoirbesoin de les réaliser en pratique. En particulier, nous étendons les résultats obtenus par Rivain en 2009, et nous exhibons des formules permettant de calculer précisément le taux de succès d’attaques d’ordre supérieur. Cette approche permet une estimation rapide de la probabilité de succès de telles attaques. Puis, nous étudions pour la première fois depuis le papier séminal de Ishai, Sahai et Wagner en 2003 le problème de la quantité d’aléa nécessaire dans la réalisation sécurisée d’une multiplication de deux bits. Nous fournissons des constructions explicites pour des ordres pratiques de masquage, et prouvons leur sécurité et optimalité. Finalement, nous proposons un protocole permettant le calcul sécurisé d’un veto parmi un nombre de joueurs arbitrairement grand, tout en maintenant un nombre constant de bits aléatoires. Notre construction permet également la multiplication sécurisée de n’importe quel nombre d’éléments d’un corps fini. / Cryptosystems are present in a lot of everyday life devices, such as smart cards, smartphones, set-topboxes or passports. The security of these devices is threatened by side-channel attacks, where an attacker observes their physical behavior to learn information about the manipulated secrets. The evaluation of the resilience of products against such attacks is mandatory to ensure the robustness of the embedded cryptography. In this thesis, we exhibit a methodology to efficiently evaluate the success rate of side-channel attacks, without the need to actually perform them. In particular, we build upon a paper written by Rivainin 2009, and exhibit explicit formulaes allowing to accurately compute the success rate of high-order side-channel attacks. We compare this theoretical approach against practical experiments. This approach allows for a quick assessment of the probability of success of any attack based on an additive distinguisher. We then tackle the issue of countermeasures against side- channel attacks. To the best of our knowledge, we study for the first time since the seminal paper of Ishai, Sahai and Wagner in 2003 the issue of the amount of randomness in those countermeasures. We improve the state of the art constructions and show several constructions and bounds on the number of random bits needed to securely perform the multiplication of two bits. We provide specific constructions for practical orders of masking, and prove their security and optimality. Finally, we propose a protocolallowing for the private computation of a secure veto among an arbitrary large number of players, while using a constant number of random bits. Our construction also allows for the secure multiplication of any number of elements of a finite field.

Le chiffrement complètement homomorphe est une classe de chiffrement permettant de calculer n’importe quelle fonction sur des données chiffrées et de produire une version chiffrée du résultat. Il permet de déléguer des données à un cloud de façon sécurisée, faire effectuer des calculs, tout en gardant le caractère privé de ces données. Cependant, l’innéficacité actuelle des schémas de chiffrement complètement homomorphes, et leur inadéquation au contexte de délégation de calculs, rend son usage seul insuffisant pour cette application. Ces deux problèmes peuvent être résolus, en utilisant ce chiffrement dans un cadre plus large, en le combinant avec un schéma de chiffrement symétrique. Cette combinaison donne naissance au chiffrement complètement homomorphe hybride, conçu dans le but d’une délégation de calculs efficace, garantissant des notions de sécurité et de vie privée. Dans cette thèse, nous étudions le chiffrement complètement homomorphe hybride et ses composantes, à travers la conception de primitives cryptographiques symétriques rendant efficace cette construction hybride. En examinant les schémas de chiffrement complètement homomorphes, nous developpons des outils pour utiliser efficacement leurs propriétés homomorphiques dans un cadre plus complexe. En analysant différents schémas symétriques, et leurs composantes, nous déterminons de bons candidats pour le contexte hybride. En étudiant la sécurité des constructions optimisant l’évaluation homomorphique, nous contribuons au domaine des fonctions booléennes utilisées en cryptologie. Plus particulièrement, nous introduisons une nouvelle famille de schémas de chiffrement symétriques, avec une nouvelle construction, adaptée au contexte hybride. Ensuite, nous nous intéressons à son comportement homomorphique, et nous étudions la sécurité de cette construction. Finalement, les particularités de cette famille de schémas de chiffrement motivant des cryptanalyses spécifiques, nous développons et analysons de nouveaux critères cryptographiques booléens. / Fully homomorphic encryption, firstly built in 2009, is a very powerful kind of encryption, allowing to compute any function on encrypted data, and to get an encrypted version of the result. Such encryption enables to securely delegate data to a cloud, ask for computations, recover the result, while keeping private the data during the whole process. However, today’s inefficiency of fully homomorphic encryption, and its inadequateness to the outsourcing computation context, makes its use alone insufficient for this application. Both of these issues can be circumvented, using fully homomorphic encryption in a larger framework, by combining it with a symmetric encryption scheme. This combination gives a hybrid fully homomorphic framework, designed towards efficient outsourcing computation, providing both security and privacy. In this thesis, we contribute to the study of hybridfully homomorphic framework, through the analysis, and the design of symmetric primitives making efficient this hybrid construction. Through the examination of fully homomorphic encryption schemes, we develop tools to efficiently use the homomorphic properties in a more complex framework. By investigating various symmetric encryption schemes, and buildingblocks up to the circuit level, we determine good candidates for a hybrid context. Through evaluating the security of constructions optimizing the homomorphic evaluation, we contribute to a wide study within the cryptographic Boolean functions area. More particularly, we introduce a new family of symmetric encryption schemes, with a new design, adapted to the hybrid fully homomorphic framework. We then investigate its behavior relatively to homomorphic evaluation, and we address the security of such design. Finally, particularities of this family of ciphers motivate specific cryptanalyses, therefore we develop and analyze new cryptographic Boolean criteria.

In historical cryptography, a cipher key represents a set of rules by which we can convert between plaintext and ciphertext within an encryption system. Presently, there are not many studies that focus on analysing keys,especially not on a large scale or done in a systematic manner. In this paper, we describe a uniform transcription standard for the keys in the DECODE database. This way, we intend to lay a strong foundation to facilitate further studies on large sets of key transcriptions. We believe that a homogeneous set of transcriptions would be an ideal starting point for comparative studies, especially from a chronological perspective, as this can reveal potential patterns in the evolution of encryption methods. We also build a script that can perform an in-depth analysis of the components of a key, using our standardized transcription files as input. Finally, we give a detailed account of our findings and show that our method can reliably extract valuable information from the transcription file, such as the method of encryption or the types of symbols used for encoding, without the need of additional manual analysis of the original key.

abstract: Lattice-based Cryptography is an up and coming field of cryptography that utilizes the difficulty of lattice problems to design lattice-based cryptosystems that are resistant to quantum attacks and applicable to Fully Homomorphic Encryption schemes (FHE). In this thesis, the parallelization of the Residue Number System (RNS) and algorithmic efficiency of the Number Theoretic Transform (NTT) are combined to tackle the most significant bottleneck of polynomial ring multiplication with the hardware design of an optimized RNS-based NTT polynomial multiplier. The design utilizes Negative Wrapped Convolution, the NTT, RNS Montgomery reduction with Bajard and Shenoy extensions, and optimized modular 32-bit channel arithmetic for nine RNS channels to accomplish an RNS polynomial multiplication. In addition to a full software implementation of the whole system, a pipelined and optimized RNS-based NTT unit with 4 RNS butterflies is implemented on the Xilinx Artix-7 FPGA(xc7a200tlffg1156-2L) for size and delay estimates. The hardware implementation achieves an operating frequency of 47.043 MHz and utilizes 13239 LUT's, 4010 FF's, and 330 DSP blocks, allowing for multiple simultaneously operating NTT units depending on FGPA size constraints. / Dissertation/Thesis / Masters Thesis Electrical Engineering 2020

In 2016 the National Institute of Standards and Technology (NIST) started the stan- dardization process for lightweight cryptography (LWC). We provide a broad introduc- tion to lightweight cryptography together with a survey of current design trends and lightweight cryptography standards, with special attention to this competition. In the second part, we present a description and cryptoanalysis of three lightweight ciphers: SIV-Rijndael256, CLX, and Limdolen. 1

京都大学 / 新制・課程博士 / 博士(情報学) / 甲第23317号 / 情博第753号 / 新制||情||129(附属図書館) / 京都大学大学院情報学研究科社会情報学専攻 / (主査)教授 神田 崇行, 教授 吉川 正俊, 教授 岡部 寿男 / 学位規則第4条第1項該当 / Doctor of Informatics / Kyoto University / DFAM

The Keccak Sponge Function is the winner of the National Institute of Standards and Technology (NIST) competition to develop the Secure Hash Algorithm-3 Standard (SHA-3). Prior work has developed reference implementations of the algorithm and described the structures necessary to harden the algorithm against power analysis attacks which can weaken the cryptographic properties of the hash algorithm. This work demonstrates the architectural changes to the reference implementation necessary to achieve the theoretical side channel-resistant structures, compare their efficiency and performance characteristics after synthesis and place-and-route when implementing them on Field Programmable Gate Arrays (FPGAs), publish the resulting implementations under the Massachusetts Institute of Technology (MIT) open source license, and show that the resulting implementations demonstrably harden the sponge function against power analysis attacks.

The theme of the thesis is Physical Unclonable Functions (PUF). The following objectives were assigned: to provide a literature research concerning PUFs, to perform a property analysis to select appropriate type of PUF for implementation and to realize an authentication cryptosystem based on the chosen PUF. Based on the research, the cryptosystem was designed based on ring oscillator PUF. The proposed cryptosystem is tested in several scenarios with the maximal rate of successful authentication of 81%. The cryptosystem also allows to be used for device identification. Furthermore, the results were discussed and suitable improvements of design was proposed. Besides the cryptosystem itself, the thesis also introduced a unique comparison of existing types of PUFs.