Issues around Quality of Service (QoS) and security for Voice over IP (VoIP) have been extensively investigated separately, due to the great attention this technology currently attracts. The specific problem this work addresses centres upon the selection of optimal parameters for QoS and security for VoIP streams integrating both network impairments and user perception metrics into a novel empirically-driven approach. Specifically, the simulation model seeks the optimal parameters in terms of variable VoIP payloads, iterative block ciphers, codecs and authentication mechanisms to be used, so that optimum tradeoff between a set of conflicting factors is achieved. The model employs the widely used Transmission Rating Factor, R, as the methodology to predict and measure the perceived QoS based on current transmission and network impairments. The R factor is then used to map perceived QoS to the corresponding Mean Opinion Score value, which gives the average estimation of perceived voice quality (Quality of Experience). Furthermore, a genetic algorithm (GA) has been developed that uses the output from the simulation model as an input into an offline optimisation routine that simultaneously maximises the VoIP call volumes and the Level of Encryption (LoE) per call basis, without degrading the perceived quality of service under a specific threshold as dictated by the R factor. The solutions reflect the optimum combination of parameters for each codec used and due to the small size of the search space the actual speed of GA has been validated against an exhaustive search algorithm. The results extracted from this study demonstrate that under strict and pre-defined parameters the default payload size supported by the codecs is not the optimal selection in terms of call volume maximisation and perceived QoS when encryption is applied.

This research investigated methods to determine appropriate security protocols for specific wireless network applications. The specific problem being addressed was that there are tradeoffs between security, performance, and efficiency among current and proposed security protocols. Performance and efficiency issues are particularly important in wireless networks which tend to have constrained network capacity and connect to resource-limited nodes. Existing security protocols address problems such as authentication, availability, confidentiality, integrity, and non-repudiation. However, these protocols use resources and limit the efficient use of node resources. Thus, the overall objective of this research is to improve the efficiency of security mechanisms for wireless networks. A methodology was constructed to satisfy this objective and is an important contribution of this research. The methodology can be used to define the relevant operational parameters of different wireless network applications, classify wireless networks into distinct categories, incorporate appropriate security protocols to a category, and analyze the security protocols through metrics. Three groups of operational parameters were created to classify wireless networks; these are equipment, network topology, and communication characteristics. The wireless network categories include, but are not limited to, fixed broadband wireless networks, wireless local area networks, mobile ad hoc networks, and small device sensor networks. The metrics in the methodology are used to measure end-to-end data throughput and delay, efficiency and overhead, power and energy consumption, and energy consumed per packet transferred. The main advantage of this methodology is the flexibility of how constraints are considered and suitability is analyzed. This approach can identify problems from manageable categories of networks and find or create solutions for each of them. Another advantage of this methodology is that after suitable security protocols are found or created for each category, any new wireless network application that falls into an existing category may be able to use the security protocols from that category and find that they are the most suitable. Another key contribution of this research was the implementation and evaluation of a context aware and adaptive security manager (CASM) that selects appropriate protocols in real-time. CASM was developed using the methodology as a guide. Results from a resource analysis of four encryption algorithms were utilized for the design of CASM. A feasibility study of CASM was then completed. Three different experimental scenarios were used to evaluate CASM's operation. The results and analysis of the experiments indicate that the security manager functions properly and security is provided efficiently with different user settings and environments. Three schemes were deemed the best to use for the decision module of CASM. / Ph. D.

In this thesis we obtain several interesting algebraic properties of the operations used in the block cipher IDEA which are important for cryptographic analyzes. We view each of these operations as a function from $mathbb Z_{2}^n times mathbb Z_{2}^n to mathbb Z_{2}^n$. By fixing one of variables $v(z)=mathbf Z$ in $mathbb Z_{2}^n times mathbb Z_{2}^n$, we define functions $mathbf {f}_z$ and $mathbf {g}_z$ from $mathbb Z_{2}^n$ to $mathbb Z_{2}^n$ for the addition $BIGboxplus$ and the multiplication $BIGodot$ operations, respectively. We first show that the nonlinearity of $mathbf {g}_z$ remains the same under some transformations of $z$. We give an upper bound for the nonlinearity of $mathbf {g}_{2^k}$, where $2leq k &lt / n-1$. We list all linear relations which make the nonlinearity of $mathbf {f}_z$ and $mathbf {g}_z$ zero and furthermore, we present all linear relations for $mathbf {g}_z$ having a high probability. We use these linear relations to derive many more linear relations for 1-round IDEA. We also devise also a new algorithm to find a set of new linear relations for 1-round IDEA based on known linear relations. Moreover, we extend the largest known linear class of weak keys with cardinality $2^{23}$ to two classes with cardinality $2^{24}$ and $2^{27}$. Finally, we obtain several interesting properties of the set $ { ({mathbf X},{mathbf X} BIGoplus {mathbf A}) in mathbb Z_2^n times mathbb Z_2^n ,|, (mathbf {X}BJoin {mathbf Z})BIGoplus( ({mathbf X} BIGoplus {mathbf A} ) BJoin mathbf {Z} ) = {mathbf B} }$ for varying ${mathbf A}, {mathbf B}$ and ${mathbf Z}$ in $mathbb Z_2^n$, where $BJoin in { BIGodot,BIGboxplus }$. By using some of these properties, we present impossible differentials for 1-round IDEA and Pseudo-Hadamard Transform.

One of the most important cryptographic primitives is the concept of block ciphers which yields confidentiality for data transmission in communication. Therefore, to be sure that confidentiality is provided, it is necessary to analyse the security of block ciphers by investigating their resistance to existing attacks. For this reason, related-key attacks gain much popularity in recent years and have been applied to many block ciphers with weak key schedules. In this work, our main motivation is to cover types of related-key attacks on block ciphers and exemplify them. For years, cryptanalysts have been investigating the security of the block cipher XTEA and proposed several attacks on the cipher. First in FSE&#039 / 02, Moon et al. presented a 14-round impossible differential attack on XTEA. Then in ICISC&#039 / 03, Hong et al. proposed a 15-round differential attack and a 23-round truncated differential attack on XTEA. In FSE&#039 / 04, Ko et al. proposed a 27-round related-key truncated differential attack on XTEA. Afterwards, in Vietcrypt&#039 / 06, Lee et al. proposed a 34-round related-key rectangle attack on XTEA. Finally in 2008, Lu improved this attack to a related-key rectangle attack on 36-round XTEA which is the best attack on XTEA in terms of the number of attacked rounds. In this thesis, we also analyse differential properties of both structure and key schedule of XTEA block cipher and introduce our 25-round related-key impossible differential distinguisher for XTEA.

Differential cryptanalysis and linear cryptanalysis are the first significant methods used to attack on block ciphers. These concepts compose the keystones for most of the attacks in recent years. Also, while designing a cipher, these attacks should be taken into consideration and the cipher should be created as secure against them. Although differential cryptanalysis and linear cryptanalysis are still important, they started to be inecient due to the improvements in the technology. So, these attacks are extended. For instance, higher order differential cryptanalysis, truncated differential cryptanalysis, generalized linear cryptanalysis, partitioning linear cryptanalysis, linear cryptanalysis using multiple linear approximations are introduced as the extended versions of these attacks. There exists significant applications of these extended attacks. Algebraic attack is a method of cryptanalysis that consists of obtaining a representation of the cipher as a system of equations and then, solving this system. Up to today, just a few attacks that are practically possible to mount are presented. However, due to the fact that algebraic cryptanalysis requires only a handful of known plaintexts to perform, it is a promising and significant attack. This thesis is a survey covering all the methods of attacks described above. Illustrations and summaries of some important papers including these cryptanalysis techniques are given.

One of the most basic properties expected from block ciphers and hash functions is passing statistical randomness testing, as they are supposed to behave like random mappings. Previously, testing of AES candidate block ciphers was done by using the statistical tests defined in the NIST Test Suite. As some of the tests in this suite require long sequences, data sets are formed by concatenating the outputs of the algorithms obtained from various input types. However, the nature of block cipher and hash function algorithms necessitates devising tests and test parameters focused particularly on short sequences, therefore we propose a package of statistical randomness tests which produce reliable results for short sequences and test the outputs of the algorithms directly rather than concatenations. Moreover, we propose an alternative method to evaluate the test results and state the required computations of related probabilities for the new evaluation method. We also propose another package of statistical tests which are designed basing on certain cryptographic properties of block ciphers and hash functions to evaluate their randomness, namely the cryptographic randomness testing. The packages are applied to the AES finalists, and produced more precise results than those obtained in similar applications. Moreover, the packages are also applied to SHA-3 second round candidate algorithms.

Šiame darbe supažindinama su kriptografija, jos istorija, pagrindiniais kriptografijos principais, šifravimo algoritmų tipais, jų taikymo sritimis, privalumais bei trūkumais. Taip pat apibrėžiamos pagrindinės sąvokos ir terminai, išvardinti kriptoanalitinių atakų tipai ir reikalavimai kriptosistemoms. Svarstoma, ar egzistuoja absoliučiai patikimi šifravimo algoritmai. Trumpai aprašomi pagrindiniai šifravimo būdai ir kriptoanalitiniai metodai. Darbe yra nagrinėjami blokiniai (DES, GOST, LOKI 91, SAFER K-64, FEAL–8, Blowfish, AES (Rijndael)) šifravimo algoritmai, išaiškinama jų svarba kriptografijoje, išsamiai aprašoma jų struktūra, atsparumas kriptoanalizei, išaiškinami privalumai bei trūkumai. Nagrinėjami algoritmų taikymų ypatumai, galimybės, apribojimai. Analizuojami algoritm��� atsparumo kriptoanalizei kriterijai, jų svarba bei algoritmų patikimumo priežastys. Išnagrinėjus esamus blokinius šifravimo algoritmus, buvo atliktas jų tarpusavio palyginimas. Nustatyta, kad šifravimo algoritmo patikimumas priklauso nuo atsparumo kriptoanalitiniams metodams, rakto ilgio, algoritmo architektūros. Išaiškinami pagrindiniai algoritmų privalumai: realizavimo lankstumas, kintamas rakto ilgis, numatantis algoritmo ilgaamžiškumą. Taip pat nurodoma, kad duomenų sauga priklauso ne tik nuo šifravimo algoritmo, bet ir nuo kitų informacijos saugos aspektų: raktų apsaugos, jų paskirstymo, atsitiktinių skaičių generavimo būdų. / This work presents cryptography, its history, main principles of cryptography, types of ciphers, their application range, advantages and disadvantages. Key concepts and term are also defined. Complexity of attacks and requirement to cryptographic systems are listed and described. A question of the existence of the absolutely safe ciphers is considered. The main encryption modes and cryptanalysis methods are described. Research of the most prominent block ciphers and their importance to many cryptographic systems is presented in this work. The structure of block ciphers, their resistance to cryptanalysis are given in details and expositive strength of block ciphers. Their advantages and disadvantages are discovered and stated. Ciphers application range, their potential and restrictions are researched. Criteria of the resistance of ciphers to cryptanalysis, their importance and the reasons of cipher reliability are analyzed. After analyzing the block ciphers such us: DES, GOST, LOKI 91, SAFER K-64, FEAL–8, Blowfish, AES (Rijndael), their inter comparison was performed. It was noted that the reliability of ciphers depends on their resistance to cryptanalysis methods, key length and their architecture. The following major advantages of ciphers as flexibility of realization, changeable key length and facilitating cipher durability are discovered. The following conclusion has been drawn, that data safety depends not only on ciphers, but also on other aspects of information safety... [to full text]

There is a significant effort in building lightweight cryptographic operations, yet the proposed solutions are typically single purpose modules that can only provide a fixed functionality. However, flexibility is an important aspect of cryptographic designs where a module can perform multiple operations with different configurations. In this work, we combine flexibility with lightweight designs and propose two cryptographic engines based on the SIMON block cipher. The first proposed engine is the Flexible SIMON, which can execute all configurations of SIMON thus enables an adaptive security with variable key sizes. Our second proposed implementation is BitCryptor, a bit-serialized Compact Crypto Engine that can perform symmetric key encryption, hash computation and pseudo-random-number-generation. The implementation results on a Spartan-3 s50 FPGA show that the proposed engines occupies 90 and 95 slices respectively, which are more compact than the majority of their single purpose counterparts. Therefore, these engines are suitable cryptographic blocks for resource-constrained systems. / Master of Science

La sécurité des transmissions et du stockage des données est devenue un enjeu majeur de ces dernières années et la cryptologie, qui traite de la protection algorithmique de l'information, est un sujet de recherche extrêmement actif. Elle englobe la conception d'algorithmes cryptographiques, appelée cryptographie, et l'analyse de leur sécurité, appelée cryptanalyse.Dans cette thèse, nous nous concentrons uniquement sur la cryptanalyse, et en particulier celle des algorithmes de chiffrement symétrique, qui reposent sur le partage d'un même secret entre l'entité qui chiffre l'information et celle qui la déchiffre. Dans ce manuscrit, trois attaques contre des algorithmes de chiffrement symétriques sont présentées. Les deux premières portent sur deux candidats de l'actuelle compétition cryptographique CAESAR, les algorithmes AEZ et NORX, tandis que la dernière porte sur l'algorithme Kravatte, une instance de la construction Farfalle qui utilise la permutation de la fonction de hachage décrite dans le standard SHA-3. Les trois algorithmes étudiés présentent une stratégie de conception similaire, qui consiste à intégrer dans une construction nouvelle une primitive, i.e. une fonction cryptographique élémentaire, déjà existante ou directement inspirée de travaux précédents.La compétition CAESAR, qui a débuté en 2015, a pour but de définir un portefeuille d'algorithmes recommandés pour le chiffrement authentifié. Les deux candidats étudiés, AEZ et NORX, sont deux algorithmes qui ont atteint le troisième tour de cette compétition. Les deux attaques présentées ici ont contribué à l'effort de cryptanalyse nécessaire dans une telle compétition. Cet effort n'a, en l'occurrence, pas permis d'établir une confiance suffisante pour justifier la présence des algorithmes AEZ et NORX parmi les finalistes.AEZ est une construction reposant sur la primitive AES, dont l'un des principaux objectifs est d'offrir une résistance optimale à des scénarios d'attaque plus permissifs que ceux généralement considérés pour les algorithmes de chiffrement authentifié. Nous montrons ici que dans de tels scénarios il est possible, avec une probabilité anormalement élevée, de retrouver l'ensemble des secrets utilisés dans l'algorithme.NORX est un algorithme de chiffrement authentifié qui repose sur une variante de la construction dite en éponge employée par exemple dans la fonction de hachage Keccak. Sa permutation interne est inspirée de celles utilisées dans BLAKE et ChaCha. Nous montrons qu'il est possible d'exploiter une propriété structurelle de cette permutation afin de récupérer la clé secrète utilisée. Pour cela, nous tirons parti du choix des concepteurs de réduire les marges de sécurité dans le dimensionnement de la construction en éponge.Enfin, la dernière cryptanalyse remet en cause la robustesse de l'algorithme Kravatte, une fonction pseudo-aléatoire qui autorise des entrées et sorties de taille variable. Dérivée de la permutation Keccak-p de SHA-3 au moyen de la construction Farfalle, Kravatte est efficace et parallélisable. Ici, nous exploitons le faible degré algébrique de la permutation interne pour mettre au jour trois attaques par recouvrement de clé : une attaque différentielle d'ordre supérieur, une attaque algébrique "par le milieu" et une attaque inspirée de la cryptanalyse de certains algorithmes de chiffrement à flot. / Nowadays, cryptology is heavily used to protect stored and transmitted data against malicious attacks, by means of security algorithms. Cryptology comprises cryptography, the design of these algorithms, and cryptanalysis, the analysis of their security.In this thesis, we focus on the cryptanalysis of symmetric encryption algorithms, that is cryptographic algorithms that rely on a secret value shared beforehand between two parties to ensure both encryption and decryption. We present three attacks against symmetric encryption algorithms. The first two cryptanalyses target two high profile candidates of the CAESAR cryptographic competition, the AEZ and NORX algorithms, while the last one targets the Kravatte algorithm, an instance of the Farfalle construction based on the Keccak permutation. Farfalle is multipurpose a pseudo-random function (PRF) developed by the same designers' team as the permutation Keccak used in the SHA-3 hash function.The CAESAR competition, that began in 2015, aims at selecting a portfolio of algorithms recommended for authenticated encryption. The two candidates analysed, AEZ and NORX, reached the third round of the CAESAR competition but were not selected to be part of the finalists. These two results contributed to the cryptanalysis effort required in such a competition. This effort did not establish enough confidence to justify that AEZ and NORX accede to the final round of the competition.AEZ is a construction based on the AES primitive, that aims at offering an optimal resistance against more permissive attack scenarios than those usually considered for authenticated encryption algorithms. We show here that one can recover all the secret material used in AEZ with an abnormal success probability.NORX is an authenticated encryption algorithm based on a variant of the so-called sponge construction used for instance in the SHA-3 hash function. The internal permutation is inspired from the one of BLAKE and ChaCha. We show that one can leverage a strong structural property of this permutation to recover the secret key, thanks to the designers' non-conservative choice of reducing the security margin in the sponge construction.Finally, the last cryptanalysis reconsiders the robustness of the Kravatte algorithm. Kravatte is an efficient and parallelizable PRF with input and output of variable length. In this analysis, we exploit the low algebraic degree of the permutation Keccak used in Kravatte to mount three key-recovery attacks targeting different parts of the construction: a higher order differential attack, an algebraic meet-in-the-middle attack and an attack based on a linear recurrence distinguisher.

É crescente a necessidade de prover segurança às informações trocadas nos mais diversos tipos de redes. No entanto, redes amplamente dependentes de dispositivos com recursos limitados (como sensores, tokens e smart cards) apresentam um desafio importante: a reduzida disponibilidade de memória, capacidade de processamento e (principalmente) energia dos mesmos dificulta a utilização de alguns dos principais algoritmos criptográficos considerados seguros atualmente. É neste contexto que se insere o presente documento, que não apenas apresenta uma pesquisa envolvendo projeto e análise de algoritmos criptográficos, mas também descreve um novo algoritmo simétrico denominado CURUPIRA. Esta cifra de bloco baseia-se na metodologia conhecida como Estratégia de Trilha Larga e foi projetada especialmente para ambientes onde existe escassez de recursos. O CURUPIRA possui estrutura involutiva, o que significa que os processos de encriptação e decriptação diferem apenas na seqüência da geração de chaves, dispensando a necessidade de algoritmos distintos para cada uma destas operações. Além disto, são propostas duas formas diferentes para seu algoritmo de geração de chaves, cada qual mais focada em segurança ou em desempenho. Entretanto, ambas as formas caracterizam-se pela possibilidade de computação das sub-chaves de round no momento de sua utilização, em qualquer ordem, garantindo uma operação com reduzido uso de memória RAM. / The need for security is a great concern in any modern network. However, networks that are highly dependent of constrained devices (such as sensors, tokens and smart cards) impose a difficult challenge: their reduced availability of memory, processing power and (more importantly) energy hinders the deployment of many important cryptographic algorithms known to be secure. In this context, this document not only presents the research involving the design and analysis of cryptographic algorithms, but also proposes a new symmetric block cipher named CURUPIRA. The CURUPIRA follows the methodology known as theWide Trail Strategy and was specially developed having constrained platforms in mind. It displays an involutional structure, which means that the encryption and decryption processes differ only in the key schedule and, thus, there is no need to implement them separately. Also, two distinct scheduling algorithms are proposed, whose main focus are either on tight security or improved performance. In spite of this difference, both of them allow the keys to be computed on-the-fly, in any desired order, assuring a reduced consumption of RAM memory during their operation.