Search

Capability architectures for memory safety have traditionally required expanding pointers and radically changing microarchitectural structures throughout processors, while only providing superficial hardening. We hence propose Cryptographic Capability Computing (C3) - the first memory safety mechanism that is stateless to avoid requiring extra metadata storage. C3 retains 64-bit pointer sizes providing legacy binary compatibility while imposing minimal touchpoints. Pointers are encrypted to unforgeably (within cryptographic bounds) reference each object. Data is encrypted even in caches and entangled with pointers for both spatial and temporal object-granular protection. Pointers become like unique keys for each allocation. C3 deploys a novel form of prediction for address translation that mitigates performance overheads even when addresses are partially encrypted. Use of a low-latency, low-area cipher from the NIST Lightweight Cryptography project avoids delaying loads by readying a data keystream by the time data is returned from the L1 cache. C3 is compatible with legacy binaries. Simulated performance overhead on SPEC CPU2006 is negligible with no memory overhead, which is a big leap forward compared to the overheads imposed by past memory safety approaches. C3 effectively replaces inefficient metadata with efficient cryptography.

This paper presents the results of an investigation into relationships between (key, IV) pairs that give rise to phase shifted keystreams for the stream cipher Plantlet. We demonstrate that such slid pairs exist for Plantlet, and that very small phase shifts are possible, including shifts of length 1. We also show that the keyspace can be partitioned into sets of keys which give rise to initial states that lie on the same state cycle during keystream generation. For a given key used to generate Plantlet keystreams, we provide a method for generating all other keys that give rise to phase shifted keystreams as they move through internal states on the same state cycle.

The paper describes an adaptive image encryption scheme. In the proposed encryption scheme, the chaotic map is used to design the plaintext dependent bit-level permutation. The plain image is firstly divided into 8 bit panels and then arranged into two groups. The permutation is performed on each group based on the feature of the other group. After that, the keystream is employed to mask the permutated image to get the cipher-image. The different types of experiments have been conducted. The experimental results and security analysis demonstrate that the proposed encryption scheme is efficient and highly secure.

Many modern stream ciphers combine linear and nonlinear operations with a certain amount of initial clock steps without producing keystream bits for encryption. As a result of this behaviour, the resulting system of equations get more and more complex and difficult to solve. Due to the increasing number of monomials, as well as the increasing algebraic degree, the resulting system of equations get immune to a SAT-based cryptanalysis. A stream cipher realizing this principle is Grain v1. Grain is a stream cipher family, whose first version was submitted as a proposal to the eSTREAM project in the year 2004. Through a key recovery attack in the year 2006, a new revised version was published, referred as Grain Version 1. Within this paper, we examine the initialization phase of Grain v1 for SAT-based cryptanalysis. In the first step, the paper presents the necessary steps for establishing the Boolean system of equations. The second step describes the formulation of the SAT-Problem and the related possibilities and limitations.

The stream cipher research field is very significant as contemporary communication channels need fast and secure encryption. To ensure unconditional security in stream ciphers the used keystream must be nonlinear and with good pseudo noise properties. By this motivation, in this paper a keystream produced by Generalized Shrinking Multiplexing Generator controlled by Ternary m-sequences (GSMG-3m) is analyzed. Statistical, spectral and approximate entropy tests are done to ensure the randomness properties of keystream sequences produced by the GSMG-3m. Some cryptanalysis of GSMG-3m are done and it is proven that GSMG-3m is more secure than Shrinking Generator (SG) to attacks through its control ternary m-sequence and linear complexity.

A secure lightweight block cipher is an effective security solution for applications running on resource-constrained devices. The SPECK family of lightweight block ciphers is designed for low-end devices that need data security. The randomness of the keystream produced by this algorithm is a good indicator of its security strength. Nevertheless, the computed proportion of sequences based on empirical test results falls beyond the range of acceptable interval, an evidence of non-randomness to each algorithm. In this study, the researchers enhanced SPECK (k-SPECK) through the addition of a key derivation function in its processes. Both SPECK and k - SPECK were evaluated with the two sophisticated statistical test suite. The result shows that k - SPECK outperformed SPECK in terms of randomness as its three variations successfully passed all the test of statistical packages NIST and DieHarder, making it more cryptographically secured. Similarly, software implementation was also evaluated showing that k - SPECK 128/192 and 128/256 performed faster in encryption cycle compared to SPECK.

In this paper, a new image encryption algorithm is presented with one chaotic map and one group of secret keys. Double permutations for pixel positions are designed followed by a function of diffusion to alter gray distribution in the plain-image. In the proposed algorithm, the keystream is produced and dependent on the plain-image. As a result, the method can frustrate the known plaintext attack and chosen plaintext attack. Moreover, diffusion encryption by row-only is applied to the permuted image to save time consumption. Then, the experimental results show that our method can perform high security and is suitable for both gray and color images.

The current article presents two chaotic pseudorandom number generators CPRNG for keystream. Statistical analysis with several high-speed stream ciphers showed that our proposed algorithms have comparable results with them. In addition, our two CPRNGs showed a good degree of randomization based on NIST statistical test suites, quasi-ideal entropy, good keystream distribution, and good sensitivity to initial conditions, indicating resistance to differential attacks.

In Sprout, a new design principle is proposed to resist the Time-Memory-Data Tradeoff (TMDTO) attack. The general idea is to involve the secret key bits in the keystream generation phase. A round key function is introduced to determine the involvement of the secret key bit at each clock. However, this function turns out to be the main weakness in this design. A key recovery attack can be easily mounted on Sprout. The attacker is able to recover the whole 80-bit secret key with time complexity equivalent to 269 encryptions. In this paper, we investigate the fundamental mechanism of the divide-and-conquer based key recovery attack. After analyzing the process of every sieving and merging step, we identify the key factor in the design that makes the cipher vulnerable. Based on our finding, we improve the round key function and the output function for Sprout. The attacker can only perform one round of sieving on the improved version, which means this attack is no better than exhaustive search. To support the validity of our theoretical method, we implement the attack on an improved toy Sprout cipher. The experiment results show that the improvement for each type of sieving helps resist the attack as predicted.

We propose pseudo random bit generator(PRBG) by constructing an ergodic orbit of logistic map generated using intermittent perturbation and sampling the orbit using Bernoulli shift map. The pseudo randomness of the key streams is tested with the standard NIST statistical test suite. The key streams generated by the proposed PRBG pass all the tests of the test suite. As an application of PRBG we propose chaotic stream ciphers. Goodness-of-Fit tests are conducted for these ciphers. Stream ciphers generated using PRBG are shown to generate ciphers in which the distribution of the characters show significant correlation to the uniform distribution. It is also shown that the ciphers exhibit good avalanche effect when the initial seed is varied infinitesimally and we can also clearly observe the avalanche effect at different points within the ciphertext as the ciphertext is being generated. Also we show that the proposed PRBG is on par with conventional PRBG RC4. This indeed vindicates our hypothesis that stream of bits obtained from orbits of logistic map using perturbation and Bernoulli shift map exhibits randomness.

A5-GMR-1 is a synchronous stream cipher used to provide confidentiality for communications between satellite phones and satellites. The keystream generator may be considered as a finite state machine, with an internal state of 81 bits. The design is based on four linear feedback shift registers, three of which are irregularly clocked. The keystream generator takes a 64-bit secret key and 19-bit frame number as inputs, and produces an output keystream of length berween 28 and 210 bits. Analysis of the initialisation process for the keystream generator reveals serious flaws which significantly reduce the number of distinct keystreams that the generator can produce. Multiple (key, frame number) pairs produce the same keystream, and the relationship between the various pairs is easy to determine. Additionally, many of the keystream sequences produced are phase shifted versions of each other, for very small phase shifts. These features increase the effectiveness of generic time-memory tradeoff attacks on the cipher, making such attacks feasible.

Both the SSS and SOBER-t32 stream cipher designs use a single word-based shift register and a nonlinear filter function to produce keystream. In this paper we show that the algebraic attack method previously applied to SOBER-t32 is prevented from succeeding on SSS by the use of the keydependent substitution box (SBox) in the nonlinear filter of SSS. Additional assumptions and modifications to the SSS cipher in an attempt to enable algebraic analysis result in other difficulties that also render the algebraic attack infeasible. Based on these results, we conclude that a well-chosen key-dependent substitution box used in the nonlinear filter of the stream cipher provides resistance against such algebraic attacks.

The Atmel chip families SecureMemory, CryptoMemory, and CryptoRF use a proprietary stream cipher to guarantee authenticity, confidentiality, and integrity. This paper describes the cipher in detail and points out several weaknesses. One is the fact that the three components of the cipher operate largely independently; another is that the intermediate output generated by two of those components is strongly correlated with the generated keystream. For SecureMemory, a single eavesdropped trace is enough to recover the secret key with probability 0.57 in 2^{39} cipher ticks. This is a factor of 2^{31.5} faster than a brute force attack. On a 2 GHz laptop, this takes around 10 minutes. With more traces, the secret key can be recovered with virtual certainty without significant additional cost in time. For CryptoMemory and CryptoRF, if one has 2640 traces it is possible to recover the key in 2^{52} cipher ticks, which is 2^{19} times faster than brute force. On a 50 machine cluster of 2 GHz quad-core machines this would take less than 2 days.

While keystream reuse in stream ciphers and one-time pads has been a well known problem for several decades, the risk to real systems has been underappreciated. Previous techniques have relied on being able to accurately guess words and phrases that appear in one of the plaintext messages, making it far easier to claim that "an attacker would never be able to do that." In this paper, we show how an adversary can automatically recover messages encrypted under the same keystream if only the type of each message is known (e.g. an HTML page in English). Our method, which is related to HMMs, recovers the most probable plaintext of this type by using a statistical language model and a dynamic programming algorithm. It produces up to 99% accuracy on realistic data and can process ciphertexts at 200ms per byte on a $2,000 PC. To further demonstrate the practical effectiveness of the method, we show that our tool can recover documents encrypted by Microsoft Word 2002 [22].

Let us have an NLFSR with the feedback function g(x) and an LFSR with the generating polynomial f(x). The function g(x) is a Boolean function on the state of the NLFSR and the LFSR, at any time instance t. Whenever the LFSR has good statistical properties, it is used for controlling the randomness of the NLFSR's state machine. In this paper we define and study the general class of "Grain" family of stream ciphers, where the keystream bits are generated by another Boolean function h(y) on the states of the NLFSR and the LFSR. We show that the cryptographic strength of this family is related to the general decoding problem, when a key-recovering attack is considered. A proper choice of the functions f(·), g(·) and h(·) could, potentially, give us a strong instance of a stream cipher. One of such stream ciphers Grain was recently proposed as a candidate for the European project ECRYPT in May, 2005. Grain uses the secret key of length 80 bits and its internal state is of size 160 bits. It was suggested as a fast and small primitive for efficient hardware implementation. In our work we propose the analysis of such structures in general, and, in particular, we give a linear distinguishing attack on Grain with time complexity O(254), when O(251) bits of the keystream is available. This is the first paper presenting an attack on Grain, and it reveals a leakage in the choice of the functions in this particular design instance.