Cryptanalysis on FPGA Based Hardware Malcolm Alda Sumantri Bachelors of Engineering (Software) & Bachelors of Commerce (Finance) Supervisors: Matt Barrie Craig Jin The University of Sydney

Introduction Welcome to the Digital Age where everything can be replicated! Cryptography is used… To protect our privacy For example: our real identity, our e-mails to family and friends, our digital photos, our work. To protect corporate secrets For example: future corporate strategies, intellectual property, pricing information, human resources information. By governments For example: sending messages to spies, task forces, between agencies to protect civilians and against terrorism. How secure are our currently deployed cryptosystems?

Motivation Information security is a resource game. More funds means more access to information. The US National Security Agency’s annual budget is classified but is said to be over US $13 billion. Assessing the strength of our cryptosystems therefore involves determining the cost to break them. Rapid development in Field Programmable Gate Array Technology (FPGA) technology that makes it cheaper to develop high-performance custom hardware systems. FPGA technology has proven to be effective for cryptographic use. A recent optimization in cryptanalysis. Rainbow Tables

Background Symmetric Cipher Cryptanalysis: Code breaking, reveal the plaintext without the key. Exhaustive Key Search: Try every key possible, requires large computational power. Table Lookup: Store keys and ciphertexts in a massive tables to perform a lookup when trying to attack, requires a large amount of memory (infeasible). Time-memory trade-off: Give up memory to achieve a faster attack time. FPGAs Reconfigurable logic (upload the bitstream to the hardware). Cheaper than Application Specific Integrated Circuits (ASICs) for small volumes.

Time-Memory Trade-Off: Rainbow Tables How does it work? Assume a chosen-plaintext attack scenario. The attacker can choose which plaintext to access. This attacker will use this to attack the cryptosystem. This is practical in the real-world (UNIX password hashing, “#include <stdio.h>”, “\n”) Two Phases Precomputation Phase Online Attack Phase (Cryptanalytic Attack) Precomputation Phase: Generate a rainbow table. A rainbow table is a two-column table (start-point, end-point) These points are possible keys. This table is generated by a specific algorithm. Online Attack Phase: Use the rainbow table. We are given a ciphertext to break. Now we perform a search on the rainbow table by using another algorithm This method is probabilistic, but faster than exhaustive key search. Unlike exhaustive key search that only requires computational resources (processor). This method uses memory as well as computational resources. As a result, the attack time is faster but we have given up memory. This is the trade-off.

Methodology Design and implement an FPGA based cryptanalytic system that uses the rainbow tables method of cryptanalysis. Use the Data Encryption Standard (DES) as the test symmetric cipher. DES uses a 56-bit key. DES is the most widely studied cipher. DES is still used today (UNIX password hashing). Determine the cost to break DES. Extrapolate the cost to break other ciphers.

Design I – Data Encryption Standard In designing a cryptanalytic system, the performance of the cipher module will determine the performance. Security of DES derives from 16 rounds of permutations, substitutions and xoring. Each round is implemented as a 3-stage pipeline. A total of 48-stages for the 16 rounds of DES. Pipelining improves performance: Attain higher clock frequencies. Achieve parallelization: 48 encryptions per clock cycle.

Design II – The Rainbow Table Precomputation System 1. High Level System Design 2. Hardware Design 3. Hardware output behavior (Timing Diagram)

Design III – The Rainbow Table Online Attack System 1. High Level System Design 2. Hardware Design 3. Mechanism Step Goal Tool Input to Tool Output of Tool 1 Generate end-points from the chosen plaintext/ciphertext pair. End-Point Generator (Hardware) Chosen plaintext, chosen ciphertext, start mark, end-mask Prospective End-Point, Prospective Column Number 2 Perform table lookup on all end-points generated from Step 1. Online Attack Software Application End-Points generated from Step 1. Start Points that corresponds with matching end-points from Step 1. 3 Generate Key from Starting Points found in Step 2. Intermediate Key Generator (Hardware) Start-Point and matching column number (from Steps 1 and 2), start-mask, end-mask. Candidate Key(s) 4 Test validity of Key Candidate key(s) from Step 3, chosen plaintext, chosen ciphertext. Key

Experiment and Results Cryptanalytic attack on 40-bit DES since the resources to break DES is out-of-reach for the budget in this thesis. Use Sensory NetworksTM NodalCoreTM C-1000 PCI Card. Xilinx® Virtex-II Pro VP-40 FPGA Flexible chipset architecture to embed our hardware engines. PCI interface allows for high-speed communications. Results 40-bit DES Rainbow Table can be generated in less than 4 hours. Table parameters allows for 85% cryptanalytic success probability. Fastest known implementation in the literature based on results. Online attack of 40-bit DES in 30.8 seconds.

Data Analysis Performance-Cost Analysis Determine the FPGA chip that provides the highest performance for the lowest cost. Synthesized the hardware designs for various Xilinx FPGAs. Spartan 3 S-1500 provides the highest performance-cost relative to other Xilinx® FPGA chips. Extrapolate the design of a machine to break DES (56-bit key length) Result: DES can be broken with 85% success probability in 72 minutes for an approximate cost of US $1,210. Performance-Cost of Precomputation Hardware System

Conclusion FPGAs provides a low cost and effective solution to cryptanalysis. Rainbow table attacks provide a faster attack time compared to brute-force, but brute-force uses less resources, that is, memory resources. For large key sizes, the rainbow table attack becomes infeasible as memory costs is prohibitive. Potential Attacker Key Length (bits) Cost (US $) Clever Outsider 56 353 58 1,413 60 5,650 Knowledgeable Insiders 62 22,600 64 90,400 Funded Organization (Large Corporation, Mafia) 66 361,601 68 1.4 million (Small Government, Terrorist Networks) 72 24 million 76 370 million 78 1.5 billion (Large Government Bodies: US National Security Agency) 80 6 billion 82 24.7 billion 84 94.8 billion 86 380 billion 88 1.5 trillion Not feasible 92 242 trillion