Mod n cryptanalysis

Short description: Attack applicable to block and stream ciphers

In cryptography, mod n cryptanalysis is an attack applicable to block and stream ciphers. It is a form of partitioning cryptanalysis that exploits unevenness in how the cipher operates over equivalence classes (congruence classes) modulo n. The method was first suggested in 1999 by John Kelsey, Bruce Schneier, and David Wagner and applied to RC5P (a variant of RC5) and M6 (a family of block ciphers used in the FireWire standard). These attacks used the properties of binary addition and bit rotation modulo a Fermat prime.

Mod 3 analysis of RC5P

For RC5P, analysis was conducted modulo 3. It was observed that the operations in the cipher (rotation and addition, both on 32-bit words) were somewhat biased over congruence classes mod 3. To illustrate the approach, consider left rotation by a single bit:

[math]\displaystyle{ X \lll 1=\left\{\begin{matrix} 2X, & \mbox{if } X \lt 2^{31} \\ 2X + 1 - 2^{32}, & \mbox{if } X \geq 2^{31}\end{matrix}\right. }[/math]

Then, because

[math]\displaystyle{ 2^{32} \equiv 1\pmod 3,\, }[/math]

it follows that

[math]\displaystyle{ X \lll 1 \equiv 2X\pmod 3. }[/math]

Thus left rotation by a single bit has a simple description modulo 3. Analysis of other operations (data dependent rotation and modular addition) reveals similar, notable biases. Although there are some theoretical problems analysing the operations in combination, the bias can be detected experimentally for the entire cipher. In (Kelsey et al., 1999), experiments were conducted up to seven rounds, and based on this they conjecture that as many as 19 or 20 rounds of RC5P can be distinguished from random using this attack. There is also a corresponding method for recovering the secret key.

Against M6 there are attacks mod 5 and mod 257 that are even more effective.

References

• John Kelsey, Bruce Schneier, David Wagner (March 1999). "Mod n Cryptanalysis, with Applications Against RC5P and M6." (PDF/PostScript). Fast Software Encryption, Sixth International Workshop Proceedings. Rome: Springer-Verlag. pp. 139–155. http://www.schneier.com/paper-mod3.html. Retrieved 2007-02-12. 
• Vincent Rijmen (2003-12-01). "mod n" Cryptanalysis of Rabbit. White paper, Version 1.0. Cryptico. http://www.cryptico.com/Files/filer/wp_modn_analysis.pdf. Retrieved 2007-02-12. 
• Toshio Tokita; Tsutomu Matsumoto. "On Applicability of Differential Cryptanalysis, Linear Cryptanalysis and Mod n Cryptanalysis to an Encryption Algorithm M8 (ISO9979-20)". Ipsj Journal 42 (8).