in swedish StreamSec  

 

 
News
Products
Research
How to - algorithms with proofs
PCFB-mode
Steak
Key Setup Scheme
Feedback process
Main Function
Algorithm
Matrix Table Transform
Hash Scheme
PRNG test results
Security proof
Source - Steak
Source - SecUtils
Source - CombUtils
Order
Demos
Downloads
About Streamsec
Contact

2003-10-22

Steak - Matrix table transform

The Matrix Table Transform and the Permute steps of the main function mounts to the equation system (xor for addition, and for multiplication) described by the following 32 by 32 binary matrix:

0 1 0 0 1 1 0 0 1 1 0 0 1 0 0 0 0 1 1 0 1 0 0 0 1 0 0 0 0 1 1 0 
0 0 0 0 0 0 1 0 0 1 0 0 1 1 0 0 1 0 0 0 1 1 0 0 1 1 1 0 0 1 0 0 
1 0 0 0 1 0 0 1 1 0 0 1 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1 0 0 
0 0 1 0 0 0 0 0 1 1 0 0 0 0 1 0 0 0 0 0 1 1 0 0 0 0 0 1 1 1 0 0 
0 1 0 0 0 0 0 0 1 1 0 0 0 1 0 1 0 1 0 1 1 0 0 0 0 1 0 0 1 1 0 0 
0 1 0 0 0 1 0 0 1 1 0 0 0 1 0 0 0 0 0 0 1 0 0 1 1 1 0 0 1 1 0 0 
1 0 0 1 1 0 0 0 0 1 0 0 1 0 0 0 1 1 0 0 0 1 0 0 1 1 0 0 1 1 0 1 
1 1 0 0 0 0 1 0 1 1 1 0 0 0 1 0 0 1 0 0 0 0 1 1 1 0 0 0 1 0 0 0 
0 0 0 0 1 0 0 1 1 1 0 0 0 0 0 1 1 0 1 0 0 0 0 0 1 1 0 0 0 0 1 1 
0 1 0 0 0 0 1 0 0 1 0 0 0 0 1 0 1 1 0 0 1 0 0 1 0 1 1 0 0 0 0 0 
0 0 0 0 0 0 1 1 1 1 0 1 0 0 1 1 1 0 0 0 0 0 1 1 0 0 0 0 0 1 0 1 
1 1 1 0 0 0 0 1 0 1 0 0 0 0 1 1 1 0 0 0 0 1 0 1 0 0 0 1 0 0 1 1 
1 0 0 0 0 1 0 0 0 1 0 0 0 0 0 1 1 1 0 1 0 0 0 0 0 0 0 0 0 0 0 1 
1 0 0 0 0 0 1 0 0 1 0 0 1 0 1 0 1 1 0 0 0 0 1 0 1 0 0 1 0 0 0 0 
1 1 0 1 0 0 0 1 1 0 0 0 0 1 0 1 1 0 0 0 0 0 0 0 0 1 1 0 0 0 1 0 
1 0 1 1 1 0 0 1 0 0 1 0 1 1 0 1 0 0 1 1 0 1 1 0 0 0 0 0 1 1 1 1 
0 0 0 0 1 1 1 0 1 0 0 1 0 1 1 0 0 0 1 1 1 1 0 1 0 0 0 1 0 0 1 0 
0 0 1 1 0 1 1 1 0 1 0 1 1 0 0 1 0 0 0 0 1 0 0 0 0 0 0 1 0 1 0 1 
0 0 0 0 1 0 0 0 0 0 0 1 0 0 1 1 1 0 1 0 0 0 0 1 0 0 1 0 1 0 1 1 
0 1 1 0 1 0 1 0 0 0 1 1 0 0 0 1 0 0 0 0 1 0 1 1 0 0 1 0 0 0 0 1 
0 0 0 1 1 0 0 0 0 0 1 1 1 1 0 1 0 0 0 0 1 1 0 1 1 0 0 0 0 0 0 0 
0 0 0 1 1 1 0 1 0 0 1 1 1 0 0 1 0 0 0 1 1 1 0 1 0 1 0 0 0 0 1 0 
0 0 1 0 0 1 1 0 0 0 1 1 1 1 1 0 0 1 1 0 1 0 1 1 0 0 0 1 1 1 0 1 
1 0 1 1 0 0 0 0 0 0 1 1 0 0 0 0 0 0 1 0 0 0 1 0 0 0 1 1 1 0 0 0 
0 0 1 1 1 0 0 0 1 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 1 0 0 0 1 0 
0 0 0 0 0 0 1 0 0 1 0 1 0 0 0 0 0 0 0 1 1 0 0 0 0 0 1 1 0 0 0 0 
0 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 1 0 1 0 0 0 0 0 0 0 1 0 0 1 0 0 
0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 0 0 1 0 0 0 0 1 0 0 0 0 0 
0 0 1 1 0 1 0 0 0 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 1 0 0 1 0 0 0 0 
0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 1 1 0 0 0 1 0 1 0 1 0 0 0 0 
0 0 0 1 0 0 0 0 0 0 1 1 0 1 0 0 0 1 0 1 0 0 0 0 0 0 0 1 0 0 0 1 
1 1 0 0 1 1 0 0 1 0 1 0 0 1 0 0 1 1 0 0 1 1 1 0 0 1 0 0 1 0 0 0 

or, equivalently, with the columns put as 32 bit hexadecimal numbers:

($8080F8C4,$88084AB1,$31CA8808,$51B2C040,
 $813D8145,$90631021,$024B2682,$0422CD04,
 $810145BD,$02023FFB,$C4F88080,$42FF0404,
 $2072A043,$C051C032,$08452E88,$103EDD10,
 $84047F42,$C04032D1,$3DC58101,$63219010,
 $827B023F,$8831884A,$80C8A480,$207D0EA0,
 $101021E3,$A0204372,$7B3F8202,$72C32020,
 $80C480F8,$0442847F,$0125C901,$404E9D40)

This matrix was chosen partly arbitrarily (by experimenting with the TwoFish data), partly experimentally as a result of extensive pseudo random properties testing. Besides this, the design of Steak only requires the MTT to be sufficiently distance separable (to delude key retreival attacks) and invertible (to ensure maximum length propagation). 

The inverse of the MTT is correspondingly described by:

($06D1C2DD,$E893C582,$A26542CB,$4DEB4D22,
$C8059A6F,$0D41BD4E,$7B8436AE,$5CC6CB83,
$C680CB5D,$88530744,$63CC820B,$C7AB0D40,
$89C78A67,$C448910F,$4140A7C0,$C6C1C71C,
$C85706C2,$66C4C04B,$CDAA85C0,$8945CA69,
$4E491D0E,$4106264E,$3C041CE1,$5084C081,
$8480C150,$80500A00,$60C18084,$C0A84042,
$89C00060,$C2C09008,$C84AACC0,$D8060992)

The MTT deviates from a maximum distance separation matrix with numbers according to the following table:

Output\Input 0 1 2 3
0 256 256 256 128
1 128 256 256 256
2 256 128 128 256
3 256 128 256 256

The number in each cell represents the number of different output differentials in the byte position corresponding to the row, given a single byte input differential in the byte position corresponding to the column. For example, a single byte differential in the second byte has a probability of 1/256 not to induce an output differential in the third or fourth byte. For an MDS matrix all cells would have been 256. Since the MTT matrix is equivalent to a bytewise MDS matrix with two bitwise transpositions applied before and after the matrix operation, the square of the MTT is indistinguishable from the square of an MDS matrix in conjunction with a post bitwise transposition.

The design principle of Steak might be described as putting together several weak and actually or potentially biased functions, to use a very large key and dynamic key data. For example, the MTT is a weak function in so far that it is a linear transform, and as such each output differential is a function of the input differential, regardless of the number of iterations. 

When the S-boxes are added (to form the D function according to the notation of the algorithm), this relationship is normally lost, and each input differential corresponds to a mostly unbiased set of output differentials. At least, the bias that remains will be statistically insignificant for outputs less than approximately 64 KB (for iterations of D only), and would possibly reveal key data if the algorithm was known, but would not be specific to the algorithm. This is an ideal property in this context. Most bias measures will reveal some degree of bias in most random functions. The objective, according to the security proof, is not to make it infeasible to extract key data if the algorithm is known, but to make it as hard as possible to tell if the algorithm is used at all. A perfect lack of key dependent bias would be a dead give away for non-randomness.

In some cases however, the S-boxes are such that the output differentials will be significantly biased. This happens when the S-boxes are all similar to bit transpositions; i.e. are "semi linear". For example, the permutation with the following cycle (hexadecimal notation):

(00 01 02 04 08 10 20 40 80 03 06 0C 18 30 60 C0 81 05 0A 14 28 50 A0 41 82 07 0E 1C 38 70 E0 C1 83 09 12 24 48 90 21 42 84 0B 16 2C 58 B0 61 C2 85 0D 1A 34 68 D0 A1 43 86 0F 1E 3C 78 F0 E1 C3 87 11 22 44 88 13 26 4C 98 31 62 C4 89 15 2A 54 A8 51 A2 45 8A 17 2E 5C B8 71 E2 C5 8B 19 32 64 C8 91 23 46 8C 1B 36 6C D8 B1 63 C6 8D 1D 3A 74 E8 D1 A3 47 8E 1F 3E 7C F8 F1 E3 C7 8F 25 4A 94 29 52 A4 49 92 27 4E 9C 39 72 E4 C9 93 2B 56 AC 59 B2 65 CA 95 2D 5A B4 69 D2 A5 4B 96 2F 5E BC 79 F2 E5 CB 97 33 66 CC 99 35 6A D4 A9 53 A6 4D 9A 37 6E DC B9 73 E6 CD 9B 3B 76 EC D9 B3 67 CE 9D 3D 7A F4 E9 D3 A7 4F 9E 3F 7E FC F9 F3 E7 CF 9F 55 AA 57 AE 5D BA 75 EA D5 AB 5B B6 6D DA B5 6B D6 AD 5F BE 7D FA F5 EB D7 AF 6F DE BD 7B F6 ED DB B7 77 EE DD BB 7F FE FD FB F7 EF DF BF FF)

belonging to the class of semi-linear permutations characterized by the "rol 1" transposition (1 2 3 4 5 6 7 0) will, if all S-boxes are identical to this permutation, result in a D matrix that when iterated four times will have an up to 0.20 absolute bias in the 27th bit for a single bit input differential. Our tests shows that this bias is reduced to insignificance if the static whitening vector A is added. We tested this particular value of  D with A equal to ($AAAAAAAA, $AAAAAAAA, $AAAAAAAA, $AAAAAAAA), and no output differential bit had an absolute bias larger than 0.001 for any single bit input differential. Some output differential bits had an absolute bias larger than 0.0005 for some single input bit differential each, for input values less than 226.

This is one of the worst cases we have found so far. For example, we haven't found any single cycle permutation similar to the transposition (7 6 5 4 3 2 1 0)  that's even remotely as biased, because this transposition contains only short cycles. There simply isn't any single cycle permutation sufficiently similar to it.

©2000-2001StreamSec