|
2003-10-22
Steak - Matrix table transform
The Matrix Table
Transform and the Permute steps of the main function mounts to the
equation system (xor for addition, and for multiplication) described
by the following 32 by 32 binary matrix:
0 1 0 0 1 1 0 0 1 1 0 0 1 0 0 0 0 1 1 0 1 0 0 0 1 0 0 0 0 1 1 0
0 0 0 0 0 0 1 0 0 1 0 0 1 1 0 0 1 0 0 0 1 1 0 0 1 1 1 0 0 1 0 0
1 0 0 0 1 0 0 1 1 0 0 1 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1 0 0
0 0 1 0 0 0 0 0 1 1 0 0 0 0 1 0 0 0 0 0 1 1 0 0 0 0 0 1 1 1 0 0
0 1 0 0 0 0 0 0 1 1 0 0 0 1 0 1 0 1 0 1 1 0 0 0 0 1 0 0 1 1 0 0
0 1 0 0 0 1 0 0 1 1 0 0 0 1 0 0 0 0 0 0 1 0 0 1 1 1 0 0 1 1 0 0
1 0 0 1 1 0 0 0 0 1 0 0 1 0 0 0 1 1 0 0 0 1 0 0 1 1 0 0 1 1 0 1
1 1 0 0 0 0 1 0 1 1 1 0 0 0 1 0 0 1 0 0 0 0 1 1 1 0 0 0 1 0 0 0
0 0 0 0 1 0 0 1 1 1 0 0 0 0 0 1 1 0 1 0 0 0 0 0 1 1 0 0 0 0 1 1
0 1 0 0 0 0 1 0 0 1 0 0 0 0 1 0 1 1 0 0 1 0 0 1 0 1 1 0 0 0 0 0
0 0 0 0 0 0 1 1 1 1 0 1 0 0 1 1 1 0 0 0 0 0 1 1 0 0 0 0 0 1 0 1
1 1 1 0 0 0 0 1 0 1 0 0 0 0 1 1 1 0 0 0 0 1 0 1 0 0 0 1 0 0 1 1
1 0 0 0 0 1 0 0 0 1 0 0 0 0 0 1 1 1 0 1 0 0 0 0 0 0 0 0 0 0 0 1
1 0 0 0 0 0 1 0 0 1 0 0 1 0 1 0 1 1 0 0 0 0 1 0 1 0 0 1 0 0 0 0
1 1 0 1 0 0 0 1 1 0 0 0 0 1 0 1 1 0 0 0 0 0 0 0 0 1 1 0 0 0 1 0
1 0 1 1 1 0 0 1 0 0 1 0 1 1 0 1 0 0 1 1 0 1 1 0 0 0 0 0 1 1 1 1
0 0 0 0 1 1 1 0 1 0 0 1 0 1 1 0 0 0 1 1 1 1 0 1 0 0 0 1 0 0 1 0
0 0 1 1 0 1 1 1 0 1 0 1 1 0 0 1 0 0 0 0 1 0 0 0 0 0 0 1 0 1 0 1
0 0 0 0 1 0 0 0 0 0 0 1 0 0 1 1 1 0 1 0 0 0 0 1 0 0 1 0 1 0 1 1
0 1 1 0 1 0 1 0 0 0 1 1 0 0 0 1 0 0 0 0 1 0 1 1 0 0 1 0 0 0 0 1
0 0 0 1 1 0 0 0 0 0 1 1 1 1 0 1 0 0 0 0 1 1 0 1 1 0 0 0 0 0 0 0
0 0 0 1 1 1 0 1 0 0 1 1 1 0 0 1 0 0 0 1 1 1 0 1 0 1 0 0 0 0 1 0
0 0 1 0 0 1 1 0 0 0 1 1 1 1 1 0 0 1 1 0 1 0 1 1 0 0 0 1 1 1 0 1
1 0 1 1 0 0 0 0 0 0 1 1 0 0 0 0 0 0 1 0 0 0 1 0 0 0 1 1 1 0 0 0
0 0 1 1 1 0 0 0 1 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 1 0 0 0 1 0
0 0 0 0 0 0 1 0 0 1 0 1 0 0 0 0 0 0 0 1 1 0 0 0 0 0 1 1 0 0 0 0
0 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 1 0 1 0 0 0 0 0 0 0 1 0 0 1 0 0
0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 0 0 1 0 0 0 0 1 0 0 0 0 0
0 0 1 1 0 1 0 0 0 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 1 0 0 1 0 0 0 0
0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 1 1 0 0 0 1 0 1 0 1 0 0 0 0
0 0 0 1 0 0 0 0 0 0 1 1 0 1 0 0 0 1 0 1 0 0 0 0 0 0 0 1 0 0 0 1
1 1 0 0 1 1 0 0 1 0 1 0 0 1 0 0 1 1 0 0 1 1 1 0 0 1 0 0 1 0 0 0
or, equivalently, with the columns put as 32 bit
hexadecimal numbers:
($8080F8C4,$88084AB1,$31CA8808,$51B2C040, $813D8145,$90631021,$024B2682,$0422CD04,
$810145BD,$02023FFB,$C4F88080,$42FF0404, $2072A043,$C051C032,$08452E88,$103EDD10,
$84047F42,$C04032D1,$3DC58101,$63219010, $827B023F,$8831884A,$80C8A480,$207D0EA0,
$101021E3,$A0204372,$7B3F8202,$72C32020, $80C480F8,$0442847F,$0125C901,$404E9D40)
This matrix was chosen partly arbitrarily (by experimenting with
the TwoFish data), partly experimentally as a result of extensive
pseudo random properties testing. Besides this, the design of Steak
only requires the MTT to be sufficiently distance separable (to
delude key retreival attacks) and invertible (to ensure maximum
length propagation).
The inverse of the MTT is correspondingly
described by:
($06D1C2DD,$E893C582,$A26542CB,$4DEB4D22,
$C8059A6F,$0D41BD4E,$7B8436AE,$5CC6CB83,
$C680CB5D,$88530744,$63CC820B,$C7AB0D40,
$89C78A67,$C448910F,$4140A7C0,$C6C1C71C,
$C85706C2,$66C4C04B,$CDAA85C0,$8945CA69,
$4E491D0E,$4106264E,$3C041CE1,$5084C081,
$8480C150,$80500A00,$60C18084,$C0A84042,
$89C00060,$C2C09008,$C84AACC0,$D8060992)
The MTT deviates from a maximum distance separation matrix with
numbers according to the following table:
| Output\Input |
0 |
1 |
2 |
3 |
| 0 |
256 |
256 |
256 |
128 |
| 1 |
128 |
256 |
256 |
256 |
| 2 |
256 |
128 |
128 |
256 |
| 3 |
256 |
128 |
256 |
256 |
The number in each cell represents the number of different
output differentials in the byte position corresponding to the
row, given a single byte input differential in the byte position
corresponding to the column. For example, a single byte
differential in the second byte has a probability of 1/256 not to
induce an output differential in the third or fourth byte. For an
MDS matrix all cells would have been 256. Since the MTT matrix is
equivalent to a bytewise MDS matrix with two bitwise
transpositions applied before and after the matrix operation, the
square of the MTT is indistinguishable from the square of an MDS
matrix in conjunction with a post bitwise transposition.
The design principle of Steak might be described as putting
together several weak and actually or potentially biased
functions, to use a very large key and dynamic key data. For
example, the MTT is a weak function in so far that it is a linear
transform, and as such each output differential is a function of
the input differential, regardless of the number of
iterations.
When the S-boxes are added (to form the D function
according to the notation of the algorithm), this relationship is
normally lost, and each input differential corresponds to a mostly
unbiased set of output differentials. At least, the bias that
remains will be statistically insignificant for outputs less than
approximately 64 KB (for iterations of D only), and would
possibly reveal key data if the algorithm was known, but would not
be specific to the algorithm. This is an ideal property in this
context. Most bias measures will reveal some degree of bias in
most random functions. The objective, according to the security
proof, is not to make it infeasible to extract key data if the
algorithm is known, but to make it as hard as possible to tell if
the algorithm is used at all. A perfect lack of key dependent bias
would be a dead give away for non-randomness.
In some cases however, the
S-boxes are such that the output differentials will be
significantly biased.
This happens when the S-boxes are all similar to bit
transpositions; i.e. are "semi linear". For example, the
permutation with the following cycle (hexadecimal notation):
(00 01 02 04 08 10 20 40 80 03 06 0C 18 30 60 C0 81 05 0A 14 28 50 A0 41 82 07 0E 1C 38 70 E0 C1 83 09 12 24 48 90 21 42 84 0B 16 2C 58 B0 61 C2 85 0D 1A 34 68 D0 A1 43 86 0F 1E 3C 78 F0 E1 C3 87 11 22 44 88 13 26 4C 98 31 62 C4 89 15 2A 54 A8 51 A2 45 8A 17 2E 5C B8 71 E2 C5 8B 19 32 64 C8 91 23 46 8C 1B 36 6C D8 B1 63 C6 8D 1D 3A 74 E8 D1 A3 47 8E 1F 3E 7C F8 F1 E3 C7 8F 25 4A 94 29 52 A4 49 92 27 4E 9C 39 72 E4 C9 93 2B 56 AC 59 B2 65 CA 95 2D 5A B4 69 D2 A5 4B 96 2F 5E BC 79 F2 E5 CB 97 33 66 CC 99 35 6A D4 A9 53 A6 4D 9A 37 6E DC B9 73 E6 CD 9B 3B 76 EC D9 B3 67 CE 9D 3D 7A F4 E9 D3 A7 4F 9E 3F 7E FC F9 F3 E7 CF 9F 55 AA 57 AE 5D BA 75 EA D5 AB 5B B6 6D DA B5 6B D6 AD 5F BE 7D FA F5 EB D7 AF 6F DE BD 7B F6 ED DB B7 77 EE DD BB 7F FE FD FB F7 EF DF BF FF)
belonging to the class of semi-linear
permutations characterized by the "rol 1" transposition (1
2 3 4 5 6 7 0) will, if all S-boxes are identical to this
permutation, result in a D matrix that when iterated four
times will have an up to 0.20 absolute bias in the 27th
bit for a single bit input differential. Our tests shows that this
bias is reduced to insignificance if the static whitening vector A
is added. We tested this particular value of D with
A equal to ($AAAAAAAA, $AAAAAAAA, $AAAAAAAA, $AAAAAAAA), and
no output differential bit had an absolute bias larger than 0.001
for any single bit input differential. Some output differential bits
had an absolute bias larger than 0.0005 for some single input bit
differential each, for input values less than 226.
This is one of the worst cases we have found so
far. For example, we haven't found any single cycle permutation
similar to the transposition (7 6 5 4 3 2 1 0) that's even
remotely as biased, because this transposition contains only short
cycles. There simply isn't any single cycle permutation sufficiently
similar to it.
|