GOST (block cipher)

The GOST block cipher (Magma), defined in the standard GOST 28147-89 (RFC 5830), is a Soviet and Russian government standard symmetric key block cipher with a block size of 64 bits. The original standard, published in 1989, did not give the cipher any name, but the most recent revision of the standard, GOST R 34.12-2015, specifies that it may be referred to as Magma.[1] The GOST hash function is based on this cipher. The new standard also specifies a new 128-bit block cipher called Kuznyechik.

GOST 28147-89 (Magma)
Diagram of GOST
General
DesignersUSSR, KGB, 8th Department
First published1994-05-23 (declassified)
SuccessorsGOST hash function, Kuznyechik
CertificationGOST standard
Cipher detail
Key sizes256 bits
Block sizes64 bits
StructureFeistel network
Rounds32

Developed in the 1970s, the standard had been marked "Top Secret" and then downgraded to "Secret" in 1990. Shortly after the dissolution of the USSR, it was declassified and it was released to the public in 1994. GOST 28147 was a Soviet alternative to the United States standard algorithm, DES.[2] Thus, the two are very similar in structure.

The algorithm

GOST has a 64-bit block size and a key length of 256 bits. Its S-boxes can be secret, and they contain about 354 (log2(16!8)) bits of secret information, so the effective key size can be increased to 610 bits; however, a chosen-key attack can recover the contents of the S-Boxes in approximately 232 encryptions.[3]

GOST is a Feistel network of 32 rounds. Its round function is very simple: add a 32-bit subkey modulo 232, put the result through a layer of S-boxes, and rotate that result left by 11 bits. The result of that is the output of the round function. In the adjacent diagram, one line represents 32 bits.

The subkeys are chosen in a pre-specified order. The key schedule is very simple: break the 256-bit key into eight 32-bit subkeys, and each subkey is used four times in the algorithm; the first 24 rounds use the key words in order, the last 8 rounds use them in reverse order.

The S-boxes accept a four-bit input and produce a four-bit output. The S-box substitution in the round function consists of eight 4 × 4 S-boxes. The S-boxes are implementation-dependent, thus parties that want to secure their communications using GOST must be using the same S-boxes. For extra security, the S-boxes can be kept secret. In the original standard where GOST was specified, no S-boxes were given, but they were to be supplied somehow. This led to speculation that organizations the government wished to spy on were given weak S-boxes. One GOST chip manufacturer reported that he generated S-boxes himself using a pseudorandom number generator.[4]

For example, the Central Bank of Russian Federation used the following S-boxes:

# S-Box
1 4 A 9 2 D 8 0 E 6 B 1 C 7 F 5 3
2 E B 4 C 6 D F A 2 3 8 1 0 7 5 9
3 5 8 1 D A 3 4 2 E F C 7 6 0 9 B
4 7 D A 1 0 8 9 F E 4 6 C B 2 5 3
5 6 C 7 1 5 F D 8 4 A 9 E 0 3 B 2
6 4 B A 0 7 2 1 D 3 6 8 5 9 C F E
7 D B 4 1 3 F 5 9 0 A E 7 6 8 2 C
8 1 F D 0 5 7 A 4 9 2 3 E 6 B 8 C

However, the most recent revision of the standard, GOST R 34.12-2015, adds the missing S-Box specification and defines it as follows.[1]

# GOST R 34.12-2015 S-Box
1 C 4 6 2 A 5 B 9 E 8 D 7 0 3 F 1
2 6 8 2 3 9 A 5 C 1 E 4 7 B D 0 F
3 B 3 5 8 2 F A D E 1 7 4 C 9 6 0
4 C 8 2 1 D 4 F 6 7 0 A 5 3 E 9 B
5 7 F 5 A 8 1 6 D 0 9 3 E B 4 2 C
6 5 D F 6 9 2 C A B 7 8 1 4 3 E 0
7 8 E 2 5 6 9 1 C F 4 B 0 D A 3 7
8 1 7 E D 0 5 8 3 4 F A 6 9 C B 2

Cryptanalysis of GOST

The latest cryptanalysis of GOST shows that it is secure in a theoretical sense. In practice, the data and memory complexity of the best published attacks has reached the level of practical, while the time complexity of even the best attack is still 2192 when 264 data is available.

Since 2007, several attacks have been developed against reduced-round GOST implementations and/or weak keys.[5][6]

In 2011 several authors discovered more significant flaws in GOST, being able to attack the full 32-round GOST with arbitrary keys for the first time. It has even been called "a deeply flawed cipher" by Nicolas Courtois.[7] Initial attacks were able to reduce time complexity from 2256 to 2228 at the cost of huge memory requirements,[8] and soon they were improved up to 2178 time complexity (at the cost of 270 memory and 264 data).[9][10]

In December 2012, Courtois, Gawinecki, and Song improved attacks on GOST by computing only 2101 GOST rounds.[11] Isobe had already published a single key attack on the full GOST cipher,[12] which Dinur, Dunkelman, and Shamir improved upon, reaching 2224 time complexity for 232 data and 236 memory, and 2192 time complexity for 264 data.[13]

Since the attacks reduce the expected strength from 2256 (key length) to around 2178, the cipher can be considered broken. However, for any block cipher with block size of n bits, the maximum amount of plaintext that can be encrypted before rekeying must take place is 2n/2 blocks, due to the birthday paradox,[14] and none of the aforementioned attacks require less than 232 data.

gollark: Idea: pay politicians more money so lobbying will be more expensive per unit politician.
gollark: Small companies can band together to lobby for things!
gollark: Well, you don't want a government which entirely ignores large companies or also small companies.
gollark: I mean, alternatively, it's the art of paying people to agree with things somewhat more.
gollark: Lobbying somewhat problematic but probably unavoidable and I think you could help a bit by reducing government powers.

See also

References
  1. "GOST R 34.12-2015 (Russian only)" (PDF). Archived from the original (PDF) on 2015-09-24. Retrieved 2015-08-28.
  2. Fleischmann, Ewan; Gorski, Michael; Hühne, Jan-Hendrik; Lucks, Stefan (2009). "Key Recovery Attack on Full GOST Block Cipher with Zero Time and Memory". Published as ISO/IEC JTC. 1.
  3. Saarinen, Markku-Juhani (1998). "A chosen key attack against the secret S-boxes of GOST". We show that a simple "black box" chosen-key attack against GOST can recover secret S-boxes with approximately 2^32 encryptions Cite journal requires |journal= (help)
  4. Schneier, Bruce (1996). Applied cryptography : protocols, algorithms, and source code in C (2. ed., [Nachdr.] ed.). New York [u.a.]: Wiley. ISBN 978-0-471-11709-4.
  5. Eli Biham; Orr Dunkelman; Nathan Keller (2007). "Improved Slide Attacks" (PDF).
  6. Orhun Kara (2008). "Reflection Cryptanalysis of Some Ciphers".
  7. Courtois, Nicolas T. (9 May 2011). "Security Evaluation of GOST 28147-89 In View Of International Standardisation". Cryptology ePrint Archive. IACR. Until 2011 researchers unanimously agreed that GOST could or should be very secure, which was summarised in 2010 in these words: despite considerable cryptanalytic efforts spent in the past 20 years, GOST is still not broken". Unhappily, it was recently discovered that GOST can be broken and is a deeply flawed cipher
  8. Nicolas T. Courtois; Michał Miształ (2011). "Differential Cryptanalysis of GOST". IACR.
  9. Nicolas T. Courtois (2012). "An Improved Differential Attack on Full GOST" (PDF). IACR.
  10. Courtois, Nicolas T. (Jun 13, 2011). "Algebraic Complexity Reduction and Cryptanalysis of GOST" (PDF). Cryptology ePrint Archive. IACR.
  11. Nicolas T. Courtois; Jerzy A. Gawinecki; Guangyan Song (2012). "CONTRADICTION IMMUNITY AND GUESS-THEN-DETERMINE ATTACKS ON GOST" (PDF). Versita. Retrieved 2014-08-25.
  12. Isobe, Takanori (2011). A Single-Key Attack on the Full GOST Block Cipher. Lecture Notes in Computer Science. 6733. pp. 290–305. doi:10.1007/978-3-642-21702-9_17. ISBN 978-3-642-21701-2.
  13. Dinur, Itai; Dunkelman, Orr; Shamir, Adi (2012). "Improved Attacks on Full GOST". Lecture Notes in Computer Science. 7549 (Fast Software Encryption): 9–28. doi:10.1007/978-3-642-34047-5_2.
  14. "Draft of ISO/IEC JTC 1/SC 27 Standing Document No. 12 (SD12) on the Assessment of Cryptographic Techniques and Key Lengths, 4th edition" (PDF). 2016.

Further reading
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.