Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
[Crypto in CTF] LFSR
Search
oalieno
October 31, 2020
Technology
0
450
[Crypto in CTF] LFSR
https://github.com/oalieno/Crypto-Course/tree/master/LFSR
oalieno
October 31, 2020
Tweet
Share
More Decks by oalieno
See All by oalieno
[Crypto in CTF] Classical Cipher
oalieno
0
380
[Crypto in CTF] Block Cipher Mode
oalieno
0
930
[Crypto in CTF] HASH
oalieno
0
230
[Crypto in CTF] RSA
oalieno
0
640
[Crypto in CTF] Bleichenbacher RSA Signature Forgery
oalieno
0
540
[Crypto in CTF] Blockchain Security
oalieno
0
380
滲透測試基本技巧與經驗分享
oalieno
2
1k
Other Decks in Technology
See All in Technology
2025-04-24 "Manga AI Understanding & Localization" Furukawa Arata (CyberAgent, Inc)
ornew
1
190
AI Agentを「期待通り」に動かすために:設計アプローチの模索と現在地
kworkdev
PRO
2
460
ガバクラのAWS長期継続割引 ~次の4/1に慌てないために~
hamijay_cloud
1
260
LiteXとオレオレCPUで作る自作SoC奮闘記
msyksphinz
0
690
Running JavaScript within Ruby
hmsk
3
330
フロントエンドも盛り上げたい!フロントエンドCBとAmplifyの軌跡
mkdev10
2
280
YOLOv10~v12
tenten0727
4
960
プロダクト開発におけるAI時代の開発生産性
shnjtk
2
240
品質文化を支える小さいクロスファンクショナルなチーム / Cross-functional teams fostering quality culture
toma_sm
0
120
Automatically generating types by running tests
sinsoku
2
3.3k
ドキュメント管理の理想と現実
kazuhe
1
200
“パスワードレス認証への道" ユーザー認証の変遷とパスキーの関係
ritou
1
600
Featured
See All Featured
Navigating Team Friction
lara
184
15k
A Modern Web Designer's Workflow
chriscoyier
693
190k
Being A Developer After 40
akosma
91
590k
Code Reviewing Like a Champion
maltzj
522
40k
The Cost Of JavaScript in 2023
addyosmani
49
7.7k
Side Projects
sachag
452
42k
ReactJS: Keep Simple. Everything can be a component!
pedronauck
667
120k
BBQ
matthewcrist
88
9.6k
Fontdeck: Realign not Redesign
paulrobertlloyd
83
5.5k
Build The Right Thing And Hit Your Dates
maggiecrowley
35
2.6k
Speed Design
sergeychernyshev
29
900
StorybookのUI Testing Handbookを読んだ
zakiyama
29
5.6k
Transcript
LFSR oalieno
⼩例⼦ ⊕ ⊗ ⊕ ⊗ ⊕ ⊗ 0 1 1
0 0 1
⼩例⼦ ⊕ ⊗ ⊕ ⊗ ⊕ ⊗ 0 1 1
1 0 0 0
⼩例⼦ ⊕ ⊗ ⊕ ⊗ ⊕ ⊗ 0 1 1
1 0 0 0 1
⼩例⼦ ⊕ ⊗ ⊕ ⊗ ⊕ ⊗ 0 1 1
1 0 0 0 1 1
⼩例⼦ clk FF2 FF1 FF0 0 1 0 0 1
0 1 0 2 1 0 1 3 1 1 0 4 1 1 1 5 0 1 1 6 0 0 1 7 1 0 0 7 個 clock ⼀個循環
從數學的觀點 s2 ⊕ s1 s0 ⊗ ⊕ ⊗ ⊕ ⊗
p2 p1 p0 • 初始值 • 回饋係數 • 轉移⽅程 s0 , s1 , s2 p0 , p1 , p2 si ≡ pi−1 si−1 + pi−2 si−2 + pi−3 si−3 mod 2
從數學的觀點 • 初始值 • 回饋係數 • 轉移⽅程 s0 , s1
, ⋯, sm−1 p0 , p1 , ⋯, pm−1 si ≡ pi−1 si−1 + pi−2 si−2 + ⋯ + pi−m si−m mod 2 sm ≡ pm−1 sm−1 + pm−2 sm−2 + ⋯ + p0 s0 mod 2 sm+1 ≡ pm−1 sm + pm−2 sm−1 + ⋯ + p0 s1 mod 2 ⋮
使⽤ LFSR 作為 Stream Cipher • 把 LFSR 產⽣的輸出當作 key,拿去做
xor cipher ⊕ ⊗ ⊕ ⊗ ⊕ ⊗ 0 1 1 1 0 0 0 1 1 0 0 1 ⊕ 0 0 1 密鑰 明⽂ 密⽂
Known Plaintext Attack • 攻擊者不知道黃⾊的部分 • 攻擊者知道了⼀⼩部分明⽂以及對應的密⽂,可推出⼀些 LFSR 的輸出 ⊕
⊗ ⊕ ⊗ ⊕ ⊗ 0 1 1 1 0 0 0 1 1 0 0 1 ⊕ 0 0 1 密鑰 明⽂ 密⽂
解聯立⽅程式 • 只要知道 2n 個 bits 的輸出,攻擊者就可以算出回饋係數 • 比如知道 ,那下⾯式⼦只會有
三個未知數 • 簡單的⾼斯消去法即可求解 ( 不⼀定有唯⼀解,也不⼀定最短 ) s0 , s1 , ⋯, s5 p0 , p1 , p2 s3 ≡ p2 s2 + p1 s1 + p0 s0 mod 2 s4 ≡ p2 s3 + p1 s2 + p0 s1 mod 2 s5 ≡ p2 s4 + p1 s3 + p0 s2 mod 2
Berlekamp Massey Algorithm • 先介紹 Linear Recurrence • 在 mod
13 下,[ 1, 2, 3, 2, 12 ] 符合 linear recurrence relation [ 7, 3, 1 ] • • 1 ⋅ 1 + 2 ⋅ 3 + 3 ⋅ 7 ≡ 2 mod 13 2 ⋅ 1 + 3 ⋅ 3 + 2 ⋅ 7 ≡ 12 mod 13 Sequence satisfy a linear recurrence relation iff a0 , a1 , ⋯ p1 , p2 , ⋯, pm ∀i ≥ m, ai = m ∑ j=1 ai−j pj
Berlekamp Massey Algorithm • 這個演算法可以找到最短的 Linear Recurrence Relation • 也可以⽤
Polynomial 來表⽰這個 Relation • Relation [ 7, 3, 1 ] 就會是 x3 − 7x2 − 3x − 1
Berlekamp Massey Algorithm from sage.matrix.berlekamp_massey import berlekamp_massey berlekamp_massey([GF(7)(1), 5, 1,
5]) x^2 + 6 sagemath output
Mixed LFSR https://en.wikipedia.org/wiki/Trivium_(cipher) • 既然⼀個 LFSR 很容易被預測,那就兩個 LFSR • 兩個不⾏,就三個,於是就有了
Trivium
Correlation Attack • 那⾃⼰來簡單的組合⼀組 LFSR 來試試 class MYLFSR: def getbit(self):
x1 = LFSR1.getbit() x2 = LFSR2.getbit() x3 = LFSR3.getbit() return (x1 & x2) ^ ((not x1) & x3)
Correlation Attack x1 x2 x3 輸出 0 0 0 0
0 0 1 1 0 1 0 0 0 1 1 1 1 0 0 0 1 0 1 0 1 1 0 1 1 1 1 1 75% of x3 = 輸出
Correlation Attack x1 x2 x3 輸出 0 0 0 0
0 0 1 1 0 1 0 0 0 1 1 1 1 0 0 0 1 0 1 0 1 1 0 1 1 1 1 1 75% of x2 = 輸出
Correlation Attack • 假設回饋係數是已知的 • 要找回三個 LFSR 的初始值最簡單的做法就是暴搜全部可能 • 假設⼀個
LFSR 有的初始值有 32 bits 那就要爆搜 96 bits • 其實可以單獨暴搜 LFSR3,根據暴搜的初始值產出的 x3 去跟輸出比對, 相同的比例有⼤約 75% 的話,就很有可能是真正的初始值 • 同理 LFSR2 也可以這樣做,最後只剩下 LFSR3 就直接暴 • 從要暴搜 296 變成暴搜 3 232 ×
Fast Correlation Attack • 有沒有比暴搜更好的做法,有 • Fast Correlation Attacks: Methods
and Countermeasures • A Fast Correlation Attack Implementation