Subject: [Ietf-krb-wg] Fwd: Fwd: Re: camellia-cts-cmac as a backup enctype for Kerberos

From: <[email-masked]>
Date: Thu, 28 Jul 2011 23:59:08 +0900

Hi, colleagues,

> Sam Hartman <[email-masked]> writes:
> 
> > Tom, you mentioned related key attacks against AES. Has the same
> > methodology failed against Camellia?
> 
> To the best of my knowledge, there are no known related-key attacks
> against full-round Camellia, but I would ask actual cryptographers for
> opinions on that topic.  A quick search only turns up an attack on a
> variant known as "byte-Camellia" (http://eprint.iacr.org/2010/248.pdf).

Yes, because of the following reasons, we believe that Camellia is
much more secure than AES.

(1) related-key differential characteristics of block ciphers
depends on complexity of both in the state and in the key,
(2) the construction of AES key expansion is byte-oriented,
while the one of Camellia key expansion includes bit-shift rotations,
(3) the construction of AES encryption states is only the regular 
functions
called SubBytes, Shiftrows, and Mixcolumns, 
while the one of Camellia encryption states include the irregular 
functions
called FL/FLinv functions beside the regular F-function.

Because of (2) and (3) above, Biryukov and Nikolic, authors for 
http://eprint.iacr.org/2010/248.pdf, used modified-Camellia version
called "byte-Camellia" to find related-key differential characteristics.
The byte-Camellia modifies (2) byte-shift rotation instead of bit-shift 
rotations,
and (3) elimination of FL/FLinv functions.
That is, they changed both key expansion states and encryption states 
from original version
for estimating resistance property of Camellia.
This means their automatic search tool for successful AES related-key 
attacks
CANNOT directly apply to Camellia related-key attacks.

Actually, in the conclusions, the authors stated 
".. a couple of open problems emerged. The first one is
how to deal with ciphers that have small part that is not byte oriented
such as Camellia which has rotations in the key schedule."

Best regards,
Masayuki KANDA

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Tom Yu <[email-masked]>
Date: Fri, 29 Jul 2011 10:11:49 -0400

> much more secure than AES.

Kanda-san, thank you for the additional information about the security
of Camellia.  It reinforces my belief that the structural differences
between Camellia and AES allow Camellia to resist attacks that would
succeed against AES.

>>From original version

---

From: Nico Williams <[email-masked]>
Date: Fri, 29 Jul 2011 09:18:48 -0500

This looks compelling enough, but I have at least one more concern:
side channels.  Are there software implementations of Camellia that
are  not subject to various side-channels?

Nico
--