Subject: [Ietf-krb-wg] Fwd: Re: camellia-cts-cmac as a backup enctype for Kerberos

From: Satoru Kanno <[email-masked]>
Date: Fri, 29 Jul 2011 06:56:33 +0900

Hi Folks,

Just in case I forward an expert opinion on Camellia cipher for
related-key attack to this ML.

Regards,
Satoru

-------- Original Message --------
Subject: Re: [Ietf-krb-wg] camellia-cts-cmac as a backup	 enctype for
Kerberos
Date: Thu, 28 Jul 2011 23:59:08 +0900
From: <[email-masked]>
To: Tom Yu <[email-masked]>
CC: Sam Hartman <[email-masked]>, <[email-masked]>,
Satoru Kanno <[email-masked]>

Hi, colleagues,

> Sam Hartman <[email-masked]> writes:
> 
> > Tom, you mentioned related key attacks against AES. Has the same
> > methodology failed against Camellia?
> 
> To the best of my knowledge, there are no known related-key attacks
> against full-round Camellia, but I would ask actual cryptographers for
> opinions on that topic.  A quick search only turns up an attack on a
> variant known as "byte-Camellia" (http://eprint.iacr.org/2010/248.pdf).

Yes, because of the following reasons, we believe that Camellia is
much more secure than AES.

(1) related-key differential characteristics of block ciphers
depends on complexity of both in the state and in the key,
(2) the construction of AES key expansion is byte-oriented,
while the one of Camellia key expansion includes bit-shift rotations,
(3) the construction of AES encryption states is only the regular
functions
called SubBytes, Shiftrows, and Mixcolumns,
while the one of Camellia encryption states include the irregular
functions
called FL/FLinv functions beside the regular F-function.

Because of (2) and (3) above, Biryukov and Nikolic, authors for
http://eprint.iacr.org/2010/248.pdf, used modified-Camellia version
called "byte-Camellia" to find related-key differential characteristics.
The byte-Camellia modifies (2) byte-shift rotation instead of bit-shift
rotations,
and (3) elimination of FL/FLinv functions.
That is, they changed both key expansion states and encryption states
from original version
for estimating resistance property of Camellia.
This means their automatic search tool for successful AES related-key
attacks
CANNOT directly apply to Camellia related-key attacks.

Actually, in the conclusions, the authors stated
".. a couple of open problems emerged. The first one is
how to deal with ciphers that have small part that is not byte oriented
such as Camellia which has rotations in the key schedule."

Best regards,
Masayuki KANDA

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg