Onderwerp: Secure Science issues preview of their upcoming block cipher

Secure Science is offering a preview of one of the 3 ciphers they will
be publishing througout the year. The CS2-128 cipher is a 128-bit block
cipher with a 128 bit key. This cipher is proposed as an alternative
hardware-based cipher to AES, being that it is more efficient in
hardware, simpler to implement, and provably just as secure as AES-128.

http://www.securescience.net/ciphers/csc2/

--
Best Regards,
Secure Science Corporation
[Have Phishers stolen your customers' logins? Find out with DIA]
https://slam.securescience.com/signup.cgi - it's free!

Really? How does one go about proving the security of a block cipher?

My understanding is that you, and others, perform attacks against it,
and see how it holds up. Many of the very best minds out there
attacked AES, so for your new CS2 cipher to be "provably just as
secure as AES-128," all those people would have had to have spent as
much time and energy as they did on AES. That strikes me as unlikely,
there's a lot more interest in hash functions today.

Adam

PS: I've added the cryptography mail list to this. Some of the folks
over there may be interested in your claims.

On Wed, Mar 23, 2005 at 05:00:25PM -0800, BugTraq wrote:
| Secure Science is offering a preview of one of the 3 ciphers they will
| be publishing througout the year. The CS2-128 cipher is a 128-bit block
| cipher with a 128 bit key. This cipher is proposed as an alternative
| hardware-based cipher to AES, being that it is more efficient in
| hardware, simpler to implement, and provably just as secure as AES-128.
|
| http://www.securescience.net/ciphers/csc2/
|
| --
| Best Regards,
| Secure Science Corporation
| [Have Phishers stolen your customers' logins? Find out with DIA]
| https://slam.securescience.com/signup.cgi - it's free!
|

| Really? How does one go about proving the security of a block cipher?
They don't claim that:

This cipher is ... provably just as secure as AES-128.

I can come up with a cipher provably just as secure as AES-128 very quickly....

(Actually, based on the paper a while back on many alternative ways to
formulate AES - it had a catchy title something like "How Many Ways Can You
Spell AES?", except that I can't find one like that now - one could even
come up with a formulation that is (a) probably as secure as AES-128; (b)
actually faster in hardware or simpler to implement or whatever...)

-- Jerry :-)

| My understanding is that you, and others, perform attacks against it,
| and see how it holds up. Many of the very best minds out there
| attacked AES, so for your new CS2 cipher to be "provably just as
| secure as AES-128," all those people would have had to have spent as
| much time and energy as they did on AES. That strikes me as unlikely,
| there's a lot more interest in hash functions today.
|
| Adam
|
| PS: I've added the cryptography mail list to this. Some of the folks
| over there may be interested in your claims.
|
| On Wed, Mar 23, 2005 at 05:00:25PM -0800, BugTraq wrote:
| | Secure Science is offering a preview of one of the 3 ciphers they will
| | be publishing througout the year. The CS2-128 cipher is a 128-bit block
| | cipher with a 128 bit key. This cipher is proposed as an alternative
| | hardware-based cipher to AES, being that it is more efficient in
| | hardware, simpler to implement, and provably just as secure as AES-128.
| |
| | http://www.securescience.net/ciphers/csc2/
| |
| | --
| | Best Regards,
| | Secure Science Corporation
| | [Have Phishers stolen your customers' logins? Find out with DIA]
| | https://slam.securescience.com/signup.cgi - it's free!
| |
|
| ---------------------------------------------------------------------
| The Cryptography Mailing List
| Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
|

Wouldn't a proof that AES-128 were reducible to CS2-128, so that any
successful attack on CS2-128 would also constitute a successful attack on
AES-128, provide exactly the situation that he describes? CS2-128 would be
"provably as secure as" AES-128.

On Thu, 24 Mar 2005, Adam Shostack wrote:

> Really? How does one go about proving the security of a block cipher?
>
> My understanding is that you, and others, perform attacks against it,
> and see how it holds up. Many of the very best minds out there
> attacked AES, so for your new CS2 cipher to be "provably just as
> secure as AES-128," all those people would have had to have spent as
> much time and energy as they did on AES. That strikes me as unlikely,
> there's a lot more interest in hash functions today.
>
> Adam
>
> PS: I've added the cryptography mail list to this. Some of the folks
> over there may be interested in your claims.
>
> On Wed, Mar 23, 2005 at 05:00:25PM -0800, BugTraq wrote:
> | Secure Science is offering a preview of one of the 3 ciphers they will
> | be publishing througout the year. The CS2-128 cipher is a 128-bit block
> | cipher with a 128 bit key. This cipher is proposed as an alternative
> | hardware-based cipher to AES, being that it is more efficient in
> | hardware, simpler to implement, and provably just as secure as AES-128.
> |
> | http://www.securescience.net/ciphers/csc2/
> |
> | --
> | Best Regards,
> | Secure Science Corporation
> | [Have Phishers stolen your customers' logins? Find out with DIA]
> | https://slam.securescience.com/signup.cgi - it's free!
> |
>

Jerrold Leichter wrote:

> I can come up with a cipher provably just as secure as AES-128 very quickly....
>
> (Actually, based on the paper a while back on many alternative ways to
> formulate AES - it had a catchy title something like "How Many Ways Can You
> Spell AES?", except that I can't find one like that now - one could even
> come up with a formulation that is (a) probably as secure as AES-128; (b)
> actually faster in hardware or simpler to implement or whatever...)

You're probably looking for [1] by Barkan and Biham. What they do is
replacing the irreducible polynomial and all the constants involved in
Rijndael to get what they call "dual ciphers"; basically those ciphers
are isomorphic to Rijndael. All in all they get 240 dual ciphers which
are listed in [2]. What I found more interesting back then was that they
also give square dual and log dual ciphers of Rijndael. I.e. let E be
the Rijndael encryption and E' be the encryption function of the
square/log dual Rijndael construction. Furthermore let f be a function
that either performs bytewise squaring in GF(2^8) or replaces each byte
with a logarithmic representation (relative to a generator g. you also
need to fix log_g(0) = -\infty for this to make sense). Then

E'(f(plaintext), f(key)) = f(E(plaintext, key))

holds. The squaring construction then also naturally extends to what
they call "higher-order self dual ciphers": meaning you can apply the
squaring multiple times.

In 2004 Wu, Lu and Laih then demonstrated that using Barkan's and
Biham's method can indeed lead to more efficient implementations of
AES/Rijndael in hardware.

Cheers,
Ralf

[1] Elad Barkan and Eli Biham:
In How Many Ways Can You Write Rijndael?
ASIACRYPT 2002, Springer
note: also on ePrint as http://eprint.iacr.org/2002/157
if you don't have Springer Link access

[2] Elad Barkan and Eli Biham:
The Book of Rijndaels
http://eprint.iacr.org/2002/158

[3] Shee-Yau Wu and Shih-Chuan Lu and Chi Sung Laih:
Design of AES Based on Dual Cipher and Composite Field
Topics in Cryptology, CT-RSA 2004, Springer

--
Ralf-P. Weinmann <weinmann@cdc.informatik.tu-darmstadt.de>
TU Darmstadt, FB Informatik, FG Theoretische Informatik
Tel: +49-(0)6151-16-6628

[The From: header is a broken-autoresponder defense; use the address in
the signature if you want to write to me.]

[quoting order repaired manually -dM]
>> [...] CS2-128 cipher is a 128-bit block cipher with a 128 bit key.
>> This cipher is [...] provably just as secure as AES-128.
> Really? How does one go about proving the security of a block
> cipher?

Proving it just as secure as another cipher is very different from
proving its security in any kind of absolute sense.

If I wanted to prove two ciphers to be of equivalent security ("just as
secure as"), I would try to find a way to use a break of either to
break the other (with sufficiently trivial transformation cost, of
course). If I show that any break of CS2-128 can be trivially used to
break AES-128, then I have shown that CS2-128 is at least as secure
than AES-128; if I do the same in the other direction too, I have shown
that it is just as secure.

> My understanding is that you, and others, perform attacks against it,
> and see how it holds up.

That is how to probe its security in absolute terms; it cannot prove
anything in the mathematical sense that is apparently being used here.
(Well, okay, it _can_ prove that a cipher is *in*secure.) "Provably
just as secure as" has little to nothing to do with the kind of
demonstration of security derived from withstanding skilled attacks.

/~\ The ASCII der Mouse
\ / Ribbon Campaign
X Against HTML mouse@rodents.montreal.qc.ca
/ \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B