[Paper Review] The role of Boolean functions in hiding sums as trapdoors for some block ciphers

Riccardo Aragona, Marco Calderini+1 more|arXiv (Cornell University)|Nov 27, 2014

Coding theory and cryptography20 references3 citations

TL;DR

This paper introduces 'hidden sums'—alternative vector space structures in block ciphers that can serve as cryptographic backdoors. It characterizes Boolean function S-boxes that resist such trapdoors by introducing the class of 'anti-crooked' functions, and demonstrates a toy cipher vulnerable to a key-recovery attack requiring only 7 encryptions, independent of rounds and key schedule.

ABSTRACT

Most modern block ciphers are built using components whose cryptographic strength is evaluated in terms of their resistance to attacks on the whole cipher. In particular, differential properties of vectorial Boolean functions are studied for the S-Boxes to thwart differential cryptanalysis. Little is known on similar properties to avoid trapdoors in the design of the block cipher. In this paper we present a form of trapdoors coming from alternative vector space structures, which we call hidden sums, and give a characterization on the Boolean function S-Box to avoid any such hidden sum. We also study some properties of this new class of vectorial Boolean functions, which we call anti-crooked, and provide a toy cipher with a hidden sum trapdoor.

Motivation & Objective

• To identify and formalize a new class of trapdoors in block ciphers based on alternative vector space structures, termed 'hidden sums'.
• To characterize the properties of S-boxes—specifically, vectorial Boolean functions—that prevent such hidden sum trapdoors.
• To introduce and analyze a new class of Boolean functions, called 'anti-crooked' functions, which are resistant to hidden sum attacks.
• To construct a toy cipher with a hidden sum trapdoor and demonstrate a practical key-recovery attack that bypasses standard security assumptions.

Proposed method

• Models block cipher components using group actions, particularly the affine group AGL(V,∘), where ∘ is a hidden sum operation.
• Defines a ring structure (V,∘,·) and a group operation ⋆ on V such that the abelian regular subgroup T is isomorphic to (V,⋆).
• Uses the isomorphism between the translation group T and the group (V,⋆) to derive the map κ_y: x ↦ κ_y(x)∘y, which links the hidden sum to linear transformations.
• Derives the key identity κ_{x⋆y} = κ_y ∘ κ_x, showing that the image of the map y ↦ κ_y forms a p-group acting unipotently on (V,∘).
• Applies the derived structure to a toy cipher with a 6-bit key space, using a specific hidden sum ∘′ defined on V = (F₂)^6.
• Employs a chosen-plaintext or chosen-plaintext/chosen-ciphertext attack to recover the matrix M and translation vector t of the encryption function in AGL(V,∘′), using only 7 encryptions or 14 operations.

Experimental results

Research questions

• RQ1 How can alternative vector space structures (hidden sums) be exploited to create undetectable trapdoors in block ciphers?
• RQ2 What properties must a vectorial Boolean function S-box satisfy to prevent the existence of such hidden sum trapdoors?
• RQ3 Can a new class of Boolean functions be defined that inherently resists hidden sum constructions?
• RQ4 To what extent can a hidden sum trapdoor be exploited in practice, and how efficiently can it be broken?

Key findings

• The paper introduces the class of 'anti-crooked' vectorial Boolean functions, which are characterized as those that prevent the existence of nontrivial hidden sums in the cipher's structure.
• A hidden sum trapdoor can be exploited via a key-recovery attack requiring only 7 encryptions, regardless of the number of rounds or key schedule complexity.
• The attack works by recovering the matrix M and translation vector t of the encryption function in AGL(V,∘′), enabling full reconstruction of the cipher.
• The attack is efficient: it costs approximately 7 encryptions (chosen-plaintext) or 14 operations (chosen-plaintext/chosen-ciphertext), both far below brute force.
• The existence of a nontrivial subgroup U ⊆ V such that x⋆y = x∘y for all x,y ∈ U implies the presence of a hidden sum, which can be detected via structural analysis.
• The paper demonstrates that standard AES-like ciphers can be extended to include hidden sum trapdoors, and provides a concrete toy cipher with such a vulnerability.