Breaking Industrial Ciphers at a Whim MATE SOOS PRESENTATION AT HES 11

Transkript

1 Breaking Industrial Ciphers at a Whim MATE SOOS PRESENTATION AT HES 11

2 Story line 1 HiTag2: reverse-engineered proprietary cipher 2 Analytic tools are needed to investigate them 3 CryptoMiniSat: free software tool to test ciphers (and to break them) 2

3 Philips HiTag2 Cipher For access control: cars, army buildings Proprietary: reverse-engineered by Karsten Nohl and Sean O Neil Feedback linear(!), filter non-linear 3

4 SAT Solvers Input: CNF, an and of or-s (x 1 x 3 ) ( x 2 x 3 ) (x 1 x 2 ) Crypto-problem needs conversion Uses DPLL(ϕ) algorithm 1 If (formula ϕ trivial) return SAT/UNSAT 2 ret DPLL(ϕ with v true) 3 If (ret = SAT) return SAT 4 ret DPLL(ϕ with v false) 5 If (ret = SAT) return SAT 6 return UNSAT 4

5 Toy Example ( x 1 x 2 x 3 ) ( x 1 x 2 ) ( x 1 x 2 ) Clause 1 Clause 2 Clause 3 1 Guess: x 1 = True 2 Clause 2: x 2 = True 3 Clause 3: impossible! Reverse. 4 x 1 = False 5 Good, everything is satisfied! 5

6 calc_s[80] - - ** ** ** **61 **60 calc_s[80] - - ** s[80] - s[84] - s[83] - s[82] - s[81] ** **65 ** ** s[86] - s[95] - s[94] - - s[92] - s[91] - s[90] - s[89] - s[88] - s[87] **61 **60 - **69 **68 - calc_s[7] - ** s[97] - - calc_s[8] - **71 - s[98] - - calc_s[20] - - **65 - **69 ** calc_s[7] **74 ** calc_s[8] - - **76 - ** calc_s[20] - - ** calc_s[8] ** **80 - **81 - **76 - **71 **82 **78 - **79 - calc_s[8] - - ** calc_s[7] **84 - ** s[101] **85 - ** calc_s[20] ** ** ** **90 ** **92 - ** ** ** **83 ** ** ** ** ** ** ** **104 ** ** **106 - ** ** ** **110 ** ** ** ** ** ** **85 **81 - **116 **113 - ** ** **118 **117 - **119 ** **120 ** **87 **83 **122 **121 **111 - **105 BEGIN - ** ** **127 ** calc_s[25] - **125 - ** ** **129 **126 ** calc_s[25] **131 **130 - ** s[86] ** calc_s[25] - ** **136 - **137 ** **139 ** calc_s[25] **140 node66 learnt unit clause ** **142 - learnt unit clause - ** calc_s[16] ** **145 ** ** ** calc_s[92] - s[92] calc_s[18] - - calc_s[83] - s[83] calc_s[87] s[87] - calc_s[81] s[81] calc_s[97] s[97] calc_s[90] - s[90] calc_s[98] - s[98] calc_s[82] - s[82] calc_s[88] - s[88] calc_s[84] - s[84] calc_s[101] - s[101] calc_s[80] s[80] calc_s[94] - s[94] calc_s[95] - s[95] calc_s[89] s[89] calc_s[91] - s[91] calc_s[86] - s[86] MODEL Example Search Tree Guess until conflict Start - - Backtrack - - First conflict Solution Found 6

7 CryptoMiniSat SAT solver that excels at cryptography General purpose: won SAT Race 10 Time (s) MiniSat 2.2 lingeling PrecoSat465 CryptoMiniSat SAT Comp No. solved instances from SAT Comp 09 Collaborative: GPL, mailing list, regular releases 7

8 Demo 1 Generate HiTag2 problem: Grain-of-Salt tool 2 Solve it using CryptoMiniSat 3 Analyse results: 2 days to break 8

9 Conclusion SAT solvers are powerful tools to break weak cryptography CryptoMiniSat, a leading SAT solver, is waiting for your contribution Weak ciphers like HiTag2 should not be used in high-value applications 9