Probabilistic properties of modular addition Victoria Vysotskaya JSC InfoTeCS, NPK Kryptonite CTCrypt 19 / June 4, 2019 vysotskaya.victory@gmail.com Victoria Vysotskaya (Infotecs, Kryptonite) Probabilistic properties of modular addition CTCrypt 19 1 / 23
Definitions Definition The table P n of shape 2 n 2 n indexed by x and f with elements pp n q x, f P n p x, f q, where and P n p x, f q 1 tpx, yq P Z 2 2 2n 2 n : f f px ` x, yq ` f px, yqu f px, yq x `n y is called Differential Distribution Table (DDT). Victoria Vysotskaya (Infotecs, Kryptonite) Probabilistic properties of modular addition CTCrypt 19 2 / 23
DDT has the following form P n = f x 0... j... 2 n 1 0......... i...... P n pi, jq. 2 n 1 P n pi, jq 1 2 2n! px, yq : j px ` iq `n y ` px `n yq). Victoria Vysotskaya (Infotecs, Kryptonite) Probabilistic properties of modular addition CTCrypt 19 3 / 23
Previous results [1] Lemma Let matrix P n have the form A P n C B D. Then matrix P n 1 has the form P n 1 1 2 2A B 0 B C D C D 0 B 2A B C D C D. [1] Vysotskaya V., Some properties of modular addition (Extended abstract), Cryptology eprint Archive https://eprint.iacr.org/2018/1103, 2018. Victoria Vysotskaya (Infotecs, Kryptonite) Probabilistic properties of modular addition CTCrypt 19 4 / 23
Problem statement Question How for a given x can we determine the minimum cardinality K c p xq of the set of numbers f 1,..., f Kcp xq such that K cp xq i1 P n p x, f i q c, 0 c 1? Note Attacker searches for a row with a small value K c. Victoria Vysotskaya (Infotecs, Kryptonite) Probabilistic properties of modular addition CTCrypt 19 5 / 23
Definition The entropy in i-th row of matrix P n is defined as Hypothesis Idea 2 n 1 Hn i P n pi, jq log 2 P n pi, jq, i 0,..., 2 n 1. j0 K 1 piq 2 Hi n for all P n rows indices i P t0,..., 2 n 1u. 2 Let s consider value 2 Hi n instead of K 1 2 piq. Victoria Vysotskaya (Infotecs, Kryptonite) Probabilistic properties of modular addition CTCrypt 19 6 / 23
Lemma H i n 1 #Hi mod 2n n 1, if i P r2 n 1, 2 n 1s Y r3 2 n 1, 2 n 1 1s, Hi mod 2n n βi mod 2n n, if i P r0, 2 n 1 1s Y r2 n, 3 2 n 1 1s, where 1 1 β n 0, lomon 2 n 1, 2 n 2, 1 looooomooooon 2 n 2,..., 1 8,..., 1, 1 looomooon 8 4,..., 1, 1 looomooon 4 2,..., 1. looomooon 2 1 2 2 n 4 2 n 3 2 n 2 Victoria Vysotskaya (Infotecs, Kryptonite) Probabilistic properties of modular addition CTCrypt 19 7 / 23
Theorem EH n 2 n Op1q as n Ñ 8. 3 Corollary E2 qhn Ω 2 2 nq 3. Victoria Vysotskaya (Infotecs, Kryptonite) Probabilistic properties of modular addition CTCrypt 19 8 / 23
Theorem There exist two sequences of recurrence relations qf k pnq k 1 l1 qα k,l q Fk pn lq and p Fk pnq k 1 l1 pα k,l p Fk pn lq and two sequences of positive numbers qc k, pc k such that: qf k pnq À E2 qhn À p Fk pnq as n Ñ 8 and log Fk q pnq log Fk q pnq lim Ñ 0 as k Ñ 8. nñ8 n Victoria Vysotskaya (Infotecs, Kryptonite) Probabilistic properties of modular addition CTCrypt 19 9 / 23
Lemma Characteristic polynomials Hk q pλq and Hk p pλq of these recurrences: 1 have no root in the annulus 1 λ 2, if q 1; 2 have no root λ such that λ 2 q 1 1, if q 1, 3 have exactly one root λ such that λ 2 q 1 1, if q 1. Note Both functions Hk p pλq and Hk q pλq have a real root on the segment r2 q 1, 3 2 q s which can be found by halving the segment. In this case, for m steps the root can be found with an accuracy Op2 m q. Victoria Vysotskaya (Infotecs, Kryptonite) Probabilistic properties of modular addition CTCrypt 19 10 / 23
Lemma qf k pnq qγ k qy n k pf k pnq pγ k py n k qρ kpnq, pρ kpnq, where qy k, py k are maximum (by the absolute value) roots of polynomials qh k pλq and Hk p pλq respectively, and # Op1q, if q 1, qρ k pnq O 2 q 1 1 as n Ñ 8 n, otherwise pthe same holds for pρ k pnqq. Lemma lim ppy k qy k q 0. kñ8 Victoria Vysotskaya (Infotecs, Kryptonite) Probabilistic properties of modular addition CTCrypt 19 11 / 23
Example For 0 ε 10 4 qα 1 2 p0.7265 εqn À E2 Hn À pα 1 2 p0.7265 εqn, qα 2 2 p1.5361 εqn À D2 Hn À pα 2 2 p1.5361 εqn. Victoria Vysotskaya (Infotecs, Kryptonite) Probabilistic properties of modular addition CTCrypt 19 12 / 23
Example By Chebyshev s inequality P 2 H n E2 Hn u n? D2 Hn 1 Ñ 0 as n Ñ 8, u 1. u2n Thus with probability tending to one 2 Hn E2 Hn u n? D2 Hn or, for example, 2 Hn o 2 0.76807n as n Ñ 8. Victoria Vysotskaya (Infotecs, Kryptonite) Probabilistic properties of modular addition CTCrypt 19 13 / 23
Note Last year we proved [1] that matrix P n rows are divided into classes of equivalence. Entropy is one and the same for all members of a class. Lemma Compact pof size Opnqq representations of classes of equivalence may be generated in time proportional to their number. This is b e π 2n 3 2? 2π? n O 2 3,7007? n as n Ñ 8. Victoria Vysotskaya (Infotecs, Kryptonite) Probabilistic properties of modular addition CTCrypt 19 14 / 23
Theorem For each number i the row of DDT-matrix with this number belongs to the equivalence class of size where ρ i 2 C s 1 K C c 1 s 1 C c 2 s 1 c 1... C c r 1 s 1 c 1 c r 2, 1 K is the number of 1 s in binary representation of i, 2 s is the number of groups of 0 s and 1 s in i, 3 c 1, c 2,... is the number of 0 s of size 1, 2,.... Victoria Vysotskaya (Infotecs, Kryptonite) Probabilistic properties of modular addition CTCrypt 19 15 / 23
Note Usually one needs Ωp2 3n q operations to calculate H n. For n 32 it is 2 96 p 6, 4 10 19 sec.q, for n 64 it is 2 192 p 4 10 48 sec.q. But using our approach for n 32 it takes 0,1 sec. and for n 64 it takes 62 sec. on a laptop. Victoria Vysotskaya (Infotecs, Kryptonite) Probabilistic properties of modular addition CTCrypt 19 16 / 23
Figure: Distribution of H 32 Victoria Vysotskaya (Infotecs, Kryptonite) Probabilistic properties of modular addition CTCrypt 19 17 / 23
Figure: Distribution of H 64 Victoria Vysotskaya (Infotecs, Kryptonite) Probabilistic properties of modular addition CTCrypt 19 18 / 23
Figure: Distribution of 2 H32 {K 1 2. Victoria Vysotskaya (Infotecs, Kryptonite) Probabilistic properties of modular addition CTCrypt 19 19 / 23
Figure: Distribution of 2 H64 {K 1 2. Victoria Vysotskaya (Infotecs, Kryptonite) Probabilistic properties of modular addition CTCrypt 19 20 / 23
Note For n 32 theoretical E2 Hn 9, 96 10 6, computed E2 Hn 5, 40 10 6. So real value is only 1,8 times smaller than calculated one. Note For n 32 and n 64 we showed that K 1 piq 2 Hi n 2 so our hypothesis is true for them. Besides, the relation is small. 2 Hi n{k 1 piq 2 Victoria Vysotskaya (Infotecs, Kryptonite) Probabilistic properties of modular addition CTCrypt 19 21 / 23
Conclusion In this work we 1 obtained an estimate (accurate up to an additive constant) of expected value of entropy H n in rows of DDT, 2 proved asymptotic inequalities describing the behavior of values E2 Hn and D2 Hn as long as other moments as n Ñ 8, 3 checked all results for n 32 and n 64. Victoria Vysotskaya (Infotecs, Kryptonite) Probabilistic properties of modular addition CTCrypt 19 22 / 23
Questions? Victoria Vysotskaya (Infotecs, Kryptonite) Probabilistic properties of modular addition CTCrypt 19 23 / 23