In the present paper we describe the technology for translating algorithmic descriptions of discrete functions to SAT. The proposed technology is aimed at applications in algebraic cryptanalysis. We describe how cryptanalysis instances are reduced to SAT in such a way that it should be perceived as natural by the cryptographic community. Therefore, in the theoretical part of the paper we justify the main principles of general reduction to SAT for discrete functions from a class containing the majority of functions employed in cryptography. Based on these principles we describe the Transalg software system, developed with SAT-based cryptanalysis specifics in mind. We show the results of applications of Transalg to construction of a number of attacks on various cryptographic functions. Some of the corresponding attacks are state of the art. We also compare the functional capabilities of the proposed system with that of other software systems that can be used to reduce cryptanalysis instances to SAT, and also with the CBMC system widely employed in symbolic verification. In the paper we also present vast experimental data, obtained using the SAT-solvers that took first places at the SAT-competitions in the recent several years.
As we mentioned above, SAT-based cryptanalysis is still actively developing. The cryptographic attacks that employ SAT-solvers show very good results for a number of keystream generators: Geffe, Wolfram (present paper), Crypto-1, Hitag2 (see @cite_24 ). In @cite_61 there was described a successful SAT-based attack on the widely known A5 1 cryptographic keystream generator, which has been used in GSM networks to cipher traffic. Later several dozen cryptanalysis instances for this cipher were solved in the SAT@home volunteer computing project @cite_10 . This result together with other attacks on A5 1 (see @cite_66 @cite_124 @cite_12 ) provides an exhaustive argument towards not using A5 1 any more. The Bivium keystream cipher @cite_23 is a popular object of algebraic and SAT-based cryptanalysis @cite_29 @cite_89 @cite_24 @cite_96 . In @cite_92 there was constructed a SAT-based guess-and-determine attack on Bivium the estimated runtime of which is realistic for modern distributed computing systems. In @cite_14 there were described SAT-based guess-and-determine attacks on several variants of the alternating step generator.
@cite_61 @cite_14 @cite_92 @cite_29 @cite_96 @cite_89 @cite_24 @cite_23 @cite_124 @cite_10 @cite_66 @cite_12
207960843 2765992693 2342940067 2079597561 1493429498 1605798759 1561363170 2144007792 1972549227 2792205615
In logical cryptanalysis a problem of search of a secret key of a cryptographic system is formulated as a SAT problem, i.e. a problem of search of a satisfying assignment for some CNF. In this paper we consider some natural strategies for parallelization of these SAT problems. We apply coarse-grained approach which makes it possible to use distributed computing environments with slow interconnect. The main practical result of this paper is successful logical cryptanalysis of keystream generator A5 1 in BNB-Grid system. In this paper, we propose an algorithm for constructing guess-and-determine attacks on keystream generators and apply it to the cryptanalysis of the alternating step generator (ASG) and two its modifications (MASG and MASG0). In a guess-and-determine attack, we first “guess” some part of an initial state and then apply some procedure to determine, if the guess was correct and we can use the guessed information to solve the problem, thus performing an exhaustive search over all possible assignments of bits forming a chosen part of an initial state. We propose to use in the “determine” part the algorithms for solving Boolean satisfiability problem (SAT). It allows us to consider sets of bits with nontrivial structure. For each such set it is possible to estimate the runtime of a corresponding guess-and-determine attack via the Monte-Carlo method, so we can search for a set of bits yielding the best attack via a black-box optimization algorithm augmented with several SAT-specific features. We constructed and implemented such attacks on ASG, MASG, and MASG0 to prove that the constructed runtime estimations are reliable. We show, that the constructed attacks are better than the trivial ones, which imply exhaustive search over all possible states of the control register, and present the results of experiments on cryptanalysis of ASG and MASG MASG0 with total registers length of 72 and 96, which have not been previously published in the literature. In this paper we describe Grain of Salt, a tool developed to automatically test stream ciphers against standard SAT solver-based attacks. The tool takes as input a set of configuration options and the definition of each filter and feedback function of the stream cipher. It outputs a problem in the language of SAT solvers describing the cipher. The tool can automatically generate SAT problem instances for Crypto-1, HiTag2, Grain, Bivium-B and Trivium. In addition, through a simple text-based interface it can be extended to generate problems for any stream cipher that employs shift registers, feedback and filter functions to carry out its work. Bivium is a reduced version of the stream cipher Trivium. In this paper we investigate how fast a key recovery attack on Bivium using Grobner bases is. First we explain the attack scenario and the cryptographic background. Then we identify the factors that have impact on the computation time and show how to optimise them. As a side effect these experiments benchmark several Grobner basis implementations. The optimised version of the Grobner attack has an expected running time of 239.12 s, beating the attack time of our previous SAT solver attack by a factor of more than 330. Furthermore this approach is faster than an attack based on BDDs, an exhaustive key search, a generic time-memory trade-off attack and a guess-and-determine strategy.