Time/memory/data tradeoff attack

<h2 id="history">History</h2>
Tradeoff attacks on <a href="/facts/Symmetric-key_algorithm/5zfe0b76">symmetric cryptosystems</a> date back to 1980, when <a href="/facts/Martin_Hellman/QCxKCFgn">Martin Hellman</a> suggested a time/memory tradeoff method to break <a href="/facts/Block_cipher/MJywAyfQ">block ciphers</a> with 
 
 
 
 N
 
 
 {\displaystyle N}
 
 possible keys in time 
 
 
 
 T
 
 
 {\displaystyle T}
 
 and memory 
 
 
 
 M
 
 
 {\displaystyle M}
 
 related by the tradeoff curve 
 
 
 
 T
 
 
 M
 
 2
 
 
 
 =
 
 
 N
 
 2
 
 
 
 
 
 {\displaystyle T{M^{2}}={N^{2}}}
 
 where 
 
 
 
 1
 ≤
 T
 ≤
 N
 
 
 {\displaystyle 1\leq T\leq N}
 
.<a class="footnote-ref" id="fnref:1" href="#fn:1">1</a> Later, in 1995, Babbage and Golic devised a different tradeoff attack for <a href="/facts/Stream_cipher/BxU0aWmJ">stream ciphers</a> with a new bound such that 
 
 
 
 T
 M
 =
 N
 
 
 {\displaystyle TM=N}
 
 for 
 
 
 
 1
 ≤
 T
 ≤
 D
 
 
 {\displaystyle 1\leq T\leq D}
 
 where 
 
 
 
 D
 
 
 {\displaystyle D}
 
 is the output data available to the cryptanalyst at real time.<a class="footnote-ref" id="fnref:2" href="#fn:2">2</a><a class="footnote-ref" id="fnref:3" href="#fn:3">3</a>

<h2 id="attack-mechanics">Attack mechanics</h2>
This attack is a special version of the general cryptanalytic time/memory tradeoff attack, which has two main phases:

<ol><li>Preprocessing: During this phase, the attacker explores the structure of the cryptosystem and is allowed to record their findings in large tables. This can take a long time.</li>
<li>Realtime: In this phase, the cryptanalyst is granted real data obtained from a specific unknown key. They then try to use this data with the precomputed table from the preprocessing phase to find the particular key in as little time as possible.</li></ol>
Any time/memory/data tradeoff attack has the following parameters:

N
      
    
    {\displaystyle N}
  
 search space size

P
 
 
 {\displaystyle P}
 
 time required for the preprocessing phase

T
 
 
 {\displaystyle T}
 
 time required for the realtime phase

M
      
    
    {\displaystyle M}
  
 amount of memory available to the attacker

D
 
 
 {\displaystyle D}
 
 amount of realtime data available to the attacker
<h2 id="hellmans-attack-on-block-ciphers">Hellman's attack on block ciphers</h2>
For block ciphers, let 
 
 
 
 N
 
 
 {\displaystyle N}
 
 be the total number of possible keys and also assume the number of possible plaintexts and ciphertexts to be 
 
 
 
 N
 
 
 {\displaystyle N}
 
. Also let the given data be a single ciphertext block of a specific plaintext counterpart. If we consider the mapping from the key 
 
 
 
 x
 
 
 {\displaystyle x}
 
 to the ciphertext 
 
 
 
 y
 
 
 {\displaystyle y}
 
 as a random permutation function 
 
 
 
 f
 
 
 {\displaystyle f}
 
 over an 
 
 
 
 N
 
 
 {\displaystyle N}
 
 point space, and if this function 
 
 
 
 f
 
 
 {\displaystyle f}
 
 is invertible; we need to find the inverse of this function 
 
 
 
 
 
 f
 
 
 −
 1
 
 
 (
 y
 )
 =
 x
 
 
 {\displaystyle {f}^{-1}(y)=x}
 
.
Hellman's technique to invert this function:

During the preprocessing stage
Try to cover the 
 
 
 
 N
 
 
 {\displaystyle N}
 
 point space by an 
 
 
 
 m
 ×
 t
 
 
 {\displaystyle m\times t}
 
 rectangular matrix that is constructed by iterating the function 
 
 
 
 f
 
 
 {\displaystyle f}
 
 on 
 
 
 
 m
 
 
 {\displaystyle m}
 
 random starting points in 
 
 
 
 N
 
 
 {\displaystyle N}
 
 for 
 
 
 
 t
 
 
 {\displaystyle t}
 
 times. The start points are the leftmost column in the matrix and the end points are the rightmost column. Then store the pairs of start and end points in increasing order of end points values.

Now, only one matrix will not be able to cover the whole 
 
 
 
 N
 
 
 {\displaystyle N}
 
 space. But if we add more rows to the matrix, we will end up with a huge matrix that includes recovered points more than once. So, we find the critical value of 
 
 
 
 m
 
 
 {\displaystyle m}
 
 at which the matrix contains exactly 
 
 
 
 m
 
 
 {\displaystyle m}
 
 different points. Consider the first 
 
 
 
 m
 
 
 {\displaystyle m}
 
 paths from start points to end points are all disjoint with 
 
 
 
 m
 t
 
 
 {\displaystyle mt}
 
 points, such that the next path which has at least one common point with one of those previous paths and includes exactly 
 
 
 
 t
 
 
 {\displaystyle t}
 
 points. Those two sets of 
 
 
 
 m
 t
 
 
 {\displaystyle mt}
 
 and 
 
 
 
 t
 
 
 {\displaystyle t}
 
 points are disjoint by the <a href="/facts/Birthday_problem/ct7ao4dF">birthday paradox</a> if we make sure that 
 
 
 
 t
 ⋅
 m
 t
 ≤
 N
 
 
 {\displaystyle t\cdot mt\leq N}
 
. We achieve this by enforcing the matrix stopping rule: 
 
 
 
 m
 
 
 t
 
 
 2
 
 
 =
 N
 
 
 {\displaystyle m{t}^{2}=N}
 
.
Nevertheless, an 
 
 
 
 m
 ×
 t
 
 
 {\displaystyle m\times t}
 
 matrix with 
 
 
 
 m
 
 
 t
 
 
 2
 
 
 =
 N
 
 
 {\displaystyle m{t}^{2}=N}
 
 covers a portion 
 
 
 
 m
 t
 
 /
 
 N
 =
 1
 
 /
 
 t
 
 
 {\displaystyle mt/N=1/t}
 
 of the whole space. To generate 
 
 
 
 t
 
 
 {\displaystyle t}
 
 to cover the whole space, we use a variant of 
 
 
 
 f
 
 
 {\displaystyle f}
 
 defined: 
 
 
 
 
 
 f
 
 
 i
 
 
 (
 x
 )
 =
 
 
 h
 
 
 i
 
 
 (
 f
 (
 x
 )
 )
 
 
 {\displaystyle {f}_{i}(x)={h}_{i}(f(x))}
 
 and 
 
 
 
 
 
 h
 
 
 i
 
 
 
 
 {\displaystyle {h}_{i}}
 
 is simple out manipulation such as reordering of bits of 
 
 
 
 f
 (
 x
 )
 
 
 {\displaystyle f(x)}
 
 <a class="footnote-ref" id="fnref:4" href="#fn:4">4</a> (refer to the original paper for more details). And one can see that the total preprocessing time is 
 
 
 
 P
 ≈
 N
 
 
 {\displaystyle P\approx N}
 
. Also 
 
 
 
 M
 =
 m
 t
 
 
 {\displaystyle M=mt}
 
 since we only need to store the pairs of start and end points and we have 
 
 
 
 t
 
 
 {\displaystyle t}
 
 matrices each of 
 
 
 
 m
 
 
 {\displaystyle m}
 
 pairs.
During the real time phase
The total computation required to find 
 
 
 
 
 f
 
 −
 1
 
 
 (
 y
 )
 
 
 {\displaystyle f^{-1}(y)}
 
 is 
 
 
 
 T
 =
 
 t
 
 2
 
 
 
 
 {\displaystyle T=t^{2}}
 
 because we need to do 
 
 
 
 t
 
 
 {\displaystyle t}
 
 inversion attempts as it is likely to be covered by one matrix and each of the attempts takes 
 
 
 
 t
 
 
 {\displaystyle t}
 
 evaluations of some 
 
 
 
 
 f
 
 i
 
 
 
 
 {\displaystyle f_{i}}
 
. The optimum tradeoff curve is obtained by using the matrix stopping rule 
 
 
 
 m
 
 
 t
 
 
 2
 
 
 =
 N
 
 
 {\displaystyle m{t}^{2}=N}
 
 and we get 
 
 
 
 T
 
 
 M
 
 2
 
 
 
 =
 
 
 N
 
 2
 
 
 
 ,
 P
 =
 N
 ,
 D
 =
 1
 
 
 {\displaystyle T{M^{2}}={N^{2}},P=N,D=1}
 
 and choice of 
 
 
 
 T
 
 
 {\displaystyle T}
 
 and 
 
 
 
 M
 
 
 {\displaystyle M}
 
 depends on the cost of each resource.
According to Hellman, if the block cipher at hand has the property that the mapping from its key to cipher text is a random permutation function 
 
 
 
 f
 
 
 {\displaystyle f}
 
 over an 
 
 
 
 N
 
 
 {\displaystyle N}
 
 point space, and if this 
 
 
 
 f
 
 
 {\displaystyle f}
 
 is invertible, the tradeoff relationship becomes much better: 
 
 
 
 T
 M
 =
 N
 
 
 {\displaystyle TM=N}
 
.

<h2 id="babbage-and-golic-attack-on-stream-ciphers">Babbage-and-Golic attack on stream ciphers</h2>
For stream ciphers, N is specified by the number of internal states of the bit generator—probably different from the number of keys. D is the count of the first pseudorandom bits produced from the generator. Finally, the attacker's goal is to find one of the actual internal states of the bit generator to be able to run the generator from this point on to generate the rest of the key. Associate each of the possible N internal states of the bit generator with the corresponding string that consists of the first 
 
 
 
 log
 ⁡
 (
 N
 )
 
 
 {\displaystyle \log(N)}
 
 bits obtained by running the generator from that state by the mapping 
 
 
 
 f
 (
 x
 )
 =
 y
 
 
 {\displaystyle f(x)=y}
 
 from states x to output prefixes y. This previous mapping is considered a random function over the N points common space. To invert this function, an attacker establishes the following.

<ol><li>During the preprocessing phase, pick M random 
 
 
 
 
 
 x
 
 
 i
 
 
 
 
 {\displaystyle {x}_{i}}
 
 states and compute their corresponding 
 
 
 
 
 
 y
 
 
 i
 
 
 
 
 {\displaystyle {y}_{i}}
 
 output prefixes.</li>
<li>Store the pairs 
 
 
 
 (
 
 
 x
 
 
 i
 
 
 ,
 
 
 y
 
 
 i
 
 
 )
 
 
 {\displaystyle ({x}_{i},{y}_{i})}
 
 in increasing order of 
 
 
 
 
 
 y
 
 
 i
 
 
 
 
 {\displaystyle {y}_{i}}
 
 in a large table.</li>
<li>During the realtime phase, you have 
 
 
 
 D
 +
 log
 ⁡
 (
 N
 )
 −
 1
 
 
 {\displaystyle D+\log(N)-1}
 
 generated bits. Calculate from them all D possible combinations of 
 
 
 
 
 
 y
 
 
 1
 
 
 ,
 
 
 y
 
 
 2
 
 
 ,
 .
 .
 .
 ,
 
 
 y
 
 
 D
 
 
 ,
 
 
 {\displaystyle {y}_{1},{y}_{2},...,{y}_{D},}
 
 of consecutive bits with length 
 
 
 
 log
 ⁡
 (
 N
 )
 
 
 {\displaystyle \log(N)}
 
.</li>
<li>Search for each 
 
 
 
 
 
 y
 
 
 i
 
 
 
 
 {\displaystyle {y}_{i}}
 
 in the generated table which takes log time.</li>
<li>If you have a hit, this 
 
 
 
 
 
 y
 
 
 i
 
 
 
 
 {\displaystyle {y}_{i}}
 
 corresponds to an internal state 
 
 
 
 
 
 x
 
 
 i
 
 
 
 
 {\displaystyle {x}_{i}}
 
 of the bit generator from which you can forward run the generator to obtain the rest of the key.</li>
<li>By the <a href="/facts/Birthday_problem/ct7ao4dF">Birthday Paradox</a>, you are guaranteed that two subsets of a space with N points have an intersection if the product of their sizes is greater than N.</li></ol>
This result from the Birthday attack gives the condition 
 
 
 
 D
 M
 =
 N
 
 
 {\displaystyle DM=N}
 
 with attack time 
 
 
 
 T
 =
 D
 
 
 {\displaystyle T=D}
 
 and preprocessing time 
 
 
 
 P
 =
 M
 
 
 {\displaystyle P=M}
 
 which is just a particular point on the tradeoff curve 
 
 
 
 T
 M
 =
 N
 
 
 {\displaystyle TM=N}
 
. We can generalize this relation if we ignore some of the available data at real time and we are able to reduce T from T=D to 1 and the general tradeoff curve eventually becomes 
 
 
 
 T
 M
 =
 N
 
 
 {\displaystyle TM=N}
 
 with 
 
 
 
 1
 ≤
 T
 ≤
 D
 
 
 {\displaystyle 1\leq T\leq D}
 
 and 
 
 
 
 P
 =
 M
 
 
 {\displaystyle P=M}
 
.

<h2 id="shamir-and-biryukovs-attack-on-stream-ciphers">Shamir and Biryukov's attack on stream ciphers</h2>
This novel idea introduced in 2000 combines the Hellman and Babbage-and-Golic tradeoff attacks to achieve a new tradeoff curve with better bounds for stream cipher cryptoanalysis.<a class="footnote-ref" id="fnref:5" href="#fn:5">5</a> Hellman's block cipher technique can be applied to a stream cipher by using the same idea of covering the 
 
 
 
 N
 
 
 {\displaystyle N}
 
 points space through matrices obtained from multiple variants 
 
 
 
 
 f
 
 i
 
 
 
 
 {\displaystyle f_{i}}
 
 of the function 
 
 
 
 f
 
 
 {\displaystyle f}
 
 which is the mapping of internal states to output prefixes. Recall that this tradeoff attack on stream cipher is successful if any of the given 
 
 
 
 D
 
 
 {\displaystyle D}
 
 output prefixes is found in any of the matrices covering 
 
 
 
 N
 
 
 {\displaystyle N}
 
. This cuts the number of covered points by the matrices from 
 
 
 
 N
 
 
 {\displaystyle N}
 
 to 
 
 
 
 N
 
 /
 
 D
 
 
 {\displaystyle N/D}
 
 points. This is done by reducing the number of matrices from 
 
 
 
 t
 
 
 {\displaystyle t}
 
 to 
 
 
 
 t
 
 /
 
 D
 
 
 {\displaystyle t/D}
 
 while keeping 
 
 
 
 m
 
 
 {\displaystyle m}
 
 as large as possible (but this requires 
 
 
 
 t
 ≥
 D
 
 
 {\displaystyle t\geq D}
 
 to have at least one table).
For this new attack, we have 
 
 
 
 M
 =
 m
 t
 
 /
 
 D
 
 
 {\displaystyle M=mt/D}
 
 because we reduced the number of matrices to 
 
 
 
 t
 
 /
 
 D
 
 
 {\displaystyle t/D}
 
 and the same for the preprocessing time 
 
 
 
 P
 =
 N
 
 /
 
 D
 
 
 {\displaystyle P=N/D}
 
. The realtime required for the attack is 
 
 
 
 T
 =
 (
 t
 
 /
 
 D
 )
 ⋅
 t
 ⋅
 D
 =
 
 t
 
 2
 
 
 
 
 {\displaystyle T=(t/D)\cdot t\cdot D=t^{2}}
 
 which is the product of the number of matrices, length of each iteration and number of available data points at attack time.
Eventually, we again use the matrix stopping rule to obtain the tradeoff curve 
 
 
 
 T
 
 M
 
 2
 
 
 
 D
 
 2
 
 
 =
 
 t
 
 2
 
 
 ⋅
 (
 
 m
 
 2
 
 
 
 t
 
 2
 
 
 
 /
 
 
 D
 
 2
 
 
 )
 ⋅
 
 D
 
 2
 
 
 =
 
 m
 
 2
 
 
 
 t
 
 4
 
 
 =
 
 N
 
 2
 
 
 
 
 {\displaystyle TM^{2}D^{2}=t^{2}\cdot (m^{2}t^{2}/D^{2})\cdot D^{2}=m^{2}t^{4}=N^{2}}
 
 for 
 
 
 
 
 D
 
 2
 
 
 ≤
 T
 ≤
 N
 
 
 {\displaystyle D^{2}\leq T\leq N}
 
 (because 
 
 
 
 t
 ≥
 D
 
 
 {\displaystyle t\geq D}
 
).

<h3>Attacks on stream ciphers with low sampling resistance</h3>
This attack, invented by <a href="/facts/Alex_Biryukov/7kbdNe6r">Biryukov</a>, <a href="/facts/Adi_Shamir/CTnaUeP6">Shamir</a>, and <a href="/facts/David_A._Wagner/ewC269Uo">Wagner</a>, relies on a specific feature of some stream ciphers: that the bit generator undergoes only few changes in its internal state before producing the next output bit.<a class="footnote-ref" id="fnref:6" href="#fn:6">6</a>
Therefore, we can enumerate those special states that generate 
 
 
 
 k
 
 
 {\displaystyle k}
 
 zero bits for small values of 
 
 
 
 k
 
 
 {\displaystyle k}
 
 at low cost. But when forcing large number of output bits to take specific values, this enumeration process become very expensive and difficult.
Now, we can define the sampling resistance of a stream cipher to be 
 
 
 
 R
 =
 
 2
 
 −
 k
 
 
 
 
 {\displaystyle R=2^{-k}}
 
 with 
 
 
 
 k
 
 
 {\displaystyle k}
 
 the maximum value which makes such enumeration feasible.
Let the stream cipher be of 
 
 
 
 N
 =
 
 2
 
 n
 
 
 
 
 {\displaystyle N=2^{n}}
 
 states each has a full name of 
 
 
 
 n
 
 
 {\displaystyle n}
 
 bits and a corresponding output name which is the first 
 
 
 
 n
 
 
 {\displaystyle n}
 
 bits in the output sequence of bits. If this stream cipher has sampling resistance 
 
 
 
 R
 =
 
 2
 
 −
 k
 
 
 
 
 {\displaystyle R=2^{-k}}
 
, then an efficient enumeration can use a short name of 
 
 
 
 n
 −
 k
 
 
 {\displaystyle n-k}
 
 bits to define the special states of the generator. Each special state with 
 
 
 
 n
 −
 k
 
 
 {\displaystyle n-k}
 
 short name has a corresponding short output name of 
 
 
 
 n
 −
 k
 
 
 {\displaystyle n-k}
 
 bits which is the output sequence of the special state after removing the first 
 
 
 
 k
 
 
 {\displaystyle k}
 
 leading bits. Now, we are able to define a new mapping over a reduced space of 
 
 
 
 N
 R
 =
 
 2
 
 n
 −
 k
 
 
 
 
 {\displaystyle NR=2^{n-k}}
 
 points and this mapping is equivalent to the original mapping. If we let 
 
 
 
 D
 R
 ≥
 1
 
 
 {\displaystyle DR\geq 1}
 
, the realtime data available to the attacker is guaranteed to have at least one output of those special states. Otherwise, we relax the definition of special states to include more points. If we substitute for 
 
 
 
 D
 
 
 {\displaystyle D}
 
 by 
 
 
 
 D
 R
 
 
 {\displaystyle DR}
 
 and 
 
 
 
 N
 
 
 {\displaystyle N}
 
 by 
 
 
 
 N
 R
 
 
 {\displaystyle NR}
 
 in the new time/memory/data tradeoff attack by Shamir and Biryukov, we obtain the same tradeoff curve 
 
 
 
 T
 
 M
 
 2
 
 
 
 D
 
 2
 
 
 =
 
 N
 
 2
 
 
 
 
 {\displaystyle TM^{2}D^{2}=N^{2}}
 
 but with 
 
 
 
 (
 D
 R
 
 )
 
 2
 
 
 ≤
 T
 ≤
 N
 R
 
 
 {\displaystyle (DR)^{2}\leq T\leq NR}
 
. This is actually an improvement since we could relax the lower bound on 
 
 
 
 T
 
 
 {\displaystyle T}
 
 since 
 
 
 
 (
 D
 R
 
 )
 
 2
 
 
 
 
 {\displaystyle (DR)^{2}}
 
 can be small up to 
 
 
 
 1
 
 
 {\displaystyle 1}
 
 which means that our attack can be made faster. This technique reduces the number of expensive disk access operations from 
 
 
 
 t
 
 
 {\displaystyle t}
 
 to 
 
 
 
 t
 R
 
 
 {\displaystyle tR}
 
 since we will be accessing only the special 
 
 
 
 D
 R
 
 
 {\displaystyle DR}
 
 points, and makes the attack faster because of the reduced number of expensive disk operations.

<h2 id="references">References</h2>

<ol>
<li id="fn:1">Hellman, M.E., "A cryptanalytic time-memory trade-off", IEEE Transactions on Information Theory, vol.26, no.4, pp. 401, 406, Jul 1980 <a href="https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=1056220&isnumber=22715&tag=1" target="_blank">https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=1056220&isnumber=22715&tag=1</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></li>
<li id="fn:2">Babbage, S. H., "Improved “exhaustive search” attacks on stream ciphers", European Convention on Security and Detection, 1995, vol., no., pp.161-166, 16–18 May 1995 <a href="https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=491713&isnumber=10615" target="_blank">https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=491713&isnumber=10615</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></li>
<li id="fn:3">Golic, J., "Cryptanalysis of Alleged A5 Stream Cipher" Lecture Notes in Computer Science, Advances in Cryptology – EUROCRYPT ’97, LNCS 1233, pp.239-255, Springer-Verlag 1997 <a href="#fnref:3" class="footnote-back-ref">↩</a></li>
<li id="fn:4">Hellman, M.E., "A cryptanalytic time-memory trade-off", IEEE Transactions on Information Theory, vol.26, no.4, pp. 401, 406, Jul 1980 <a href="https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=1056220&isnumber=22715&tag=1" target="_blank">https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=1056220&isnumber=22715&tag=1</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></li>
<li id="fn:5">Biryukov A., Shamir A., "Cryptanalytic Time/Memory/Data Tradeoffs for Stream Ciphers" Lecture Notes in Computer Science, Advances in Cryptology – ASIACRYPT 2000, LNCS 1976, pp.1-13, Springer-Verlag Berlin Heidelberg 2000 <a href="#fnref:5" class="footnote-back-ref">↩</a></li>
<li id="fn:6">Biryukov A., Shamir A., Wagner D., "Real Time Cryptanalysis of A5/1 on a PC" Fast Software Encryption 2000, pp.1-18, Springer-Verlag 2000 <a href="#fnref:6" class="footnote-back-ref">↩</a></li>
</ol>

Time/memory/data tradeoff attack open-in-new

Time/memory/data tradeoff attack