Cryptomeria cipher
The Feistel function of the Cryptomeria cipher. | |
| General | |
|---|---|
| Designers | 4C Entity |
| First published | 2003 |
| Derived from | DES |
| Related to | CSS |
| Cipher detail | |
| Key sizes | 56 bits |
| Block sizes | 64 bits |
| Structure | Feistel network |
| Rounds | 10 |
| Best public cryptanalysis | |
| A boomerang attack breaks all 10 rounds in 248 time with known S-box, or 253.5 with an unknown S-box, using 244 adaptively chosen plaintexts/ciphertexts. [1] | |
The Cryptomeria cipher, also called C2, is a proprietary block cipher defined and licensed by the 4C Entity. It is the successor to CSS algorithm (used for DVD-Video) and was designed for the CPRM/CPPM digital rights management scheme which are used by DRM-restricted Secure Digital cards and DVD-Audio discs.
Cipher details
[edit ]The C2 symmetric key algorithm is a 10-round Feistel cipher. Like DES, it has a key size of 56 bits and a block size of 64 bits. The encryption and decryption algorithms are available for peer review, but implementations require the so-called "secret constant", the values of the substitution box (S-box), which are only available under a license from the 4C Entity.
The 4C Entity licenses a different set of S-boxes for each application (such as DVD-Audio, DVD-Video and CPRM).[2]
Cryptanalysis
[edit ]In 2008, an attack was published against a reduced 8-round version of Cryptomeria to discover the S-box in a chosen-key scenario. In a practical experiment, the attack succeeded in recovering parts of the S-box in 15 hours of CPU time, using 2 plaintext-ciphertext pairs.[2]
A paper by Julia Borghoff, Lars Knudsen, Gregor Leander and Krystian Matusiewicz in 2009 breaks the full-round cipher in three different scenarios; it presents a 224 time complexity attack to recover the S-box in a chosen-key scenario, a 248 boomerang attack to recover the key with a known S-box using 244 adaptively chosen plaintexts/ciphertexts, and a 253.5 attack when both the key and S-box are unknown.[1]
Distributed brute force cracking effort
[edit ]Following an announcement by Japanese HDTV broadcasters that they would start broadcasting programs with the copy-once broadcast flag starting with 2004年04月05日, a distributed Cryptomeria cipher brute force cracking effort was launched on 2003年12月21日. To enforce the broadcast flag, digital video recorders employ CPRM-compatible storage devices, which the project aimed to circumvent. However, the project was ended and declared a failure on 2004年03月08日 after searching the entire 56-bit keyspace, failing to turn up a valid key for unknown reasons.[3] Because the attack was based on S-box values from DVD-Audio, it was suggested that CPRM may use different S-boxes.[4]
Another brute force attack to recover DVD-Audio CPPM device keys was mounted on 2009年05月06日. The attack was intended to find any of 24570 secret device keys by testing MKB file from Queen "The Game" DVD-Audio disc. On 2009年10月20日 such key for column 0 and row 24408 was discovered.
The similar brute force attack to recover DVD-VR CPRM device keys was mounted on 2009年10月20日. The attack was intended to find any of 3066 secret device keys by testing MKB from Panasonic LM-AF120LE DVD-RAM disc. On 2009年11月27日 such key for column 0 and row 2630 was discovered.
By now the CPPM/CPRM protection scheme is deemed unreliable.
Notes
[edit ]- ^ a b Borghoff, Julia; Knudsen, Lars R.; Leander, Gregor; Matusiewicz, Krystian (2009). "Cryptanalysis of C2". Advances in Cryptology - CRYPTO 2009. Lecture Notes in Computer Science. Vol. 5677. Berlin, Heidelberg: Springer Berlin Heidelberg. pp. 250–266. doi:10.1007/978-3-642-03356-8_15. ISBN 978-3-642-03355-1. ISSN 0302-9743.
- ^ a b Ralf-Philipp Weimann (2008年03月01日). "Algebraic Methods in Block Cipher Cryptanalysis" (PDF). Darmstadt University of Technology. (Abstract is in German, rest is in English)
- ^
"Distributed C2 Brute Force Attack: Status Page" . Retrieved 2006年08月14日.
"C2 Brute Force Crack - team timecop". Archived version of cracking team's English web site. Archived from the original on 2005年03月06日. Retrieved 2006年10月30日. - ^ "Discussion about the attack (Archived)". Archived from the original on 2005年03月16日. Retrieved 2006年10月30日.
References
[edit ]- "C2 Block Cipher Specification" (PDF). 1.0. 4C Entity, LLC. 2003年01月17日. Archived from the original (PDF) on 2011年07月18日. Retrieved 2009年02月13日.
- "Software Obfuscation from Crackers' Viewpoint" (PDF). Proceedings of the IASTED International Conference. Puerto Vallarta, Mexico. 2006年01月23日. Archived from the original (PDF) on 2007年09月26日. Retrieved 2006年08月13日.