Meet-in-the-middle attack

From Wikipedia, the free encyclopedia
Jump to: navigation, search
This article is about the cryptanalysis optimisation process. For the form of communication interception, see man-in-the-middle attack.

The Meet-in-the-Middle attack (MITM) is a generic space–time tradeoff cryptographic attack against encryption schemes which rely on performing multiple encryption operations in sequence. The MITM attack is the primary reason why Double DES is not used and why a Triple DES key (168-bit) can be bruteforced by an attacker with 256 space and 2112 operations.

Description[edit]

When trying to improve the security of a block cipher, a tempting idea is to encrypt the data several times using multiple keys. One might think this doubles or even n-tuples the security of the multiple-encryption scheme, depending on the number of times the data is encrypted, because an exhaustive search on all possible combination of keys (simple brute-force) would take 2n·k attempts if the data is encrypted with k-bit keys n times.

The Meet-in-the-Middle is a generic attack which weakens the security benefits of using multiple encryptions by storing intermediate values from the encryptions or decryptions and using those to improve the time required to brute force the decryption keys. This makes a Meet-in-the-Middle attack (MITM) a generic space–time tradeoff cryptographic attack.

The Meet-in-the-Middle attack attempts to find the keys by using both of the range (ciphertext) and domain (plaintext) of the composition of several functions (or block ciphers) such that the forward mapping through the first functions is the same as the backward mapping (inverse image) through the last functions, quite literally meeting in the middle of the composed function. For example, although Double DES encrypts the data with two different 56-bit keys, Double DES can be broken with 257 encryption and decryption operations.

The Multidimensional MITM (MD-MITM) uses a combination of several simultaneous MITM-attacks like described above, where the meeting happens in multiple positions in the composed function.

History[edit]

It was first developed as an attack on an attempted expansion of a block cipher by Diffie and Hellman in 1977.[1]

Diffie and Hellman, however, devised a space-time tradeoff that could break the scheme in only double the time to break the single-encryption scheme.

In 2011, Bo Zhu and Guang Gong investigated the Multidimensional Meet-in-the-Middle attack and presented new attacks on the block ciphers GOST, KTANTAN and Hummingbird-2.[2]

Meet-in-the-middle (1D-MITM)[edit]

Assume someone wants to attack an encryption scheme with the following characteristics for a given plaintext P and ciphertext C:

where ENC is the encryption function, DEC the decryption function defined as ENC−1 (inverse mapping) and k1 and k2 are two keys.

The naive approach at brute-forcing this encryption scheme would be to bruteforce every value for k1 for every value of k2, for a total of 2k1 * 2k2 operations.

By decrypting C with k2, one is left with the following equivalence:


The attacker can then compute ENCk1(P) for all values of k1 and DECk2(C) for all possible values of k2, for a total of 2k1 + 2k2 operations. If the result from any of the ENCk1(P) operations matches a result from the DECk2(C) operations, it is possibly the correct key. This potentially-correct key is called a candidate key. The attacker can then determine which candidate key is correct by using it for a second test-set of plaintext and ciphertext.

The MITM attack is one of the reasons why DES was replaced with Triple DES and not Double DES. Double DES was not used because it is vulnerable to a MITM attack and an attacker can bruteforce the keyspace with 257 operations and 256 space. [3] Triple DES uses a "triple length" (168-bit) key and is also vulnerable to a meet-in-the-middle attack in 256 space and 2112 operations, but is considered secure due to the size of its keyspace.[4]

An illustration of 1D-MITM attack


MITM algorithm[edit]

Compute the following:

  • :
    and save each together with corresponding in a set A
  • :
    and compare each new with the set A

When a match is found, keep kf1,kb1 as candidate key-pair in a table T. Test pairs in T on a new pair of (P,C) to confirm validity. If the key-pair does not work on this new pair, do MITM again on a new pair of (P,C).

MITM complexity[edit]

If the keysize is k, this attack uses only 2k+1encryptions (and decryptions) (and O(2k) memory in case a look-up table have been built for the set of forward computations) in contrast to the naive attack, which needs 22·k encryptions but O(1) space.

Multidimensional-MITM[edit]

While 1D-MITM can be efficient, a more sophisticated attack has been developed: Multi Dimensional-Meet In The Middle attack, also abbreviated MD-MITM. This is preferred when the data has been encrypted using more than 2 encryptions with different keys. Instead of meeting in the middle (one place in the sequence), the MD-MITM attack attempts to reach several specific intermediate states using the forward and backward computations at several positions in the cipher.[2]

Assume that the attack has to be mounted on a block cipher, where the encryption and decryption is defined as before:


that is a plaintext P is encrypted multiple times using a repetition of the same block cipher

An illustration of MD-MITM attack

The MD-MITM has been used for cryptanalysis of among many, the GOST block cipher, where it has been shown that a 3D-MITM has significantly reduced the time complexity for an attack on it.[2]

MD-MITM algorithm[edit]

Compute the following:

  • :
and save each together with corresponding in a set .
  • :
and save each together with corresponding in a set .

For each possible guess on the intermediate state compute the following:

  • :
and for each match between this and the set , save and in a new set .
  • :[verification needed]
and save each together with corresponding in a set .
For each possible guess on an intermediate state compute the following:
1
and for each match between this and the set , check also whether
it matches with and then save the combination of sub-keys together in a new set .
2 ...
For each possible guess on an intermediate state compute the following:
a)
and for each match between this and the set , check also whether
it matches with , save and in a new set
.
b)
and for each match between this and the set , check also
whether it matches with . If this is the case then:"

Use the found combination of sub-keys on another pair of plaintext/ciphertext to verify the correctness of the key.

Note the nested element in the algorithm. The guess on every possible value on sj is done for each guess on the previous sj-1. This make up an element of exponential complexity to overall time complexity of this MD-MITM attack.

MD-MITM complexity[edit]

Time complexity of this attack without brute force, is

Regarding the memory complexity, it is easy to see that are much smaller than the first built table of candidate values: as i increases, the candidate values contained in must satisfy more conditions thereby fewer candidates will pass on to the end destination .

An upper bound of the memory complexity of MD-MITM is then

where denotes the length of the whole key (combined).

The data complexity depends on the probability that a wrong key may pass (obtain a false positive), which is , where is the intermediate state in the first MITM phase. The size of the intermediate state and the block size is often the same! Considering also how many keys that are left for testing after the first MITM-phase, it is .

Therefore, after the first MITM phase, there are , where is the block size.

For each time the final candidate value of the keys are tested on a new plaintext/ciphertext-pair, the amount of keys that will pass will be multiplied by the probability that a key may pass which is .

The part of brute force testing (testing the candidate key on new (P,C)-pairs, have time complexity ... ,clearly for increasing multiples of b in the exponent, number tends to zero.

The conclusion on data complexity is by similar reasoning restricted by that around (P,C)-pairs.

Below is a specific example of how a 2D-MITM is mounted:

A general example of 2D-MITM[edit]

This is a general description of how 2D-MITM is mounted on a block cipher encryption.

In Two-dimensional MITM (2D-MITM) the method is to reach 2 intermediate states inside the multiple encryption of the plaintext. See below figure:

An illustration of 2D-MITM attack

2D-MITM algorithm[edit]

Compute the following:

and save each together with corresponding in a set A
and save each together with corresponding in a set B.

For each possible guess on an intermediate state s between and compute the following:

1
and for each match between this and the set A, save and in a new set T.
2
and for each match between this and the set B, check also whether it matches with T for
if this is the case then:

Use the found combination of sub-keys on another pair of plaintext/ciphertext to verify the correctness of the key.

2D-MITM complexity[edit]

Time complexity of this attack without brute force, is where |⋅| denotes the length.

Main memory consumption is restricted by the construction of the sets A and B where T is much smaller than the others.

For data complexity see subsection on complexity for MD-MITM.

See also[edit]

References[edit]

  1. ^ ^ Diffie, Whitfield; Hellman, Martin E. (June 1977). "Exhaustive Cryptanalysis of the NBS Data Encryption Standard". Computer. 10 (6): 74–84. doi:10.1109/C-M.1977.217750. 
  2. ^ a b c Zhu, Bo; Guang Gong (2011). "MD-MITM Attack and Its Applications to GOST, KTANTAN and Hummingbird-2". eCrypt. 
  3. ^ Zhu, Bo; Guang Gong (2011). "MD-MITM Attack and Its Applications to GOST, KTANTAN and Hummingbird-2". eCrypt. 
  4. ^ Moore, Stephane (November 16, 2010). "Meet-in-the-Middle Attacks" (PDF): 2.