International Journal on Cryptography and Information Security (IJCIS), Vol. 4, No.

1, March 2014

RANDOMNESS EVALUATION FRAMEWORK OF CRYPTOGRAPHIC ALGORITHMS

Cristina-Loredana Duta, Bogdan-Costel Mocanu, Florin-Alexandru Vladescu, Laura Gheorghe
Department of Computer Science and Engineering, University Politehnica of Bucharest, Bucharest, Romania

ABSTRACT
Nowadays, computer systems are developing very rapidly and become more and more complex, which leads to the necessity to provide security for them. This paper is intended to present software for testing and evaluating cryptographic algorithms. When evaluating block and stream ciphers one of the most basic property expected from them is to pass statistical randomness testing, demonstrating in this way their suitability to be random number generators. The primary goal of this paper is to propose a new framework to evaluate the randomness of cryptographic algorithms: based only on a .dll file which offers access to the encryption function, the decryption function and the key schedule function of the cipher that has to be tested (block cipher or stream cipher), the application evaluates the randomness and provides an interpretation of the results. For this, all nine tests used for evaluation of AES candidate block ciphers and three NIST statistical tests are applied to the algorithm being tested. In this paper, we have evaluated Tiny Encryption Algorithm (block cipher), Camellia (block cipher) and LEX (stream cipher) to determine if they pass statistical randomness testing.

KEYWORDS
Cryptography, Randomness tests, NIST Statistical Test Suite, TEA, LEX, Camellia

1. INTRODUCTION
As the volume of data becomes larger and more complex, the importance of security becomes crucial in all domains. The most used methods to provide the confidentiality of data are encryption and decryption techniques. Cryptography ensures a method to authenticate and protect the transmission of information across insecure communication channels. It is a critical tool for protecting sensitive data in computer systems because it guarantees that unauthorized persons cannot read it. Cryptography offers the mechanisms necessary to provide accountability, accuracy and confidentiality of data. Cryptographic systems ensure security, which is tightly related to randomness since every aspect of cryptography is dependent of the accessibility of random number generators that are strong enough to pass analysis, that have high statistical characteristics, that provide high throughput, that are available and affordable. But, the major problem encountered in this situation is that strict analysis of the randomness source and the quality of sequences produced is not performed which leads to the existence of cryptographic systems that are compromised by the utilization of inadequate randomness generators and that will fail to provide the desired level of security.
DOI:10.5121/ijcis.2014.4103 31

International Journal on Cryptography and Information Security (IJCIS), Vol. 4, No. 1, March 2014

Randomness refers to the outcome of a probabilistic process that produces independent, uniformly distributed and unpredictable values that cannot be reliably reproduced [1]. The main characteristics of randomness are unpredictability, uniform distribution and the lack of correlation (independency of variables). The major problem when referring to randomness is represented by the lack of certainty because a strict analysis and testing can offer a high confidence in the generator, but not an absolute trust in it. This is the reason why nowadays a heterogeneous collection of statistical test suites exists: NIST [2], TestU01 [3], Diehard [4], and ENT [5]. Taking into consideration the properties of cryptographic primitives such as block and stream ciphers, incapacity of distinguishing it from a random mapping is an important one. This means that the evaluation of the outputs generated by the algorithms using statistical randomness test is very important. The evaluation involves taking a sample sequence from the algorithm that is being tested and analyze it using statistical randomness tests. When the AES competition took place, the candidate block ciphers were evaluated by J. Soto [6]. The test he applied needed sequence of at least 106 bits length and this was achieved by concatenating the outputs of the candidate algorithms. There were proposed nine different ways to generate large number of data stream from a block cipher and then the streams were tested using the statistical tests from NIST Test Suite [3]. In this study, we propose the use of the same tests together with three NIST statistical tests (implemented in the generic framework for evaluating cryptographic algorithms) to analyze the randomness proprieties of stream or block ciphers. We have chosen for evaluation TEA and Camellia block ciphers and LEX, a stream cipher. These tests have the purpose to try to rule out sequences which do not verify certain statistical proprieties, yet can never guarantee perfect randomness. We describe how each algorithm has been evaluated, we show the results of the statistical randomness testing and we offer an interpretation of the results obtained. The paper is organized as follows. Related work is described in Section 2. Section 3 gives an overview of the algorithms chosen for evaluation. Section 4 presents details about the cryptographic randomness tests implemented in our framework. In Section 5 the experimental results obtained after applying the randomness tests to the algorithms that we have chosen for evaluation are shown and explained. Section 6 describes our conclusions and future work.

2. RELATED WORK
This section presents the encryption algorithms which were evaluated using the framework we have created and offers details about their advantages and their vulnerabilities that have been discovered until now. Tiny Encryption Algorithm (TEA) was designed by Roger Needham and David Wheeler from Cambridge Computer Laboratory in 1994 [7]. It is a variant of the Feistel cipher which operates on 64-bits blocks and uses a 128-bit key. It was published for the first time in the proceedings of Fast Software Encryption Workshop held in Leuven [8]. The main advantage of it is that it doesnt need a lot of resources which means it i s a good algorithm to be implemented on embedded systems which have limited resources such as smart cards, microcontrollers etc. This means that the basic operations were very simple and weak, typically only a few lines of code. Repeating this operations many times ensured the security of the algorithm. Since these operations are simple, TEA can be considered also a very high speed encryption algorithm. This type of algorithm can replace DES cipher in software since its implementation, with 64 rounds, is three times faster than a good software implementation of
32

International Journal on Cryptography and Information Security (IJCIS), Vol. 4, No. 1, March 2014

DES which has 16 rounds. TEA supports all DES modes of operation and the security can be enhanced by increasing the number of iterations. Remarked for the simple design, the cipher was intensively studied and put through a number of attacks. There are several drawbacks of TEA which were exploited by a lot of researchers and today TEA is considered broken. According to the paper of Biham and Shamir, in 1992 [9], about differential cryptanalysis, researchers have shown that TEA cipher is highly resistant to it and is capable to achieve complete diffusion (a one bit difference in the plaintext will produce almost 32 bit differences in the ciphertext. Hong, et al [10], explain that the combination and order of operations used in TEA make it very hard to apply a differential attack. Kelsey et al [11] in 1996 reached the conclusion that the effective key size of TEA cipher was actually 126 bits, instead of 128 bits. Based on this result, Microsofts Xbox gaming console was attacked (it was using TEA as a hash function) which means that TEA is bad as a cryptographic hash function [12]. TEA uses equivalent keys which reduces the effectiveness of the key length and needs a complexity of O (232) to be broken when performing a related key attack. In 1997, Kelsey et al. [13] constructed such an attack using 223 chosen plaintexts under a related-key pair, with 232 time complexity. After all these vulnerabilities of TEA were discovered, TEA was redesigned by Needham and Wheeler [14] and two variants of the cipher appeared: Block TEA and XTEA (eXtended TEA). Although XTEA had the same key size, block size and number of rounds as TEA, Block TEA supports variable block sizes and it applies the XTEA round function to different iterations. Both of the algorithms previously mentioned were implemented for the first time in the Linux kernel [15]. After weaknesses were discovered in Block TEA, its creators designed Corrected Block TEA (also called XXTEA) in 1998 [15]. The number of rounds is calculated based on the block size, but it shouldnt be smaller than six. Also, XXTEA is based on an unbalanced Feistel structure and supports variable length messages. In [15] is presented an attack on the full Block TEA and the vulnerabilities identified for XXTEA. In [16] is demonstrated why an ultra-low power implementation of XTEA is better for low resource environments than Advanced Encryption Standard (AES). Camellia [17] is a cryptographic block cipher that uses symmetric keys. The length of one block is 16 bytes and the length of the key can be 16, 24 or 32 bytes. The algorithm was developed by Mitsubishi Electric Corporation in cooperation with Nippon Telegraph and Telephone Corporation of Japan [18]. Camellia was published for the first time in 2000, when it was introduced to New European Schemes for Signature, Integrity, and Encryption (NESSIE) project as a strong cryptographic primitive and has been approved for use by International Organization for Standardization (ISO/IEC). This block cipher has the performance and the capacity to generate security similar to AES (Advanced Encryption Standard). Camellia was designed to be very efficient when implemented in software as well as in hardware, including in small, low-cost devices (such as smart-cards) and also in high speed networks. The great performance of it on a wide variety of platforms is ensured by the existence of only 8*8
33

International Journal on Cryptography and Information Security (IJCIS), Vol. 4, No. 1, March 2014

Substitution boxes and the simple logical operations. The key schedule is designed to be simple it has similar parts with the encryption function. For instance, it allows on-the-key sub-key generation which can be computed in any order. In 2003 a cache attack using a timing of CPU cache was published by Tsunoo [19]. The key, which had 128 bits, was recovered using plaintexts during 35 minutes. An improvement of Tsunoo attack was made a year later by Ikeda Yoshitaka [20], who managed to extract the key in 22 minutes within plaintexts. Researchers show that, due to its frequent S-box lookup operations, Camellia is vulnerable to access driven cache timing attacks. In 2009, Zhao Xin-jie et al. [21], present several attacks on Camellia and their experiments demonstrate that 500 random texts are enough to recover the 128 bits key of the cipher, and 900 plaintexts to recover the 192 and 256 bits keys. Their attack can also be expanded to known ciphertext conditions when attacking the Camellia decryption function. The security of Camellia was also analyzed against several cryptanalytic techniques such as: differential cryptanalysis [9], high-order differential cryptanalysis [22, 23], truncated differential cryptanalysis [22], integral cryptanalysis [24, 25, and 26], linear cryptanalysis [27], boomerang attack [28], rectangle attack [29], collision attack and impossible differential cryptanalysis [30, 31]. From all of these teqchiques, impossible differential cryptanalysis is the most efficient one considering the numbers of rounds that are attacked: 11-round Camellia-128, 12-round Camellia192 and 14-round Camellia-256 [32, 33]. In 2011, Lu et al [34] proposed an extension of meet-in-the-middle attack which was based on using multiple plaintexts in order to eliminate some key-dependent components or parameters when creating the value-in-the-middle. The authors succeeded to break 5-6 round Camellia cipher. After that, in 2012, Lu et al. [35] created an extension of this attack and managed to break 10-round Camellia-128, 11-round Camellia-192 and 12-round Camellia-256. A new methodology for creating stream ciphers was released by Alex Biryukov [36], from the University of Leuven research institute entitled leak extraction. The main idea of this methodology is to extract certain bytes of the internal states of block ciphers at certain rounds. Therefore, the bytes extracted form an output stream key. Basically this method of stream cipher keys generation can work with any block cipher, but the strength of the key depends on the strength of the internal state of the block cipher used. An example of the leak extraction methodology is LEX (Leak EXtraction) stream cipher [36], in which the underlying block cipher is AES. The algorithm uses every round of the AES block cipher to output key stream bytes. Thus, the LEX algorithm can use every key length type of AES (128, 192, and 256). The algorithm was submitted to the eSTREAM competition [37] and because it had fast key initialization phase (a single AES encryption), high speed (2.5 faster that AES) and very good security (similar with AES security), LEX was a very promising candidate and was one of the ciphers who entered the final phase of evaluation. Because it was one of the finalists of the eSTREAM competition, LEX has been very carefully studied by cryptanalysts due to its simple structure. Courtois and Meier [38] have studied algebraic attacks which have recently become very powerful. One the properties of LEX cipher is the renewal of the AES key K, after 500 encryption processes. Therefore, writing a non-linear equation for determining the output key stream form
34

International Journal on Cryptography and Information Security (IJCIS), Vol. 4, No. 1, March 2014

the key K is not possible as. As it was mentioned before the LEX cipher is based on AES encryption algorithm, and such an algebraic equation will lead for an attack of AES itself. Thus, there is no applicability of algebraic attack on LEX stream cipher. The stream cipher LEX has no weak keys because is an algorithm based on AES, which has no weak keys. One of the known attacks on LEX is the slide attack, which was proposed by Wu and Preneel [39]. To achieve this, 500*320 bits of key stream are necessary, each of them being generated using 2^60.8 different IVs and the same key. The initialization phase of the cipher is exploited in this attack, such that if three collisions are found in the output key stream, 96 bits of the key can be recovered. The unknown 32 bits are recovered using exhaustive search. After this attack, the cipher was modified and now is using a full AES encryption during its initialization phase. In [40] another attack on LEX is described; it shows that it is possible to decrypt some ciphertext without recovering the key. For the attack to work, 265.66 key stream bits are necessary which are produced based on the same IV and 320 bits from 265.66 different IVs. The attack Johansson proposed doesnt work on the tweaked version of LEX. Dunkelman and Keller [41] proposed the most recent attack on LEX, which identifies particular states in two AES encryptions which satisfy a specific difference pattern. Using 2112 operations time and 236.3 bytes of key stream produced by the same key, the attack can extract the entire secret key. In [42], Turan et al. propose a statistical analysis of synchronous stream ciphers. They have analyzed the randomness properties of the stream ciphers present for eSTREAM project, which includes LEX cipher. The paper is organized into two parts: in the first part the authors apply the NIST test suite to the output sequence and in the second part they apply four structural randomness tests to the ciphers. This paper had the goal to show the randomness proprietes of the eSTREAM candidates since until that moment no statistical analysis was reported for ciphers Achterbahn, Decim, Mickey, LEX, Edon, NLS, Salsa20, Sosemanuk etc, in algorithm specification documents Cook et al [43] present a new method called elastic block cipher method and they construct examples based on AES, Camellia, MISTY1 and RC6. The authors evaluate the original and the elastic versions using statistical test measuring the randomness of the ciphertext. Statistical tests used by NIST on the AES candidates are applied to the selected ciphers. In [44] a new statistical test for block ciphers is presented. The authors apply this test on Rijndael, Camellia and SMS4 algorithms and observe that good statistical properties can be seen after 4 round, 5 round and respectively 7 round operation. As far as we know, a generic framework to evaluate the randomness proprieties of any cryptographic algorithm (stream cipher or block cipher) hasnt been publicly presented o r described. Also, we are the first to publish the results obtained for TEA cipher regarding its randomness proprieties.

3. DESIGN
The general structure and operations of the stream and block ciphers evaluated in this paper are described as follows.

35

International Journal on Cryptography and Information Security (IJCIS), Vol. 4, No. 1, March 2014

3.1. TEA
TEA is a symmetric block cipher which operates on blocks of 64 bits, using a secret key of 128 bits long. A magic constant, denoted as DELTA, is used which is defined as 232, being derived from the golden ratio. In order to prevent exploits based on the symmetry between the rounds, this constant is multiplied using modulo 232 operations, during each round. The block message is divided into two halves of 32-bits and each half is encrypted in 32 stages (rounds). The 128-bit key is divided into four 32-bit keys. TEA is based on the Feistel structure such that one round of TEA includes two Feistel operations which means that a full encryption of a block goes through 32 TEA cycles (which involves 64 Feistel rounds). The operations realized in a TEA round are presented in Figure 1 and they are described below.

Figure 1. Two Feistel rounds (one cycle) of TEA

As it can be seen from the figure, the two 32-bit halves (denoted as L=left half and R= right half) are swapped per round. As mentioned before, the key is split up into four 32-bit keys, which are denoted as K[0], K[1], K[2], and K[3]. We have to remember that or addition operations are modulo 232. 1. Right half (R0) is shifted with 4 to the left and then key K[0] is added to the value previously obtained; 2. In the next step, the value of R0 is added with the value of DELTA; 3. R0 is the shifted to the right with 5 and then key K[1] is added to this value; 4. After all these three operations, an XOR is applied and the result obtained from here is added to left half (L0); 5. The result obtained in step 4 becomes right half (R1) form the next Feistel round and R0 becomes the left half (L1), because a swap operation was applied. The key schedule is represented by XOR between the 32-bit key and the shifted value of the last state of each of the 32-bit halves, operation that ensures that all the bits of the key and of the data
36

International Journal on Cryptography and Information Security (IJCIS), Vol. 4, No. 1, March 2014

are being mixed repeatedly. The keys K[0] and K[1] of the sub-key are used in the odd rounds and the keys K[2] and K[3] are used in even rounds. The round function has the same general structure for all 32 rounds, being parameterized by round sub-key K[i] the sub-keys K[i] are different from the initial 128-bit key K and from each other. The decryption is essentially the same as the encryption process: in the decode function the ciphertext is used as the input to the TEA cipher with the sub-keys K[i] used in reverse order.

3.2. Camellia
Similar to AES, Camellia is a block cipher that has a Feistel structure. It can have 18 rounds, when a key of 128 bits is used or 24 rounds when keys of 192 bits or 256 bits are used. Every six rounds logical functions are applied, called FL functions (inverse function). In Figure 2 the structure of Camellia algorithm is presented:

Figure 2. Operations of Camellia algorithm

The algorithm is composed of four S-boxes, each having a dimension of 8 by 8. It uses a technique called key whitening. This technique has the purpose of increasing the level of security of the cipher. It is applied in the case of iterate block ciphers. It consists in an XOR operation between sets of data and the keys. It is applied after the first round and before the last one.

37

International Journal on Cryptography and Information Security (IJCIS), Vol. 4, No. 1, March 2014

As it can be seen, every six rounds whitenings and logical functions are applied. The logical functions are called FL and . One of the reasons of such design is to prevent future unknown attacks. The figure shows the encryption part of the algorithm using a key of 16 bytes. In Figure 3, the F function is shown. It uses S-functions, formed with 8 S-boxes and only 4 of them active: S1, S2, S3 and S4. Also, the P-functions are applied to ensure computational efficiency and provide security against differential and linear cryptanalysis.

Figure 3. Structure of F-function

The key schedule generates 64-bit sub-keys for input/output whitening, for round functions and for FL functions from the secret key K. The decryption can be done in the same way as the encryption by reversing the order of the subkeys.

3.3. LEX
The structure of LEX stream cipher is present in Figure 4.

Figure 4. Structure of LEX algorithm

The LEX cipher is initialized by performing a complete key schedule operation. The result of this process are 10, 12 or 14 AES round keys. The next step of initialization is to encipher a value called IV with a key K. The result of the encryption of IV is chained with the AES encryption process where the byte extraction process will begin (Figure 3). For every round depending of its parity four bytes are extracted. The bytes proposed by the author for extraction are presented in Figure 5.

38

International Journal on Cryptography and Information Security (IJCIS), Vol. 4, No. 1, March 2014

Figure 5. Bytes extracted according to the round parity

As it can be seen, for odd rounds bytes b0,0 ,b2,0 ,b0,2 ,b2,2 are extracted and for even rounds bytes b0,1 ,b2,1 ,b0,3 ,b3,2 are extracted. For a 128 bit key length AES the output stream key will be 320 bit long. Based on AES algorithm the LEX stream cipher uses the same round algorithm as AES with only one difference. At the end of each round are leaked four bytes as mentioned above. Thus, the LEX cipher could be translated in the Figure 6.

Figure 6 LEX cipher operations

Another difference between AES algorithm is the fact that for the LEX cipher all the rounds have the same form as it is presented above, in contrast with AES algorithm which has no MixColumns operation for the last round.

4. STATISTICAL AND CRYPTOGRAPHIC RANDOMNESS TESTS

In this section we describe the statistical and cryptographic randomness tests used for the framework implementation.

4.1. 128-bit Key Avalanche Test

In order to examine the sensitivity of algorithms due to the changes in the plaintext, 100, 500 and 1000 binary sequences were analyzed. These sequences were parsed from a string which was built as follows.
39

International Journal on Cryptography and Information Security (IJCIS), Vol. 4, No. 1, March 2014

We considered the key has the value zero (no matter the size of it: 128 bits, 192 bits or 256 bits) and that the plaintext block (no matter the size of it: 128 bits or 64 bits) is random. Then we obtain the derived blocks by concatenating the results of: the XOR between the ciphertext formed with the fixed key and the random plaintext; the XOR between the ciphertext formed using the fixed key and the modified random plaintext with the i-th bit changed, with 1<i<128 (this means that for each random plaintext a number of 128 or 64 sets of derived blocks were formed)

So we have built 100, 500 and 1000 binary sequences of 1,048,576 bits each (which is equivalent to 128 Kb). These sequences were then used as an input for NIST statistical tests and the results are presented in the next section.

4.2. 128-bit Plaintext Avalanche Test

This test examines how the algorithms react to changes in the 128-bit, 192-bit or 256-bit key. In order to do this 100, 500 and 1000 sequences were analyzed. The sequences were parsed from a string constructed as follows. We considered that the key has random value (no matter the size of it: 128 bits, 192 bits or 256 bits) and that the plaintext block (no matter the size of it: 128 bits or 64 bits) has the value zero. Then we obtain the derived blocks by concatenating the results of: the XOR between the ciphertext formed with one of the keys and the fixed plaintext; the XOR between the ciphertext formed using the fixed plaintext and the modified form of a random key with the i-th bit changed, with 1<i<128 (this means that for each random key a number of 128, 192 or 256 sets of derived blocks were formed)

So we have built 100, 500 and 1000 binary sequences of 1,048,576 bits each (which is equivalent to 128 Kb). These sequences were then used as an input for NIST statistical tests and the results are presented in the next section.

4.3. Plaintext-Ciphertext Correlation Test

To study the correlation of plaintext-ciphertext pairs, 100, 500 and 1000 sequences were examined. Each sequence has 1,048,576 bits. We considered the key has the random value (no matter the size of it: 128 bits, 192 bits or 256 bits) and that the plaintext block (no matter the size of it: 128 bits or 64 bits) is also random. We have generated 8,192/16,384 random plaintext blocks. A binary sequence was constructed by concatenating the 8,192/16,384 derived blocks (a block is a XOR operation between the plaintext block and its corresponding ciphertext block computed in ECB mode). Using 8,192/16,384 plaintext blocks this procedure was repeated 100, 500 and respectively 1000 times. The sequences obtained after these operations were then used as an input for NIST statistical tests and the results are presented in the next section.

4.4. Cipher Block Chaining Mode Test

In this test, the cipher block works in CBC mode and the initialization vector of 128 bits (in the case of TEA of 64 bits) has the value zero. The 128-bit plaintext (64-bit plaintext in the case of TEA algorithm) is initialized with zero and the key of 128, 192 or 256 bits is randomly generated.
40

International Journal on Cryptography and Information Security (IJCIS), Vol. 4, No. 1, March 2014

There are generated 100, 500 and 1000 binary sequences of 1,048,576 bits (which is equivalent to 128Kb). This means that a sequence of 8,192 ciphertext blocks (of 128-bits) or 16,384 ciphertext blocks (of 64 bits for cryptographic algorithm TEA) is created through the concatenation of the ciphertexts and written to a file. Each of the 100, 500 and 1000 binary sequences of 128Kb is obtained by encrypting the plaintext with a different random 128, 192 or 256 bit key.

Figure 7. Cipher Block Chaining mode

The initialization vector (IV) is used for the first block to make each message unique. In this mode of operation, the initial plaintext block is XOR-ed with the IV which is 0 and then the result of this operation is encrypted, obtaining a 128- bit (or 64-bit) ciphertext block. In the next step, the ciphertext obtained in the previous round becomes the new IV, so each plaintext block will be XOR-ed with the previous ciphertext block before being encrypted. The advantage of this mode is the fact that it ensures dependency between each ciphertext block and all the plaintext blocks that have been processed until that moment. The results obtained here are used as an input for NIST statistical tests and the results are presented in the next section.

4.5. Random Plaintext- Random Key Test

Another test that can be applied in order to evaluate the randomness of the ciphertext generated by the block ciphers is described here. We generate 100,500 and 1000 binary sequences of 128 Kb obtained by concatenating 8,912 ciphertext blocks of 128-bits (respectively 16,384 ciphertext blocks of 64-bits for TEA algorithm). The plaintext and the key are randomly generated, which means that each ciphertext block is obtained by encrypting a random plaintext of 64 bits or 128 bits with a 128, 192 or 256 -bit random key. The binary sequences generated as described above were then used as an input for NIST statistical tests and the results are presented in the next section.

4.6. Low Density 128-bit, 192-bit and 256-bit Keys Test

For this test were created data sets of 100, 500 and 100 sequences, based on low density keys. For each sequence were enciphered the blocks using ECB mode. To create the ciphertext blocks we have set a fixed random plaintext block of 128 or 64 bits which will be used to encipher:

41

International Journal on Cryptography and Information Security (IJCIS), Vol. 4, No. 1, March 2014

one all zero key; 128 keys which have only one bit of one and the rest of 127 bits are zero (this corresponds to the apparition of value one on each possible position of the existing 128) ; or 192/256 keys with only one bit of one and the rest of 191/255 bits are zero; 8,128 keys which have two bits of one and the rest of 126 bits are zero (this corresponds to the apparition of the two ones in each possible combination); or 12,224/16,320 keys with two bits of one and 190/254 bits of zero;

The ciphertext blocks generated as described above are concatenated in sequences of 1,048,576 bits which are then used as an input for NIST statistical tests and the results are presented in the next section.

4.7. Low Density Plaintext Test

For this test were created data sets of 100, 500 and 1000 sequences, based on low density plaintext block. For each sequence were enciphered the blocks using ECB mode. To create the ciphertext blocks we have set a fixed random key of 128, 192 or 256 bits which will be used to encipher: one all zero plaintext block; 128 plaintext blocks which have only one bit of one and the rest of 127 bits are zero (this corresponds to the apparition of value one on each possible position of the existing 128) or 64 plaintext blocks with only one bit of one and the rest of 63 bits are zero; 8,128 plaintext blocks which have two bits of one and the rest of 126 bits are zero (this corresponds to the apparition of the two ones in each possible combination); or 4,032 plaintext blocks with two bits of one and 62 bits of zero;

The ciphertext blocks generated as described above are concatenated in sequences of 1,048,576 bits which are then used as an input for NIST statistical tests and the results are presented in the next section.

4.8. High Density Plaintext Test

For this test were created data sets of 100, 500 and 1000 sequences, based on low density plaintext block. For each sequence were enciphered blocks in ECB mode. To create the ciphertext blocks we have set a fixed random key of 128, 192 or 256 bits which will be used to encipher the random plaintext blocks. By using in the block 128 or 64 bits of ones as plaintext we created the first ciphertext block. For the next blocks from 2 to 129 the ciphertexts were determined by enciphering the fixed key with plaintext blocks consisting of one bit of zero and 127 of ones (or 63 bits of ones). The ciphertext blocks from 130 to 8,257 (respectively from 130 to 4,320) were determined by enciphering the fixed key with plaintext blocks consisting of two bits of zeros and 126 bits of ones (or 62 bits of ones). This test is similar with Low Density Plaintext Test, except that we replace now the zero values with values of one. The ciphertext blocks generated are concatenated in sequences of 1,048,576 bits which are then used as an input for NIST statistical tests and the results are presented in the next section.

42

International Journal on Cryptography and Information Security (IJCIS), Vol. 4, No. 1, March 2014

4.9. High Density 128-bit, 192-bit and 256-bit Keys Test

For this test were created three data sets of 100, 500 and 1000 sequences, based on low density keys. For each sequence were enciphered blocks in ECB mode. At the beginning, we have set a fixed random plaintext block of 128 or 64 bits. By using 128, 192 or 256 bits of ones as the key we have generated our first ciphertext block. For the next blocks from 2 to 129 the ciphertexts were determined by using a key consisting of one bit of zero and 127 of ones (respectively one bit of zero and 191 of ones or one bit of zero and 255 of ones). The ciphertext blocks from 130 to 8,257 (or from 130 to 12,224; or from 130 to 16,320) were determined by using keys consisting of two bits of zeros and 126 bits of ones (respectively two bits of zero and 190 of ones or two bits of zero and 254 of ones). This test is similar with Low Density Key Test, except that we replace now the zero values with values of one. The ciphertext blocks generated are concatenated in sequences of 1,048,576 bits which are then used as an input for NIST statistical tests and the results are presented in the next section. Referring to the three statistical NIST tests which were applied to the output obtained from the previous described tests, they are presented in the following subsections:

4.10. Frequency Test (Monobit)

The aim of this statistical test is to calculate the number of bits with the value one or zero in a sequence is almost the same as for a true random number. This test converts the binary digits of the sequence into +1 sand -1 depending of the value of the bit. Therefore, bit value 1 turns into +1 and bit value 0 turns into -1. This new values are added together, like in (1), where n represents the number of bits of the sequence. The statistical test is calculated as (2). (1) .

(2)

The P-value is then calculated as it can be seen in (3). If the resulted P-value is lower than 0.01 than the sequence is not random, otherwise the sequence tested is random. (3)

4.11. Block Frequency Test

The aim of this test is to calculate the frequency of appearance of an n-bit block in a sequence is almost the same as for a true random number. The first step of this test is to partition the tested sequence into (4) non-overlapping blocks. (4)

43

International Journal on Cryptography and Information Security (IJCIS), Vol. 4, No. 1, March 2014

The second step is to determine the value of

, through the following equation (5). (5)

Then the value specified in (6) is calculated. (6) The value of P-value is then calculated as in (7). If the resulted P-value is lower than 0.01 than the sequence is not random, otherwise the sequence tested is random. (7)

4.12. Runs Test

The aim of this test is to calculate the frequency of subsequences oscillations. In order to calculate such value is determined the number of runs of zeros and ones. First a pre-test proportion of ones is calculated in (8).

(8)
Then the value of test statistics is calculated in (9). (9) The P-value is calculated then as it can be seen in (10). (10) If the resulted P-value is lower than 0.01 than the sequence is not random, otherwise the sequence tested is random.

5. EXPERIMENTAL RESULTS
The framework we have created has all the randomness and statistical tests described in the previous section included and these can be applied to any cryptographic algorithm (block cipher or stream cipher). The user who wants to evaluate his algorithm has to load the .dll of the cipher (this offers to the framework the ability to access the encryption/decryption function and also the key schedule if it is necessary) in the framework and select which test it wants to apply. He can apply all of them at the same time or he can select some of them based on what the user needs. The program stores all the results of the statistical tests in files and shows to the user the percent of successes out of 100, 500 and 1000 sequences.

44

International Journal on Cryptography and Information Security (IJCIS), Vol. 4, No. 1, March 2014

We have selected for evaluation three algorithms: two block cipher, TEA and Camellia and one stream cipher, LEX. The experiments that were performed are presented in detail in the following sections. Table 1 shows the rate of success for all algorithms (TEA, Camellia and LEX), for each possible size for the key (128, 192 or 256 bits) and for 100, 500 and 1000 binary sequences generated.
Table 1. Rate of Success for all algorithms and all tests

Algorithm

Number of sequences generated (128 Kb each) 100 500 1000 100 500 1000 100 500 1000 100 500 1000 100 500 1000 100 500 1000 100 500 1000

Monobit Test (% ) 98 99.2 99.3 100 99.4 99.6 99 99.6 99.7 99 99.6 99.8 100 99.8 99.8 98 99.4 99.6 98 99.4 99.7

Block Frequency Test (%) 99 99.6 99.8 98 99.6 99.7 98 99.6 99.7 99 99.8 99.8 98 99.6 99.7 98 99.4 99.6 98 99.4 99.7

Runs Test (%)

TEA-128 TEA-128 TEA-128 Camellia-128 Camellia-128 Camellia-128 Camellia-192 Camellia-192 Camellia-192 Camellia-256 Camellia-256 Camellia-256 LEX-128 LEX-128 LEX-128 LEX-192 LEX-192 LEX-192 LEX-256 LEX-256 LEX-256

98 99.4 99.7 98 100 99.8 100 99.6 99.9 100 100 99.9 99 99.8 100 99 100 99.9 100 99.8 100

Figure 8 shows the rate of success for 100 sequences generated and for each NIST statistical test applied. The horizontal axis shows the algorithms that have been tested and the vertical axis shows the rate of success for each test in %. As it can be observed, the algorithms have very good randomness properties as is indicated by the fact that the smallest rate of success it 97.5% which is very high.

45

International Journal on Cryptography and Information Security (IJCIS), Vol. 4, No. 1, March 2014

Figure 8. Rate of success for 100 sequences

If we look at Figure 9 and Figure 10, where the results for 500 and 1000 generated sequences are presented, we can draw the same conclusions. TEA, Camellia and LEX are algorithms that pass with high score the statistical randomness testing demonstrating in this way their suitability to be random number generators.

Figure 9. Rate of success for 500 sequences

46

International Journal on Cryptography and Information Security (IJCIS), Vol. 4, No. 1, March 2014

Figure 10. Rate of success for 1000 sequences

6. CONCLUSIONS
During the testing, numerous statistical tests were applied on large sets of data, which collectively verify many well-known properties that any good cryptographic algorithm should satisfy. Referring to these properties, they include any detectable correlation between plaintext-ciphertext pairs, any detectable bias due to single bit changes to either a plaintext or a key, and many others. It appears that LEX, Camellia and TEA algorithms have good statistical results obtained for all the tests applied. We wanted to emphasize the importance of random number sequences in digital cryptography and to present a framework which can be used to statistically test any cryptographic algorithm. Our future work involves an improvement of the framework such that it will allow evaluating algorithms based on other criteria such as memory usage, CPU time, performance and security.

REFERENCES
[1] B. Schneier, Applied cryptography: protocols, algorithms, and source code in C, Second Edition, John Wiley & Sons, 1996. [2] A. Rukhin et al., A statistical test suite for random and pseudorandom number generators for cryptographic applications, NIST Special Publication 80022, National Institute of Standards and Technology, revised May 2001. [3] P. L'Ecuyer and R. Simard, TestU01: A C library for empirical testing of random number generators, in ACM Transactions on Mathematical Software, 2007. [4] G. Marsaglia. The diehard test suite, 2003, available at http://i.cs.hku.hk/~diehard/ (Accessed: January 2014). [5] J. Walker, ENT A pseudorandom number sequence test program, 2008, available at http://www.fourmilab.ch/random/ (Accessed: January 2014). [6] J. Soto, Radomness Testing of AES Candidate Algorithms, 1999, available at http://csrc.nist.gov/encryption/aes/round1/r1-rand.pdf (Accessed: January 2014). [7] R. Needham and D. Wheeler, TEA, a Tiny Encryption Algorithm, in Proceedings of FSE 94,1994, pp. 363-366 . [8] http://www.informatik.uni-trier.de/~ley/db/conf/fse/fse94.html (Accessed: January 2014). [9] E. Biham and A. Shamir, Differential Cryptanalysis of DES-like Cryptosystems, in Proceedings of the 10th Annual International Cryptology Conference on Advances in Cryptology, 1992, pp. 2-21. [10] S. Hong, D. Hong, Y. Ko, D. Chang, W. Lee, and S. Lee. Dierential Cryptanalysis of TEA and XTEA, in Information Security and Cryptology ICISC, 2003, pp. 402-417. 47

International Journal on Cryptography and Information Security (IJCIS), Vol. 4, No. 1, March 2014 [11] J. Kesley, B. Schneier, and D. Wagner, Key-Schedule Cryptanalysis of IDEA, G-DES, GOST, SAFER RC2, and Triple-DES, in Advances in Cryptology- CRYPTO 96, 1996, pp. 237-251. [12] M. Steil, 17 Mistakes Microsoft Made in the Xbox Security System, in Chaos Communication Congress 2005, available at http://events.ccc.de/congress/2005/fahrplan/events/559.en.html ( Accessed: January 2014). [13] J. Kesley, B. Schneier, and D. Wagner, Related-Key Cryptanalysis of 3-WAY, Biham-DES, CAST, NewDES, RC2, and TEA, in Proceedings of Information and Communications Security ICICSS 97, 1997. [14] R. M. Needham and D.J. Wheeler, Correction to XTEA, technical report, Computer Laboratory, University of Cambridge, October 1998, available at http://www.movabletype.co.uk/scripts/xxtea.pdf. ( Accessed: January 2014). [15] M.-J. Saarinen, Cryptanalysis of Block TEA, unpublished manuscript,October 1998, available at http://groups.google.com/group/sci.crypt.research/msg/f52a533d1e2fa15e (Accessed: January 2014). [16] J.-P. Kaps, Chai-Tea, Cryptographic Hardware Implementations of xTEA, in Proceedings of INDOCRYPT 2008, 2008, pp. 363-375. [17] http://en.wikipedia.org/wiki/Camellia_(cipher) (Accessed: January 2014). [18] K. Aoki, T. Ichikawa, M. Kanda, M. Matsui, S. Moriai, J. Nakajima, and T. Tokita, Specification of Camellia a 128-bit Block Cipher, 2000, available at http://info/isl.co/jp/camellia/ (Accessed: January 2014). [19] Y. Tsunoo, T. Suzaki, T. Saito, T. Kawabata and H. Miyauchi, Timing Attack on Camellia Using Cache Delay in S-boxes, in Proceedings of the 2003 Symposium on Cryptography and Information Security, SCIS2003, 2003, pp. 179-184. [20] I. Yoshitaka and K. Toshinobu, A study on the effect of cache structure to the cache timing attack for a block cipher, IEIC Technical Report, 2004, pp. 37-42. [21] Z. Xin-jie, W. Tao and Z. Yuan-yuan, Cache Timing Attacks on Camellia Block Cipher, 2009, available at http://eprint.iacr.org/2009/354.pdf (Accessed: January 2014). [22] L.R. Knudsen, Truncated and higher order differentials, in Preneel, B. (ed.) FSE94, 1994, pp. 196211. [23] X. Lai, Higher order derivatives and differential cryptanalysis, in Communications and Cryptography, 1994, pp. 227-233. [24] J. Daemen, L.R. Knudsen and V. Rijmen, The block cipher Square, in Proceedings of FSE97, 1997, pp. 149-165. [25] Y. Hu, Y. Zhang and G. Xiao, Integral analysis of SAFER, , Electronics Letters, 1999, pp. 1458-1459. [26] L.R. Knudsen and D. Wagner, Integral cryptanalysis, in Proceedings of FSE2002, 2002, pp. 112-127. [27] M. Matsui, Linear cryptanalysis method for DES cipher, in Proceedings of EUROCRYPT 1993, 1993, pp. 386-397. [28] D. Wagner, The boomerang attack, in Proceedings of FSE 1999, 1999, pp. 156-170. [29] E. Biham, O. Dunkelman and N. Keller, The rectangle attack rectangling the Serpent, in Proceedings of EUROCRYPT 2001, 2001, pp. 340-357. [30] E. Biham, A. Biryukov and A. Shamir, A Cryptanalysis of Skipjack reduced to 31 rounds using impossible differentials, in Proceedings of EUROCRYPT 1999, 1999, pp. 12-23. [31] M. Sugita, K. Kobara and H. Imai, Security of reduce version of the block cipher Camellia against truncated and impossible differential cryptanalysis, in Proceedings of ASIACRYPT 2001, 2001, pp. 193-207. [32] D. Bai and L. Li, New impossible differential attacks on Camellia, in Proceedings of ISPEC 2012, 2012, pp. 80-96. [33] Y. Liu, L. li, D. Gu, X. Wang, Z. Liu, J. Chen and W. Li, New observations on impossible differential cryptanalysis of reduced-round Camellia, in Proceedings of FSE 2012, 2012. [34] J. Lu, Y. Wei, J. Kim and E. Pasalic, The higher-order meet-in-the-middle attack and its application to the Camellia block cipher, presented at First Asian Workshop on Symmetric Key Cryptography (ASK 2011), 2011, available at https://sites.google.com/site/jiqiang/HO-MitM.pdf (Accessed: January 2014). [35] J. Lu, Y. Wei, E. Pasalic and P.A. Fouque, Meet-in-the-middle attack on reduced versions of Camellia block cipher, 2012, available at http://www.di.ens.fr/~fouque/pub/iwsec12.pdf (Accessed: January 2014). [36] A. Biryukov, The Design of a Stream Cipher LEX, in Proceedings of Selected Areas in Cryptography 2006, 2007, pp. 67-75. 48

International Journal on Cryptography and Information Security (IJCIS), Vol. 4, No. 1, March 2014 [37] A. Biryukov, A New 128-bit Key Stream Cipher LEX, in ECRYPT stream cipher project report 2005/013, 2005, available at http://www.ecrypt.org/stream (Accessed: January 2014). [38] N. T. Courtois and W. Meier, Algebraic attacks on stream ciphers with linear feedback, in Advances in Cryptology EUROCRYPT 2003, 2003, pp. 345-359. [39] B. Preneel and H Wu, Resynchronization Attacks on WG and LEX, in Proceedings of Fast Software Encryption 2006, 2006, pp. 422-432. [40] Englund, Hell, Johansson, A Note on Distinguishing Attacks, in Information Theory for Wireless Networks, 2007 IEEE Information Theory Workshop, 2007, pp. 1-4. [41] O. Dunkelman and N. Keller, A New Attack on the LEX Stream Cipher, in Proceedings of ASIACRYPT 2008, 2008, pp. 539-556. [42] M. S. Turan, A. Doanaksoy, C. alik, Statistical Analysis of Synchronous Stream Ciphers, in Proceedings of SASC 2006: Stream Ciphers Revisited, 2006. [43] D. L. Cook, M. Yung, A. D. Keromytis, Elastic Block Ciphers in Practice: Constructions and Modes of Enceryption, in Proceedings of the 3rd European Conference on Computer Network Defense, 2009, pp. 69-91. [44] H. Chen, D.G. Feng, L.M. Fan, A New Statistical Test on Block Ciphers, in Chinese Journal of Computers, 2009, pp. 595-601.

49