Upcoming SlideShare
×
Like this presentation? Why not share!

Like this? Share it with your network

Share

# HES2011 - Mate Soos - Craking Industry Ciphers at a Whim

• 1,289 views

More in: Technology
• Comment goes here.
Are you sure you want to
Be the first to comment
Be the first to like this

Total Views
1,289
On Slideshare
1,285
From Embeds
4
Number of Embeds
2

Shares
92
0
Likes
0

### Report content

No notes for slide

### Transcript

• 1. Breaking Industrial Ciphers at a Whim M ATE S OOS P RESENTATION AT HES’11
• 2. Story line1 HiTag2: reverse-engineered proprietary cipher2 Analytic tools are needed to investigate them3 CryptoMiniSat: free software tool to test ciphers (and to break them) 2
• 3. Philips HiTag2 Cipher For access control: cars, army buildings Proprietary: reverse-engineered by Karsten Nohl and Sean O’Neil Feedback linear(!), ﬁlter non-linear 3
• 4. SAT SolversInput: CNF, an “and of or-s’ (x1 ∨ ¬x3 ) ∧ (¬x2 ∨ x3 ) ∧ (x1 ∨ x2 ) Crypto-problem needs conversionUses DPLL(ϕ) algorithm 1 If (formula ϕ trivial) return SAT/UNSAT 2 ret ← DPLL(ϕ with v ← true) 3 If (ret = SAT) return SAT 4 ret ← DPLL(ϕ with v ← false) 5 If (ret = SAT) return SAT 6 return UNSAT 4
• 5. Toy Example (¬x1 ∨ ¬x2 ∨ x3 ) ∧ (¬x1 ∨ x2 ) ∧ (¬x1 ∨ ¬x2 ) Clause 1 Clause 2 Clause 31 Guess: x1 = True2 Clause 2: x2 = True3 Clause 3: impossible! Reverse guess.4 x1 = False5 Good, everything is satisﬁed! 5
• 6. Example Search Tree BEGIN guess Start Guess - s[60] guess **115 **121 **123 **125 **126 - s[104] s[104] s[63] s[74] s[103] s[79] guess **99 **107 **111 **113 **114 guess **117 **119 **120 calc_s[28] **122 guess **124 guess **114 - s[103] s[103] s[79] s[74] s[63] s[78] - s[63] s[74] s[103] s[78] - s[76] s[103] - s[103] s[79] - s[79] s[78] guess **95 **97 **98 guess **103 **105 **106 guess **109 **110 calc_s[31] **112 calc_s[28] calc_s[30] calc_s[28] **116 guess **118 **113 calc_s[30] guess **111 **95 calc_s[31] **106 calc_s[31] - s[102] - s[100] s[63] s[79] - s[79] s[63] s[74] s[78] - s[74] s[63] s[78] - s[72] s[78] - s[76] - s[65] s[76] s[103] - s[103] s[79] - s[79] s[65] - s[74] - s[79] - s[100] - s[72] s[78] - s[72] guess **87 **91 **93 **94 **83 **96 calc_s[28] calc_s[31] guess **101 **102 calc_s[28] **104 calc_s[31] calc_s[30] calc_s[31] **108 calc_s[28] calc_s[30] guess calc_s[30] guess calc_s[103] guess **113 **95 calc_s[31] calc_s[31] calc_s[103] guess **105 **87 calc_s[100] calc_s[31] calc_s[30] s[74] until - s[101] s[100] s[79] s[63] s[74] s[74] s[79] - s[76] - s[72] - s[63] s[74] s[78] - s[76] s[78] s[72] s[65] s[72] s[78] - s[76] s[65] - s[63] - s[65] - s[78] s[75] - s[74] - s[79] - s[100] - s[72] s[72] - s[75] - s[103] s[60] s[102] s[75] s[72] - s[65] guess guess **89 **90 guess **92 calc_s[28] calc_s[31] **87 calc_s[31] guess calc_s[100] calc_s[28] **100 calc_s[31] calc_s[30] guess calc_s[30] guess calc_s[103] guess calc_s[30] guess calc_s[103] calc_s[28] calc_s[103] calc_s[30] calc_s[3] guess **101 **85 calc_s[100] guess calc_s[3] **95 guess calc_s[103] calc_s[30] calc_s[103] s[74] - s[100] - s[79] s[63] s[74] - s[63] s[74] - s[76] - s[72] s[102] - s[72] - s[79] s[75] s[76] s[75] s[72] s[65] - s[74] - s[65] - s[78] - s[75] - s[63] s[65] - s[78] - s[75] s[76] s[75] s[65] s[64] - s[79] s[63] s[102] - s[75] - s[78] - s[64] - s[100] - s[79] - s[78] s[65] s[75] s[60] guess **79 **83 **85 **86 guess **88 calc_s[28] calc_s[31] calc_s[28] calc_s[31] guess calc_s[100] guess calc_s[100] calc_s[31] calc_s[103] guess calc_s[100] guess calc_s[103] calc_s[31] calc_s[103] calc_s[30] calc_s[3] calc_s[28] calc_s[103] calc_s[30] calc_s[3] guess calc_s[3] calc_s[103] calc_s[99] **101 guess calc_s[103] calc_s[30] calc_s[99] **87 calc_s[31] calc_s[30] calc_s[103] calc_s[3] - s[99] s[99] s[74] s[63] s[79] - s[63] s[74] - s[76] s[72] s[76] - s[72] - s[74] - s[75] - s[63] - s[75] s[72] - s[78] - s[74] s[100] - s[78] - s[75] - s[72] s[75] - s[65] s[64] s[76] - s[75] - s[65] - s[64] - s[78] - s[64] - s[75] s[99] - s[103] - s[79] s[78] - s[65] s[99] s[102] s[72] s[65] - s[75] s[64] guess **72 **75 **77 **78 guess **81 **82 guess **84 calc_s[28] calc_s[31] calc_s[28] calc_s[31] guess calc_s[100] guess calc_s[100] calc_s[31] calc_s[103] calc_s[28] calc_s[103] calc_s[100] calc_s[30] calc_s[31] calc_s[103] calc_s[30] calc_s[3] guess calc_s[3] calc_s[103] calc_s[99] guess calc_s[3] calc_s[103] calc_s[99] calc_s[30] calc_s[99] calc_s[3] calc_s[17] calc_s[31] calc_s[31] calc_s[30] calc_s[103] calc_s[17] **83 calc_s[100] calc_s[3] calc_s[3] calc_s[99] s[103] - s[98] s[96] s[63] s[79] s[74] - s[74] s[63] s[79] - s[63] s[79] - s[76] - s[72] s[76] s[72] - s[74] s[75] - s[74] s[75] s[72] s[78] s[76] s[78] - s[75] s[65] - s[72] s[78] - s[65] - s[64] - s[78] - s[64] s[75] s[99] - s[78] s[64] s[75] - s[99] s[65] s[99] s[64] s[77] - s[72] s[72] - s[65] s[75] - s[77] s[74] - s[75] - s[64] s[64] s[99] s[60] guess guess **73 **74 calc_s[28] **76 guess **67 guess **80 calc_s[28] **78 calc_s[28] calc_s[31] guess calc_s[100] guess calc_s[100] calc_s[31] calc_s[103] calc_s[31] calc_s[103] calc_s[100] calc_s[30] guess calc_s[30] calc_s[103] calc_s[3] guess calc_s[30] calc_s[103] calc_s[99] calc_s[30] calc_s[99] calc_s[3] calc_s[17] calc_s[30] calc_s[99] calc_s[3] calc_s[17] calc_s[103] calc_s[17] calc_s[99] calc_s[2] **95 calc_s[100] calc_s[3] calc_s[3] calc_s[2] calc_s[103] calc_s[99] calc_s[99] calc_s[17] conﬂict - s[97] - s[63] s[74] s[79] - s[76] s[74] - s[74] s[65] - s[63] s[79] - s[76] - s[96] s[76] - s[72] - s[79] s[75] - s[74] - s[75] - s[72] s[78] s[72] - s[78] s[75] - s[65] - s[79] - s[65] - s[78] - s[64] - s[100] - s[65] s[75] s[99] s[65] - s[99] s[64] s[77] - s[65] - s[99] - s[64] - s[77] - s[75] - s[77] - s[99] s[62] - s[100] s[75] s[64] - s[64] - s[62] - s[78] s[99] s[99] s[77] guess calc_s[28] guess **67 guess calc_s[31] calc_s[31] calc_s[31] calc_s[28] calc_s[31] guess calc_s[31] guess calc_s[100] **77 calc_s[103] calc_s[31] calc_s[103] calc_s[100] calc_s[30] calc_s[100] calc_s[30] calc_s[103] calc_s[3] calc_s[31] calc_s[3] calc_s[30] calc_s[99] calc_s[100] calc_s[3] calc_s[3] calc_s[17] calc_s[103] calc_s[17] calc_s[99] calc_s[2] calc_s[103] calc_s[17] calc_s[99] calc_s[2] calc_s[3] calc_s[2] calc_s[17] calc_s[4] **85 calc_s[103] **67 calc_s[99] calc_s[23] calc_s[30] calc_s[17] calc_s[17] calc_s[2] s[104] s[63] - s[96] s[76] - s[79] s[65] - s[79] s[72] s[72] - s[72] s[76] s[72] - s[79] s[72] - s[79] - s[75] - s[96] - s[78] - s[72] - s[78] - s[75] s[65] - s[75] s[65] s[78] - s[64] s[72] s[64] - s[65] s[99] - s[75] s[64] - s[64] - s[77] - s[75] - s[77] - s[99] - s[62] s[75] s[77] s[99] - s[62] - s[64] s[62] - s[77] s[60] s[102] s[78] s[99] - s[99] s[60] - s[65] - s[77] s[77] s[62] guess **68 **70 **71 guess calc_s[31] calc_s[31] guess calc_s[100] calc_s[100] calc_s[100] guess calc_s[100] **76 calc_s[100] **74 calc_s[103] calc_s[31] calc_s[30] calc_s[100] calc_s[30] calc_s[103] calc_s[3] calc_s[103] calc_s[3] calc_s[30] calc_s[99] calc_s[100] **67 calc_s[3] calc_s[17] calc_s[103] calc_s[99] calc_s[99] calc_s[2] calc_s[3] calc_s[2] calc_s[17] calc_s[100] calc_s[3] calc_s[2] calc_s[17] calc_s[23] calc_s[99] calc_s[4] calc_s[2] **81 calc_s[30] calc_s[99] calc_s[17] calc_s[3] calc_s[2] calc_s[2] calc_s[4] s[74] s[63] s[103] s[103] - s[79] - s[79] s[74] - s[95] - s[79] s[63] s[74] - s[74] s[72] - s[72] - s[74] - s[75] - s[75] s[75] - s[79] s[75] - s[96] - s[75] - s[96] s[78] s[72] s[65] s[75] - s[65] s[78] - s[64] - s[78] s[64] s[65] - s[99] s[75] s[99] - s[64] - s[77] - s[78] - s[99] - s[99] - s[62] - s[64] s[62] - s[77] - s[100] s[64] - s[62] s[77] s[60] - s[99] s[60] s[62] s[60] s[65] s[63] s[77] - s[64] s[62] - s[62] s[60] s[60] - s[103] - s[103] s[63] guess guess **69 calc_s[28] calc_s[31] **65 calc_s[100] calc_s[100] calc_s[31] calc_s[96] calc_s[96] calc_s[30] calc_s[31] calc_s[103] **71 calc_s[96] calc_s[31] calc_s[30] calc_s[100] calc_s[3] calc_s[103] calc_s[3] calc_s[30] calc_s[99] calc_s[30] calc_s[99] calc_s[3] calc_s[17] calc_s[103] calc_s[99] calc_s[99] calc_s[2] calc_s[30] calc_s[17] calc_s[17] calc_s[23] calc_s[99] calc_s[4] calc_s[2] calc_s[10] calc_s[99] calc_s[100] calc_s[2] calc_s[17] calc_s[4] calc_s[3] calc_s[2] calc_s[99] calc_s[4] calc_s[100] s[79] s[74] s[74] s[63] s[63] s[79] s[78] s[103] s[79] - s[79] s[103] - s[94] - s[63] s[74] - s[76] s[72] - s[79] s[75] - s[75] - s[72] - s[62] - s[62] - s[78] - s[72] s[78] s[60] s[62] s[72] - s[65] - s[75] - s[64] - s[78] s[64] - s[65] - s[99] - s[65] s[99] s[64] s[77] s[78] s[60] s[99] s[62] s[65] s[77] s[77] s[60] s[99] s[60] - s[62] s[68] s[99] s[100] - s[62] s[77] s[60] s[64] - s[62] s[99] s[60] - s[100] node66 s[103] - s[63] s[100] s[104] s[104] - s[103] - s[103] guess calc_s[28] calc_s[31] guess calc_s[100] **69 calc_s[96] calc_s[30] calc_s[100] calc_s[103] calc_s[103] calc_s[99] calc_s[100] calc_s[30] calc_s[103] calc_s[100] calc_s[99] calc_s[96] calc_s[17] calc_s[30] calc_s[99] calc_s[3] calc_s[17] calc_s[3] calc_s[17] calc_s[99] calc_s[2] calc_s[30] calc_s[17] calc_s[4] calc_s[3] calc_s[2] calc_s[2] calc_s[17] calc_s[23] calc_s[104] calc_s[17] calc_s[10] calc_s[100] calc_s[2] calc_s[99] calc_s[100] calc_s[17] calc_s[10] learnt unit clause learnt unit clause s[74] s[99] s[63] s[78] s[63] s[100] s[100] s[103] - s[63] s[79] - s[93] s[76] s[72] - s[74] - s[75] s[60] - s[62] - s[78] s[75] - s[78] - s[78] s[60] - s[75] s[65] - s[78] s[75] s[103] s[62] - s[77] s[65] s[99] s[64] s[77] - s[64] s[77] s[99] s[62] s[65] - s[77] s[104] s[64] s[62] - s[62] s[77] s[60] s[104] - s[77] - s[68] s[100] s[62] - s[99] - s[100] - s[77] s[68] s[60] s[74] s[103] s[103] s[60] s[60] s[79] s[60] s[100] s[102] s[102] - s[103] s[99] guess guess calc_s[100] calc_s[31] calc_s[96] calc_s[103] calc_s[17] calc_s[96] calc_s[27] calc_s[27] calc_s[103] calc_s[3] calc_s[27] calc_s[96] calc_s[103] calc_s[2] calc_s[3] calc_s[17] calc_s[99] calc_s[2] calc_s[99] calc_s[2] calc_s[17] calc_s[4] calc_s[3] calc_s[2] calc_s[99] calc_s[4] calc_s[100] calc_s[2] calc_s[2] calc_s[24] calc_s[10] calc_s[4] calc_s[17] calc_s[10] calc_s[2] calc_s[24] guess **134 **138 **140 **141 guess **145 **147 **148 s[74] s[63] s[78] - s[100] s[63] s[74] s[63] s[79] - s[92] - s[74] s[75] - s[72] s[62] s[78] s[77] - s[62] - s[68] - s[68] s[78] - s[64] s[68] s[62] - s[78] s[62] - s[64] s[77] s[99] - s[62] - s[99] s[62] - s[77] s[103] s[64] - s[62] s[99] s[79] - s[100] s[62] - s[62] - s[79] s[68] - s[79] - s[77] - s[68] - s[62] s[60] - s[74] s[103] s[63] s[79] s[78] - s[103] s[63] s[79] s[78] s[60] s[60] s[60] s[60] - s[103] - s[103] - s[103] guess **61 calc_s[96] calc_s[100] calc_s[103] calc_s[27] calc_s[2] calc_s[103] calc_s[102] calc_s[102] calc_s[30] calc_s[17] calc_s[102] calc_s[103] calc_s[27] calc_s[4] calc_s[99] calc_s[2] calc_s[17] calc_s[23] calc_s[17] calc_s[4] calc_s[2] calc_s[99] calc_s[10] calc_s[17] calc_s[10] calc_s[4] calc_s[23] calc_s[24] calc_s[2] calc_s[24] calc_s[10] guess **130 **132 **133 guess **136 **137 calc_s[28] **139 calc_s[31] calc_s[30] guess **143 **144 calc_s[28] **146 calc_s[31] calc_s[30] s[78] s[78] s[100] s[79] s[63] s[74] s[63] s[78] s[102] - s[100] - s[100] s[79] s[60] s[74] s[78] - s[91] - s[78] s[62] s[75] - s[78] s[68] s[62] - s[78] s[77] - s[77] - s[65] s[77] s[77] s[78] s[68] s[103] - s[99] - s[62] - s[77] s[103] - s[77] s[103] - s[62] - s[99] - s[68] - s[77] - s[68] - s[79] - s[62] s[63] - s[68] - s[103] s[63] s[79] s[78] - s[63] s[79] s[78] - s[76] s[78] - s[72] - s[65] - s[63] s[79] s[78] - s[76] s[78] s[72] s[65] - s[63] - s[79] s[60] s[60] s[60] s[60] s[74] s[60] s[60] - s[103] - s[103] - s[103] guess calc_s[31] calc_s[103] calc_s[96] calc_s[27] calc_s[102] calc_s[4] calc_s[27] calc_s[2] calc_s[8] calc_s[3] calc_s[2] calc_s[8] calc_s[27] calc_s[102] calc_s[17] calc_s[23] calc_s[2] calc_s[2] calc_s[10] calc_s[17] calc_s[104] calc_s[2] calc_s[104] calc_s[10] calc_s[24] guess **128 **129 calc_s[28] **131 calc_s[31] calc_s[30] calc_s[28] **135 calc_s[31] calc_s[30] guess calc_s[30] guess calc_s[103] calc_s[28] **142 calc_s[31] calc_s[30] guess calc_s[30] guess calc_s[103] s[74] - s[63] s[63] s[78] s[60] s[74] s[79] s[100] s[79] s[103] s[63] s[79] - s[90] - s[72] s[78] s[62] s[68] s[77] s[64] s[68] s[65] - s[79] - s[64] - s[62] s[103] - s[68] - s[77] - s[77] s[60] s[62] - s[62] - s[68] - s[77] s[60] s[62] s[104] s[68] s[103] - s[63] s[79] s[78] - s[76] s[78] - s[72] - s[65] s[76] s[78] - s[72] - s[65] - s[79] s[65] - s[78] s[75] s[76] s[78] s[72] s[65] - s[79] - s[65] - s[78] s[75] s[103] s[103] s[79] s[60] - s[96] s[60] s[104] - s[100] s[60] s[100] guess calc_s[100] calc_s[27] calc_s[103] calc_s[102] calc_s[2] calc_s[23] calc_s[102] calc_s[19] calc_s[17] calc_s[23] calc_s[102] calc_s[2] calc_s[2] calc_s[4] calc_s[10] calc_s[24] calc_s[2] calc_s[4] calc_s[24] calc_s[28] **127 calc_s[31] calc_s[30] guess calc_s[30] guess calc_s[103] guess calc_s[30] guess calc_s[103] calc_s[31] calc_s[103] calc_s[30] calc_s[3] guess calc_s[30] guess calc_s[103] calc_s[31] calc_s[103] calc_s[30] calc_s[3] s[63] s[63] s[74] s[75] s[99] s[74] s[79] s[74] s[74] s[79] s[100] - s[100] s[79] s[103] - s[89] - s[75] - s[68] - s[78] - s[77] - s[65] s[60] s[77] - s[61] s[77] s[60] - s[77] s[65] s[62] s[60] s[68] s[103] - s[62] s[63] s[60] s[76] s[78] - s[72] - s[65] - s[79] s[65] - s[86] - s[75] - s[79] s[65] - s[78] s[75] s[72] - s[75] s[65] - s[64] - s[79] - s[65] - s[78] s[75] - s[72] - s[75] - s[65] - s[64] s[103] s[103] s[102] s[100] - s[100] s[60] s[60] s[63] s[103] - s[103] guess **60 calc_s[102] calc_s[27] calc_s[2] calc_s[19] calc_s[8] calc_s[20] calc_s[2] calc_s[2] calc_s[19] calc_s[4] calc_s[24] calc_s[10] guess calc_s[30] guess calc_s[103] calc_s[31] calc_s[103] guess calc_s[3] calc_s[31] calc_s[103] calc_s[30] calc_s[3] guess calc_s[3] calc_s[103] calc_s[99] calc_s[31] calc_s[103] calc_s[30] calc_s[3] guess calc_s[3] calc_s[103] calc_s[99] s[74] s[79] s[79] - s[63] s[74] s[74] - s[63] s[60] s[63] s[63] s[79] - s[88] s[93] - s[77] - s[68] s[65] - s[61] s[60] s[102] s[62] - s[65] s[61] s[60] s[60] s[68] - s[79] s[65] - s[78] - s[75] s[72] s[75] - s[78] s[64] s[72] - s[75] s[65] s[64] - s[78] - s[64] - s[75] - s[99] - s[72] - s[75] - s[65] s[64] - s[78] - s[64] - s[75] - s[99] s[103] s[103] s[103] - s[96] - s[96] s[103] - s[100] s[100] s[100] - s[100] guess calc_s[30] calc_s[2] calc_s[102] calc_s[19] calc_s[7] calc_s[4] calc_s[19] calc_s[20] calc_s[104] calc_s[31] calc_s[103] calc_s[30] calc_s[3] guess calc_s[3] calc_s[30] calc_s[99] guess calc_s[3] calc_s[103] calc_s[99] calc_s[30] calc_s[99] calc_s[3] calc_s[17] guess calc_s[3] calc_s[103] calc_s[99] calc_s[30] calc_s[99] calc_s[3] calc_s[17] s[79] - s[74] s[79] s[79] s[79] s[60] s[63] s[100] s[63] s[63] s[60] - s[87] s[65] - s[65] - s[77] s[61] s[102] s[74] s[61] s[102] s[104] s[72] s[75] s[65] - s[64] - s[78] s[64] s[65] s[99] - s[78] s[64] - s[75] - s[99] - s[65] - s[99] - s[64] s[77] - s[78] s[64] - s[75] - s[99] s[65] - s[99] - s[64] - s[77] s[103] s[60] s[103] s[103] s[60] s[103] - s[96] s[100] s[100] guess calc_s[103] calc_s[19] calc_s[8] calc_s[20] calc_s[7] guess calc_s[3] calc_s[103] calc_s[99] calc_s[30] calc_s[99] calc_s[103] calc_s[17] calc_s[30] calc_s[99] calc_s[3] calc_s[17] calc_s[103] calc_s[17] calc_s[99] calc_s[2] calc_s[30] calc_s[99] calc_s[3] calc_s[17] calc_s[103] calc_s[17] calc_s[99] calc_s[2] s[74] s[74] s[63] - s[63] s[96] s[79] s[99] s[63] s[60] s[60] - s[86] s[79] s[61] s[79] s[102] s[60] - s[78] - s[64] s[75] s[99] - s[65] s[99] s[75] s[77] - s[65] - s[99] s[64] - s[77] s[75] s[77] s[99] - s[62] s[65] - s[99] s[64] s[77] s[75] - s[77] s[99] s[62] s[103] s[102] s[103] s[103] s[100] s[103] s[100] s[96] s[60] s[100] s[99] s[100] Backtrack guess calc_s[7] calc_s[30] calc_s[99] calc_s[3] calc_s[17] calc_s[103] calc_s[17] calc_s[3] calc_s[2] calc_s[103] calc_s[17] calc_s[99] calc_s[2] calc_s[3] calc_s[2] calc_s[17] calc_s[4] calc_s[103] calc_s[17] calc_s[99] calc_s[2] calc_s[3] calc_s[2] calc_s[17] calc_s[100] s[63] s[96] s[102] - s[85] s[103] - s[65] s[99] - s[64] - s[77] - s[75] s[77] s[64] - s[62] s[75] - s[77] s[99] - s[62] - s[64] s[62] - s[77] s[74] s[75] s[77] s[99] s[62] - s[64] - s[62] s[77] - s[100] s[60] s[100] s[99] guess **64 **66 **67 calc_s[103] calc_s[17] calc_s[99] calc_s[2] calc_s[3] calc_s[2] calc_s[99] calc_s[4] calc_s[3] calc_s[2] calc_s[17] calc_s[4] calc_s[99] calc_s[100] calc_s[2] calc_s[3] calc_s[2] calc_s[17] calc_s[23] calc_s[99] calc_s[4] calc_s[2] calc_s[10] s[103] s[63] s[63] s[79] - s[84] s[79] s[74] s[65] - s[75] - s[77] - s[99] - s[62] s[64] s[62] - s[99] s[74] s[64] s[62] s[77] s[74] s[99] s[100] - s[62] s[64] - s[62] - s[77] s[103] s[99] s[103] s[62] - s[68] guess guess **65 calc_s[31] calc_s[30] calc_s[3] calc_s[2] calc_s[17] calc_s[4] calc_s[99] calc_s[23] calc_s[17] calc_s[99] calc_s[23] calc_s[2] calc_s[17] calc_s[10] calc_s[4] calc_s[99] calc_s[4] calc_s[2] calc_s[17] calc_s[23] calc_s[85] s[63] s[79] s[79] s[79] s[78] s[78] - s[83] - s[74] s[63] - s[72] - s[78] - s[64] s[62] s[77] s[103] - s[99] s[103] - s[77] s[99] s[63] - s[62] - s[77] s[68] s[74] s[99] s[63] s[62] s[77] s[103] - s[85] s[74] s[74] s[74] s[103] guess calc_s[31] calc_s[28] guess calc_s[99] calc_s[99] calc_s[100] calc_s[2] calc_s[17] calc_s[2] calc_s[17] calc_s[4] calc_s[2] calc_s[85] calc_s[17] calc_s[100] calc_s[2] calc_s[92] s[78] - s[82] s[72] - s[76] - s[65] - s[75] - s[99] s[100] - s[62] - s[77] - s[62] s[77] s[63] s[62] s[85] - s[77] - s[100] - s[62] - s[92] s[74] guess guess calc_s[100] calc_s[30] calc_s[100] calc_s[17] calc_s[10] calc_s[4] calc_s[2] calc_s[4] calc_s[2] calc_s[23] calc_s[25] calc_s[2] calc_s[10] calc_s[4] calc_s[18] s[78] s[78] s[78] s[78] - s[81] - s[63] - s[75] s[78] s[76] s[77] s[68] s[63] s[62] s[103] s[62] s[79] s[79] - s[62] s[68] s[79] - s[61] s[74] s[74] s[74] s[74] s[103] s[103] guess calc_s[28] calc_s[103] calc_s[99] calc_s[4] calc_s[2] calc_s[85] calc_s[100] calc_s[100] calc_s[4] calc_s[85] calc_s[93] s[78] s[79] - s[80] s[76] - s[78] - s[75] s[64] s[62] s[85] s[100] s[100] - s[85] s[93] s[63] s[103] guess calc_s[100] calc_s[99] calc_s[100] calc_s[28] calc_s[23] calc_s[25] calc_s[10] calc_s[10] calc_s[16] calc_s[104] s[78] s[79] s[79] s[63] s[78] - s[79] s[75] - s[65] s[76] - s[63] s[63] - s[68] - s[68] s[63] - s[104] s[74] s[74] s[103] s[103] s[103] guess **60 **62 **63 calc_s[103] calc_s[4] calc_s[4] calc_s[103] calc_s[85] calc_s[85] calc_s[83] - s[79] s[96] s[103] - s[78] s[78] s[63] s[65] s[78] s[64] - s[64] s[100] s[85] s[85] - s[83] s[99] s[60] guess **58 **59 guess **61 calc_s[28] calc_s[30] calc_s[99] calc_s[96] calc_s[28] calc_s[25] calc_s[25] calc_s[87] s[78] s[78] s[79] s[79] - s[77] s[77] s[74] - s[63] s[74] - s[76] s[72] - s[65] s[62] - s[63] s[74] s[74] s[87] s[103] s[63] guess **57 guess calc_s[31] calc_s[28] calc_s[31] guess calc_s[17] calc_s[4] calc_s[17] calc_s[10] calc_s[96] - s[76] s[76] - s[74] s[72] s[76] s[72] - s[65] s[77] s[64] s[77] - s[68] s[96] calc_s[28] calc_s[28] calc_s[31] calc_s[30] guess calc_s[103] calc_s[30] calc_s[2] calc_s[3] calc_s[2] calc_s[104] calc_s[102] s[63] s[74] s[74] - s[79] s[60] s[60] s[63] - s[63] - s[72] - s[65] - s[74] s[75] - s[72] - s[62] - s[79] s[96] s[77] - s[102] s[99] s[99] s[103] s[103] s[100] s[100] calc_s[17] calc_s[17] calc_s[30] calc_s[93] calc_s[31] calc_s[30] calc_s[17] calc_s[31] calc_s[3] calc_s[81] s[65] - s[74] s[60] - s[65] s[65] s[65] - s[63] - s[72] s[65] - s[77] s[74] - s[79] s[81] s[100] s[99] calc_s[30] calc_s[30] calc_s[93] calc_s[99] calc_s[103] calc_s[4] calc_s[2] calc_s[93] calc_s[97] s[79] s[85] s[60] s[93] s[96] s[72] - s[72] - s[63] s[75] - s[75] s[64] s[62] s[104] s[97] s[99] s[103] s[102] s[100] calc_s[93] calc_s[93] calc_s[17] calc_s[28] calc_s[30] calc_s[96] calc_s[31] calc_s[90] s[74] - s[77] s[79] s[74] s[74] s[78] s[76] - s[65] s[62] - s[74] - s[90] s[93] s[60] calc_s[2] calc_s[31] calc_s[103] calc_s[99] calc_s[80] calc_s[104] calc_s[98] s[78] s[77] s[79] s[74] s[78] s[63] s[60] s[79] s[103] s[99] - s[62] s[60] s[99] s[60] s[61] - s[64] - s[98] s[93] - s[78] s[93] s[102] s[102] s[79] s[100] s[100] s[103] calc_s[100] calc_s[93] calc_s[96] calc_s[82] - s[75] s[77] s[75] - s[82] calc_s[80] calc_s[17] calc_s[85] calc_s[88] s[65] s[63] - s[78] s[79] s[79] - s[78] s[85] - s[61] s[93] - s[63] - s[88] s[60] s[96] s[99] s[104] s[103] s[60] calc_s[102] calc_s[84] s[76] s[77] s[78] s[102] s[79] - s[84] s[100] s[60] Solution Found s[93] calc_s[101] - s[101] calc_s[80] s[80] calc_s[94] - s[94] First conﬂict calc_s[95] - s[95] calc_s[89] s[89] calc_s[91] - s[91] calc_s[86] - s[86] MODEL 6
• 7. CryptoMiniSat SAT solver that excels at cryptography General purpose: won SAT Race’10 6000 MiniSat 2.2 5000 lingeling PrecoSat465 4000 CryptoMiniSat SAT Comp’11 Time (s) 3000 2000 1000 0 80 100 120 140 160 180 200 220 240 No. solved instances from SAT Comp’09 Collaborative: GPL, mailing list, regular releases 7
• 8. Demo1 Generate HiTag2 problem: Grain-of-Salt tool2 Solve it using CryptoMiniSat3 Analyse results: ≈ 2 days to break 8
• 9. Conclusion SAT solvers are powerful tools to break weak cryptography CryptoMiniSat, a leading SAT solver, is waiting for your contribution Weak ciphers like HiTag2 should not be used in high-value applications 9