HES2011 - Mate Soos - Craking Industry Ciphers at a Whim
Upcoming SlideShare
Loading in...5
×

Like this? Share it with your network

Share
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Be the first to comment
    Be the first to like this
No Downloads

Views

Total Views
1,289
On Slideshare
1,285
From Embeds
4
Number of Embeds
2

Actions

Shares
Downloads
92
Comments
0
Likes
0

Embeds 4

https://twitter.com 3
http://a0.twimg.com 1

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
    No notes for slide

Transcript

  • 1. Breaking Industrial Ciphers at a Whim M ATE S OOS P RESENTATION AT HES’11
  • 2. Story line1 HiTag2: reverse-engineered proprietary cipher2 Analytic tools are needed to investigate them3 CryptoMiniSat: free software tool to test ciphers (and to break them) 2
  • 3. Philips HiTag2 Cipher For access control: cars, army buildings Proprietary: reverse-engineered by Karsten Nohl and Sean O’Neil Feedback linear(!), filter non-linear 3
  • 4. SAT SolversInput: CNF, an “and of or-s’ (x1 ∨ ¬x3 ) ∧ (¬x2 ∨ x3 ) ∧ (x1 ∨ x2 ) Crypto-problem needs conversionUses DPLL(ϕ) algorithm 1 If (formula ϕ trivial) return SAT/UNSAT 2 ret ← DPLL(ϕ with v ← true) 3 If (ret = SAT) return SAT 4 ret ← DPLL(ϕ with v ← false) 5 If (ret = SAT) return SAT 6 return UNSAT 4
  • 5. Toy Example (¬x1 ∨ ¬x2 ∨ x3 ) ∧ (¬x1 ∨ x2 ) ∧ (¬x1 ∨ ¬x2 ) Clause 1 Clause 2 Clause 31 Guess: x1 = True2 Clause 2: x2 = True3 Clause 3: impossible! Reverse guess.4 x1 = False5 Good, everything is satisfied! 5
  • 6. Example Search Tree BEGIN guess Start Guess - s[60] guess **115 **121 **123 **125 **126 - s[104] s[104] s[63] s[74] s[103] s[79] guess **99 **107 **111 **113 **114 guess **117 **119 **120 calc_s[28] **122 guess **124 guess **114 - s[103] s[103] s[79] s[74] s[63] s[78] - s[63] s[74] s[103] s[78] - s[76] s[103] - s[103] s[79] - s[79] s[78] guess **95 **97 **98 guess **103 **105 **106 guess **109 **110 calc_s[31] **112 calc_s[28] calc_s[30] calc_s[28] **116 guess **118 **113 calc_s[30] guess **111 **95 calc_s[31] **106 calc_s[31] - s[102] - s[100] s[63] s[79] - s[79] s[63] s[74] s[78] - s[74] s[63] s[78] - s[72] s[78] - s[76] - s[65] s[76] s[103] - s[103] s[79] - s[79] s[65] - s[74] - s[79] - s[100] - s[72] s[78] - s[72] guess **87 **91 **93 **94 **83 **96 calc_s[28] calc_s[31] guess **101 **102 calc_s[28] **104 calc_s[31] calc_s[30] calc_s[31] **108 calc_s[28] calc_s[30] guess calc_s[30] guess calc_s[103] guess **113 **95 calc_s[31] calc_s[31] calc_s[103] guess **105 **87 calc_s[100] calc_s[31] calc_s[30] s[74] until - s[101] s[100] s[79] s[63] s[74] s[74] s[79] - s[76] - s[72] - s[63] s[74] s[78] - s[76] s[78] s[72] s[65] s[72] s[78] - s[76] s[65] - s[63] - s[65] - s[78] s[75] - s[74] - s[79] - s[100] - s[72] s[72] - s[75] - s[103] s[60] s[102] s[75] s[72] - s[65] guess guess **89 **90 guess **92 calc_s[28] calc_s[31] **87 calc_s[31] guess calc_s[100] calc_s[28] **100 calc_s[31] calc_s[30] guess calc_s[30] guess calc_s[103] guess calc_s[30] guess calc_s[103] calc_s[28] calc_s[103] calc_s[30] calc_s[3] guess **101 **85 calc_s[100] guess calc_s[3] **95 guess calc_s[103] calc_s[30] calc_s[103] s[74] - s[100] - s[79] s[63] s[74] - s[63] s[74] - s[76] - s[72] s[102] - s[72] - s[79] s[75] s[76] s[75] s[72] s[65] - s[74] - s[65] - s[78] - s[75] - s[63] s[65] - s[78] - s[75] s[76] s[75] s[65] s[64] - s[79] s[63] s[102] - s[75] - s[78] - s[64] - s[100] - s[79] - s[78] s[65] s[75] s[60] guess **79 **83 **85 **86 guess **88 calc_s[28] calc_s[31] calc_s[28] calc_s[31] guess calc_s[100] guess calc_s[100] calc_s[31] calc_s[103] guess calc_s[100] guess calc_s[103] calc_s[31] calc_s[103] calc_s[30] calc_s[3] calc_s[28] calc_s[103] calc_s[30] calc_s[3] guess calc_s[3] calc_s[103] calc_s[99] **101 guess calc_s[103] calc_s[30] calc_s[99] **87 calc_s[31] calc_s[30] calc_s[103] calc_s[3] - s[99] s[99] s[74] s[63] s[79] - s[63] s[74] - s[76] s[72] s[76] - s[72] - s[74] - s[75] - s[63] - s[75] s[72] - s[78] - s[74] s[100] - s[78] - s[75] - s[72] s[75] - s[65] s[64] s[76] - s[75] - s[65] - s[64] - s[78] - s[64] - s[75] s[99] - s[103] - s[79] s[78] - s[65] s[99] s[102] s[72] s[65] - s[75] s[64] guess **72 **75 **77 **78 guess **81 **82 guess **84 calc_s[28] calc_s[31] calc_s[28] calc_s[31] guess calc_s[100] guess calc_s[100] calc_s[31] calc_s[103] calc_s[28] calc_s[103] calc_s[100] calc_s[30] calc_s[31] calc_s[103] calc_s[30] calc_s[3] guess calc_s[3] calc_s[103] calc_s[99] guess calc_s[3] calc_s[103] calc_s[99] calc_s[30] calc_s[99] calc_s[3] calc_s[17] calc_s[31] calc_s[31] calc_s[30] calc_s[103] calc_s[17] **83 calc_s[100] calc_s[3] calc_s[3] calc_s[99] s[103] - s[98] s[96] s[63] s[79] s[74] - s[74] s[63] s[79] - s[63] s[79] - s[76] - s[72] s[76] s[72] - s[74] s[75] - s[74] s[75] s[72] s[78] s[76] s[78] - s[75] s[65] - s[72] s[78] - s[65] - s[64] - s[78] - s[64] s[75] s[99] - s[78] s[64] s[75] - s[99] s[65] s[99] s[64] s[77] - s[72] s[72] - s[65] s[75] - s[77] s[74] - s[75] - s[64] s[64] s[99] s[60] guess guess **73 **74 calc_s[28] **76 guess **67 guess **80 calc_s[28] **78 calc_s[28] calc_s[31] guess calc_s[100] guess calc_s[100] calc_s[31] calc_s[103] calc_s[31] calc_s[103] calc_s[100] calc_s[30] guess calc_s[30] calc_s[103] calc_s[3] guess calc_s[30] calc_s[103] calc_s[99] calc_s[30] calc_s[99] calc_s[3] calc_s[17] calc_s[30] calc_s[99] calc_s[3] calc_s[17] calc_s[103] calc_s[17] calc_s[99] calc_s[2] **95 calc_s[100] calc_s[3] calc_s[3] calc_s[2] calc_s[103] calc_s[99] calc_s[99] calc_s[17] conflict - s[97] - s[63] s[74] s[79] - s[76] s[74] - s[74] s[65] - s[63] s[79] - s[76] - s[96] s[76] - s[72] - s[79] s[75] - s[74] - s[75] - s[72] s[78] s[72] - s[78] s[75] - s[65] - s[79] - s[65] - s[78] - s[64] - s[100] - s[65] s[75] s[99] s[65] - s[99] s[64] s[77] - s[65] - s[99] - s[64] - s[77] - s[75] - s[77] - s[99] s[62] - s[100] s[75] s[64] - s[64] - s[62] - s[78] s[99] s[99] s[77] guess calc_s[28] guess **67 guess calc_s[31] calc_s[31] calc_s[31] calc_s[28] calc_s[31] guess calc_s[31] guess calc_s[100] **77 calc_s[103] calc_s[31] calc_s[103] calc_s[100] calc_s[30] calc_s[100] calc_s[30] calc_s[103] calc_s[3] calc_s[31] calc_s[3] calc_s[30] calc_s[99] calc_s[100] calc_s[3] calc_s[3] calc_s[17] calc_s[103] calc_s[17] calc_s[99] calc_s[2] calc_s[103] calc_s[17] calc_s[99] calc_s[2] calc_s[3] calc_s[2] calc_s[17] calc_s[4] **85 calc_s[103] **67 calc_s[99] calc_s[23] calc_s[30] calc_s[17] calc_s[17] calc_s[2] s[104] s[63] - s[96] s[76] - s[79] s[65] - s[79] s[72] s[72] - s[72] s[76] s[72] - s[79] s[72] - s[79] - s[75] - s[96] - s[78] - s[72] - s[78] - s[75] s[65] - s[75] s[65] s[78] - s[64] s[72] s[64] - s[65] s[99] - s[75] s[64] - s[64] - s[77] - s[75] - s[77] - s[99] - s[62] s[75] s[77] s[99] - s[62] - s[64] s[62] - s[77] s[60] s[102] s[78] s[99] - s[99] s[60] - s[65] - s[77] s[77] s[62] guess **68 **70 **71 guess calc_s[31] calc_s[31] guess calc_s[100] calc_s[100] calc_s[100] guess calc_s[100] **76 calc_s[100] **74 calc_s[103] calc_s[31] calc_s[30] calc_s[100] calc_s[30] calc_s[103] calc_s[3] calc_s[103] calc_s[3] calc_s[30] calc_s[99] calc_s[100] **67 calc_s[3] calc_s[17] calc_s[103] calc_s[99] calc_s[99] calc_s[2] calc_s[3] calc_s[2] calc_s[17] calc_s[100] calc_s[3] calc_s[2] calc_s[17] calc_s[23] calc_s[99] calc_s[4] calc_s[2] **81 calc_s[30] calc_s[99] calc_s[17] calc_s[3] calc_s[2] calc_s[2] calc_s[4] s[74] s[63] s[103] s[103] - s[79] - s[79] s[74] - s[95] - s[79] s[63] s[74] - s[74] s[72] - s[72] - s[74] - s[75] - s[75] s[75] - s[79] s[75] - s[96] - s[75] - s[96] s[78] s[72] s[65] s[75] - s[65] s[78] - s[64] - s[78] s[64] s[65] - s[99] s[75] s[99] - s[64] - s[77] - s[78] - s[99] - s[99] - s[62] - s[64] s[62] - s[77] - s[100] s[64] - s[62] s[77] s[60] - s[99] s[60] s[62] s[60] s[65] s[63] s[77] - s[64] s[62] - s[62] s[60] s[60] - s[103] - s[103] s[63] guess guess **69 calc_s[28] calc_s[31] **65 calc_s[100] calc_s[100] calc_s[31] calc_s[96] calc_s[96] calc_s[30] calc_s[31] calc_s[103] **71 calc_s[96] calc_s[31] calc_s[30] calc_s[100] calc_s[3] calc_s[103] calc_s[3] calc_s[30] calc_s[99] calc_s[30] calc_s[99] calc_s[3] calc_s[17] calc_s[103] calc_s[99] calc_s[99] calc_s[2] calc_s[30] calc_s[17] calc_s[17] calc_s[23] calc_s[99] calc_s[4] calc_s[2] calc_s[10] calc_s[99] calc_s[100] calc_s[2] calc_s[17] calc_s[4] calc_s[3] calc_s[2] calc_s[99] calc_s[4] calc_s[100] s[79] s[74] s[74] s[63] s[63] s[79] s[78] s[103] s[79] - s[79] s[103] - s[94] - s[63] s[74] - s[76] s[72] - s[79] s[75] - s[75] - s[72] - s[62] - s[62] - s[78] - s[72] s[78] s[60] s[62] s[72] - s[65] - s[75] - s[64] - s[78] s[64] - s[65] - s[99] - s[65] s[99] s[64] s[77] s[78] s[60] s[99] s[62] s[65] s[77] s[77] s[60] s[99] s[60] - s[62] s[68] s[99] s[100] - s[62] s[77] s[60] s[64] - s[62] s[99] s[60] - s[100] node66 s[103] - s[63] s[100] s[104] s[104] - s[103] - s[103] guess calc_s[28] calc_s[31] guess calc_s[100] **69 calc_s[96] calc_s[30] calc_s[100] calc_s[103] calc_s[103] calc_s[99] calc_s[100] calc_s[30] calc_s[103] calc_s[100] calc_s[99] calc_s[96] calc_s[17] calc_s[30] calc_s[99] calc_s[3] calc_s[17] calc_s[3] calc_s[17] calc_s[99] calc_s[2] calc_s[30] calc_s[17] calc_s[4] calc_s[3] calc_s[2] calc_s[2] calc_s[17] calc_s[23] calc_s[104] calc_s[17] calc_s[10] calc_s[100] calc_s[2] calc_s[99] calc_s[100] calc_s[17] calc_s[10] learnt unit clause learnt unit clause s[74] s[99] s[63] s[78] s[63] s[100] s[100] s[103] - s[63] s[79] - s[93] s[76] s[72] - s[74] - s[75] s[60] - s[62] - s[78] s[75] - s[78] - s[78] s[60] - s[75] s[65] - s[78] s[75] s[103] s[62] - s[77] s[65] s[99] s[64] s[77] - s[64] s[77] s[99] s[62] s[65] - s[77] s[104] s[64] s[62] - s[62] s[77] s[60] s[104] - s[77] - s[68] s[100] s[62] - s[99] - s[100] - s[77] s[68] s[60] s[74] s[103] s[103] s[60] s[60] s[79] s[60] s[100] s[102] s[102] - s[103] s[99] guess guess calc_s[100] calc_s[31] calc_s[96] calc_s[103] calc_s[17] calc_s[96] calc_s[27] calc_s[27] calc_s[103] calc_s[3] calc_s[27] calc_s[96] calc_s[103] calc_s[2] calc_s[3] calc_s[17] calc_s[99] calc_s[2] calc_s[99] calc_s[2] calc_s[17] calc_s[4] calc_s[3] calc_s[2] calc_s[99] calc_s[4] calc_s[100] calc_s[2] calc_s[2] calc_s[24] calc_s[10] calc_s[4] calc_s[17] calc_s[10] calc_s[2] calc_s[24] guess **134 **138 **140 **141 guess **145 **147 **148 s[74] s[63] s[78] - s[100] s[63] s[74] s[63] s[79] - s[92] - s[74] s[75] - s[72] s[62] s[78] s[77] - s[62] - s[68] - s[68] s[78] - s[64] s[68] s[62] - s[78] s[62] - s[64] s[77] s[99] - s[62] - s[99] s[62] - s[77] s[103] s[64] - s[62] s[99] s[79] - s[100] s[62] - s[62] - s[79] s[68] - s[79] - s[77] - s[68] - s[62] s[60] - s[74] s[103] s[63] s[79] s[78] - s[103] s[63] s[79] s[78] s[60] s[60] s[60] s[60] - s[103] - s[103] - s[103] guess **61 calc_s[96] calc_s[100] calc_s[103] calc_s[27] calc_s[2] calc_s[103] calc_s[102] calc_s[102] calc_s[30] calc_s[17] calc_s[102] calc_s[103] calc_s[27] calc_s[4] calc_s[99] calc_s[2] calc_s[17] calc_s[23] calc_s[17] calc_s[4] calc_s[2] calc_s[99] calc_s[10] calc_s[17] calc_s[10] calc_s[4] calc_s[23] calc_s[24] calc_s[2] calc_s[24] calc_s[10] guess **130 **132 **133 guess **136 **137 calc_s[28] **139 calc_s[31] calc_s[30] guess **143 **144 calc_s[28] **146 calc_s[31] calc_s[30] s[78] s[78] s[100] s[79] s[63] s[74] s[63] s[78] s[102] - s[100] - s[100] s[79] s[60] s[74] s[78] - s[91] - s[78] s[62] s[75] - s[78] s[68] s[62] - s[78] s[77] - s[77] - s[65] s[77] s[77] s[78] s[68] s[103] - s[99] - s[62] - s[77] s[103] - s[77] s[103] - s[62] - s[99] - s[68] - s[77] - s[68] - s[79] - s[62] s[63] - s[68] - s[103] s[63] s[79] s[78] - s[63] s[79] s[78] - s[76] s[78] - s[72] - s[65] - s[63] s[79] s[78] - s[76] s[78] s[72] s[65] - s[63] - s[79] s[60] s[60] s[60] s[60] s[74] s[60] s[60] - s[103] - s[103] - s[103] guess calc_s[31] calc_s[103] calc_s[96] calc_s[27] calc_s[102] calc_s[4] calc_s[27] calc_s[2] calc_s[8] calc_s[3] calc_s[2] calc_s[8] calc_s[27] calc_s[102] calc_s[17] calc_s[23] calc_s[2] calc_s[2] calc_s[10] calc_s[17] calc_s[104] calc_s[2] calc_s[104] calc_s[10] calc_s[24] guess **128 **129 calc_s[28] **131 calc_s[31] calc_s[30] calc_s[28] **135 calc_s[31] calc_s[30] guess calc_s[30] guess calc_s[103] calc_s[28] **142 calc_s[31] calc_s[30] guess calc_s[30] guess calc_s[103] s[74] - s[63] s[63] s[78] s[60] s[74] s[79] s[100] s[79] s[103] s[63] s[79] - s[90] - s[72] s[78] s[62] s[68] s[77] s[64] s[68] s[65] - s[79] - s[64] - s[62] s[103] - s[68] - s[77] - s[77] s[60] s[62] - s[62] - s[68] - s[77] s[60] s[62] s[104] s[68] s[103] - s[63] s[79] s[78] - s[76] s[78] - s[72] - s[65] s[76] s[78] - s[72] - s[65] - s[79] s[65] - s[78] s[75] s[76] s[78] s[72] s[65] - s[79] - s[65] - s[78] s[75] s[103] s[103] s[79] s[60] - s[96] s[60] s[104] - s[100] s[60] s[100] guess calc_s[100] calc_s[27] calc_s[103] calc_s[102] calc_s[2] calc_s[23] calc_s[102] calc_s[19] calc_s[17] calc_s[23] calc_s[102] calc_s[2] calc_s[2] calc_s[4] calc_s[10] calc_s[24] calc_s[2] calc_s[4] calc_s[24] calc_s[28] **127 calc_s[31] calc_s[30] guess calc_s[30] guess calc_s[103] guess calc_s[30] guess calc_s[103] calc_s[31] calc_s[103] calc_s[30] calc_s[3] guess calc_s[30] guess calc_s[103] calc_s[31] calc_s[103] calc_s[30] calc_s[3] s[63] s[63] s[74] s[75] s[99] s[74] s[79] s[74] s[74] s[79] s[100] - s[100] s[79] s[103] - s[89] - s[75] - s[68] - s[78] - s[77] - s[65] s[60] s[77] - s[61] s[77] s[60] - s[77] s[65] s[62] s[60] s[68] s[103] - s[62] s[63] s[60] s[76] s[78] - s[72] - s[65] - s[79] s[65] - s[86] - s[75] - s[79] s[65] - s[78] s[75] s[72] - s[75] s[65] - s[64] - s[79] - s[65] - s[78] s[75] - s[72] - s[75] - s[65] - s[64] s[103] s[103] s[102] s[100] - s[100] s[60] s[60] s[63] s[103] - s[103] guess **60 calc_s[102] calc_s[27] calc_s[2] calc_s[19] calc_s[8] calc_s[20] calc_s[2] calc_s[2] calc_s[19] calc_s[4] calc_s[24] calc_s[10] guess calc_s[30] guess calc_s[103] calc_s[31] calc_s[103] guess calc_s[3] calc_s[31] calc_s[103] calc_s[30] calc_s[3] guess calc_s[3] calc_s[103] calc_s[99] calc_s[31] calc_s[103] calc_s[30] calc_s[3] guess calc_s[3] calc_s[103] calc_s[99] s[74] s[79] s[79] - s[63] s[74] s[74] - s[63] s[60] s[63] s[63] s[79] - s[88] s[93] - s[77] - s[68] s[65] - s[61] s[60] s[102] s[62] - s[65] s[61] s[60] s[60] s[68] - s[79] s[65] - s[78] - s[75] s[72] s[75] - s[78] s[64] s[72] - s[75] s[65] s[64] - s[78] - s[64] - s[75] - s[99] - s[72] - s[75] - s[65] s[64] - s[78] - s[64] - s[75] - s[99] s[103] s[103] s[103] - s[96] - s[96] s[103] - s[100] s[100] s[100] - s[100] guess calc_s[30] calc_s[2] calc_s[102] calc_s[19] calc_s[7] calc_s[4] calc_s[19] calc_s[20] calc_s[104] calc_s[31] calc_s[103] calc_s[30] calc_s[3] guess calc_s[3] calc_s[30] calc_s[99] guess calc_s[3] calc_s[103] calc_s[99] calc_s[30] calc_s[99] calc_s[3] calc_s[17] guess calc_s[3] calc_s[103] calc_s[99] calc_s[30] calc_s[99] calc_s[3] calc_s[17] s[79] - s[74] s[79] s[79] s[79] s[60] s[63] s[100] s[63] s[63] s[60] - s[87] s[65] - s[65] - s[77] s[61] s[102] s[74] s[61] s[102] s[104] s[72] s[75] s[65] - s[64] - s[78] s[64] s[65] s[99] - s[78] s[64] - s[75] - s[99] - s[65] - s[99] - s[64] s[77] - s[78] s[64] - s[75] - s[99] s[65] - s[99] - s[64] - s[77] s[103] s[60] s[103] s[103] s[60] s[103] - s[96] s[100] s[100] guess calc_s[103] calc_s[19] calc_s[8] calc_s[20] calc_s[7] guess calc_s[3] calc_s[103] calc_s[99] calc_s[30] calc_s[99] calc_s[103] calc_s[17] calc_s[30] calc_s[99] calc_s[3] calc_s[17] calc_s[103] calc_s[17] calc_s[99] calc_s[2] calc_s[30] calc_s[99] calc_s[3] calc_s[17] calc_s[103] calc_s[17] calc_s[99] calc_s[2] s[74] s[74] s[63] - s[63] s[96] s[79] s[99] s[63] s[60] s[60] - s[86] s[79] s[61] s[79] s[102] s[60] - s[78] - s[64] s[75] s[99] - s[65] s[99] s[75] s[77] - s[65] - s[99] s[64] - s[77] s[75] s[77] s[99] - s[62] s[65] - s[99] s[64] s[77] s[75] - s[77] s[99] s[62] s[103] s[102] s[103] s[103] s[100] s[103] s[100] s[96] s[60] s[100] s[99] s[100] Backtrack guess calc_s[7] calc_s[30] calc_s[99] calc_s[3] calc_s[17] calc_s[103] calc_s[17] calc_s[3] calc_s[2] calc_s[103] calc_s[17] calc_s[99] calc_s[2] calc_s[3] calc_s[2] calc_s[17] calc_s[4] calc_s[103] calc_s[17] calc_s[99] calc_s[2] calc_s[3] calc_s[2] calc_s[17] calc_s[100] s[63] s[96] s[102] - s[85] s[103] - s[65] s[99] - s[64] - s[77] - s[75] s[77] s[64] - s[62] s[75] - s[77] s[99] - s[62] - s[64] s[62] - s[77] s[74] s[75] s[77] s[99] s[62] - s[64] - s[62] s[77] - s[100] s[60] s[100] s[99] guess **64 **66 **67 calc_s[103] calc_s[17] calc_s[99] calc_s[2] calc_s[3] calc_s[2] calc_s[99] calc_s[4] calc_s[3] calc_s[2] calc_s[17] calc_s[4] calc_s[99] calc_s[100] calc_s[2] calc_s[3] calc_s[2] calc_s[17] calc_s[23] calc_s[99] calc_s[4] calc_s[2] calc_s[10] s[103] s[63] s[63] s[79] - s[84] s[79] s[74] s[65] - s[75] - s[77] - s[99] - s[62] s[64] s[62] - s[99] s[74] s[64] s[62] s[77] s[74] s[99] s[100] - s[62] s[64] - s[62] - s[77] s[103] s[99] s[103] s[62] - s[68] guess guess **65 calc_s[31] calc_s[30] calc_s[3] calc_s[2] calc_s[17] calc_s[4] calc_s[99] calc_s[23] calc_s[17] calc_s[99] calc_s[23] calc_s[2] calc_s[17] calc_s[10] calc_s[4] calc_s[99] calc_s[4] calc_s[2] calc_s[17] calc_s[23] calc_s[85] s[63] s[79] s[79] s[79] s[78] s[78] - s[83] - s[74] s[63] - s[72] - s[78] - s[64] s[62] s[77] s[103] - s[99] s[103] - s[77] s[99] s[63] - s[62] - s[77] s[68] s[74] s[99] s[63] s[62] s[77] s[103] - s[85] s[74] s[74] s[74] s[103] guess calc_s[31] calc_s[28] guess calc_s[99] calc_s[99] calc_s[100] calc_s[2] calc_s[17] calc_s[2] calc_s[17] calc_s[4] calc_s[2] calc_s[85] calc_s[17] calc_s[100] calc_s[2] calc_s[92] s[78] - s[82] s[72] - s[76] - s[65] - s[75] - s[99] s[100] - s[62] - s[77] - s[62] s[77] s[63] s[62] s[85] - s[77] - s[100] - s[62] - s[92] s[74] guess guess calc_s[100] calc_s[30] calc_s[100] calc_s[17] calc_s[10] calc_s[4] calc_s[2] calc_s[4] calc_s[2] calc_s[23] calc_s[25] calc_s[2] calc_s[10] calc_s[4] calc_s[18] s[78] s[78] s[78] s[78] - s[81] - s[63] - s[75] s[78] s[76] s[77] s[68] s[63] s[62] s[103] s[62] s[79] s[79] - s[62] s[68] s[79] - s[61] s[74] s[74] s[74] s[74] s[103] s[103] guess calc_s[28] calc_s[103] calc_s[99] calc_s[4] calc_s[2] calc_s[85] calc_s[100] calc_s[100] calc_s[4] calc_s[85] calc_s[93] s[78] s[79] - s[80] s[76] - s[78] - s[75] s[64] s[62] s[85] s[100] s[100] - s[85] s[93] s[63] s[103] guess calc_s[100] calc_s[99] calc_s[100] calc_s[28] calc_s[23] calc_s[25] calc_s[10] calc_s[10] calc_s[16] calc_s[104] s[78] s[79] s[79] s[63] s[78] - s[79] s[75] - s[65] s[76] - s[63] s[63] - s[68] - s[68] s[63] - s[104] s[74] s[74] s[103] s[103] s[103] guess **60 **62 **63 calc_s[103] calc_s[4] calc_s[4] calc_s[103] calc_s[85] calc_s[85] calc_s[83] - s[79] s[96] s[103] - s[78] s[78] s[63] s[65] s[78] s[64] - s[64] s[100] s[85] s[85] - s[83] s[99] s[60] guess **58 **59 guess **61 calc_s[28] calc_s[30] calc_s[99] calc_s[96] calc_s[28] calc_s[25] calc_s[25] calc_s[87] s[78] s[78] s[79] s[79] - s[77] s[77] s[74] - s[63] s[74] - s[76] s[72] - s[65] s[62] - s[63] s[74] s[74] s[87] s[103] s[63] guess **57 guess calc_s[31] calc_s[28] calc_s[31] guess calc_s[17] calc_s[4] calc_s[17] calc_s[10] calc_s[96] - s[76] s[76] - s[74] s[72] s[76] s[72] - s[65] s[77] s[64] s[77] - s[68] s[96] calc_s[28] calc_s[28] calc_s[31] calc_s[30] guess calc_s[103] calc_s[30] calc_s[2] calc_s[3] calc_s[2] calc_s[104] calc_s[102] s[63] s[74] s[74] - s[79] s[60] s[60] s[63] - s[63] - s[72] - s[65] - s[74] s[75] - s[72] - s[62] - s[79] s[96] s[77] - s[102] s[99] s[99] s[103] s[103] s[100] s[100] calc_s[17] calc_s[17] calc_s[30] calc_s[93] calc_s[31] calc_s[30] calc_s[17] calc_s[31] calc_s[3] calc_s[81] s[65] - s[74] s[60] - s[65] s[65] s[65] - s[63] - s[72] s[65] - s[77] s[74] - s[79] s[81] s[100] s[99] calc_s[30] calc_s[30] calc_s[93] calc_s[99] calc_s[103] calc_s[4] calc_s[2] calc_s[93] calc_s[97] s[79] s[85] s[60] s[93] s[96] s[72] - s[72] - s[63] s[75] - s[75] s[64] s[62] s[104] s[97] s[99] s[103] s[102] s[100] calc_s[93] calc_s[93] calc_s[17] calc_s[28] calc_s[30] calc_s[96] calc_s[31] calc_s[90] s[74] - s[77] s[79] s[74] s[74] s[78] s[76] - s[65] s[62] - s[74] - s[90] s[93] s[60] calc_s[2] calc_s[31] calc_s[103] calc_s[99] calc_s[80] calc_s[104] calc_s[98] s[78] s[77] s[79] s[74] s[78] s[63] s[60] s[79] s[103] s[99] - s[62] s[60] s[99] s[60] s[61] - s[64] - s[98] s[93] - s[78] s[93] s[102] s[102] s[79] s[100] s[100] s[103] calc_s[100] calc_s[93] calc_s[96] calc_s[82] - s[75] s[77] s[75] - s[82] calc_s[80] calc_s[17] calc_s[85] calc_s[88] s[65] s[63] - s[78] s[79] s[79] - s[78] s[85] - s[61] s[93] - s[63] - s[88] s[60] s[96] s[99] s[104] s[103] s[60] calc_s[102] calc_s[84] s[76] s[77] s[78] s[102] s[79] - s[84] s[100] s[60] Solution Found s[93] calc_s[101] - s[101] calc_s[80] s[80] calc_s[94] - s[94] First conflict calc_s[95] - s[95] calc_s[89] s[89] calc_s[91] - s[91] calc_s[86] - s[86] MODEL 6
  • 7. CryptoMiniSat SAT solver that excels at cryptography General purpose: won SAT Race’10 6000 MiniSat 2.2 5000 lingeling PrecoSat465 4000 CryptoMiniSat SAT Comp’11 Time (s) 3000 2000 1000 0 80 100 120 140 160 180 200 220 240 No. solved instances from SAT Comp’09 Collaborative: GPL, mailing list, regular releases 7
  • 8. Demo1 Generate HiTag2 problem: Grain-of-Salt tool2 Solve it using CryptoMiniSat3 Analyse results: ≈ 2 days to break 8
  • 9. Conclusion SAT solvers are powerful tools to break weak cryptography CryptoMiniSat, a leading SAT solver, is waiting for your contribution Weak ciphers like HiTag2 should not be used in high-value applications 9