Search Space Reduction of Asynchrony Immune Cellular Automata by Center Permutivity
Luca Mariot, Luca Manzoni, Alberto Dennunzio
TL;DR
This paper investigates conditions for asynchrony immunity in cellular automata, focusing on center permutivity, and uses theoretical insights to efficiently identify immune CA rules with small neighborhoods.
Contribution
It establishes necessary conditions for asynchrony immunity, especially center permutivity, and employs these to significantly reduce the search space for immune CA rules.
Findings
Center permutivity is necessary for asynchrony immunity.
Theoretical conditions enable efficient exhaustive search.
Identified all immune CA rules with neighborhood size up to 5.
Abstract
We continue the study of asynchrony immunity in cellular automata (CA), which can be considered as a weaker version of correlation immunity in the context of vectorial Boolean functions. The property could have applications as a countermeasure for side-channel attacks in CA-based cryptographic primitives, such as S-boxes and pseudorandom number generators. We first give some theoretical results on the necessary conditions that a CA rule must satisfy in order to meet asynchrony immunity, the most important one being center permutivity. Next, we perform an exhaustive search of all asynchrony immune CA rules of neighborhood size up to , leveraging on the discovered theoretical properties to greatly reduce the size of the search space.
| Rule | Rule | ||||
|---|---|---|---|---|---|
| 13107 | 0 | 14028 | 2 | ||
| 13116 | 4 | 14643 | 2 | ||
| 13155 | 2 | 14796 | 2 | ||
| 13164 | 2 | 15411 | 4 | ||
| 13203 | 2 | 15420 | 0 | ||
| 13212 | 2 | 15555 | 0 | ||
| 13251 | 4 | 15564 | 4 | ||
| 13260 | 0 | 26214 | 0 | ||
| 13875 | 2 | 26265 | 0 |
| Rule | Rule | ||||
|---|---|---|---|---|---|
| 252691440 | 4 | 3031741620 | 8 | ||
| 252702960 | 0 | 3035673780 | 6 | ||
| 253678110 | 10 | 3537031890 | 8 | ||
| 255652080 | 4 | 3537035730 | 8 | ||
| 264499440 | 4 | 3539005680 | 2 | ||
| 267390960 | 0 | 4027576500 | 6 | ||
| 267448560 | 8 | 4030525680 | 4 | ||
| 505290270 | 8 | 4031508720 | 6 | ||
| 505336350 | 8 | 4038390000 | 2 | ||
| 509222490 | 4 | 4039373040 | 4 | ||
| 517136850 | 12 | 4040348370 | 6 | ||
| 756994590 | 12 | 4042268400 | 6 | ||
| 2018211960 | 8 | 4042276080 | 4 | ||
| 2018212080 | 10 | 4042310640 | 4 | ||
| 2526451350 | 0 | 4042318320 | 2 | ||
| 3023877300 | 6 | 4042322160 | 0 | ||
| 3027809460 | 8 | ||||
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsCoding theory and cryptography · Cellular Automata and Applications · Cryptographic Implementations and Security
Search Space Reduction of Asynchrony Immune Cellular Automata by Center Permutivity
Luca Mariot
Dipartimento di Informatica, Sistemistica e Comunicazione, Università degli Studi di Milano-Bicocca, Viale Sarca 336, 20126 Milano, Italy
{luca.mariot, alberto.dennunzio}@unimib.it
Luca Manzoni
Dipartimento di Matematica e Geoscienze, Università degli Studi di Trieste, Via Valerio 12/1, 34127 Trieste, Italy
Alberto Dennunzio
Dipartimento di Informatica, Sistemistica e Comunicazione, Università degli Studi di Milano-Bicocca, Viale Sarca 336, 20126 Milano, Italy
{luca.mariot, alberto.dennunzio}@unimib.it
Abstract
We continue the study of asynchrony immunity in cellular automata (CA), which can be considered as a generalization of correlation immunity in the case of vectorial Boolean functions. The property could have applications as a countermeasure for side-channel attacks in CA-based cryptographic primitives, such as S-boxes and pseudorandom number generators. We first give some theoretical results on the properties that a CA rule must satisfy in order to meet asynchrony immunity, like central permutivity. Next, we perform an exhaustive search of all asynchrony immune CA rules of neighborhood size up to , leveraging on the discovered theoretical properties to greatly reduce the size of the search space.
**Keywords ** cellular automata, cryptography, asynchrony immunity, correlation immunity, nonlinearity, side-channel attacks, permutivity
1 Introduction
In the last years, research about cryptographic applications of cellular automata (CA) focused on the properties of the underlying local rules [14, 10, 8]. In fact, designing a CA-based cryptographic primitive using local rules that are not highly nonlinear and correlation immune could make certain attacks more efficient.
The aim of this paper is to investigate a new property related to asynchronous CA called asynchrony immunity (AI), which could be of interest in the context of side-channel attacks. This property can be described by a three-move game between a user and an adversary. Let , and . The game works as follows:
The user chooses a local rule of memory and anticipation . 2. 2.
The adversary chooses cells of the CA in the range . 3. 3.
The user evaluates the output distribution of the CA and the distribution of the asynchronous CA where the cells selected by the adversary are not updated. 4. 4.
Outcome: if both and equals the uniform distribution, the user wins. Otherwise, the adversary wins.
A cellular automaton rule is called –asynchrony immune if, for every subset of at most cells both the asynchronous CA resulting from not updating on the subset of cells and the corresponding synchronous CA are balanced, that is, the cardinality of the counterimage of each -bit configuration equals . Thus, asynchrony immune CA rules represent the winning strategies of the user in the game described above.
Notice the difference between the asynchrony immunity game and the -resilient functions game [5]: in the latter, generic vectorial Boolean functions are considered instead of cellular automata, and the adversary selects both values and positions of the input variables.
The side-channel attack model motivating our work is the following. Suppose that a CA of length is used as an S-box in a block cipher, and that an attacker is able to inject clock faults by making cells not updating. If the CA is not -AI, then the attacker could gain some information on the internal state of the cipher by analyzing the differences of the output distributions in the original CA and the asynchronous CA. Similar fault attacks have already been investigated on stream ciphers based on clock-controlled Linear Feedback Shift Registers (LFSR), such as LILI-128 [7]. For further information on the topic, Hoch and Shamir [9] provide more references on clock fault attacks on stream ciphers.
This paper is an extended version of [12]. In particular, the new contribution is twofold: from the theoretical side, we formally prove the necessity of central permutivity to have asynchrony immunity, which was conjectured in [12] according to the experimental results reported there. From the empirical point of view, we employ this new theoretical result to consistently extend the experimental search of asynchrony immune rules, by considering larger neighborhood sizes.
In the remainder of this paper, we recall in Section 2 the necessary basic notions about Boolean functions and (asynchronous) CA, and we formally introduce the definition of asynchrony immunity in Section 3, giving some theoretical results regarding this property. In particular, we show that AI is invariant under the operations of reflection and complement and that, for high enough values of (the maximum number of blocked cells), central permutivity is a necessary condition for asynchrony immunity. We then perform in Section 4 an exhaustive search of asynchrony immune CA having output cells and neighborhood size up to , computing also their nonlinearity and algebraic normal form. Finally, we provide some possible ways to generalize the notion of asynchrony immunity and how this property can be linked to existing CA models in Section 5, as well as pointing out other avenues for future research on the subject.
2 Basic Notions
In this section, we cover all necessary background definitions about one-dimensional CA, Boolean functions, and vectorial Boolean functions. In particular, we refer the reader to [2, 3] for an in-depth discussion of (vectorial) Boolean functions.
Recall that a Boolean function is a mapping , where denotes the finite field of two elements. Once an ordering of the -bit input vectors has been fixed, each Boolean function can be uniquely represented by the output column of its truth table, which is a vector of binary elements. Therefore, the set of all possible Boolean functions of variables, denoted by , has cardinality . The interpretation of the vector as a decimal number is also called the Wolfram code of the function . Another common way of representing a Boolean function is through its Algebraic Normal Form (ANF), that is, as a sum of products over its input variables. More formally, given and , the ANF will be of the form
[TABLE]
where is the initial segment of the natural numbers determined by , i.e., , and the set is a subset of indices and thus an element of , the power set of . For all the coefficient is determined through the Möbius transform [2]. A function is called affine if the only non null coefficients are such that . In other words, the ANF is composed only of monomials of degree at most .
Boolean functions used in the design of symmetric ciphers must satisfy a certain number of properties in order to withstand particular cryptanalytic attacks. Two of the most important properties are balancedness and nonlinearity. A Boolean function is balanced if its output vector is composed of an equal number of zeros and ones. Unbalanced Boolean functions produce a statistical bias in the output of a symmetric cipher, which can be exploited by an attacker.
The nonlinearity of , on the other hand, is the minimum Hamming distance of from the set of all affine functions. The value of nonlinearity of can be computed as , where is the maximum absolute value of the Walsh transform of [2]. The nonlinearity of a Boolean function used in a cipher should be as high as possible, in order to thwart linear cryptanalysis attacks. Nonetheless, there exist upper bounds on the nonlinearity achievable by a Boolean function with respect to the number of its input variables. In particular, for even it holds that . Functions satisfying this bound with equality are called bent. On the other hand, for odd the upper bound when is , which is achieved by quadratic functions. For , the exact bound is still not known.
Let . A vectorial Boolean function of input variables and output variables (also called an -function) is a mapping . In particular, a -function is defined by Boolean functions of the form , called coordinate functions. Each , each specifies the -th output bit of . That is, for each , we have for .
A one-dimensional cellular automaton (CA) can be seen as a particular case of vectorial Boolean function by limiting the way the coordinate functions can be defined. Let be non-negative integers and let . Let be a Boolean function of variables. A cellular automaton of length with local rule , memory and anticipation is the -function defined for all and for all as:
[TABLE]
Thus, a CA is the special case of a vector Boolean function where all coordinate functions are defined uniformly.
A -asynchronous CA, or -ACA, induced by is denoted by and it is defined by the following global function :
[TABLE]
We also recall that a local rule is said to be center permutive when for each , , and there exists a unique such that . In the field , center permutivity can also be expressed in another way. A local rule is center permutive if there exists a function such that for all we have that:
[TABLE]
3 Definition of Asynchrony Immunity
Recall that a CA with is said to be balanced if for each , the preimages of , i.e., all such that , denoted by is such that . Asynchrony immune CA can then be defined as follows:
Definition 1**.**
Let be non-negative integers, with , and a balanced CA having local rule .
The CA is said to be -asynchrony immune (for short, -AI) if for all sets with the resulting -ACA is balanced.
Among all possible rules of memory and anticipation , we are interested in finding local rules that generates asynchrony immune CA satisfying additional useful cryptographic properties, such as high nonlinearity. As a consequence, proving necessary conditions for a rule to generate a -AI is useful in reducing the size of the search space.
We start by proving that, for large enough CA and for high enough values of , a necessary condition of is central permutivity.
Theorem 1**.**
Let be a -AI CA with memory and anticipation . If and then the local rule is center permutive.
Proof.
Suppose to be -AI with and as in the hypothesis. Let be a configuration with , , , and . Let the set be a set of indices to be blocked. It then follows that each preimage of can be expressed in the form with , , and . Notice that both and remain unchanged when applying to , since their indices are all contained in . This situation is illustrated in Fig. 1.
Since the value of the cells in cannot influence any cell in (since all cells that can be influenced are blocked), if is a preimage of , also for every is a preimage of . Hence, the first cells of the automaton contribute a multiplicative factor of for the number of preimages.
We are now going to prove that the remaining factor of for the number of preimages is entirely due to the last cells (i.e., the part denoted by ).
For the sake of argument, suppose that the multiplicative factor contributed by the last cells (i.e., the part denoted by in the preimages) is less than , since only a single other cell in the preimage can change (the one denoted by ), it follows that, in that case the following two configurations are preimages of for some choice of :
[TABLE]
Notice that the value of in is either [math] or and it is influenced only by its own value and the value of and . Without loss of generality, suppose that . Consider now the preimages of . To obtain in the unblocked position between and then, it must be or , but by our previous assumption, both and are equal to [math], and has no preimages. Hence, our hypothesis that the part denote by in the preimages contributes less than a factor of in the number or preimages is inconsistent with the fact that must be balanced.
Therefore, the parts and contribute, respectively, factors and in the number of preimages, for a total of preimages. It follows that, for each , , and there should be only one value such that . This means that is center permutive. ∎
The previous theorem can be generalized as follows:
Theorem 2**.**
Let be a -AI CA with memory and anticipation and be a non-negative integer. Then, if and , the function , which, for each and , is defined as where is a CA with the same local rule as , is a bijection.
Proof.
The proof of this theorem follows the same reasoning of the proof of Theorem 1. Let be a set of indices to be blocked such that . Each element of can then be rewritten in the form with , , , and . Similarly, a preimage of can be expressed in the form with , , and . Following the same reasoning of the proof of Theorem 1, it can be shown that the part of the preimage contributes a factor in the number of preimages and that the part contributes a factor of . Hence, the part denoted by in can have only one preimage. Therefore, when restricted to the cells “surrounded” by and , the global function of the CA is a bijection, as desired. ∎
Recall that the reverse of a vector is the vector with all components of appearing in reverse order. Also, the complement of is the vector where all components of appear negated. Given a local rule it is possible to define its reverse as and its complement as for all . The definition of reverse and complement can also be extended to a CA in the following way:
[TABLE]
We can now show that, for a given -AI CA it is possible to obtain other (not necessarily distinct) -AI by taking either its reverse or its complement.
Proposition 1**.**
Let be a -AI CA for some with and . Then its reverse is also a -AI CA.
Proof.
Starting with the reverse CA, by definition is . Hence, given a set of indices with , the reflection of the -ACA is:
[TABLE]
Where is defined as a “reverse” of the set of indices, that is . Notice that in all cases only if . This means that for every set of indices for , the corresponding set of indices in is still a valid one (i.e., a subset of ). Notice that since generates a -AI CA and , the resulting ACA is still -AI. ∎
Notice that, in general, if a -AI CA has memory and anticipation with , its reverse might not be a -AI CA. In fact, since center permutivity of the local rule is not preserved, this negates a condition for asynchrony-immunity that, by Theorem 1, is necessary for large enough values of and .
Proposition 2**.**
Let be a -AI CA for some . Then its complement is also a -AI CA.
Proof.
Let be a configuration, with , and let be the set of preimages of under the function . By definition, for each , . Hence, the set is , which is which corresponds to . Since is a -AI CA, and all ranges across all elements of (and thus does the same), is balanced and is also balanced. Since this holds for every set of cardinality at most , it follows that is also a -AI CA, as required. ∎
Upper bounds on the size of the search space could be derived using techniques from [4] w.r.t. to the set of transformations , where is the identity transformation.
4 Search of AI Rules up to Variables
In order to search for asynchrony immune rules having additional cryptographic properties, by Theorem 1 and Propositions 1 and 2 we only need to explore center-permutive rules under the equivalence classes induced by reflection and complement.
In our experiments, we fixed the number of output bits in the CA to . Since we are considering only center-permutive rules, we tested only the smallest value of satisfying the hypothesis of Theorem 1. The reason why we limited our analysis to these particular values is twofold. First, checking for asynchrony immunity is a computationally cumbersome task, since it requires to determine the output distribution of the -ACA for all possible choices of at most blocked cells. Second, the sizes of vectorial Boolean functions employed as nonlinear components in several real-world cryptographic primitives is limited. A concrete example is given by AES [15], which employs a S-box with output bits.
Table 1 shows all CA parameters considered in our experiments from to input variables of the local rules, while keeping the value of output bits fixed to . Recall that, since we need to consider only center permutive local rules, we do not need to explore the entire space, but only the subset having cardinality .
We started our investigation by performing an exhaustive search among all CA rules with (that is, rules of variables), which are also known in the CA literature as elementary rules. Up to reflection and complement, and neglecting the identity rule that is trivially AI for every length and order , out of the elementary rules we found that only rule 60 is –asynchrony immune. However, rule is not interesting from the cryptographic standpoint, since it is linear (its ANF being ).
We thus extended the search by considering all local rules of and input variables, according to the values of and reported in Table 1.
For the case of variables, the search returned a total of rules satisfying –asynchrony immunity, among which several of them were nonlinear. Table 2 reports the Wolfram codes of the discovered rules, along with their nonlinearity values and algebraic normal form. It can be observed that rules out of are nonlinear, but none of them is a bent function (since the nonlinearity value in this case would be ).
For variables, Table 3 reports the list of -AI CA. One can see that in this case most of the asynchrony immune functions are nonlinear, and moreover two of them achieve the maximum nonlinearity allowed by the quadratic bound, which in this case is .
5 Open Problems
There are many possible research directions for exploring asynchrony immune CA, mainly related to generalizations and relations with other models.
From the generalization point of view, we can relax the assumption that an attacker can control the updating of at most cells on cells CA. We can suppose that additional “anti-tamper” measures are present and, for example, that the attacker can only take control of non-consecutive cells. More in general, we can define -asynchrony immune CA where is a family of subsets of . The standard -AI CA can be recovered by taking as the set of all subsets of with cardinality at most . It would be interesting to understand for what families of sets the theorems of this paper still hold. Also, what are some families that are “plausible” from a real-world point of view? This study will also require to explore the different methods that can be employed by an attacker to take control of some cells and what physical limits restrict the patterns of blocked cells that can be generated.
Another research direction is to find relations with already existing CA models that can be used to implement AI CA. Take, for example, the Multiple Updating Cycles CA (MUCCA) [11], where each cell has a speed for a positive and a cell updates only if the current time step is a multiple of . This means that, at different time steps, different cells might be active. If the current time step is not known or if it is under the attacker’s control, then a CA that is -AI can withstand any situation in which the number of “slow” cells (i.e., with speed less than ) is bounded by . More generally, in what other models of ACA being asynchrony immune can protect from an attacker that controls some variables (like the time step in MUCCA)?
Subsequently, we have found that for size there are no -AI CA rules reaching maximum nonlinearity, that is, none of them is a bent function. Hence, an interesting question would be if there exists at least one bent AI CA rule of larger number of variables, and if it is possible to design an infinite family of bent AI CA.
Finally, from the cryptanalysis point of view, it would be interesting to analyze the resistance to clock-fault attacks of cryptographic primitives and ciphers based on cellular automata, such as the stream cipher CAR30 [6], the S-box employed in the Keccak sponge construction [1], or the CA-based S-boxes optimized through Genetic Programming in [16, 13] and to verify if plugging in their design one of the AI CA rules found here decreases their possible vulnerability.
The reference list from the paper itself. Each links out to its DOI / PubMed record.
- 1[1] Bertoni, G., Daemen, J., Peeters, M., Van Assche, G., Van Keer, R.: The keccak reference (2008). URL http://keccak.team
- 2[2] Carlet, C.: Boolean functions for cryptography and error correcting codes. Boolean models and methods in mathematics, computer science, and engineering 2 , 257–397 (2010)
- 3[3] Carlet, C.: Vectorial Boolean functions for cryptography. Boolean models and methods in mathematics, computer science, and engineering 134 , 398–469 (2010)
- 4[4] Cattaneo, G., Formenti, E., Margara, L., Mauri, G.: Transformations of the one-dimensional cellular automata rule space. Parallel Computing 23 (11), 1593 – 1611 (1997)
- 5[5] Chor, B., Goldreich, O., Hasted, J., Freidmann, J., Rudich, S., Smolensky, R.: The bit extraction problem or t-resilient functions. In: Foundations of Computer Science, 26th Annual Symposium on, pp. 396–407. IEEE (1985)
- 6[6] Das, S., Chowdhury, D.R.: CAR 30: A new scalable stream cipher with rule 30. Cryptography and Communications 5 (2), 137–162 (2013)
- 7[7] Dawson, E., Clark, A., Golic, J., Millan, W., Penna, L., Simpson, L.: The lili-128 keystream generator. In: Proceedings of first NESSIE Workshop (2000)
- 8[8] Formenti, E., Imai, K., Martin, B., Yunès, J.B.: Advances on random sequence generation by uniform cellular automata. In: Computing with New Resources, pp. 56–70. Springer (2014)