METHOD FOR DETERMINING A CRYPTOGRAPHIC KEY, COMPUTER PROGRAM, AND DATA PROCESSING SYSTEM

Abstract

A method for determining a cryptographic key is carried out in a data processing system, and comprises: providing a plaintext and a ciphertext determined from the plaintext using a cryptographic key and a cryptographic procedure which comprises cryptographic operations; for each cryptographic operation of the cryptographic procedure, providing at least one intermediate relation which comprises an intermediate equation and/or an intermediate inequality; determining an optimization problem comprising: the plaintext and the ciphertext; at least one optimization expression assigned to a round of the cryptographic procedure; and optimization variables comprising state variables of the cryptographic procedure and a cryptographic key variable; wherein the at least one optimization expression is determined from the at least one intermediate relation and comprises at least one preceding state variable assigned to a preceding round. The method further comprises: solving the optimization problem and determining the cryptographic key from an optimizing value of the cryptographic key variable.

Description

TECHNICAL FIELD

The present disclosure relates to techniques for determining a cryptographic key, in particular on a quantum computer, such as a quantum annealing device.

BACKGROUND

In symmetric-key cryptography algorithms, the same cryptographic key is used for both encrypting input data (plaintext) to encrypted data (ciphertext), and decrypting the ciphertext back to the plaintext. A prominent symmetric key algorithm is AES (Advanced Encryption Standard). It is in general a computationally hard problem to determine the cryptographic key used for creating the ciphertext from the plaintext, even if both the ciphertext and the plaintext are known.

SUMMARY

It is an object of the present disclosure to provide a method for determining a cryptographic key in an efficient and resource-conserving manner.

For solving the problem, a method for determining a cryptographic key according to independent claim 1 is provided. Further, a computer program and a data processing system are provided according to independent claims 14 and 15, respectively. Further embodiments are disclosed in dependent claims.

According to one aspect, a method for determining a cryptographic key, carried out in a data processing system, is provided. The method comprises providing a plaintext and a ciphertext determined from the plaintext using a cryptographic key and a cryptographic procedure which comprises cryptographic operations; for each cryptographic operation of the cryptographic procedure, providing at least one intermediate relation which comprises an intermediate equation and/or an intermediate inequality; determining an optimization problem comprising the plaintext and the ciphertext, at least one optimization expression assigned to a round of the cryptographic procedure, and optimization variables comprising state variables of the cryptographic procedure and a cryptographic key variable, wherein the at least one optimization expression is determined from the at least one intermediate relation and comprises at least one preceding state variable assigned to a preceding round. The method further comprises solving the optimization problem and determining the cryptographic key from an optimizing value of the cryptographic key variable.

According to another aspect, a computer program and/or a computer program product is provided comprising instructions which, when the computer program and/or the computer program product is carried out in a data processing system, cause the data processing system to perform the steps of the method for determining a cryptographic key.

According to a further aspect, a data processing system is provided which is configured to determine a cryptographic key by performing the following steps: providing a plaintext and a ciphertext determined from the plaintext using a cryptographic key and a cryptographic procedure which comprises cryptographic operations; for each cryptographic operation of the cryptographic procedure, providing at least one intermediate relation which comprises an intermediate equation and/or an intermediate inequality; determining an optimization problem comprising the plaintext and the ciphertext, and further comprising at least one optimization expression assigned to a round of the cryptographic procedure, and optimization variables comprising state variables of the cryptographic procedure and a cryptographic key variable, wherein the at least one optimization expression is determined from the at least one intermediate relation and comprises at least one preceding state variable assigned to a preceding round; and solving the optimization problem and determining the cryptographic key from an optimizing value of the cryptographic key variable.

The proposed method allows for examining and/or validating the cryptographic strength of a number of state-of-the-art cryptographic algorithms which are described in terms of Boolean functions on binary variables, notably, symmetric encryption algorithms such as DES, 3DES, AES-*, and ARX-based ciphers. Further, the problems of determining secret keys of symmetric ciphers based on pairs of plain text and cipher text may be transformed to appropriate mixed-integer linear programming (MILP) problems or quadratic unconstrained binary optimization (QUBO) problems. Such QUBO problems may in principle be solved using quantum annealing devices with substantial computational speedup. The representation of any Boolean function on binary variables either as a linear equation (with the same variables and binary ancillaries) or as a system of linear inequalities (with the same binary variables without binary ancillaries) may be applied in a wide range of discrete optimization systems as a sub-system of automatic generation of linear constraints.

The cryptographic procedure may be described in terms of Boolean functions on binary variables. The cryptographic procedure may be one of AES, IDEA, Salsa20, DES, 3-DES, and an ARX (AND-ROTATE-XOR) procedure.

In particular, the cryptographic procedure may be one of AES-128, AES-192, and AES-256. The cryptographic procedure may comprise cryptographic operations which may be decomposable into elementary operations consisting of AND, OR, XOR, NOR, and NAND. The ARX procedure may comprise only AND, ROTATE, and XOR operations. In general, the provided method does not require a decomposition and may be applied to a cryptographic procedure which uses an arbitrary Boolean function on binary variables.

The cryptographic operations may comprise AES operations, preferably at least one of AddRoundKey, SubBytes, ShifiRows, MixColumns, and KeyExpansion. In particular, each of the cryptographic operations may be one of AddRoundKey, SubBytes, ShifiRows, MixColumns, and KeyExpansion.

The cryptographic operations may comprise sub-operations such as an inverse operation in a finite field, or a multiplication with an integer greater than one (e.g., 2 or 3) in the finite field, preferably in GF(2⁸).

The method may further comprise determining an elementary operation of at least one of the cryptographic operations; from the elementary operation, determining an elementary relation, comprising an elementary equation and/or an elementary inequality; and determining at least one intermediate relation from the elementary relation. Preferably, the elementary operation is at least one of NOT, AND, OR, and XOR. Generally, the elementary operation may be a Boolean function acting on one or two binary variables. The elementary relation and/or a system of elementary relations may correspond to a Boolean function acting on one or two binary variables.

A plurality of elementary operations may be determined. From each of the plurality of elementary operations, a corresponding elementary relation of a plurality of elementary relations may be determined. A plurality of intermediate relations may be determined from the plurality of elementary relations.

At least one elementary relation may be determined by solving an elementary optimization problem, preferably an unconstrained quadratic problem. The unconstrained quadratic problem may be adapted to be solved in a quantum annealing device.

In particular, each of the elementary relations may be determined by solving a respective elementary optimization problem, preferably a respective constrained quadratic problem.

At least one of the elementary relations may comprise a bilinear equation and/or a linear equation, which may preferably comprise at least one of continuous variables, binary variables, and integer variables.

In particular, at least one of the elementary relations may have the form {right arrow over (c)}_x^T{right arrow over (x)}+{right arrow over (c)}_a^T {right arrow over (a)}_x=b, wherein the binary variables and/or integer variables comprise {right arrow over (a)}_x and {right arrow over (x)}=({right arrow over (y)}, q({right arrow over (y)})), and the continuous variables comprise b, {right arrow over (c)}_x, and {right arrow over (c)}_a, wherein q is one of the elementary operations.

By solving the elementary optimization problem, at least one of the continuous and/or binary variables may be determined. In particular, the variables {right arrow over (a)}_x, b, {right arrow over (c)} and {right arrow over (e)} may be determined by solving the elementary optimization problem. The elementary optimization problem may comprise an elementary objective function of the form (c₁−1)², wherein c₁ may preferably be the first component of the variable {right arrow over (c)}. The elementary optimization problem may comprise auxiliary constraints comprising at least one of {right arrow over (c)}^T{right arrow over (x)}+{right arrow over (e)}^T{right arrow over (a)}=b and {right arrow over (c)}^T{right arrow over (x)}+{right arrow over (e)}^T{right arrow over (a)}≠b.

At least one intermediate relation (in particular one intermediate equation) may be provided by solving an intermediate optimization problem. Additionally or alternatively, the at least one intermediate relation may correspond to a Boolean function with more than one elementary operation. Further, at least one system of intermediate relations may correspond to a Boolean function with more than one elementary operation.

At least one intermediate relation may also correspond to an elementary operation.

The intermediate optimization problem may preferably be a constrained quadratic problem.

At least one intermediate relation may comprise a permutation function. Each intermediate equation may comprise binary variables and/or continuous variables. Each intermediate inequality may also comprise binary variables and/or continuous variables.

At least one intermediate relation may be provided by determining an H-representation of a convex polyhedron for one of the cryptographic operations. In particular, a system of intermediate inequalities may be provided by determining the H-representation of the convex polyhedron for one of the cryptographic operations.

The system of intermediate inequalities may be determined such as being irreducible.

The convex polyhedron may be determined from a Boolean function of the respective cryptographic operation. The convex polyhedron may be representable by its vertices (V-representation) or by its facets (H-representation). The H-representation may be determined via a polyhedral computation code, particularly via CDD or LRS.

At least one intermediate relation may also be provided by determining a conjunctive normal form or a disjunctive normal form of the Boolean function of the respective cryptographic operation. Preferably, the intermediate relation may then be determined from the elementary relations corresponding to the terms in the conjunctive normal form or the disjunctive normal form.

At least one intermediate relation may be provided by determining, for one of the cryptographic operations acting on a finite field, a further operation acting on a further finite field of lower order. Further, the at least one intermediate relation may be provided by determining, for a sub-operation of the cryptographic operation acting on a finite field, a further sub-operation and/or elementary operation acting on a further finite field of lower order.

In particular, if the cryptographic operation and/or sub-operation acts on GF(2⁸), the further operation, sub-operation and/or elementary operation may act on GF(2⁴). If the cryptographic operation and/or sub-operation acts on GF(2⁴), the further operation, sub-operation and/or elementary operation may act on GF(2²). If the cryptographic operation and/or sub-operation acts on GF(2²), the further operation, sub-operation and/or elementary operation may act on GF(2).

The optimization problem may be a mixed-integer linear program, a mixed-integer nonlinear program, or a quadratic unconstrained binary optimization problem. The optimization problem may also be a constrained integer program.

During optimization, an optimizing set of optimizing values for the optimization variables is searched within a search space. The optimization problem may comprise a discrete search space. The optimizing set may correspond to a minimum, preferably a global minimum, of the optimization problem.

The optimization expression may be an optimization constraint or may be contained in an objective function of the optimization problem.

The optimization constraint may be an equation or an inequality, in particular one of the intermediate equations or intermediate inequalities. The optimization constraint may also be a rearranged intermediate equation or intermediate inequality. A plurality of optimization expressions or a plurality of optimization constraints may also be determined by reducing a linear system of intermediate equations or a system of intermediate inequalities.

The objective function of the optimization problem may consist of a sum of squared optimization expressions.

The plaintext may comprise a first plaintext and a second plaintext and the ciphertext may comprise a first ciphertext and a second ciphertext. The first ciphertext may have been determined from the first plaintext using the cryptographic key and the cryptographic procedure, and the second ciphertext may have been determined from the second plaintext using the (same) cryptographic key and the cryptographic procedure.

For example, the cryptographic key may have a length of 192 bits or 256 bits, and the first and the second plaintext may each have a length of 128 bits.

For the first plaintext and the first ciphertext, a first plurality of intermediate relations may be determined. Further, for the second plaintext and the second ciphertext, a second plurality of intermediate relations may be determined. The optimization problem may be determined from both the first and the second plurality of intermediate relations.

The optimization problem may at least partially be solved in a quantum processing device of the data processing system, preferably a quantum annealing device.

For example, the quantum annealing device may comprise a D-Wave annealing device.

The optimization problem may also be solved at least partially on a universal quantum computer. To this end, a quantum approximate optimization algorithm may be employed to solve the optimization problem.

Alternatively, the optimization problem may be solved only in one or a plurality of classical processing devices of the data processing system. The classical processing devices may each comprise a processor and a memory.

Determining the elementary relations, determining the intermediate relations, determining the optimization problem, and/or determining the cryptographic key from an optimizing value of the cryptographic key variable may be carried out in the classical data processing device(s), in particular by the corresponding processor(s).

The data processing system may comprise the quantum processing device, in particular the quantum annealing device. Alternatively, the quantum processing device may be separated from the data processing system.

At least one of the optimization constraints, preferably all of the optimization constraints, may be transferred to the quantum processing device, preferably from the classical processing device(s), in particular the memory/memories of the classical processing device(s). Transferring the optimization constraints may comprise transferring fixed values during optimization.

The optimization variables may be assigned to a superposition of quantum states.

In particular, each possible value allocation of the optimization variables may correspond to one of the quantum states, preferably generated in the quantum processing device. At an initial time, each of the quantum states of the superposition may have the same weight.

The superposition may be evolved in time by the quantum processing device according to a prescription determined from the constraints. The prescription may for example be represented by a Hamiltonian.

The optimizing value of the cryptographic key variable may be determined from the superposition at a final time. At the final time, an optimizing quantum state of the quantum states, corresponding to the optimizing set, may have the largest weight of the quantum states of the superposition. The optimizing quantum state may for example correspond to a ground state of the Hamiltonian.

The optimizing value of the cryptographic key variable may be determined by determining the optimizing quantum state. The optimizing value may be transferred to the classical data processing device(s). With this, the cryptographic key may be provided in the classical data processing device(s), in particular in the memory/memories of the classical processing device(s).

The aforementioned embodiments related to the method for determining a cryptographic key may be provided correspondingly for the data processing system configured to determine a cryptographic key.

DESCRIPTION OF FURTHER EMBODIMENTS

In the following, embodiments, by way of example, are described with reference to figures.

FIG. 1 shows a graphical representation of a method for determining a cryptographic key,

FIG. 2 shows a graphical representation of a data processing system,

FIG. 3 shows a graphical representation of the AddRoundKey operation,

FIG. 4 shows a graphical representation of the SubBytes operation,

FIG. 5 shows a graphical representation of the MixColumns operation, and

FIG. 6 shows a graphical representation of the KeyExpansion operation.

In FIG. 1, a graphical representation of the (computer-implemented) method for determining a cryptographic key is shown. In a first step 11, a plaintext and a ciphertext by encrypting the plaintext using a cryptographic procedure are provided.

In a second step 12, at least one intermediate relation is provided for each cryptographic operation of the cryptographic procedure. In case of the cryptographic procedure being AES, the cryptographic operations are AddRoundKey, SubBytes, Shiftows, MixColumns, and KeyExpansion. Each intermediate relation can be an intermediate equation, or alternatively, an intermediate inequality. The intermediate equations can be determined by solving elementary optimization problems.

In a third step 13, after providing, in particular determining, the intermediate relations, an optimization problem such as a mixed-integer linear programming problem (MILP) or a quadratic unconstrained binary optimization (QUBO) problem is determined.

The optimization problem comprises a plurality of optimization expressions established from the intermediate relations and assigned to each round of the cryptographic procedure. An optimization expression can be an optimization constraint, in particular of a MILP. Alternatively, the optimization expression is contained in a summand of the objective function of the optimization problem, in particular of a QUBO problem.

The optimization problem further comprises the state variables of the cryptographic procedure. A plurality of optimization expressions assigned to a certain round each comprise at least one state variable assigned to a preceding round.

After determining the optimization problem, the optimization problem is solved, and the cryptographic key is determined from an optimizing set of optimization variables (optimizer) of the optimization problem, in particular from an optimizing value of the cryptographic key variable (fourth step 14).

FIG. 2 shows a graphical representation of a data processing system 20. The data processing system 20 comprises at least one classical processing device 21. Additionally, the data processing system 20 may comprise a quantum processing device 22, for example a quantum annealing device. Data may be exchanged between the at least one classical processing device 21 and the quantum processing device 22.

In particular, in case of employing a D-Wave quantum annealing device, a D-Wave Python API may be used for data exchange.

Steps 11 to 13 are preferably carried in out in the classical processing device 21. The fourth step 14 of solving the optimization problem may be carried out in the classical processing device 21 or the quantum processing device 22. In the latter case, the fourth step 14 is significantly accelerated.

DETAILED DESCRIPTION OF THE METHOD

In the following, the steps of the method are laid out in detail with particular reference to AES.

a. AES Structure

In AES, the cryptographic key may have one of three different sizes, namely 128, 192, and 256 bits, while the input, the plaintext, has a fixed block size of 128 bits. For larger input data to be encrypted, the input data is split into data blocks of 128 bits each and the AES algorithm is applied to each data block, making use of a block cipher mode of operation.

Depending on the cryptographic key size, AES comprises a different number of rounds/iterations in which cryptographic operations are successively carried out, namely 10, 12, or 14—respectively corresponding to 128, 192, or 256 bits.

AES acts on 4×4 data blocks/arrays. In the AES regime, these data blocks are called states, each comprising in total 16 state entries (bytes). For instance, the plaintext b with 128 bits or equivalently 16 bytes b₀, b₁, . . . , b₁₅ is represented by the two-dimensional array

$\begin{array}{cc}\left[\begin{array}{cccc}{b}_0& b_4& b_8& b_{12}\\ b_1& b_5& b_9& b_{13}\\ b_2& b_6& b_{10}& b_{14}\\ b_3& b_7& b_{11}& b_{15}\end{array}\right].& \left(1\right)\end{array}$

AES comprises the following cryptographic operations:

• I. KeyExpansion—round keys are derived from the cryptographic key using an AES key schedule. AES requires a separate 128-bit round key block for each round plus an additional round key block.
• II. Key addition round:
  • a. AddRoundKey—each state entry is combined with a byte of the round key using bitwise XOR.
• III. Subsequent rounds (9, 11, or 13 rounds):
  • a. SubBytes—a non-linear substitution step in which each byte is replaced with another according to a lookup table.
  • b. ShiftRows—a transposition step in which the last three rows of the state are shifted cyclically by a certain number of steps.
  • c. MixColumns—a linear mixing operation which operates on the columns of the state, combining the four bytes in each column.
  • d. AddRoundKey
• IV. Final round:
  • a. SubBytes
  • b. ShiftRows
  • c. AddRoundKey

The final state corresponds to the ciphertext.

Within the context of the present disclosure, the KeyExpansion operation can be understood as being contained in an initial round.

a. Determining the Elementary Relations

The cryptographic operations comprise Boolean functions with binary variables. For example, the cryptographic operation SubBytes comprises successively applying XOR operations. In the method, intermediate relations are determined for each cryptographic operation based on the Boolean functions. The intermediate relations may correspond to (intermediate) equations (equation representation) or to systems of (intermediate) inequalities (inequality representation).

Each Boolean function of a cryptographic operation can be further divided into elementary operations such as x∧y, x∨y, or x⊕y (AND, OR, XOR). For each elementary operation, at least one elementary relation, i.e., an elementary equation or an elementary inequality, can be determined. From the established elementary relations, the intermediate relations can be determined. In the following, determining the elementary relations will be illustrated before treating the intermediate relations in the subsequent section.

In order to determine a linear equation corresponding to an elementary operation, a respective (elementary) optimization problem is solved. The vector {right arrow over (x)} is defined as joint vector {right arrow over (x)}=({right arrow over (y)}, q({right arrow over (y)})) for elementary operation q, set of input variables {right arrow over (y)}, and output q({right arrow over (y)}). Further, f denotes a set of feasible configurations. The elementary equation to be determined has the form

{right arrow over (c)} ^T {right arrow over (x)}+{right arrow over (e)} ^T {right arrow over (a)}=b,  (2)

wherein {right arrow over (a)} is an auxiliary vector of binary coefficients, b is a continuous coefficient, {right arrow over (c)}, {right arrow over (e)} are vectors of continuous coefficients, and {right arrow over (x)}=({right arrow over (y)}, q({right arrow over (y)})) is a vector of binary variables. The transpose of a vector is denoted with (•)^T. Notably, Eq. (2) is linear in {right arrow over (c)}.

The linear system must satisfy:

$\begin{array}{cc}\{\begin{array}{c}{\stackrel{\to }{c}}^T\stackrel{\to }{x}+{\stackrel{\to }{e}}^T\stackrel{\to }{a_x}=b\left(\forall x\in f\right)\\ {\stackrel{\to }{c}}^T\stackrel{\to }{x}+{\stackrel{\to }{e}}^T\stackrel{\to }{a}\ne b\left(\forall x\notin f\forall \stackrel{\to }{a}\in {\left\{0,1\right\}}^{N_a}\right)\end{array}& \left(3\right)\end{array}$

The sought-after coefficients to be determined by the elementary optimization problem are the continuous variables {right arrow over (c)}, {right arrow over (e)}, and b. The elementary optimization problem can be formulated as a MILP and is determined from Eq. (3) as follows. First, a number N_a of ancillaries {right arrow over (a)} in Eq. (3) is chosen. The number of variables in the original problem is denoted by N_x. The MILP consists of a set of auxiliary constraints and an objective function. Each vector from the feasible configurations yields one of the auxiliary constraints with continuous variables {right arrow over (c)}, {right arrow over (e)}, and b and N_a new binary variables d:

{right arrow over (c)} ^T {right arrow over (x)}+{right arrow over (e)} ^Ta {right arrow over (=)}b  (4)

For each vector {right arrow over (x)} from the infeasible configurations, 2^Na new of the auxiliary constraints are added:

∀{right arrow over (a)}ε{0,1}^N:{right arrow over (c)}^T{right arrow over (x)}+{right arrow over (e)}^T{right arrow over (a)}≠b  (5)

As a result, a MILP with |f|+2^Na|f*| auxiliary constraints (|f| and |f*| being the number of the feasible and the infeasible configurations, respectively) and N_x+N_a+1+|f|·N_a variables is established. Such a homogeneous MILP has a plurality of solutions (multiplying all coefficients by the same number also results in a solution). Hence, the first coefficient c₁ of {right arrow over (c)} is set to 1, yielding the additional auxiliary constraint or corresponding penalty term c₁=1.

The elementary optimization problem then reads:

$\begin{array}{cc}{\underset{\stackrel{\to }{a_x},b,\stackrel{\to }{c},\stackrel{\to }{e}}{\min }\left(c_1-1\right)}^2\mathrm{subject}\mathrm{to}\{\begin{array}{c}{\stackrel{\to }{c}}^T\stackrel{\to }{x}+{\stackrel{\to }{e}}^T\stackrel{\to }{a_x}=b\left(\forall x\in f\right)\\ {\stackrel{\to }{c}}^T\stackrel{\to }{x}+{\stackrel{\to }{e}}^T\stackrel{\to }{a}\ne b\left(\forall x\notin f\forall \stackrel{\to }{a}\in {\left\{0,1\right\}}^{N_a}\right)\end{array}& \left(6\right)\end{array}$

with b, {right arrow over (c)}, {right arrow over (e)} comprising real-valued variables and {right arrow over (a)}_x comprising binary variables.

As an example, determining the elementary equation for the elementary operation z=x∧y is described below.

The feasible configurations and the infeasible configurations of the elementary operation are as follows:

x	y	z
0	0	0	feasible
0	1	0	feasible
1	0	0	feasible
1	1	1	feasible
0	0	1	infeasible
0	1	1	infeasible
1	0	1	infeasible
1	1	0	infeasible

Eq. (4) is simplified to c_xx+c_yy+c_zz+c_aa=b and the coefficients c_x, c_y, c_z, c_a, b are to be determined such that:

z=x∧y⇔(∃a∈{0,1}:c_xx+c_yy+c_zz+c_aa=b).  (7)

The elementary optimization problem then reads

${\underset{c_x,c_y,c_z,c_a,b,a_0,a_1,a_2,a_3}{\min }\left(c_x-1\right)}^2$

subject to:

c _x·0+c_y·0+c_z·0+c_aa₀=b,

c _x·0+c_y·1+c_z·0+c_aa₁=b

c _x·1+c_y·0+c_z·0+c_aa₂=b

c _x·1+c_y·1+c_z·1+c_aa₃=b

c _x·0+c_y·0+c_z·1+c_a·0≠b,

c _x·0+c_y·0+c_z·1+c_a·1≠b,

c _x·0+c_y·1+c_z·1+c_a·0≠b,

c _x·0+c_y·1+c_z·1+c_a·1≠b,

c _x·1+c_y·0+c_z·1+c_a·0≠b,

c _x·1+c_y·0+c_z·1+c_a·1≠b,

c _x·1+c_y·1+c_z·0+c_a·0≠b,

c _x·1+c_y·1+c_z·0+c_a·1≠b,

c _x ,c _y ,c _z ,c _{a} ,b∈ ,a ₀ ,a ₁ ,a ₂ ,a ₃∈{0,1}.  (8)

Analogously, the elementary equations for further Boolean elementary operations can be determined, yielding the following Table 1:

TABLE 1
	Elementary operation	Elementary equation
AND	x ∧ y = z	E∧(x, y, a, z) ≐ {x + y − 2z − a = 0}
OR	x ∨ y = z	E∨(x, y, a, z) ≐ {x + y − 2z + a = 0}
XOR	x ⊕ y = z	$E_{\oplus }\left(x,y,a,z\right)\stackrel{.}{=}\left\{x+y-z-2a=0\right\}$
NOR	x ∨ y = z	E∨(x, y, a, z) ≐ {x + y + 2z − a = 1}
NAND	x ∧ y = z	E∧(x, y, a, z) ≐ {x + y + 2z − a = 2}

Instead of elementary equations, systems of elementary inequalities can be established for each elementary operation, according to Table 2:

	TABLE 2
	El. operation	Systems of elementary inequalities
AND	x ∧ y = z	S∧(x, y, z) ≐ {z ≤ x, z ≤ y, z ≥ x + y − 1, z ≥
		0}
OR	x ∨ y = z	S∨(x, y, z) ≐ {x ≤ z, y ≤ z, z ≤ x + y, z ≤ 1}
XOR	x ⊕ y = z	S⊕(x, y, z) ≐ {z ≤ x + y, z ≥ x − y, z ≥ y − x,
		z ≤ 2 − x − y}
NOR	x ∨ y = z	S∨(x, y, z) ≐ {x ≤ 1 − z, y ≤ 1 − z, 1 − z ≤
		x + y, −z ≤ 0}
NAND	x ∧ y = z	S∧(x, y, z) ≐ {1 −z ≤ x, 1 − z ≤ y, −z ≥ x +
		y − 2, 1 − z ≥ 0}

The equivalence may be verified directly of the respective elementary operation and system of elementary inequalities. Systems S_∧(x, y, z) and S_∨(x, y, z) may be derived from S_∧(x, y, z), S_∨(x, y, z) by change of variable from z to 1−z. If variables x, y, z satisfy the corresponding system of elementary inequalities and x and y are binary-valued then z will be binary-valued as well.

a. Determining the Intermediate Relations

Having established the elementary relations corresponding to the elementary Boolean operations underlying the cryptographic operations, the respective intermediate relations are determined as follows.

c.1 Rijndael's Finite Field

Several cryptographic operations in AES are based on Rijndael's finite field, the Galois field GF(2⁸)=GF(2)[x]/(x⁸+x⁴+x³+x+1). In AES, inverse operations and multiplications by 1, 2, and 3 are carried out in GF(2⁸). The calculation of the inverse operation is a hard problem in GF(2⁸), but an easy problem in GF(2), where multiplication is carried out using AND operations. Therefore 1⁻¹=1 in GF(2). Further 0⁻¹ is defined as 0. These relations are valid for any GF(2P), p≥1. The inversion in GF(2⁸) may be sequentially reduced into multiplication and inversion in GF(2⁴), then GF(2²), and GF(2) (cf. Canright, Cryptographic Hardware and Embedded Systems, CHES 2005, pp. 441-455). For example, an element G in GF(2⁸) can be represented as G=γ₁γ+γ₀ with multiplication modulo an irreducible polynomial r(y)=y²+τy+v and γ₀, γ₁∈GF(2⁴). Similar transformations to GF(2²) and GF(2) may be carried out. As a result, the inversion in GF(2⁸) can be represented by the Boolean elementary operations XOR, NAND, and NOR. As laid out above, the elementary operations are transformed into the corresponding elementary relations, cf. tables 1 and 2. For one byte/state entry, 180 elementary operations (XOR, NAND, NOR) are required. Each elementary operation requires one additional equation and two additional bits (z and a). The resulting intermediate equation for inversion, as determined from the elementary equations, is denoted with E_inv({right arrow over (x)}, {right arrow over (a)}, {right arrow over (z)}) with (vector-valued) variables {right arrow over (x)}, {right arrow over (a)}, and {right arrow over (z)}.

Intermediate equations for the multiplication by 1, 2, and 3 in GF(2⁸) can be determined as follows. Multiplying by 1 simply yields the same number, i.e., a×1=a with a∈GF(2⁸). Multiplying a number by 2 is equivalent to shifting the number left by one, and subsequently, if the highest bit of the number is one, additionally applying XOR to the result and the value 0x1B (in hexadecimal representation, corresponding to 00011011 in binary representation).

In particular, starting with {right arrow over (x)}=[x₀, x₁, . . . , x₇], shifting and applying XOR with 0x1B yields {right arrow over (z)}=[z₀, z₁, . . . , z₇]. As 0x1B is constant, the XOR operation can be simplified using a⊕0=a and a⊕1=ā. Hence, after shifting, the result is flipped if the highest bit of x and the corresponding bit of 0x1B are both equal to 1. Therefore, full multiplication by 2 results in the following equation system of intermediate equations:

• • (9)

$E_2\left(\stackrel{\to }{x},\stackrel{\to }{a},\stackrel{\to }{z}\right)=\{\begin{array}{c}{z}_0=x_7\\ z_1=x_7+x_0-2a_0\\ z_2=x_1\\ z_3=x_7+x_2-2a_1\\ z_4=x_7+x_3-2a_2\\ z_5=x_4\\ z_6=x_5\\ z_7=x_6\end{array}$

The intermediate equations with two variables correspond to substitution and can thus be eliminated. As a result, multiplication by 2 requires three additional equations and six additional bits.

Multiplication by 3 can be reformulated as follows:

x×3=x×(2⊕1)=x×2⊕x  (10)

The employed XOR operation requires one additional equation and one additional auxiliary bit per state bit. Hence, multiplication by 3 requires 3+8=11 additional equations and 22 additional bits. The corresponding intermediate equations are denoted with E₃({right arrow over (x)},{right arrow over (a)},{right arrow over (z)}).

c.2 AddRoundKey

In the AddRoundKey operation, the state is combined with a round key, which is determined from the cryptographic key for each round using the AES key schedule. Each round key has the same size as the state. The round key is added to the state by combining each byte of the state with the corresponding byte of the round key via bitwise XOR (see FIG. 3 for an illustration with exemplary byte values). For each of the 128 bits of the state and the round key, a bitwise XOR operation is applied. The AddRoundKey operation therefore requires 128 XOR operations corresponding to 128 additional equations and 256 additional bits.

The intermediate equations E_addroundkey({right arrow over (state)},{right arrow over (subkey)},{right arrow over (ancilla)},{right arrow over (newstate)}) thus can be written as

E _addroundkey({right arrow over (state)},{right arrow over (subkey)},{right arrow over (ancilla)},{right arrow over (newstate)})={E_⊕(state[i][j],subkey[i][j],ancilla[i][j],newstate[i][j]) for i in 0-15 for j in 0 . . . 7}  (11)

c.3 SubBytes

FIG. 4 shows graphical representation of the SubBytes operation. In the SubBytes operation, each byte a_i,j of the state is replaced with S(a_i,j) using an 8-bit substitution box (S-box) S. This cryptographic operation provides non-linearity in the encryption procedure. The S-box used is derived from the multiplicative inverse over GF(2⁸), which comprises suitable non-linearity properties. The SubBytes operation can be decomposed into two parts.

First, each input byte is mapped to its multiplicative inverse in Rijndael's finite field GF(2⁸). Second, the following affine transformation is applied:

$\begin{array}{cc}\left[\begin{array}{c}{s}_0\\ s_1\\ s_2\\ s_3\\ s_4\\ s_5\\ s_6\\ s_7\end{array}\right]=\left[\begin{array}{cccccccc}1& 0& 0& 0& 1& 1& 1& 1\\ 1& 1& 0& 0& 0& 1& 1& 1\\ 1& 1& 1& 0& 0& 0& 1& 1\\ 1& 1& 1& 1& 0& 0& 0& 1\\ 1& 1& 1& 1& 1& 0& 0& 0\\ 0& 1& 1& 1& 1& 1& 0& 0\\ 0& 0& 1& 1& 1& 1& 1& 0\\ 0& 0& 0& 1& 1& 1& 1& 1\end{array}\right]\left[\begin{array}{c}{b}_0\\ b_1\\ b_2\\ b_3\\ b_4\\ b_5\\ b_6\\ b_7\end{array}\right]\oplus \left[\begin{array}{c}1\\ 1\\ 0\\ 0\\ 0\\ 1\\ 1\\ 0\end{array}\right]& \left(12\right)\end{array}$

where b is the multiplicative inverse of the input byte.

Determining the multiplicative inverse can be carried out as described in section c.1. Thus, 180 additional equations and 360 bits for each byte are required, resulting in 16 180=360 additional linear equations and bits.

The affine transformation comprises an XOR operation with 5 input bits (corresponding to five matrix entries with value 1 per matrix row). The right-hand side vector does not have any variables. Hence, if its i-th bit has value zero, then s_i is a flipped value (in the corresponding equation, s_i is replaced by 1−s_i). The XOR operation with 5 input values can be evaluated sequentially, i.e., x₁ ⊕x₂ ⊕x₃ ⊕x₄ ⊕x_s=(((x₁ ⊕x₂)⊕x₃) ⊕x₄)⊕x₅). This requires several additional auxiliary variables.

In an alternative approach, an intermediate optimization problem is determined and solved as detailed above with respect to the elementary optimization problems. The optimization problem yields the following intermediate equation:

E _5⊕ ≐{x ₁ +x ₂ −x ₃ +x ₄ −x ₅ −y+2a₀−2a₁=0}  (13)

Hence, each bit of the cryptographic operation SubBytes requires one equation and three auxiliary bits. For the entire state, 128 equations and 384 auxiliary bits are required. In total, the SubBytes operation requires 2880+128=3008 (intermediate) equations and 5760+384=6144 auxiliary bits.

For the cryptographic operation SubBytes, the following intermediate equations are thus provided:

$\left(14\right)$ $E_{\mathrm{subbytes}}\left(\stackrel{⟶}{\mathrm{state}},\stackrel{⟶}{\mathrm{ancilla}},\stackrel{⟶}{\mathrm{nextstate}}\right)=\{\begin{array}{c}{E}_{\mathrm{inv}}\left(\stackrel{⟶}{\mathrm{state}}\left[0\right],\stackrel{⟶}{\mathrm{ancilla}}\left[0\right]\left[0\right],\stackrel{⟶}{\mathrm{invstate}}\left[0\right]\right)\\ E_{5\oplus }\left(\stackrel{⟶}{\mathrm{invstate}}\left[0\right],\stackrel{⟶}{\mathrm{ancilla}}\left[0\right]\left[1\right]\left[i\right],\mathrm{nextstate}\left[0\right]\left[i\right]\right)\mathrm{for}i\mathrm{in}0.\text{.7}\\ \dots \\ E_{\mathrm{inv}}\left(\stackrel{⟶}{\mathrm{state}}\left[15\right],\stackrel{⟶}{\mathrm{ancilla}}\left[15\right]\left[0\right],\stackrel{⟶}{\mathrm{invstate}}\left[15\right]\right)\\ E_{5\oplus }\left(\stackrel{⟶}{\mathrm{invstate}}\left[15\right],\stackrel{⟶}{\mathrm{ancilla}}\left[15\right]\left[1\right]\left[i\right],\mathrm{nextstate}\left[15\right]\left[i\right]\right)\mathrm{for}i\mathrm{in}0.\text{.7}\end{array}$

c.4 ShiftRows

The ShiftRows operation acts on the rows of the state by cyclically shifting the bytes in each row by a certain offset. For AES, the first row is left unchanged. Each byte of the second row is shifted one to the left. Similarly, the third and fourth rows are shifted by offsets of two and three, respectively. Hence, the ShiftRows operation just rearranges bits and does not require additional linear equations with auxiliary variables.

The corresponding intermediate relation therefore comprises a permutation function

S({right arrow over (state)})={right arrow over (newstate)},  (15)

which represents the bit rearrangements.

c.5 MixColumns

FIG. 5 shows a graphical representation of the MixColumns operation, by which the four bytes of each column of the state are combined using an invertible linear transformation. Each column j is transformed using a fixed matrix by left-multiplying the fixed matrix with the column j:

$\begin{array}{cc}\left[\begin{array}{c}{b}_{0,j}\\ b_{1,j}\\ b_{2,j}\\ b_{3,j}\end{array}\right]=\left[\begin{array}{cccc}2& 3& 1& 1\\ 1& 2& 3& 1\\ 1& 1& 2& 3\\ 3& 1& 1& 2\end{array}\right]\left[\begin{array}{c}{a}_{0,j}\\ a_{1,j}\\ a_{2,j}\\ a_{3,j}\end{array}\right]0\le j\le 3& \left(16\right)\end{array}$

Multiplication and addition are carried out in the Galois field GF(2⁸). Addition in GF(2⁸) corresponds to the XOR operation. Using four input bits for each output bit b_i,j(i=0, . . . 3), the corresponding intermediate equation reads:

x ₁ +x ₂ −x ₃ +x ₄ +y−2a₀−2a₁=0  (17)

Hence, addition in GF(2⁸) requires one additional equation and 3 auxiliary bits per state bit, resulting in 128 additional equations and 384 auxiliary bits per state in total. Multiplication by 2 requires three equations and six auxiliary bits per byte and 48 equations and 96 bits per state, while multiplication by 3 requires 176 equations and 352 auxiliary bits per state. In total, the MixColumns operation requires 128+48+176=352 intermediate equations and 384+96+352=832 auxiliary bits.

Denoting the MixColumns input state with {right arrow over (state)}≐{a_i,j for i in 0 . . . 3 for j in 0 . . . 3} and the output state with {right arrow over (newstate)}≐{a_i,j for i in 0 . . . 3 for j in 0 . . . 3}, the intermediate equations for the MixColumns operation read:

E _mixcolumns({right arrow over (state)},{right arrow over (ancilla)},{right arrow over (newstat)}e)={E₂(a_i,j,ancilla_i,j,2,aa_i,j),E₃(a_i,j,ancilla_i,j,3,aaa_i,j),E_4⊕(aa_0,j,aaa_1,j,a_2,j,a_3,j,ancilla_0,j,ancilla_1,j,b_0,j),E_4⊕(a_0,j,aa_1,j,aaa_2,j,a_3,j,ancilla_0,j,ancilla_1,j,b_1,j),E_4⊕(a_0,j,a_1,j,aa_2,j,aaa_3,j,ancilla_0,j,ancilla_1,j,b_2,j),E_4⊕(aaa_0,j,a_1,j,a_2,j,aa_3,j,ancilla_0,j,ancilla_1,j,b_3,j), for i in 0 . . . 3, for j in 0 . . . 3}  (18)

c.6 KeyExpansion

FIG. 6 shows a graphical representation of the KeyExpansion operation, which expands the cryptographic key into a plurality of separate round keys. The three AES variants AES-128, AES-192, and AES-256 (with the cryptographic key having 128, 192, and 256 bits, respectively) comprise different numbers of rounds. Each AES variant requires a separate 128-bit round key for each round plus an additional round. The AES key schedule produces the round keys from the cryptographic key. Denoting the number of 32-bits words in the cryptographic key with N (i.e., N=4 for AES-128, N=6 for AES-192, and N=8 for AES-256), the cryptographic key with [K₀, K₁, . . . , K_N−1] the number of rounds plus one with R (i.e., R=11 for AES-128, R=13 for AES-192, and R=15 for AES-256), and the 32-bit words of the expanded key with W₀, W₁, . . . , W_4R−1, the round key at round r (with r<R) is [W_4r, W_4r+1, W_4r+2, W_4r+3]. The 32-bit words W_i for each round key are determined as follows:

$\begin{array}{cc}{W}_i=\{\begin{array}{cc}{K}_i& \mathrm{if}i<N\\ W_{i-N}\oplus \mathrm{SubWord}\left(\mathrm{RotWord}\left(W_{i-1}\right)\right)\oplus {\mathrm{rcon}}_{i/N}& \mathrm{if}i\ge N\mathrm{and}i\equiv 0\left(\mathrm{mod}N\right)\\ W_{i-N}\oplus \mathrm{SubWord}\left(W_{i-1}\right)& \mathrm{if}i\ge N,N>6,\mathrm{and}i\equiv 4\left(\mathrm{mod}N\right)\\ W_{i-N}\oplus W_{i-1}& \mathrm{otherwise}\end{array}.& \left(19\right)\end{array}$

The operation RotWord corresponds to a one-byte left circular shift and does not require additional linear equations as it just rearranges state bits. The operation SubWord represents an application of the AES S-box as described in Section c.3 to each of the four bytes of the word:

SubWord([b₀b₂b₃])=[S(b₀)S(b₁)S(b₂)S(b₃)].  (20)

Further, rcon is an array of given numbers. Therefore, applying XOR does not involve additional linear equations and auxiliary bits. Both operations W_i−N⊕SubWord(RotWord (W_i−1))⊕rcon_i/N and W_i−N⊕SubWord (W_i−1) are equivalent in terms of additional equations and auxiliary bits. Hence, the 32-bit words W_i of the round key are calculated using three different operations:

• I. W_i is determined as K_i, which is just part of the cryptographic key. Hence, no additional equations and only 32 bits are required (each K_i has a bit length of 32). This type of operation is carried out N times.
• II. W_i is determined as W_i−N⊕SubWord(RotWord (W_i−1))⊕rcon_i/N or as W_i−NδSubWord (W_i−1). The corresponding S-box requires 188 equations and 384 auxiliary bits per byte. With 4 bytes and additional XOR, in total 188·4+8=760 equations and 384·4+2·8=1552 auxiliary bits are required. This type of operation is carried out 10 times for AES-128, 8 times for AES-192 and 13 times for AES-256.
• III. W_i is determined as W_i−N⊕W_i−1, which corresponds to XOR acting on a 32-bit word, thus requiring 32 equations and auxiliary 64 bits. This type of operation is carried out 30 times for AES-128, 38 times for AES-192 and 39 times for AES-256.

In total, the KeyExpansion operation requires 8560 intermediate equations and 17568 auxiliary bits for AES-128, 7296 intermediate equations and 15040 auxiliary bits for AES-192, and 11128 intermediate equations and 22928 auxiliary bits for AES-256.

The intermediate equations corresponding to the KeyExpansion operation are denoted with E_keyexpansion({right arrow over (K)},{right arrow over (ancillca)},{right arrow over (W)}).

c.7 Obtaining the Intermediate Inequalities Via Convex Polyhedron Representations

The intermediate inequalities for the respective cryptographic procedures can also be determined by making use of the fact that any Boolean function F({right arrow over (x)}) can be represented as a system of linear inequalities. For a set Bⁿ≐{(x₁, x₂, . . . , x_n): x_k∈{0,1}}∈Rⁿ of all vertices of an n-dimensional unit cube, which corresponds to the set of all 0-1 arguments of the Boolean function F: Bⁿ→{0,1}, there exists a system of linear inequalities with n+1 variables ({right arrow over (x)}, x_n+1)

S({right arrow over (x)},x_n+1)={a_i+l_i({right arrow over (x)})+b_ix_n+1≥0:1=1, . . . ,m},  (21)

(wherein a_i, b_i, b_i≠0 are scalars, and l_i({right arrow over (x)}) are linear functions of n variables) such that the following holds:

∀{right arrow over (x)}∈Bⁿ:{F({right arrow over (x)})=x_n+1}⇔{a_i+l_i({right arrow over (x)})+b_ix_n+1≥0:i=1, . . . ,m}  (22)

I.e., for any {right arrow over (x)}∈Bⁿ, F({right arrow over (x)})=x_n+1 if and only if S({right arrow over (x)}, x_n+i) holds. Importantly, it is not required to assume x_n+1 to be a binary-values variable. For any binary-valued vector {right arrow over (x)}, the system S({right arrow over (x)}, x_n+1) has only a solution ({right arrow over (x)}, x_n+1) where x_n+1=F({right arrow over (x)}).

Transforming Boolean functions to linear equations or inequalities is a known challenge in computing science, in particular with regard to connections between the Boolean satisfiability (SAT) problem and integer linear programming (ILP) problems. Treating the SAT-problem corresponds to checking the satisfiability of a large Boolean function that is represented mainly in one of two special forms: CNF (conjunctive normal form) or DNF (disco junctive normal form). If a Boolean function has DNF or CNF representation, then the generation of corresponding linear inequalities may be done directly on the base of Table 2 since DNF and CNF representations are compositions of elementary bi-variant Boolean operations. This (first) approach may be applied to any Boolean functions because any Boolean function may be converted to a DNF or CNF representation.

Such an approach may have two drawbacks: First, a corresponding CNF or DNF representation has to be determined for a given Boolean function and, second, the system of linear inequalities to be generated may comprise a substantial amount of redundant inequalities.

In an alternative second approach, DNF or CNF representations are not required, and irreducible systems of linear inequalities may be obtained. Any Boolean function F of n variables can be represented by a convex hull of appropriate 2ⁿ vertices of the unit hypercube Bⁿ⁺¹⊂ⁿ⁺¹. The Boolean function F may be represented by a set of vectors in ⁿ⁺¹: V[F]≐{({right arrow over (x)}, F(x)):{right arrow over (x)}∈Bⁿ}, which can be understood as a graph of the Boolean function F. V[F] is a subset of the unit hypercube, i.e., V [F]⊂Bⁿ⁺¹. It can be shown that all vectors in V[F] are vertices of the corresponding convex polyhedron conv(V[F]), a convex hull of V [F]. Therefore, the Boolean function F may be treated as a convex polyhedron V [F] (using the same symbol for polyhedron and the set of its vertices). Any polyhedron may be represented either by the set of all its vertices, the V-representation, or by the system of linear inequalities (corresponding to the set of the facets of the polyhedron), the H-representation (cf. Avis and Fukuda, Discrete & Computational Geometry, 8(3):295-313, 1992). The H-representation of the polyhedron V [F] (given by V-representation) represents the sought-after system of linear inequalities.

V- and H-representations of convex hulls of finite set of points in Euclidean spaces may e.g., be determined via polyhedral computation codes such as CDD or LRS. Notably, irreducible H-representations can be produced, i.e., redundant linear inequalities are eliminated. Thus, the complexity of the resulting optimization problem for determining the cryptographic key can be reduced. LRS further allows for a parallel implementation of reverse search algorithms. Moreover, in LRS computations regarding polyhedra with integral-valued vertices (as is the case with V [F]) may be carried out without loss of accuracy.

All linear systems for elementary Boolean bi-variant functions listed in Table 2 may be obtained via determining a corresponding H-representation. As an example, for the Boolean function J with

J(x₁,x₂,x₃)=(x₁∧x₂)∨(x₁∧x₃)∨(x₂∧x₃)=x₄,  (23)

systems of inequalities as MILP constraints are determined using both the first and the second approach.

Determining the H-representation (e.g., with LRS) yields a system with 10 inequalities,

$\begin{array}{cc}\left[\begin{array}{c}1\\ 0\\ 1\\ 1\\ 1\\ 0\\ 1\\ 0\\ 0\\ 0\end{array}\right]+\left[\begin{array}{cccc}0& 0& 0& -1\\ 0& 0& 0& 1\\ -1& -1& 0& 1\\ -1& -1& -1& 2\\ 0& -1& -1& 1\\ 1& 0& 1& -1\\ -1& 0& -1& 1\\ 1& 1& 0& -1\\ 0& 1& 1& -1\\ 1& 1& 1& -2\end{array}\right]\left[\begin{array}{c}{x}_1\\ x_2\\ x_3\\ x_4\end{array}\right]\ge \stackrel{⟶}{\left[0\right]}& \left(24\right)\end{array}$

while using the first approach with DNF/CNF representation, a system of 17 inequalities and 4 continuous ancillaries is established. The larger number in the latter case results from the successive construction of the system from elementary bi-variant Boolean functions and continuous ancillary variables, while the former approach allows for treating the Boolean function J as a whole.

In a second example, a Boolean expression comprising 5 binary variables x₁, x₂, x₃, x₄, x₅, x₆ and

x ₁ ⊕x ₂ ⊕x ₃ ⊕x ₄ ⊕x ₅ =x ₆,  (25)

is equivalent to the following system of linear inequalities:

$\begin{array}{cc}\left[\begin{array}{c}1\\ 0\\ 4\\ 4\\ 4\\ 4\\ 4\\ 2\\ 2\\ 2\\ 0\\ 0\\ 0\\ 0\\ 0\\ 0\\ 2\\ 2\\ 2\\ 2\\ 2\\ 2\\ 2\\ 2\\ 2\\ 2\\ 2\\ 2\\ 2\\ 4\\ 2\\ 2\\ 2\\ 2\end{array}\right]+\left[\begin{array}{cccccc}0& 0& 0& 0& 0& -1\\ 0& 0& 0& 0& 0& 1\\ -1& -1& -1& -1& -1& 1\\ -1& -1& -1& -1& 1& -1\\ -1& 1& -1& -1& -1& -1\\ 1& -1& -1& -1& -1& -1\\ -1& -1& 1& -1& -1& -1\\ 1& -1& -1& 1& 1& -1\\ -1& 1& -1& 1& 1& -1\\ 1& 1& -1& -1& -1& 1\\ 1& -1& 1& 1& 1& 1\\ 1& 1& 1& 1& 1& -1\\ 1& 1& 1& 1& -1& 1\\ 1& 1& 1& -1& 1& 1\\ 1& 1& -1& 1& 1& 1\\ -1& 1& 1& 1& 1& 1\\ 1& 1& 1& -1& -1& -1\\ 1& 1& -1& -1& 1& -1\\ 1& 1& -1& 1& -1& -1\\ 1& -1& 1& 1& -1& -1\\ -1& 1& 1& 1& -1& -1\\ -1& -1& 1& 1& 1& -1\\ 1& -1& 1& -1& 1& -1\\ -1& 1& 1& -1& 1& -1\\ -1& 1& 1& -1& -1& 1\\ 1& -1& 1& -1& -1& 1\\ -1& 1& -1& -1& 1& 1\\ 1& -1& -1& -1& 1& 1\\ -1& -1& 1& -1& 1& 1\\ -1& -1& -1& 1& -1& -1\\ -1& 1& -1& 1& -1& 1\\ 1& -1& -1& 1& -1& 1\\ -1& -1& 1& 1& -1& 1\\ -1& -1& -1& 1& 1& 1\end{array}\right]\left[\begin{array}{c}{x}_1\\ x_2\\ x_3\\ x_4\\ x_5\\ x_6\end{array}\right]\ge \stackrel{⟶}{\left[0\right]}& \left(26\right)\end{array}$

Since x₁, x₂, x₃, x₄, x₅ are all binary-valued, redundant trivial inequalities (0≤x₁≤1) could be excluded as well as inequalities with zero coefficients for the variable x₆. The output value x₆ will automatically be binary.

a. Determining the Optimization Problem

Having established all intermediate relations, the optimization problem to be solved can be determined. Table 3 shows the number of employed intermediate equations and auxiliary bits.

	TABLE 3
	Number of intermediate equations	Auxiliary bits
AES-128	43216	89312
AES-192	2 · 48928	2 · 101248
AES-256	2 · 59736	2 · 123600

The optimization expressions of the optimization problem are determined from the set of intermediate relations, in case of intermediate equations from

$\begin{array}{cc}\{\begin{array}{c}{E}_{\mathrm{keyexpansion}}\left(\stackrel{⟶}{K},{\stackrel{⟶}{\mathrm{ancilla}}}_{\mathrm{key}},\stackrel{⟶}{W}\right)\\ E_{\mathrm{addroundkey}}\left(\stackrel{⟶}{\mathrm{initstate}},\stackrel{⟶}{W_0{W}_1{W}_2{W}_3},{\stackrel{⟶}{\mathrm{ancilla}}}_{\mathrm{add}0},{\stackrel{⟶}{\mathrm{state}}}_0\right)\\ E_{\mathrm{subbytes}}\left({\stackrel{⟶}{\mathrm{state}}}_0,{\stackrel{⟶}{\mathrm{ancilla}}}_{\mathrm{sub}0},{\stackrel{⟶}{\mathrm{boxstate}}}_0\right)\\ E_{\mathrm{mixcolumns}}\left(S\left({\stackrel{⟶}{\mathrm{boxstate}}}_0\right),{\stackrel{⟶}{\mathrm{ancilla}}}_{\mathrm{mix}0},{\stackrel{⟶}{\mathrm{mixstate}}}_0\right)\\ E_{\mathrm{addroundkey}}\left({\stackrel{⟶}{\mathrm{mixstate}}}_0,\stackrel{⟶}{W_4{W}_5{W}_6{W}_7},{\stackrel{⟶}{\mathrm{ancilla}}}_{\mathrm{add}1},{\stackrel{⟶}{\mathrm{state}}}_1\right)\\ ⋮\\ E_{\mathrm{subbytes}}\left({\stackrel{⟶}{\mathrm{state}}}_{R-2},{\stackrel{⟶}{\mathrm{ancilla}}}_{\mathrm{subR}-2},{\stackrel{⟶}{\mathrm{boxstate}}}_{R-2}\right)\\ E_{\mathrm{mixcolumns}}\left(S\left({\stackrel{⟶}{\mathrm{boxstate}}}_{R-2}\right),{\stackrel{⟶}{\mathrm{ancilla}}}_{\mathrm{mixR}-2},{\stackrel{⟶}{\mathrm{mixstate}}}_{R-2}\right)\\ E_{\mathrm{addroundkey}}\left({\stackrel{⟶}{\mathrm{mixstate}}}_{R-2},\stackrel{⟶}{W_{4\left(R-2\right)}{W}_{4\left(R-2\right)+1}{W}_{4\left(R-2\right)+2}{W}_{4\left(R-2\right)+3}},{\stackrel{⟶}{\mathrm{ancilla}}}_{\mathrm{addR}-1},{\stackrel{⟶}{\mathrm{state}}}_{R-1}\right)\\ E_{\mathrm{subbytes}}\left({\stackrel{⟶}{\mathrm{state}}}_{R-1},{\stackrel{⟶}{\mathrm{ancilla}}}_{\mathrm{subR}-1},{\stackrel{⟶}{\mathrm{boxstate}}}_{R-1}\right)\\ E_{\mathrm{addroundkey}}\left({\stackrel{⟶}{\mathrm{mixstate}}}_{R-1},\stackrel{⟶}{W_{4\left(R-1\right)}{W}_{4\left(R-1\right)+1}{W}_{4\left(R-1\right)+2}{W}_{4\left(R-1\right)+3}},{\stackrel{⟶}{\mathrm{ancilla}}}_{\mathrm{addR}},{\stackrel{⟶}{\mathrm{state}}}_R\right)\end{array}& \left(27\right)\end{array}$

where {right arrow over (initstate)} corresponds to the plaintext, {right arrow over (state)}_R corresponds to the ciphertext and {right arrow over (K)} denotes the cryptographic key variable. The cryptographic key is determined from an optimizing value of the cryptographic key variable {right arrow over (K)}. The state variables {right arrow over (state)}_r correspond to the states of the AES procedure for different rounds r. Notably, several optimization expressions each comprise at least one preceding state variable assigned to a preceding round, in particular a directly preceding round. e.g., the optimization expression E_subbytes({right arrow over (state)}_R−2, {right arrow over (ancilla)}_subR−2,{right arrow over (boxstate)}_R−2) comprises the state variable {right arrow over (state)}_R−2 assigned to the preceding round R−2.

For the optimization problem being a MILP, the optimization expressions are optimization constraints. Hence, the intermediate equations in Eq. (27) constitute the constraints of a MILP. A MILP can also be determined with the optimization expressions as constraints being the intermediate inequalities instead of the intermediate equations. To this end, the corresponding inequalities for each cryptographic operation and round have to be determined.

For the optimization problem being a QUBO problem, the optimization expressosions are determined from the intermediate equations by moving all terms of each intermediate equation to one side and squaring the resulting terms. The objective function of the QUBO problem then comprises a sum of all squared terms. Determining the optimization expressions this way can be formally described as follows. Representing the intermediate equations as a linear system

A{right arrow over (x)}≈{right arrow over (b)},  (28)

where {right arrow over (x)}∈{0,1}^N, A∈^N×N, {right arrow over (b)}∈^N and a_ij is the matrix entry of the matrix A in the i-th row and the j-th column, the linear system in Eq. (28) is equivalent to:

$\begin{array}{cc}\{\begin{array}{c}\sum _j{a}_{0j}{x}_j-b_0=0\\ \sum _j{a}_{1j}{x}_j-b_1=0\\ ⋮\\ \sum _j{a}_{N-1,j}{x}_j-b_{N-1}=0\end{array}& \left(29\right)\end{array}$

Summing up the left-hand sides of Eq. (29) yields the objective function

min((Σ_ja_0jx_j−b₀)²+(Σ_ja_1jx_j−b₁)²+ . . . +(Σ_ja_N−1,jx_j−b_N−1)²).  (30)

The minimum of the objective function in Eq. (30) is reached if and only if {right arrow over (x)} is a solution of the linear systems in Eqs. (28), (29).

Both equation representation and inequality representation may be used for determining MILPs.

In case of using equations, each Boolean function of the cryptographic procedures may be reduced to a single equation with binary ancillaries. A CPLEX-solver may be used to obtain coefficients of the equation. Using intermediate equations with binary ancillaries/auxiliary variables further allows for determining QUBOs specifically suited for Quantum Annealers.

Both MILP and QUBO problems may also in principle be solved by classical generic solvers such as CPLEX, Gurobi, SCIP, or CBC. However, the additional binary ancillaries may substantially increase the computing complexity, posing a challenge for classical solvers. In this regard, QUBO problems may considered to be more promising since they may be solved by a quantum annealing device such as D-Wave.

In case of inequalities without binary ancillaries, each Boolean function is reduced to a system of linear inequalities without any additional binary variables. The inequalities may explicitly be determined using polyhedra applications such as LRS. This approach is mainly, but not exclusively, suitable for classical solvers.

AES variants may use cryptographic keys which are longer than plaintext (AES-256 has 256 bits for the cryptographic key and 128 bits for the plaintext). Therefore, one plaintext block with 128 bits and its ciphertext are not sufficient to determine the full cryptographic key. However, two known plaintext blocks of 128 bits each (together with their corresponding ciphertexts) comprise sufficient information.

In order to treat the variants AES-192 and AES-256, two copies of the plurality/system of intermediate relations (equations or inequalities) are determined. A first system comprises a first plaintext and a first ciphertext generated from the first plaintext using the cryptographic key, and a second system comprises a second plaintext and a second ciphertext generated from the second plaintext using the (same) cryptographic key. The first and the second system can also be considered forming a (total) system of intermediate relations. From the first and the second system, a common optimization problem is determined and solved analogously to the case of AES-128.

The described method steps are not only suitable for AES, but also for other cryptographic procedures. Any cryptographic procedure which comprises a defined protocol and non-linear functions and which either has a limited amount of inputs bits or can be decomposed into the elementary operations XOR, AND etc. can be approached as well. Namely, the method can be adapted for IDEA, Salsa20, or ARX.

The features disclosed in this specification, the figures and/or the claims may be material for the realization of various embodiments, taken in isolation or in various combinations thereof.

Claims

1. A method for determining a cryptographic key, the method being carried out in a data processing system, the method comprising: providing a plaintext and a ciphertext determined from the plaintext using a cryptographic key and a cryptographic procedure which comprises cryptographic operations;for each cryptographic operation of the cryptographic procedure, providing at least one intermediate relation which comprises an intermediate equation and/or an intermediate inequality;determining an optimization problem comprisingthe plaintext and the ciphertext,at least one optimization expression assigned to a round of the cryptographic procedure, andoptimization variables comprising state variables of the cryptographic procedure and a cryptographic key variable,wherein the at least one optimization expression is determined from the at least one intermediate relation and comprises at least one preceding state variable assigned to a preceding round; andsolving the optimization problem and determining the cryptographic key from an optimizing value of the cryptographic key variable.

2. The method according to claim 1, wherein the cryptographic procedure is described in terms of Boolean functions on binary variables and/or is one of AES, IDEA, Salsa20, DES, 3-DES, and an ARX procedure.

3. The method according to claim 1, wherein the cryptographic operations comprise AES operations, preferably at least one of AddRoundKey, SubBytes, ShiftRows, MixColumns, and KeyExpansion.

4. The method according to claim 1, further comprising: determining an elementary operation of at least one of the cryptographic operations;from the elementary operation, determining an elementary relation comprising an elementary equation and/or an elementary inequality; anddetermining at least one intermediate relation from the elementary relation,wherein, preferably, the elementary operation is one of NOT, AND, OR, and XOR.

5. The method according to claim 4, wherein at least one elementary relation is determined by solving an elementary optimization problem, preferably an unconstrained quadratic problem.

6. The method according to claim 1, wherein at least one intermediate relation is provided by solving an intermediate optimization problem and/or corresponds to a Boolean function with more than one elementary operation.

7. The method according to claim 1, wherein at least one intermediate relation is provided by determining an H-representation of a convex polyhedron for one of the cryptographic operations.

8. The method according to claim 1, wherein at least one intermediate relation is provided by determining, for one of the cryptographic operations acting on a finite field, a further operation acting on a further finite field of lower order.

9. The method according to claim 1, wherein the optimization problem is a mixed-integer linear program, a mixed-integer nonlinear program, or a quadratic unconstrained binary optimization problem.

10. The method according to claim 1, wherein the optimization expression is an optimization constraint, or is contained in an objective function of the optimization problem.

11. The method according to claim 1, wherein the plaintext comprises a first plaintext and a second plaintext, and the ciphertext comprises a first ciphertext and a second ciphertext, wherein the first ciphertext has been determined from the first plaintext using the cryptographic key and the cryptographic procedure, and the second ciphertext has been determined from the second plaintext using the cryptographic key and the cryptographic procedure.

12. The method according to claim 1, wherein the optimization problem is at least partially solved in a quantum processing device of the data processing system, preferably a quantum annealing device.

13. The method according to claim 12, wherein the optimization variables are assigned to a superposition of quantum states.

14. A data processing system configured to determine a cryptographic key by performing the following steps: providing a plaintext and a ciphertext determined from the plaintext using a cryptographic key and a cryptographic procedure which comprises cryptographic operations;for each cryptographic operation of the cryptographic procedure, providing at least one intermediate relation which comprises an intermediate equation and/or an intermediate inequality;determining an optimization problem comprisingthe plaintext and the ciphertext,at least one optimization expression assigned to a round of the cryptographic procedure, andoptimization variables comprising state variables of the cryptographic procedure and a cryptographic key variable,wherein the at least one optimization expression is determined from the at least one intermediate relation and comprises at least one preceding state variable assigned to a preceding round; andsolving the optimization problem and determining the cryptographic key from an optimizing value of the cryptographic key variable.