vulcan-cryptanalysis

... k
k 127 000
7-bitvaddressvselects
1vbitvofvcryptovariable
z -1 z -1 z -1 z -1 z -1 z -1 z -1 z -1 z -1 z -1 z -1 z -1 z -1 z -1 z -1 z -1 z -1 z -1 z -1 z -1 z -1
z -1 z -1 z -1 z -1 z -1 z -1 z -1 z -1 z -1
k 137 k 136 k 135 k 134 k 133 k 132 k 131 k 130
z -1
plaintext
in
differential
encoder
ciphertext
out
Figure 4: Vulcan Cipher Encrypt
The most recent seven ciphertext bits in the ciphertext shift register form a 7-
bit address to the SRAM, addressing one bit of the first 128 bits of cryptovariable
(k 000 ...k 127 ). The specifically addressed bit of cryptovariable transfers to an
XOR gate at the far right of the ciphertext shift register, where it adds modulo-
2 to the 21st bit of ciphertext. The bit resulting from this XOR then enters
the modified ciphertext shift register, which holds 10 bits (only 9 of which are
shown).
The bits in the modified ciphertext shift register are added modulo-2 to the
plaintext bit, under conditional control of the last 8 cryptovariable bits (with
the exception of the last bit in the modified ciphertext shift register). In effect,
the 8 bits of cryptovariable (k 130 ...k 137 ) act as switches that either enable or
disable the corresponding XOR gate.
If the given cryptovariable bit is 1, then the corresponding XOR gate adds
the modified ciphertext bit to the partial ciphering result. If the given cryptovariable
bit is 0, then the XOR gate is disabled and the partial ciphering result
simply passes on to the next XOR gate unmodified.
Although the GF (2) multiplication (equivalent to a logical AND) shown here
is nonlinear, we can think of the overall effect of this multiply as simply enabling
or disabling the GF (2) addition (logical XOR) for this stage of the operation.
This perspective becomes important when we attempt cryptanalysis of Vulcan
in a later section.
A quick review of the XOR tree and its associated circuitry on the SC76807
IC reveals that the XOR tree has a total of 10 stages, whereas we show only 9
stages in Figure 4. This is because the logic of the last two stages is different
from that of the first eight stages.
The last stage of the XOR tree, which would have been controlled by cryptovariable
bit k 128 , simply passes its input to its output without modification.
This is why we omitted it from Figure 4.
The second to last stage of the XOR tree always adds the modified ciphertext
bit to the partial ciphering result, which is why this stage lacks the AND gate
that would have been controlled by cryptovariable bit k 129 .
As a consequence of how the last two stages of the XOR tree operate, cryptovariable
bits k 128 and k 129 have no effect whatsoever. Not surprisingly, these
14