The problem of finding a minimal circuit to implement a given function is one of the oldest in electronics. It is known to be NP-hard. Still, many tools exist to find sub-optimal circuits to implement a function. In electronics, such tools are known as synthesisers. However, these synthesisers aim to implement very large functions (a whole electronic chip). In cryptography, the focus is on small functions, hence the necessity for new dedicated tools for small functions. Several tools exist to implement small functions. They differ by their algorithmic approach (some are based on Depth-First-Search as introduced by Ullrich in 2011, some are based on SAT-solvers like the tool desgined by Stoffelen in 2016, some non-generic tools use subfield decomposition) and by their optimisation criteria (some optimise for circuit size, others for circuit depth, and some for side-channel-protected implementations). However, these tools are limited to functions operating on less than 5 bits, sometimes 6 bits for quadratic functions, or to very simple functions. The limitation lies in a high computing time. We propose a new tool (The tool is provided alongside the IEEE article with CodeOcean and athttps://github.com/seduval/implem-quad-sbox) to implement quadratic functions up to 9 bits within AND-depth 1, minimising the number of AND gates. This tool is more time-efficient than previous ones, allowing to explore larger implementations than others on 6 bits or less and allows to reach larger sizes, up to 9 bits.

In this article, we propose an instantiation, called${\sf Stanislas}$, of a dedicated Self-Synchronizing Stream Cipher (SSSC) involving an automaton with finite input memory using non-triangular state transition functions. Previous existing SSSC are based on automata with shifts or triangular functions ($T$–functions) as state transition functions. Our algorithm${\sf Stanislas}$admits a matrix representation deduced from a general and systematic methodology called Linear Parameter Varying (LPV). This particular representation comes from the automatic theory and from a special property of dynamical systems called flatness. Hardware implementations and comparisons with some state-of-the-art stream ciphers on Xilinx FPGAs are presented. It turns out that${\sf Stanislas}$provides bigger throughput than the considered stream ciphers (synchronous and self-synchronizing) when straightforward implementations are considered. Moreover, its synchronization delay is much smaller than the SSSC Moustique (40 clock cycles instead of 105) and the standard approach CFB1-AES128 (40 clock cycles instead of 128).

We describe Constraint Programming (CP) models to solve a cryptanalytic problem: the chosen key differential attack against the standard block cipher AES. We show that CP solvers are able to solve these problems quicker than dedicated cryptanalysis tools, and we prove that a solution claimed to be optimal in two recent cryptanalysis papers is not optimal by providing a better solution.

While Generalized Feistel Networks (GFNs) have been widely studied in the literature as a building block of a block cipher, we recall in this paper the results of [1] where a unified vision to easily represent them through a matrix representation is proposed. We also introduce a new class of such schemes called Extended Generalized Feistel Networks well suited for cryptographic applications. We instantiate this particular construction into a lightweight block cipher called Lilliput analyzing its security and its hardware performances.

This paper focuses on the resilience of routing protocols against malicious insiders willing to disrupt communications. Previous study showed that introducing randomness and data replication enhances the resilience of routing protocols. It makes them unpredictable for an attacker and provides route diversification. We propose a theoretical framework of the resilience based on biased random walks on a torus lattice. The objective is to evaluate analytically the influence of bias and data replication introduced to random walks. The bias allows to decrease the route length, thus reducing the probability of a data packet to meet a malicious insider along the route; however, it also decreases the degree of randomness (entropy). When combined with data replication, the reliability is improved thanks to route diversity despite an additional overhead in terms of energy consumption. The main goal is to provide a good tradeoff between shortest path and route diversity for a reasonable cost.

Abstract For security applications in wireless sensor networks (WSNs), choosing best algorithms in terms of energy‐efficiency and of small memory requirements is a real challenge because the sensor networks are composed of low‐power entities. In some previous works, 12 block‐ciphers have been benchmarked on an ATMEL AVR ATtiny45 8‐bit microcontroller and the best candidates to use in the context of small embedded platforms have been deduced. This article proposes to study on the TI 16‐bit microcontroller MSP430 most of the recent lightweight block cipher proposals as well as some conventional block ciphers. First, we describe the design of the chosen block ciphers with a security and an implementation summary and we then present some implementation tests performed on our dedicated platform. Copyright © 2015 John Wiley & Sons, Ltd.

The operations of smart metering heavily rely on the communication network for efficient data gathering, thus eliminating manual meter reading. Smart electronic devices are deployed in open, unattended and possibly hostile environment such as consumer's home and office areas, making them particularly vulnerable to physical attacks. Resilience is needed to mitigate such inherent vulnerabilities and risks related to security and reliability. In this article, a general overview of the resilience including definition, metric and resilient techniques relevant for smart metering is presented. A quantitative metric, visual and meaningful, based on the graphical representation is adopted to compare routing protocols in the sense of resilience against active insider attacks. Five well-known routing protocols from the main categories have been studied through simulations and their resilience is evaluated according to the given metric. Resilient techniques introduced to these protocols have enhanced significantly the resilience against attacks providing route diversification.

Sensors are commonly deployed in hostile environment, and consequently a number of research works have focused on data aggregation schemes designed to be tolerant to attacks on sensor nodes. In parallel, schemes ensuring the confidentiality of sensor data have been proposed to address the emerging privacy concerns. We note that resilience against tampering attacks requires access to the sensor node's data, while in privacy-preserving systems this data must remain confidential. In this work, we aim to reconcile these two seemingly conflicting objectives. We present a novel private and resilient aggregation system, in which an aggregator combines the data collected from sensor nodes and forwards the resulting sum to an analyst. Our scheme protects the privacy of the users from both honest-but-curious aggregator and analyst, while enabling the filtering of fake data values using a Private Range Test protocol.

Little effort has been made to compare routing protocols according to their resiliency in wireless multi-hop sensor networks in the presence of packet dropping malicious insiders. In this paper, we propose a new taxonomy of routing protocols obtained by applying our resiliency metric. Several resiliency enhancing methods such as introducing a random behavior to the classical routing protocols and a new data replication method based on the distance information have been evaluated as well. Simulation results demonstrate the effectiveness of the proposed approach.

SUMMARY Recent advances in information theory and networking, e.g. aggregation, network coding or rateless codes, have significantly modified data dissemination in wireless networks. These new paradigms create new threats for security such as pollution attacks and denial of services (DoS). These attacks exploit the difficulty to authenticate data in such contexts. The particular case of xor network coding is considered herein. We investigate different strategies based on message authentication codes algorithms (MACs) to thwart these attacks. Yet, classical MAC designs are not compatible with the linear combination of network coding. Fortunately, MACs based on universal hash functions (UHFs) match nicely the needs of network coding: some of these functions are linear h(x1⊕x2) = h(x1)⊕h(x2). To demonstrate their efficiency, we consider the case of wireless sensor networks (WSNs). Although these functions can drastically reduce the energy consumption of authentication (up to 68% gain over the classical designs is observed), they increase the threat of DoS. Indeed, an adversary can disrupt all communications by polluting few messages. To overcome this problem, a group testing algorithm is introduced for authentication resulting in a complexity linear in the number of attacks. The energy consumption is analyzed for cross‐point and butterfly network topologies with respect to the possible attack scenarios. The results highlight the trade‐offs between energy efficiency, authentication and the effective throughput for the different MAC modes. Copyright © 2011 John Wiley & Sons, Ltd.

Network coding has attracted the attention of many researchers in security and cryptography. While most of the works have been dedicated to the protection of messages carrying information, nothing has been done to protect the acknowledgment messages needed in network coding. These flooding attacks are critical in resource constraint networks such as wireless sensor networks. An adversary can easily create congestion in the network and exhaust all the resources available. The degradation of the QoS (delay, energy) goes beyond the capabilities of cryptographic solutions. We investigate the security capabilities of multipath acknowledgment.

Linear finite state machines (LFSMs) are particular primitives widely used in information theory, coding theory and cryptography. Among those linear automata, a particular case of study is linear feedback shift registers (LFSRs) used in many cryptographic applications such as design of stream ciphers or pseudo-random generation. LFSRs could be seen as particular LFSMs without inputs. In this paper, we first recall the description of LFSMs using traditional matrices representation. Then, we introduce a new matrices representation with polynomial fractional coefficients. This new representation leads to sparse representations and implementations. As direct applications, we focus our work on the Windmill generators case, used for example in the E0 stream cipher and on other general applications that use this new representation. In a second part, a new design criterion called diffusion delay for LFSRs is introduced and well compared with existing related notions. This criterion represents the diffusion capacity of an LFSR. Thus, using the matrices representation, we present a new algorithm to randomly pick LFSRs with good properties (including the new one) and sparse descriptions dedicated to hardware and software designs. We present some examples of LFSRs generated using our algorithm to show the relevance of our approach.

The recent advances in information theory and networking have significantly modified the way to disseminate data in wireless sensor networks (WSNs): aggregation, network coding or rateless codes. These new paradigms of dissemination create new threats for security such as pollution attacks. These attacks exploit the difficulty to protect data integrity in those contexts. In this paper, we consider the particular case of xor network coding. We compare the different strategies based on message authentication codes algorithms (MACs) to thwart these attacks. We emphasize the advantages of universal hash functions (UHFs) in terms of flexibility and efficiency. These schemes reduce the energy consumption by 42% and 68% (according to the used protocol) for the relaying nodes over those based on classical cryptographic primitives without any loss in security. The key feature of the UHFs considered here is their homomorphic property (h(x1⊕ x2)=h(x1) ⊕ h(x2)). These homomorphic MACs offer more possibilities for the relying nodes than the classical cryptographic ones: the detection time of a pollution attack can be adjusted to preserve the nodes energy. Moreover, they can be computed with the low resources of a sensor.

Wireless sensor networks (WSNs) are composed of a large number of low-cost, low-power, and multi-functional sensor nodes that communicate at short distance through wireless links. They are usually deployed in an open and uncontrolled environment where attackers may be present. Due to the use of low-cost materials, hardware components are not tamper-resistant and an adversary could access a sensor's internal state. An adversary can easily capture even a single node and inserts duplicated nodes at any location in the network. If no specific detection mechanisms are established, the attacker could lead many insidious attacks such as subverting data aggregation protocols by injecting false data, revoking legitimate nodes and disconnecting the network if the replicated nodes are judiciously placed at chosen locations. In this paper, we propose a hierarchical distributed algorithm for detecting node replication attacks using a Bloom filter mechanism and a cluster head selection, we also introduce the adequate network replies in case of detection. We also present simulation results for random topologies and show that our algorithm is able to detect replication attacks in all cases.

Wormhole attacks enable an attacker with limited resources and no cryptographic material to disrupt wireless networks. In a wormhole attack, an attacker records packets (or bits) at one location in the network, tunnels them (possibly selectively) to another location and retransmits them there into the network. In this paper, we present an algorithm for detecting and thus defending against wormhole attacks in wireless multi-hop networks. This algorithm uses only local and neighborhood information without requiring clock synchronization, location information or dedicated hardware. Moreover, the algorithm is independent of wireless communication models. We present simulation results for grid-like topologies and for random topologies and show that the algorithm is able to detect wormhole attacks in all cases whereas the number of false alarms (false detections) decreases rapidly if the network is sufficiently dense.

This article describes new theoretical results concerning the general behavior of a feedback with carry shift register (FCSR) automaton. They help to better understand how the initial parameters must be chosen to use this automaton as a basic block of a filtered stream cipher. These results especially concern the structure of the transition graph of an FCSR automaton and the number of iterations of the FCSR transition function required to reach the main part of the graph. A potential linear weakness and a easy way to prevent the corresponding attack are also given.