![Page 1: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/1.jpg)
Cold War Crypto, Correlation Attacks,
DC, LC, T-310, Weak Keys and Backdoors
Nicolas T. CourtoisUniversity College London, UK
![Page 2: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/2.jpg)
Roadmap
2
bugs or backdoors?
False Backdoors = def =
strong properties of ciphers/systems/RNGs which are maybe dangerous…
![Page 3: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/3.jpg)
Algebraic Attacks on Stream Ciphers
3
Any Backdoors?
RNG
Block and Stream Ciphers
Backdoors
easy methods
Practical Security Solutions
much harder
![Page 4: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/4.jpg)
Code Breakers
4
Bad Randoms – 1930s – Enigma Message Keys
Operators always found a way to «degrade » their security
(should be 3 random letters)
AAA
XYZ
![Page 5: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/5.jpg)
Code Breakers
Nicolas T. Courtois5
Crypto History
![Page 6: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/6.jpg)
Code Breakers
Nicolas T. Courtois6
HistoCrypt / Euro-HCC
18-19 May 2017, Slovakia
![Page 7: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/7.jpg)
Code Breakers
Nicolas T. Courtois7
18-19 May Program
![Page 8: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/8.jpg)
Crypto Currencies
8
![Page 9: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/9.jpg)
Roadmap
9
Post-WW2 Crypto
History
![Page 10: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/10.jpg)
Bugs or Backdoors?
10
1960sNATO Cipher competition
• UK
• US
• France
• Germany
Requirements:
• “tapeless and rotorless” => semi-conductor electronic,
• high EM/SCA security!
![Page 11: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/11.jpg)
Backdoors
Nicolas T. Courtois11
French Submission
• large period, non-linearity / removing the correlations (p.108)“…certainement la meilleure machine cryptographique de son époque…"??????????????????????????????????????????????????????????
[2004]
![Page 12: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/12.jpg)
Code Breakers
12
Compromise of Old Crypto
• USS Pueblo / North KoreaJan 1968
![Page 13: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/13.jpg)
GOST, Self-Similarity and Cryptanalysis of Block Ciphers
© Nicolas T. Courtois, 2006-201313
US/NATO crypto broken
Russia broke the NATO KW-7 cipher machine: Walker spy ring, rotors+keys,
• paid more than 1M USD (source: NSA)
• “greatest exploit in KGB history”
• allowed Soviets to “read millions”of US messages [1989, Washington Post]
![Page 14: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/14.jpg)
Bugs or Backdoors?
14
1970sModern block ciphers are born.
In which country??
![Page 15: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/15.jpg)
Bugs or Backdoors?
15
1970sModern block ciphers are born.
In which country??
Who knows…
![Page 16: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/16.jpg)
Backdoors
Nicolas T. Courtois16
Our Sources
![Page 17: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/17.jpg)
Backdoors
Nicolas T. Courtois17
![Page 18: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/18.jpg)
Backdoors
Nicolas T. Courtois18
MfS = Ministerium für Staatssicherheit =
Ministry of State Security of GDR = Stasi
MfS Abteilung 11 = ZCO = Zentrales Chiffrierorgan
der DDR
![Page 19: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/19.jpg)
Backdoors
19
BStU
BStU = Bundesbeauftragter
= Stasi Records Agency =
a.k.a. Birthler authority
![Page 20: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/20.jpg)
Backdoors
Nicolas T. Courtois20
Our Sources
BStU = Stasi Records Agency
ZCO = Zentrales Chiffrierorgan
der DDR
![Page 21: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/21.jpg)
Bugs or Backdoors?
21
How do you say “ZCO” in Russian?
![Page 22: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/22.jpg)
Bugs or Backdoors?
22
How do you say “ZCO” in Russian?
![Page 23: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/23.jpg)
T-310
Nicolas T. Courtois23
East German SKS V/1 and T-310
240 bits
long-term secret 90 bits only!
“quasi-absolute security” [1973-1990]
has a physical
RNG=>IV
![Page 24: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/24.jpg)
Bugs or Backdoors?
24
Block Cipher Class Alpha = c.1970
obscure origins…
[full document not avail.]
![Page 25: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/25.jpg)
Bugs or Backdoors?
25
Differential Cryptanalysis = DC
Wikipedia DC entry says: In 1994 […] IBM […] Coppersmith published a paper stating that DC was known to IBM as early as 1974.
[…] IBM had discovered differential cryptanalysis on its own […] NSA was apparently well aware of the technique.
Coppersmith explains: "After discussions with NSA, it was decided that disclosure of the design considerations would reveal the technique of DC, a powerful technique that could be used against many ciphers. This in turn would weaken the competitive advantage the United States enjoyed over other countries in the field of cryptography.
![Page 26: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/26.jpg)
Security of DES (overview)
26
“Official” History
• Davies-Murphy attack [1982=classified, published in 1995] = early LC
• Shamir Paper [1985]……… early LC
• Differential Cryptanalysis :Biham-Shamir [1991]
• Linear Cryptanalysis: Gilbert and Matsui [1992-93]
![Page 27: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/27.jpg)
Bugs or Backdoors?
27
One form of DC was known in 1973!
![Page 28: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/28.jpg)
Bugs or Backdoors?
28
LC at ZCO - 1976!
![Page 29: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/29.jpg)
Bugs or Backdoors?
29
Discrete Differentials and HO DC – 1976 !
Higher Order:
![Page 30: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/30.jpg)
Bugs or Backdoors?
30
Computation of Differentials for All Orders
.
.
.
![Page 31: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/31.jpg)
Security of DES (overview)
31
1970s, not 1990s…
• Differential Cryptanalysis Biham-Shamir 1991
• Linear Cryptanalysis: Gilbert and Matsui 1992-93
![Page 32: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/32.jpg)
Backdoors
Nicolas T. Courtois32
Contracting Feistel [1970s Eastern Germany!]
1 round of T-310
φ
![Page 33: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/33.jpg)
Backdoors
33
How to Backdoor T-310 [to appear in 2017]
bad long-term key
omit just 1 out of 40 conditions: ciphertext-only
![Page 34: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/34.jpg)
Roadmap
34
bugs or backdoors?
False Backdoors = longer def =
strong properties of ciphers/systems/RNGs which exist for NO apparent reason and which are clearly counter-productive or harmful. • in some cases a really good attack was never found!
• or maybe we just discovered ½ of what we need to uncover?
![Page 35: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/35.jpg)
Backdoors
Nicolas T. Courtois35
Mystery Paper - Shamir 1985
Mystery thing.
Related to LC published 8 years later.
![Page 36: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/36.jpg)
Backdoors
36
** Shamir 1985
![Page 37: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/37.jpg)
Backdoors
37
Shamir 1985
x_2 y_1 y_2 y_3 y_4 .
Common to all S-boxes !!!!
Mystery never explained, super strong pty, We found more such properties [Courtois, Goubin, Castagnos 2003/184]
![Page 38: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/38.jpg)
Backdoors
38
Another Method to Backdoor T-310
bad long-term key1,3,5 => 1,3,5 P=1
703P=7,14,33,23,18,36,5,2,9,16,30,12,32,26,21,1,13,25,20,8,24,15,22,29,10,28,6D=0,4,24,12,16,32,28,36,20
![Page 39: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/39.jpg)
Backdoors
39
Another Method to Backdoor T-310
bad long-term key1,3,5 => 1,3,5 P=1
703P=7,14,33,23,18,36,5,2,9,16,30,12,32,26,21,1,13,25,20,8,24,15,22,29,10,28,6D=0,4,24,12,16,32,28,36,20
Backdoor NOT KT1 compliant
![Page 40: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/40.jpg)
Better Card-only Attacks on Mifare Classic
Nicolas T. Courtois, 2009-1740
New Backdoors [to appear in 2017]
Level 1: Non-bijective φ – ALL broken! See:
1. Nicolas T. Courtois, Maria-BristenaOprisanu: “Ciphertext-Only Attacks and Weak Long-Term Keys in T-310”
and our long extended master paper:
2. Courtois et al, “Cryptographic Security Analysis of T-310”, eprint.iacr.org/2017/440.
![Page 41: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/41.jpg)
Better Card-only Attacks on Mifare Classic
Nicolas T. Courtois, 2009-1741
New Backdoors [to appear in 2017]
Level 2: Bijective φ – secure???
• New attack to be published in 2017.
![Page 42: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/42.jpg)
Better Card-only Attacks on Mifare Classic
Nicolas T. Courtois, 2009-1742
New Backdoors [to appear in 2017]
Level 2: Bijective φ and KT1 compliant –secure???
• Fact: some KT1 keys have 10 Linear approximations true with P=1. Cf. 2017/440.
• Not exploitable due to super-paranoid low-rate cipher mode.
=>A percentage of keys is also broken, another NEW attack to be published soon.
![Page 43: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/43.jpg)
Roadmap
43
Open Problems
– Backdoor symmetric encryption?
![Page 44: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/44.jpg)
Bugs or Backdoors?
© Nicolas T. Courtois, 2006-201344
GOST Cipher
![Page 45: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/45.jpg)
Bugs or Backdoors?
© Nicolas T. Courtois, 2006-201345
GOST 28148-89
• Developed in the 1970s, or the 1980s,
– First "Top Secret" / Type 1/Type A algorithm.
– Downgraded to "Secret" in 1990.
• Declassified in 1994.
![Page 46: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/46.jpg)
Bugs or Backdoors?
© Nicolas T. Courtois, 2006-201346
Seki-Kaneko Split
0x70707070,0x070707071-35-7
![Page 47: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/47.jpg)
Bugs or Backdoors?
© Nicolas T. Courtois, 2006-201347
0x80700700,0x80700700 [Courtois-Misztal 2011]
Type 3+3: S836 + S836
![Page 48: Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak ... · Cold War Crypto, Correlation Attacks, DC, LC, T-310, Weak Keys and Backdoors Nicolas T. Courtois University College](https://reader034.vdocuments.site/reader034/viewer/2022042712/5f977338f2d0f033a75cdd52/html5/thumbnails/48.jpg)
Bugs or Backdoors?
© Nicolas T. Courtois, 2006-201348
0x80700700,0x80700700Type 3+3: S836 + S836