1. 1 Lect. 7 : Data Encryption Standard

2. 2 Data Encryption Standard (DES)  DES - History 1976 – adopted as a federal standard 1977 – official publication as FIPS PUB 46 1983, 1987, 1993 – recertified for another 5 years  Design Criteria of DES Provide a high level of security Completely specify and easy to understand Security must depend on hidden key, not algorithm Available to all users Adaptable for use in diverse applications Economically implementable in electronic device Able to be validated Exportable DES Plaintext block 64 bits Ciphertext block 64 bits Key 56 bits * Federal Information Processing Standards

3. 3 DES Overview P K IP f FP PC-2 C 16 Round PC-1 Rot R0(32) L0(32) R16L16 PC-2 64 56 64 Round function Key Scheduling

4. 4 DES Overview Plaintext M ( 64 ) IP –1 LE 0 ( 32 ) RE 0 ( 32 ) LE 1 ( 32 ) RE 1 ( 32 ) LE 2 ( 32 ) RE 2 ( 32 ) LE 15 ( 32 ) RE 15 ( 32 ) RE 16 ( 32 ) LE 16 ( 32 ) K1K1 K2K2 K3K3 f f f IP Ciphertext C ( 64 ) K 16 f

5. 5 Initial Permutation and Final Permutation 585042342618102 605244362820124 625446383022146 645648403224168 57494133251791 595143352719113 615345372921135 635547393123157 408481656246432 397471555236331 386461454226230 375451353216129 364441252206028 353431151195927 342421050185826 33141949175725 IP (Initial permutation) IP –1 (Final permutation) cf.) The 58th bit of x is the first bit of IP(x)

6. 6 Function f(k i,RE i-1 ) RE i-1 ( 32bits ) K i (48bits) E 48bits S1S1 S2S2 S3S3 S4S4 S5S5 S8S8 P 32bits S6S6 S7S7 Expansion E Permutation P S-box

7. 7 Expansion E and Permutation P 3212345 456789 8910111213 121314151617 161718192021 202122232425 242526272829 28293031321 1672021 29122817 1152326 5183110 282414 322739 1913306 2211425 Expansion E Permutation P cf.) 32-bits are expanded into 48-bits. Some bits are selected more than once. 32-bit  32-bit permutation

8. 8 S-box (substitution box) S1S1 b 1 b 2 b 3 b 4 b 5 b 6 Sb 1 Sb 2 Sb 3 Sb 4 Look-up a value from the table using b 1 b 6 : row b 2 b 3 b 4 b 5 : column Sb 1 1441312151183106125907 0157414213110612119538 4114813621115129731050 1512824917511314100613 S 1 -box table 01230123 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 b 2 b 3 b 4 b 5 : column b 1 b 6 : row

9. 9 DES S-Boxes S 3 -box 10 0 9 14 6 3 15 5 1 13 12 7 11 4 2 8 13 7 0 9 3 4 6 10 2 8 5 14 12 11 15 1 13 6 4 9 8 15 3 0 11 1 2 12 5 10 14 7 1 10 13 0 6 9 8 7 4 15 14 3 11 5 2 12 S 4 -box 7 13 14 3 0 6 9 10 1 2 8 5 11 12 4 15 13 8 11 5 6 15 0 3 4 7 2 12 1 10 14 9 10 6 9 0 12 11 7 13 15 1 3 14 5 2 8 4 3 15 0 6 10 1 13 8 9 4 5 11 12 7 2 14

10. 10 DES S-boxes  8 S-boxes (6  4 bits)  some known design criteria not linear Any one bit of the inputs changes at least two output bits S(x) and S(x  001100) differs at least 2bits S(x)  S(x  11ef00) for any ef Resistance against DC etc. The actual design principles have never been revealed (US classified information) HW : For the S 4 -box, check whether the following property holds S 4 (x) and S 4 (x  001100) differs at least 2bits

11. 11 Key Scheduling Key ( 64 ) C 0 ( 28 ) D 0 ( 28 ) LS 1 C 1 ( 28 ) D 1 ( 28 ) LS 2 C 2 ( 28 ) D 2 ( 28 ) LS 16 C 16 ( 28 ) D 16 ( 28 ) PC 2 K1K1 PC 1 PC 2 K2K2 K 16

12. 12 PC 1 5749413325179 1585042342618 1025951433527 1911360524436 63554739312315 7625446383022 1466153453729 211352820124 64 bit -> 56 bit (Actual key size of DES is 56-bit) cf.) Do not use the parity check bits preventing from input error. 8 16 24 32 40 48 56 64 was not selected.

13. 13 PC 2 1417112415 3281562110 2319124268 1672720132 415231374755 304051453348 444939563453 464250362932 56 bit -> 48 bit Note that 9, 18, 22, 25, 35, 38, 43 and 54 th positions was not selected.

14. 14 Left Shift LS s IterationShiftIterationShift LS 1 1LS 9 1 LS 2 1LS 10 2 LS 3 2LS 11 2 LS 4 2LS 12 2 LS 5 2LS 13 2 LS 6 2LS 14 2 LS 7 2LS 15 2 LS 8 2LS 16 1

15. 15 Breaking DES(1/2)  DES Crack Machine Can test over 90 billion keys per second EFF's "Deep Crack" and the Distributed.Net computers were testing 245 billion keys per second On Jan. 19, 1999, RSA DES-III Challenge was deciphered after searching 22h. and 15m.  DES - Controversies Unknown design criteria Slow in software Too short key size – 56 bits http://www.rsa.com/rsalabs/node.asp?id=2108 Identifier: DES-Challenge-III Cipher: DES Start: January 18, 1999 9:00 AM PST Prize: $10,000 IV: da 4b be f1 6b 6e 98 3d Plaintext: See you in Rome (second AES Conference, March 22-23, 1999)

16. 250,000$@ 1998 10,000$@2008 Breaking DES(2/2)

17. 17 Double DES & Triple DES  How to strengthen existing DES implementations ?  Double DES  Essentially no security increase: E K1 (P) = X = D K2 (C) Meet-in-the-middle attack ! E E K1K1 P X C K2K2 D D K2K2 C X P K1K1  Triple DES  Three-key or Two-key 3DES: K 1 = K 3 E D K1K1 P A C K2K2 E B K3K3 D E K3K3 C B P K2K2 D A K1K1