1. Block Cipher- introduction
DES
Description: Feistel, S-box
Exhaustive Search, DC and LC
Modes of Operation
AES
Description: SPN, Branch number
Security and Efficiency
Other Ciphers
Linear layer
Confusion layer

2. (Data Encryption Standard)
DES
(Data Encryption Standard)

3. “Communication Theory for Secrecy System “, C. Shannon,1949
Confusion:
The ciphertext statistics should depend on the plaintext statistics in a manner too complicated to be exploited by the enemy cryptanalyst
Diffusion:
Each digit of the plaintext should influence many digits of the ciphertext, and/or
Each digit of the secret key should influence many digits of the the ciphertext.
Block cipher:
A repetition of confusion(Substitution) and diffusion(Permutation)
Iteration: Weak  Strong
Claude Shannon

4. News on Shannon’s Death

5. Block Cipher Definition: Characteristics
Let Bn denote the set of bit strings of length n.
A block cipher is an encryption algorithm E such that EK is a permutation of Bn for each key K
Characteristics
Based on Shannon’s Theorem(1949)
Same P => Same C
{|P| = |C|}  64 bit, |P|  |K|  56 bit
Memoryless configuration
Operate as stream cipher depending on mode
Shortcut cryptanalysis (DC, LC etc) in 90’s
* DC: Differential Cryptanalysis, LC: Linear Cryptanalysis

6. Design Criteria of DES Provide a high level of security
Completely specify and easy to understand
Security must depend on hidden key, not algorithm
Available to all users
Adaptable for use in diverse applications
Economically implementable in electronic device
Efficient to use
Able to be validated
Exportable
* Federal Register, May 15, 1973

7. DES(Data Encryption Standard)
Based on Lucifer (1972)
Developed by IBM and intervened by NSA
Adopted Federal Standard by NIST, revised every 5 years (~’98),
64bit block cipher, 56bit key
16 Round, Nonlinearity : S-box
Cryptanalysis like DC, LC, etc. after 1992
* DC:Differential Cryptanalysis, LC : Linear Cryptanalysis

8. FIPS Documents
FIPS PUB 46-3, Data Encryption Standard”, 1977(83,88,93) (*)
FIPS PUB 81, “DES modes of operation”,1980(*)
FIPS PUB 74, “Guidelines for implementing and using the NBS Data Encryption Standard”, 1981(*)
FIPS PUB 113, “Computer Data Authentication”, 1985
FIPS PUB 140-2, “Security Requirements for Cryptographic Modules”, 2001
* Federal Notice (July 26, 2004) Announcing Proposed Withdrawal of Federal Information Processing Standard (FIPS) for the Data Encryption Standard (DES) and Request for Comments
“NIST determined that the strength of the DES algorithm is no longer sufficient to adequately protect Federal government information. As a result, NIST proposes to withdraw FIPS 46-3, and the associated FIPS 74 and FIPS 81. Future use of DES by Federal agencies is to be permitted only as a component function of the Triple Data Encryption Algorithm (TDEA). TDEA may be used for the protection of Federal information; however, NIST encourages agencies to implement the faster and stronger algorithm specified by FIPS 197, Advanced Encryption Standard (AES) instead. NIST proposes issuing TDEA implementation guidance as a NIST Recommendation via its ``Special Publication'' series (rather than as a FIPS) as Special Publication , Recommendation for Implementation of the Triple Data Encryption Algorithm (TDEA). “
FIPS: Federal Information Processing Standard

9. Involution structure
If we apply its operation 2 times, it returns to the original value, e.g., f(f(x)) = x.
Type of f-1(x) = f(x)
(a)
(b)
(c)
(d) x1 x2 x1 x2 x1 x2 x1 x2   g y1 y2 y1 y2
y1=x1x2
y2 = x2
y1=x1 g(x2)
or x1 g(x2,k)
y2 = x2

10. Structure of DES K P Key Scheduling C Round function 56 64 IP f FP
PC-2 C
16 Round
PC-1
Rot
R0(32)
L0(32)
R16
L16 64 56
Key Scheduling
Round function

11. Enciphering Computation
* Decryption is done by executing
round key in the reverse order.

12. Initial Permutation & Final PermutationIP
FP= IP-1
cf.) The 58th bit of x is the first bit of IP(x)
IP & FP have no cryptanalytic significance.

13. f-function of DES

14. P Permutation Permutes the order of 32 bits 16 7 20 2 29 12 28 17

15. E Expansion Expands 32 -> 48 bits by duplicating 16 bits twice
cf.) The first 4 bits are expanded into 6 bits by adding the last bit of the last 4 bits at first and the first bit of the second 4 bits at last.

16. DES Key Scheduling

17. Permutated Choice-1(PC-1)
64 -> 56 bits
cf.) Do not use the parity check bits.

18. Permutated Chioce-2 (PC-2)
56 -> 48 bits

19. Rotation Schedule
Rnd
Rot
Total number of rotation = 28
After final rotations, the final round keys return to the input of the 1st round keys.

20. DES S-boxes 8 S-boxes (6 -> 4 bits) each row : permutation of 0-15
4 rows : choose by MSB & LSB of input
some known design criteria
not linear (affine)
Any one bit of the inputs changes at least two output bits
S(x) and S(x  ) differs at least 2bits
S(x)  S(x  11ef00) for any ef={ }
Resistance against DC etc.
The actual design principles have never been revealed (U.S. classified information)

21. DES S-boxes(I) Input values mapping order S1(1 0111 0)=11=(1011)2
L R
S1( )=11=(1011)2

22. DES S-boxes(II) e.g.) S2(010010)= ? S1-box S2-box
S2-box
e.g.) S2(010010)= ?

23. DES S-boxes(III) S3-box S4-box 7 13 14 3 0 6 9 10 1 2 8 5 11 12 4 15
S4-box
S4-box is most linear than others.!!!

24. Criticism of DES Short key size : 112 -> 56 bits by NSA
Classified design criteria
Revision of standard every 5 yrs after 1977 by NIST
No more standard

25. Cryptographic properties
(P,C) dependency with fixed Key : after 5 round
(K,C) dependency with fixed plaintext : after 5 round
Avalanche effect
Cyclic Test : Random function
Algebraic structure : Not a group
i.e., E(K1, E(K2,P))  E(K3,P)

26. Known Weakness of DES Complementary Prop. Weak Key : 4 keys
If C= E(K,P), C = E(K, P)
Weak Key : 4 keys
E(K, E(K,P))=P
Semi-weak Keys : 12 keys (6 pairs)
E(K1, E(K2,P))=P
Key Exhaustive Search : 255