1 CIS 5371 Cryptography 5a. Pseudorandom Objects in Practice Block Ciphers B ased on: Jonathan Katz and Yehuda Lindell Introduction to Modern Cryptography

2 Block ciphers as encryption schemes or pseudorandom permutations  Block ciphers should be viewed as pseudorandom permutations and not as encryption schemes.  Block ciphers should be viewed as basic building blocks for symmetric key applications as not just as encryption schemes themselves.

3 Block ciphers in practice and Definition 3.28  Although we consider block ciphers as pseudorandom permutations, practical constructions of block ciphers do not quite meet the definition.  Practical block ciphers are defined for one (or a few) key and block lengths.  This is in contrast to Definition 3.28 that refers to all possible key and block lengths.

4 Substitution-Permutation Networks

5  A substitution-permutation network is a direct implementation of this paradigm.  The substitution component refers to small random functions, called S-boxes and the permutation component refers to the mixing of the outputs of the random functions.  The permutation involves the reordering of the output bits and are called mixing permutations.

6  The secret key  One possibility is to have the key specify the S-boxes and mixing permutations.  Another possibility is to mix the key into the computation in between each round of substitution- permutation. This option is commonly used.

7  The basic idea is to break the input up into small parts and then feed these parts through different S-boxes (random permutations).  The outputs are then mixed together  The process is repeated a given number of times, called a rounds.  The S-boxes introduce confusion into the construction.  In order to spread the confusion throughout, the results are mixed together, achieving diffusion.

8 Single round of substitution-permutation network

9 The avalanche effect  An important property in any block cipher is that small changes to the input must result in large changes to the output.  To ensure this, block ciphers are designed so that small changes in the input propagate quickly to very large changes in the intermediate values.

10 The avalanche effect It is easy to demonstrate that the avalanche effect holds in a substitution-permutation network, when the following hold: 1.The S-boxes are designed so that any change of at least a single bit to the input to an S-box results in a change of at least two bits in the output. 2.The mixing permutations are designed so that the output bits of any given S-box are spread into different S-boxes in the next round.

11 Feistel Networks  A Feistel network is an alternative way of constructing a block cipher.  The low-level building blocks (S-boxes, mixing permutations and key schedule) are the same.  The difference is in the high-level design.  The advantage of Feistel networks over substitution permutation networks is that they enable the use of S-boxes that are not necessarily invertible.

12 Feistel Networks  This is important because a good block cipher has chaotic behavior (it should look random).  Requiring that all of the components of the construction be invertible inherently introduces structure, which contradicts the need for chaos.

13 Feistel Networks  A Feistel network is thus a way of constructing an invertible function from non-invertible components.  This seems like a contradiction in terms---if you cannot invert the components, how can you invert the overall structure.  Nevertheless, the Feistel design ingeniously overcomes this obstacle.

14 A Feistel network

15 mmm mm mmm m mm mmm m Feistel Network.