1. Le Trong Ngoc Security Fundamentals (2) Encryption mechanisms 4/2011

2. 1.2 2-5 MODERN BLOCK CIPHERS A symmetric-key modern block cipher encrypts an n-bit block of plaintext or decrypts an n-bit block of ciphertext. The encryption or decryption algorithm uses a k-bit key.

3. 1.3 2-5 Continued A modern block cipher can be designed to act as a substitution cipher or a transposition cipher. To be resistant to exhaustive-search attack, a modern block cipher needs to be designed as a substitution cipher.

4. 1.4 2-5 Continued Full-Size Key Transposition Block Ciphers In a full-size key transposition cipher We need to have n! possible keys, so the key should have [log 2 n!] bits.

5. 1.5 2-5 Continued Full-Size Key Substitution Block Ciphers A full-size key substitution cipher does not transpose bits; it substitutes bits. We can model the substitution cipher as a permutation if we can decode the input and encode the output.

6. 1.6 2-5 Continued

7. 1.7 2-5 Continued A full-size key n-bit transposition cipher or a substitution block cipher can be modeled as a permutation, but their key sizes are different:  Transposition: the key is [log 2 n!] bits long.  Substitution: the key is [log 2 (2n)!] bits long. A partial-key cipher is a group under the composition operation if it is a subgroup of the corresponding full-size key cipher.

8. 1.8 2-5 Continued Modern block ciphers normally are keyed substitution ciphers in which the key allows only partial mappings from the possible inputs to the possible outputs. A P-box (permutation box) parallels the traditional transposition cipher for characters. It transposes bits. P-Boxes

9. 1.9 2-5 Continued Three types of P-boxes

10. 1.10 2-5 Continued S-Box An S-box (substitution box) can be thought of as a miniature substitution cipher. An S-box is an m × n substitution unit, where m and n are not necessarily the same.

11. 1.11 2-5 Continued In an S-box with three inputs and two outputs, we have The S-box is linear because a 1,1 = a 1,2 = a 1,3 = a 2,1 = 1 and a 2,2 = a 2,3 = 0. The relationship can be represented by matrices, as shown below:

12. 1.12 2-5 Continued In an S-box with three inputs and two outputs, we have where multiplication and addition is in GF(2). The S- box is nonlinear because there is no linear relationship between the inputs and the outputs.

13. 1.13 2-5 Continued An S-box may or may not be invertible. In an invertible S-box, the number of input bits should be the same as the number of output bits.

14. 1.14 2-5 Continued An important component in most block ciphers is the exclusive-or operation. Invertibility of the exclusive-or operation

15. 1.15 2-5 Continued The five properties of the exclusive-or operation in the GF(2n) field makes this operation a very interesting component for use in a block cipher: closure, associativity, commutativity, existence of identity, and existence of inverse.

16. 1.16 2-5 Continued Another component found in some modern block ciphers is the circular shift operation. Circular shifting an 8-bit word to the left or right

17. 1.17 2-5 Continued Swap The swap operation is a special case of the circular shift operation where k = n/2. Swap operation on an 8-bit word

18. 1.18 2-5 Continued Split and Combine Two other operations found in some block ciphers are split and combine. Split and combine operations on an 8-bit word

19. 1.19 2-5 Continued Shannon introduced the concept of a product cipher. A product cipher is a complex cipher combining substitution, permutation, and other components discussed in previous sections.

20. 1.20 2-5 Continued Diffusion The idea of diffusion is to hide the relationship between the ciphertext and the plaintext. Diffusion hides the relationship between the ciphertext and the plaintext.

21. 1.21 2-5 Continued Confusion The idea of confusion is to hide the relationship between the ciphertext and the key. Confusion hides the relationship between the ciphertext and the key.

22. 1.22 2-5 Continued Rounds Diffusion and confusion can be achieved using iterated product ciphers where each iteration is a combination of S-boxes, P-boxes, and other components.

23. 1.23 2-5 Continued

24. 1.24 2-5 Continued Diffusion and confusion in a block cipher

25. 1.25 2-5 Continued Modern block ciphers are all product ciphers, but they are divided into two classes. 1. Feistel ciphers 2. Non-Feistel ciphers

26. 1.26 2-5 Continued Feistel Ciphers Feistel designed a very intelligent and interesting cipher that has been used for decades. A Feistel cipher can have three types of components: self-invertible, invertible, and noninvertible.

27. 1.27 2-5 Continued The first thought in Feistel cipher design Diffusion hides the relationship between the ciphertext and the plaintext.

28. 1.28 2-5 Continued Improvement of the previous Feistel design

29. 1.29 2-5 Continued Final design of a Feistel cipher with two rounds

30. 1.30 2-5 Continued Non-Feistel Ciphers A non-Feistel cipher uses only invertible components. A component in the encryption cipher has the corresponding component in the decryption cipher.

31. 1.31 2-5 Continued Attacks on traditional ciphers can also be used on modern block ciphers, but today’s block ciphers resist most of the attacks Attacks on Block Ciphers

32. 1.32 2-5 Continued Differential Cryptanalysis Eli Biham and Adi Shamir introduced the idea of differential cryptanalysis. This is a chosen-plaintext attack.

33. 1.33 2-5 Continued

34. 1.34 2-5 Continued Differential input/output

35. 1.35 2-5 Continued Differential distribution table

36. 1.36 2-5 Continued Differential cryptanalysis is based on a nonuniform differential distribution table of the S-boxes in a block cipher.

37. 1.37 2-5 Continued Linear Cryptanalysis Linear cryptanalysis was presented by Mitsuru Matsui in 1993. The analysis uses known plaintext attacks.

38. 1.38 2-5 Continued In some modern block ciphers, it may happen that some S-boxes are not totally nonlinear; they can be approximated, probabilistically, by some linear functions. where 1 ≤ x ≤ m, 1 ≤ y ≤ n, and 1 ≤ z ≤ n.

39. 1.39 2-6 MODERN STREAM CIPHERS In a modern stream cipher, encryption and decryption are done r bits at a time. We have a plaintext bit stream P = p n …p 2 p 1, a ciphertext bit stream C = c n …c 2 c 1, and a key bit stream K = k n …k 2 k 1, in which p i, c i, and k i are r-bit words.

40. 1.40 2-6 Continued In a modern stream cipher, each r-bit word in the plaintext stream is enciphered using an r-bit word in the key stream to create the corresponding r-bit word in the ciphertext stream. Stream cipher

41. 1.41 2-6 Continued In a synchronous stream cipher the key is independent of the plaintext or ciphertext. One-time pad

42. 1.42 2-6 Continued What is the pattern in the ciphertext of a one-time pad cipher in each of the following cases? a. The plaintext is made of n 0’s. b. The plaintext is made of n 1’s. c. The plaintext is made of alternating 0’s and 1’s. d. The plaintext is a random string of bits.

43. 1.43 2-6 Continued Feedback shift register (FSR) Create a linear feedback shift register with 5 cells in which b 5 = b 4  b 2  b 0.

44. 1.44 2-6 Continued Create a linear feedback shift register with 4 cells in which b 4 = b 1  b 0. Show the value of output for 20 transitions (shifts) if the seed is (0001) 2.

45. 1.45 2-6 Continued In a nonsynchronous stream cipher, each key in the key stream depends on previous plaintext or ciphertext. In a nonsynchronous stream cipher, the key depends on either the plaintext or ciphertext.

46. 1.46 2-7 2-7 Data Encryption Standard In 1973, NIST published a request for proposals for a national symmetric-key cryptosystem. A proposal from IBM, a modification of a project called Lucifer, was accepted as DES. DES was published in the Federal Register in March 1975 as a draft of the Federal Information Processing Standard (FIPS).

47. 1.47 2-7 Continued

48. 1.48 2-7 Continued Find the output of the initial permutation box when the input is given in hexadecimal as:

49. 1.49 2-7 Continued DES uses 16 rounds. Each round of DES is a Feistel cipher.

50. 1.50 2-7 Continued

51. 1.51 2-7 Continued The S-boxes do the real mixing (confusion).

52. 1.52 2-7 Continued The input to S-box 1 is 100011. What is the output? Straight permutation table

53. 1.53 2-7 Continued Cipher and Reverse Cipher First Approach To achieve this goal, one approach is to make the last round (round 16) different from the others; it has only a mixer and no swapper. Alternative Approach We can make all 16 rounds the same by including one swapper to the 16th round and add an extra swapper after that (two swappers cancel the effect of each other).

54. 1.54 2-7 Continued Key generation

55. 1.55 2-7 Continued Parity-bit drop table Number of bits shifts

56. 1.56 2-7 Continued Key-compression table

57. 1.57 2-8 DES ANALYSIS AND SECURITY Critics have used a strong magnifier to analyze DES. Tests have been done to measure the strength of some desired properties in a block cipher. Two desired properties of a block cipher are the avalanche effect and the completeness.

58. 1.58 2-8 Continued To check the avalanche effect in DES, let us encrypt two plaintext blocks (with the same key) that differ only in one bit and observe the differences in the number of bits in each round. Completeness effect Completeness effect means that each bit of the ciphertext needs to depend on many bits on the plaintext.

59. 1.59 2-8 Continued S-Boxe The design provides confusion and diffusion of bits from each round to the next. P-Boxes They provide diffusion of bits. Number of Rounds DES uses sixteen rounds of Feistel ciphers. the ciphertext is thoroughly a random function of plaintext and ciphertext. Design Criteria

60. 1.60 2-8 Continued During the last few years critics have found some weaknesses in DES. Weaknesses in Cipher Design 1. Weaknesses in S-boxes 2. Weaknesses in P-boxes 3. Weaknesses in Key The major criticism of DES regards its key length. Fortunately DES is not a group. This means that we can use double or triple DES to increase the key size.

61. 1.61 2-8 Continued DES, as the first important block cipher, has gone through much scrutiny. Among the attempted attacks, three are of interest: brute-force, differential cryptanalysis, and linear cryptanalysis. Security of DES

62. 1.62 2-8 Continued We have discussed the weakness of short cipher key in DES. Combining this weakness with the key complement weakness, it is clear that DES can be broken using 2 55 encryptions. Brute-Force Attack

63. 1.63 2-8 Continued It has been revealed that the designers of DES already knew about this type of attack and designed S-boxes and chose 16 as the number of rounds to make DES specifically resistant to this type of attack. Differential Cryptanalysis

64. 1.64 2-8 Continued Linear cryptanalysis is newer than differential cryptanalysis. DES is more vulnerable to linear cryptanalysis than to differential cryptanalysis. S-boxes are not very resistant to linear cryptanalysis. It has been shown that DES can be broken using 2 43 pairs of known plaintexts. However, from the practical point of view, finding so many pairs is very unlikely. Linear Cryptanalysis