1 / 57

Chapter 3

Chapter 3. Block Ciphers & The Data Encryption Standard. Contents. Block Cipher Principles The Data Encryption Standard The Strength of DES Differential and Linear Cryptananlysis Block Cipher Design Principles. Block Cipher principles. Stream Ciphers and Block Ciphers

bond
Télécharger la présentation

Chapter 3

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Chapter 3 Block Ciphers & The Data Encryption Standard

  2. Contents • Block Cipher Principles • The Data Encryption Standard • The Strength of DES • Differential and Linear Cryptananlysis • Block Cipher Design Principles

  3. Block Cipher principles • Stream Ciphers and Block Ciphers • Motivation for the Feistel Cipher Structure • The Feistel Cipher

  4. Stream Ciphers and Block Ciphers • Stream cipher • encrypts one bit or one byte at a time. • Vigenère cipher, Verman cipher • Block cipher • encrypts a block of plaintext as a whole • to produce a ciphertext block of equal length. • Typical block size: 64 or 128 bits

  5. Motivation for the Feistel Cipher Structure • A block cipher operates on a plaintext block of n bits to produce a ciphertext block of n bits. • Each plaintext must produce a unique ciphertext block (for decryption to be possible). • Such transformation is called reversible or nonsingular.

  6. Motivation for the Feistel Cipher Structure • The logic of a general substitution cipher. (for n = 4)

  7. Motivation for the Feistel Cipher Structure • A practical problem with the general substitution cipher • If a small block size is used, then the system is equivalent to a classical substitution cipher. • Such systems are vulnerable to a statistical analysis of the plaintext. • If block size is sufficiently large and an arbitrary reversible substitution is allowed, then statistical analysis is infeasible. • This is not practical from a performance point of view. • For n-bit block cipher, the key size is n X 2n bits. • For n = 4, the key size is 4 x 16 = 64 bits. • For n = 64, the key size is 64 x 2n 16 = 64 bits

  8. The Feistel Cipher • Feistel proposed the use of a cipher that alternates substitutions and permutations. • In fact, this is a practical application of a proposal by Claude Shannon to develop a product cipher that alternates confusion and diffusion functions.

  9. Diffusion and Confusion • Shannon suggests two methods for frustrating statistical cryptanalysis. • Diffusion and Confusion

  10. Diffusion and Confusion • Diffusion • To make the statistical relationship between the plaintext and ciphertext as complexas possible in order to thwart attempts to discover the key. • Confusion • To make the relationship between the statistics of the ciphertext and the value of the encryption key as complexas possibleto thwart attempts to discover the key.

  11. Diffusion and Confusion • Diffusion can be achieved by • a permutation followed by a function. • Confusion can be achieved by • a substitution.

  12. Feistel Cipher Structure • Feistel structure • Input • Plaintext : 2w bits • A Key K • Output • Ciphertext : 2w bits

  13. Feistel Cipher Structure • The input is divided into two halves L0 and R0 and they pass through n rounds. • Round i • Input: Li-1,Ri-1, and Ki(round key) • Output: LiandRi • A substitution is performed on the left halfLi-1. • A permutation is performed by swapping the two halves.

  14. Feistel Cipher Structure • Design features • Block size • The larger it is, the securer the cipher is but the slower the cipher is. • 64 or 128 bits • Key size • The larger it is, the securer the cipher is but the slower the cipher is. • 64 or 128 bits • Number of rounds • The larger it is, the securer the cipher is but the slower the cipher is. • 16 rounds is typical.

  15. Feistel Cipher Structure • Design features • Subkey generation • The more complex it is, the securer the cipher is but the slower… • Round function • The more complex it is, the securer the cipher is but the slower… • Fast software encryption/decryption • Ease of analysis

  16. Feistel Decryption Algorithm • Decryption is the same as the encryption except that the subkeys are used in reverse order.

  17. Feistel Cipher Structure • Round i

  18. The Data Encryption Standard • DES Encryption • Initial Permutation • Details of Single Round • Key Generation • The Avalanche Effect

  19. The Data Encryption Standard • The most widely used encryption. • Adopted in 1977 by NIST • FIPS PUB 46 • Data are encrypted in 64-bit blocks using a 56-bit key.

  20. DES Encryption DES is a Feistel cipher with the exception of IP and IP-1.

  21. Initial Permutation • The permutation • X = IP(M) • The inverse permutation • Y = IP-1(X) = IP-1(IP(M)) • The original ordering is restored

  22. Single Round • F function • Ri-1is expanded to 48-bits using E. • The result is XORed with the 48-bit round key. • The 48-bit is substituted by a 32-bit. • The 32-bit is permuted by P.

  23. Single Round • Expansion E • 32 bits  48 bits • 16 bits are reused. • Permutation P

  24. Single Round • Substitution • 48 bits  32 bits • 8 S-boxes • Each S-box gets 6 bits and outputs 4 bits.

  25. Single Round • Each S-box is given in page 79. • Outer bits 1 & 6 (row bits) select one rows • Inner bits 2-5 (col bits) are substituted • Example : Input : 011001 • the row is 01 (row 1) • the column is 1100 (column 12) • Output is 1001

  26. Key Generation • A 64-bit key used as input • Every 8th bit is ignored. • Thus, the key is 56 bits. • PC1permute 56 bits into two 28-bit halves.

  27. Key Generation • In each round, • each 28 bits are rotated left and • 24 bits are selected from each half.

  28. Key Generation

  29. Key Generation

  30. DES Decryption • Decryption uses the same algorithm as encryption. • Feistel cipher • Roundkey schedule is reversed.

  31. The Avalanche Effect • A small change of plaintext or key produces a significant change in the ciphertext. • DES exhibits a strong avalanche effect.

  32. The Avalanche Effect • Example

  33. The Avalanche Effect • Example

  34. The Strength of DES • The Use of 56-bit keys • The Nature of the DES Algorithm • Timing Attacks

  35. The Use of 56-bit Keys • If the key length is 56-bit, we have 256 = 7.2 x 1016keys. • In 1998, Electronic Frontier Foundation (EFF) announced ‘DES cracker’ which can attack DES in 3 days. • It was built for less than $250,000. • Alternatives to DES • AES (key size is 128 ~ 256 bit) and triple DES (112 ~ 168 bit)

  36. Differential and Linear Cryptanalysis • Differential Cryptanalysis • History • Differential Cryptanalysis Attack • Linear Cryptanalysis

  37. Differential Cryptanalysis • One of the most significant advances in cryptanalysis in recent years is differential cryptanalysis.

  38. History • Murphy, Biham & Shamir published 1990. • The first published attack that is capable of breaking DES in less than 255 complexity. • As reported, can successfully cryptanalyze DES with an effort on the order of 247, requiring chosen plaintexts. • This is a powerful tool, but it does not do very well against DES • Differential cryptanalysis was known to IBM as early as 1974

  39. Differential Cryptanalysis Attack • The differential cryptanalysis attack is complex. • Change in notation for DES • Original plaintext block : m • Two halves : m0, m1 • At each round for DES, only one new 32-bit block is created. • The intermediate message halves are related.

  40. Differential Cryptanalysis Attack • Start with two messages m and m’, and consider the difference between the intermediate message halves : • With a known XOR difference • Then

  41. Differential Cryptanalysis Attack • The Overall strategy is based one these considerations for a single round. • The procedure is • to begin with two plaintext message m and m’ with a given difference. • to trace through a probable pattern of differences after each round to yield a probable difference for the ciphertext.

  42. Differential Cryptanalysis Attack • Actually, there are two probable differences for the two 32-bit halves. • Next, submit m and m’ for encryption to determine the actual difference under the unknown key. • And compare the result to the probable difference. • If there is a match, • Then, suspect that all the probable patterns at all the intermediate rounds are correct. • With that assumption, can make some deductions about the key bits.

  43. Linear Cryptanalysis • another recent development • also a statistical method • must be iterated over rounds, with decreasing probabilities • developed by Matsui et al in early 90's • based on finding linear approximations • can attack DES with 247 known plaintexts, still in practise infeasible

  44. Linear Cryptanalysis • find linear approximations with prob p != ½ P[i1,i2,...,ia](+)C[j1,j2,...,jb] = K[k1,k2,...,kc] where ia,jb,kc are bit locations in P,C,K • gives linear equation for key bits • get one key bit using max likelihood alg • using a large number of trial encryptions • effectiveness given by: |p–½|

  45. Block Cipher Design Principles • DES Design Criteria • Number of Rounds • Design of Function F • Design Criteria for F • S-Box Design • Key Schedule Algorithm

  46. Block Cipher Design Principles • Although much progress has been made that are cryptographically strong, the basic principles have not changed all.

  47. DES Design Criteria • Focused on the design of the S-boxes and on the P function. • The criteria for the S-boxes. • No output bit of any S-box should be too close a linear function of the input bits. • Each row of an S-box should include all 16 possible output bit combinations • If two inputs differ in exactly one bit, the outputs must differ in at least two bits. • If two inputs differ in the two middle bits exactly, the outputs must differ in at least two bits.

  48. DES Design Criteria • The criteria for the S-boxes (~ continue) • If two inputs differ in their first two bits and are identical in their last two bits, the two outputs must not be the same. • For any nonzero 6-bit difference between inputs, no more than 8 of the 32 pairs of inputs exhibiting that difference may result in the same output difference. • This is a criterion similar to the previous one, but for the case of three S-boxes.

  49. DES Design Criteria • The criteria for the permutation P • The four output bits from each S-box at round i are distributed so that two of them affect “middle bits” of round (i + 1) and the other two affect end bits. The two middle bits of input to an S-box are not shared with adjacent S-boxes. The end bits are the two left-hand bits and the two right-hand bits, which are shared with adjacent S-boxes. • The four output bits from each S-box affect six different S-boxes on the next round, and no two affect the same S-boxes. • For two S-boxes j, k, if an output bit from Sj affects a middle bit of Sk on the next round, then an output bit from Sk cannot affect a middle bit of Sj . • These criteria are intended to increase the diffusion of the algorithm.

  50. Number of Rounds • The greater the number of rounds, the more difficult it is to perform cryptanalysis, even for a relatively weak F. • This criterion is attractive because it makes it easy to judge the strength of an algorithm and to compare different algorithms.

More Related