Interested in learning more? Global Information Assurance Certification Paper. Copyright SANS Institute Author Retains Full Rights

Transcription

1 Globl Informtion Assurnce Certifiction Pper Copyright SANS Institute Author Retins Full Rights This pper is tken from the GIAC directory of certified professionls. Reposting is not permited without express written permission. Interested in lerning more? Check out the list of upcoming events offering "Security Essentils Bootcmp Style (Security 4)" t

2 A Look t Some of the Mthemtics Behind Rijndel Brett Crpenter Jnury 4, Introduction As lymn, I hve often been frustrted by the wy in which the mechnics of ciphers re pssed off s blck box into which plintext is inserted nd from which, with the help of mgic, ciphertext is retrieved. The brnch of mthemtics behind this mgic is known s cryptology. The purpose of this pper is to shed tiny ry of light on the concepts t work in this field. Specific ttention will be pid to Rijndel (pronounced Rhine-dhl), the Ntionl Institute of Stndrds nd Technology s recent choice for the Advnced Encryption Stndrd (AES). Key fingerprint = AF9 FA7 F94 998D FDB5 DED F8B5 6E4 A69 4E46 I pologize in dvnce to ny mthemticins who might hppen to red this pper. Objectives The objectives of this pper re s follows: To introduce, t very high level, some of the concepts in mthemtics underlying cryptology nd the Rijndel block cipher To describe the Rijndel block cipher in light of these concepts Mthemticl Bckground The mthemticl concepts mentioned in the following sections re tken loosely from the fields of lgebr nd nlysis. This section describes the model tht the designers of Rijndel used to represent binry dt. Fields A field is set clled F, for exmple long with two opertions, ddition ( ) nd multipliction ( ). F is closed under these opertions; tht is, the sum or product of ny two elements of F is lso n element of F. A mthemticin might express this property s follows:, b F b F, b F b F It is importnt to note tht these opertions need not be wht we think of s stndrd ddition (+) nd multipliction (*); thus the use of the lternte symbols. SANS Institute -, Author retins full rights. The properties of field include the following, mong others: Key fingerprint Addition = is AF9 commuttive: FA7 F94 998D b = bfdb5 DED F8B5 6E4 A69 4E46 Multipliction is distributive: ( b c) = ( b) ( c) The rel number system, R, is n exmple of field. SANS Institute - As prt of GIAC prcticl repository. Author retins full rights.

3 GF( 8 ) A finite field tht is, field contining finite number of elements is used s the bsis for Rijndel: GF( 8 ). This is the Glois Field (GF) contining 8, or 56, elements. Note tht ny byte vlue cn be mpped to exctly one element of GF( 8 ). A common representtion of the elements of GF( 8 ) is polynomil of degree seven with coefficients in {,}. Go with me on this one! A byte, b, consisting of bits b 7 b 6 b 5 b 4 b b b b, is the mpped to GF( 8 ) s the polynomil x b6x + b5x + b4 x + b x + bx + b x b b + +. Key Exmple fingerprint : = AF9 FA7 F94 998D FDB5 DED F8B5 6E4 A69 4E46 The byte with hex vlue 9 (binry ) is mpped to 6 4 x + x + x + x. Sounds like this might come in hndy when deling with binry dt, right? Addition nd Multipliction in GF( 8 ) Rel numbers cn be dded nd multiplied. All of us do this every dy. For exmple, + = 4. Well, there is n nlogous opertion in GF( 8 ). The ddition ( ) of two elements results in the polynomil with coefficients tht re given by the sum modulo. Exmple : Written in hex, we hve: Or, in binry, we hve: x x + x + x + x = x + x + D4 = 98. SANS Institute -, Author retins full rights. =. x Thus, ddition ( ) in GF( 8 ) is the stndrd bitwise XOR opertion. Pretty Key strightforwrd fingerprint = so AF9 fr! FA7 F94 998D FDB5 DED F8B5 6E4 A69 4E46 Multipliction ( ) is little trickier. It corresponds with multipliction of the polynomils modulo m(x), where SANS Institute - As prt of GIAC prcticl repository. Author retins full rights.

4 8 m ( x) = x + x + x + x + 4 or B in hex. Well, I hven t modulo d polynomil recently, but this is done to ensure tht the product is in fct n element of GF( 8 ), mong other things. Sounds resonble, though. Exmple : 4 7 ( x + x + ) ( x + x + x) = x( + x + x ) + ( x + x + x ) + ( x + x + x) = x + x + x + x + x Then, clculte the previous result modulo m(x): Key fingerprint = AF9 7 FA7 4 F94 998D FDB5 8 DED 4 x x x x x x x x F8B5 x 6E47 x A = + x + 4E46 ( ) mod( ) x + x + x This is equivlent to 5 4 = 9E in hex. 6 Like the ddition opertion in GF( 8 ), the multipliction opertion stisfies the requisite properties of field, s described bove. Result: 5 We now hve n bstrct representtion of our binry dt tht includes some bsic mthemticl opertions. Why Does Any of This Mtter? The steps described bove hve resulted in the following: digitl informtion, represented t the lowest logicl level s bits nd bytes, cn be mpped to mthemticl model tht hs certin nice qulities. In the cse of Rijndel, tht model is the finite field GF( 8 ). These qulities, nd their implictions, re then ultimtely used to encipher nd decipher the dt. For exmple, polynomils with coefficients in GF( 8 ) cn be used to represent rrys of bytes or multi-byte words. If,,, nd re elements of GF( 8 ), then x + x + x + is used to represent 4-byte vector, or 4-element rry of bytes, or 4-byte word. Imgine it s n rry of rrys. Thus, this model lends itself well to opertions t both the byte nd word level. These byte- nd word-level representtions re lso convenient for cipher tht is to be implemented on modern computer. SANS Institute -, Author retins full rights As nother exmple, multipliction of polynomils with coefficients in GF( 8 ) is done Key modulo fingerprint M(x), where = AF9 FA7 F94 998D FDB5 DED F8B5 6E4 A69 4E46 M ( x) = x 4 +, nd cn be conveniently represented s mtrix opertion: SANS Institute - As prt of GIAC prcticl repository. Author retins full rights.

5 c c c c = Agin, this lends itself well to being implemented on computer. Key fingerprint = AF9 FA7 F94 998D FDB5 DED F8B5 6E4 A69 4E46 Finlly, multipliction by the polynomil x corresponds with bit-level shift left nd n XOR with the hex vlue B. This cn lso be represented s mtrix opertion: b b, b b where n nd b n re two polynomils of degree nd c n is their product: c c c c where c n is the product of x nd b n : The Rijndel Block Cipher = n b n = c n. x b n = c n. b b b b Overview As you might expect from the bckground given bove, the Rijndel block cipher is designed to use simple whole-byte opertions. Its supports independent key nd block sizes of 8, 9, or 56 bits. The description of the lgorithm given here is for the cse where key nd block sizes re both 8 bits. The Rounds Rijndel is composed of n initil XOR step, nine round trnsformtions (or rounds), nd n dditionl round performed t the end with one step omitted. The input to ech round is clled the Stte. Ech of the first nine rounds is in turn composed of four trnsformtions: SANS Institute -, Author retins full rights. ByteSub Key ShiftRow fingerprint = AF9 FA7 F94 998D FDB5 DED F8B5 6E4 A69 4E46 MixColumn AddRoundKey The MixColumn trnsformtion is omitted from the tenth round. SANS Institute - As prt of GIAC prcticl repository. Author retins full rights.

6 The Inputs Since 8 bits is 6 bytes, our Stte ( m,n ) nd Cipher Key (k m,n ) cn be represented by 4*4 mtrices. Ech column contins four consecutive bytes, so ech successive row is word. The order of the bytes in the input block is preserved in this mnner..... k. k. k. k.,,,, k, k, k, k, k k k k,,,,,,,,,,,, k, k, k, k, The Stte The Cipher Key Key fingerprint = AF9 FA7 F94 998D FDB5 DED F8B5 6E4 A69 4E46 The initil step is to XOR the Stte with Round Key. See AddRoundKey, below. Trnsformtion - ByteSub In this step, the individul bytes of the input block re substituted ccording to vlues given in n S-Box, or Substitution Tble. The Rijndel specifiction includes formul for creting this S-Box. In brief, given byte vlue is replced with its reciprocl in GF( 8 ), multiplied by bitwise modulo mtrix, nd XORed with hex 6. Some smple input nd corresponding ByteSub vlues re: Input ByteSub FF Trnsformtion - ShiftRow Next, the individul rows of the Stte re shifted left s follows: Exmple Row Offset SANS Institute -, Author retins full rights ShiftRow Key fingerprint = AF9 FA7 7 F D FDB5 DED 5 F8B5 6E4 7 A69 4E SANS Institute - As prt of GIAC prcticl repository. Author retins full rights.

7 Trnsformtion - MixColumn Next, ech column of the Stte is multiplied by the polynomil c(x) = x + x + x +, which is equivlent to multipliction by the mtrix. Key fingerprint = AF9 FA7 F94 998D FDB5 DED F8B5 6E4 A69 4E46 Trnsformtion 4 - AddRoundKey Finlly, the Round Key is XORed with the Stte. An Expnded Key is generted from the Cipher Key by process clled Key Expnsion, which cn be performed before or during the cipher process. The result is key whose length is times the length of the originl Cipher Key, or 48 bits in our cse. The contents consists of the originl Cipher Key, followed by 8-bit blocks consisting of four-byte words such tht ech word is the XOR of the preceding four-byte word nd either the corresponding word in the previous block or function of it. Ech Round Key is 8-bit block of the Expnded Key. The Big Picture The steps of Rijndel re s follows: Initil AddRoundKey Round ByteSub ShiftRow MixColumn AddRoundKey Round 9 Byte Sub ShiftRow MixColumn AddRoundKey Round Byte Sub ShiftRow AddRoundKey Key fingerprint = AF9 FA7 F94 998D FDB5 DED F8B5 6E4 A69 4E46 The following is nice illustrtion of Rijndel round: SANS Institute -, Author retins full rights. SANS Institute - As prt of GIAC prcticl repository. Author retins full rights.

8 Key fingerprint = AF9 FA7 F94 998D FDB5 DED F8B5 6E4 A69 4E46 The Inverse Cipher The inverse of round is s follows: AddRoundKey InverseMixColumn InverseShiftRow InverseByteSub Figure : A Rijndel Round The AddRoundKey trnsformtion is simple XOR, nd so is its own inverse. By design, the other trnsformtions re invertible, so decryption is firly strightforwrd. This is one of those instnces where the nice qulities of GF( 8 ) come in hndy! Conclusion The mthemtics of cryptology is extremely complex nd lgorithm described bove ws designed to thwrt the efforts of cryptnlysts, or those who ttempt to brek ciphers. For exmple, they introduce confusion nd diffusion to foil sttisticl nlysis. The true brillince t work here is of course beyond the scope of this pper. It is, however, possible for us non-cryptologists to t lest visulize wht might occur to dt s it psses through cipher. SANS Institute -, Author retins full rights. References. Bltimore Technologies. Technicl Overview of RIJNDAEL - The AES. URL: Key fingerprint = AF9 FA7 F94 998D FDB5 DED F8B5 6E4 A69 4E46 (4 Jn. ).. Rijmen, Vincent. Rijndel. 4 Dec.. URL: (4 Jn ). SANS Institute - As prt of GIAC prcticl repository. Author retins full rights.

9 . RSA Security. RSA Lbortories Frequently Asked Questions bout Tody s Cryptogrphy, Version 4... URL: (4 Jn. ). 4. Svrd, John J.G. The Advnced Encryption Stndrd (Rijndel).. URL: (4 Jn. ). 5. Schneier, Bruce. Applied Cryptogrphy. nd Edition, John Wiley & Sons, Inc, 996. Key fingerprint = AF9 FA7 F94 998D FDB5 DED F8B5 6E4 A69 4E46 SANS Institute -, Author retins full rights. Key fingerprint = AF9 FA7 F94 998D FDB5 DED F8B5 6E4 A69 4E46 SANS Institute - As prt of GIAC prcticl repository. Author retins full rights.

10 Lst Updted: Jnury 8th, 9 Upcoming Trining SANS Security Est 9 New Orlens, LA Feb, 9 - Feb 9, 9 Live Event Security Est 9 - SEC4: Security Essentils Bootcmp Style New Orlens, LA Feb 4, 9 - Feb 9, 9 vlive SANS Anheim 9 Anheim, CA Feb, 9 - Feb 6, 9 Live Event SANS Northern VA Spring- Tysons 9 Tysons, VA Feb, 9 - Feb 6, 9 Live Event SANS Scottsdle 9 Scottsdle, AZ Feb 8, 9 - Feb, 9 Live Event SANS New York Metro Winter 9 Jersey City, NJ Feb 8, 9 - Feb, 9 Live Event SANS Dlls 9 Dlls, TX Feb 8, 9 - Feb, 9 Live Event SANS Secure Jpn 9 Tokyo, Jpn Feb 8, 9 - Mr, 9 Live Event SANS Reno Thoe 9 Reno, NV Feb 5, 9 - Mr, 9 Live Event Open-Source Intelligence Summit & Trining 9 Alexndri, VA Feb 5, 9 - Mr, 9 Live Event Mentor - SEC4 Rleigh, NC Feb 7, 9 - Mr 6, 9 Mentor SANS Bltimore Spring 9 Bltimore, MD Mr, 9 - Mr 9, 9 Live Event Bltimore Spring 9 - SEC4: Security Essentils Bootcmp Style Bltimore, MD Mr 4, 9 - Mr 9, 9 vlive Community SANS Indinpolis SEC4 Indinpolis, IN Mr 4, 9 - Mr 9, 9 Community SANS SANS Secure Indi 9 Bnglore, Indi Mr 4, 9 - Mr 9, 9 Live Event SANS St. Louis 9 St. Louis, MO Mr, 9 - Mr 6, 9 Live Event SANS London Mrch 9 London, United Mr, 9 - Mr 6, 9 Live Event Kingdom SANS Secure Singpore 9 Singpore, Singpore Mr, 9 - Mr, 9 Live Event SANS Sn Frncisco Spring 9 Sn Frncisco, CA Mr, 9 - Mr 6, 9 Live Event SANS Secure Cnberr 9 Cnberr, Austrli Mr 8, 9 - Mr, 9 Live Event SANS Norfolk 9 Norfolk, VA Mr 8, 9 - Mr, 9 Live Event SANS Munich Mrch 9 Munich, Germny Mr 8, 9 - Mr, 9 Live Event SANS vlive - SEC4: Security Essentils Bootcmp Style SEC4-9, Mr 9, 9 - Apr 5, 9 vlive Mentor Session - SEC4 Fredericksburg, VA Mr 9, 9 - My, 9 Mentor Community SANS Rleigh SEC4 Rleigh, NC Apr, 9 - Apr 6, 9 Community SANS SANS 9 Orlndo, FL Apr, 9 - Apr 8, 9 Live Event SANS 9 - SEC4: Security Essentils Bootcmp Style Orlndo, FL Apr, 9 - Apr 6, 9 vlive Mentor Session - SEC4 Tucson, AZ Apr 4, 9 - My 6, 9 Mentor SANS London April 9 London, United Apr 8, 9 - Apr, 9 Live Event Kingdom Blue Tem Summit & Trining 9 Louisville, KY Apr, 9 - Apr 8, 9 Live Event SANS Riydh April 9 Riydh, Kingdom Of Sudi Arbi Apr, 9 - Apr 8, 9 Live Event