AES Advanced Encryption Standard

Transcription

1 AES Advanced Encryption Standard

2 AES is iterated block cipher that supports block sizes of 128-bits and key sizes of 128, 192, and 256 bits. The AES finalist candidate algorithms were MARS, RC6, Rijndael, Serpent, and Twofish. On October 2, 2000, Rijndael was selected by the National Institute of Standards and Technology (NIST) for an advanced encryption standard. Rijndael Rijmen & Daemen

3 Resistance against all known attacks Speed and code compactness on a wide range of platforms Design simplicity

4 Very good performance in hardware and software Wide range of computing environments Variable block and key lengths, and number of cycles Simplicity, low memory requirements, sound design Suitable for ATM, HDTV, B-ISDN, voice,and satellite

5 The inverse cipher is less suited to be implemented on a smart card than the cipher itself: it takes more code and cycles. In software, the cipher and its inverse make use of different code and/or tables. In hardware, the inverse cipher can only partially re-use the electrical circuits that implements the cipher.

6 Variable block length and variable key length No Feistel structure Four distinct invertible uniform transformations, called layers The ByteSub Transformation (BS) The ShiftRow Transformation (SR) The MixColumn Transformation (MC) AddRoundKey (ARK)

7 1. ARK, using the 0 th round key 2. Nine rounds of BS, SR, MC, ARK using round keys 1 to A final round: BS, SR, ARK, using the 10 th round key

8 Plaintext Add Round Key ByteSub ShiftRow MixColumn AddRound Key

9 ByteSub ShiftRow AddRound Key Ciphertext

10 Definition: The intermediate cipher result is called the State. The State can be pictured as a rectangular array of bytes. This array has four rows, the number of columns is denoted by Nb and is equal to the block length divided by 32. The Cipher Key can be also pictured as a rectangular array of bytes. This array has four rows, the number of columns is denoted by Nk and is equal to the key length divided by 32.

11

12 The number of rounds is denoted by Nr and depends on the values of Nb and Nk.

13 BS is a non-linear substitution, operating on each of the State bytes independently The S- box is invertible and is constructed by the following transformations: 1. Take the multiplicative inverse in GF(2^8) 2. Apply an affine transformation defined by:

14 Input: a(x)=x 5 +x 4 +x 3 +x 2 +1 Binary representation: Hex representation: 3D Inverse of a(x): a -1 (x)=x 7 + x 5 +x 4 +x 3 +x+1 Binary representation: = Hex representation: 27

15

16

17 The four rows of the matrix are shifted Cyclically to the left by offsets of 0, 1, 2 and 3. C00 C01 C02 C03 C10 C11 C12 C13 C20 C21 C22 C23 C30 C31 C32 C33 C00 C01 C02 C03 C11 C12 C13 C10 C22 C23 C20 C21 C33 C30 C31 C32

18

19 Example: The polynomial m(x)=x 8 +X 4 +X 3 +X+1 in hexadecimal representation is 11B.

20 c(x)= c 3 X 3 + c 2 X 2 + c 1 X + c 0 a(x)= a 3 X 3 + a 2 X 2 + a 1 X + a 0 c(x) a(x)= c 0 c 1 c 2 c 3 c 1 c 0 c 3 c 2 c 2 c 1 c 0 c 3 c 3 c 2 c 1 c 0 a 0 a 1 a 2 a 3

21 The columns of the State are considered as polynomials over GF(2^8) and multiplied mod g(x)=x^4 + 1 with a fixed polynomial c(x ) = 03 x^ x^ x + 02.

22 b(x)=c(x) a(x)

23

24 Round key bits are XORed with the output of the MixColumn step. This is the final output of the round with a key size of 192 bits.

25 The number of RoundKeys necessary to encrypt one block of information depends on the block length and key length as this determines the number of rounds. Example. For a block length of 128 bits, 11 RoundKeys are needed.

26 Example. The matrix (representation of 128 bits key) is expanded by adding 40 more columns.

27 ExtendedKeySize=(Nr+1)*BlockSize Denote with W i the i-th column in the matrix representation of the cipher key K. First four columns: W 0 W 1 W 2 W 3 New column: W i, i>3.

28 Case1: i mod 4 >0 W i = W i-4 W i-1 Case2: i mod 4 =0 W i = W i-4 SubByte(S(W i-1 )) r i

29 Let W i-1 be the column: abcd S(W i-1 ): Shift abcd cyclically : bcda SubByte(S(W i-1 )) : Replace each of the bytes in S(W i-1 ) with the corresponding element in the S-box from the BS step: efgh r i =[ (i-4)/4, , , ]

30 The round key for the i-th round consists of the columns W 4i W 4i+1 W 4i +2 W 4i +3

31 Case1: i mod N k >0 W i = W i-nk W i-1 Case2: i mod N k =0 where W i = W i-nk SubByte(S(W i-1 )) r i r i =[ (i/ N k ) -1, , , ]

32 Case1: i mod N k = 4 W i = W i-nk SubByte(W i-1 ) Case2: i mod N k =0 W i = W i-nk SubByte(S(W i-1 )) r i where r i =[ (i/n k ) -1, , , ] Elsewhere W i = W i-nk W i-1

33 The block size is 128 bits (N b =4) and the key size is 128 bits (N k =4). Key: 2B 7E AE D2 A6 AB F CF 4F 3C The matrix representation of the key is:

34 S(W 3 ) = SubByte(S(W 3 ) )=

35 r 4 = [ (4/4)-1, , , ] = [ , , , ]

36 This process of generating W i matrix contains 44 columns. continues until the extended

37 Plaintext AddRound Key Invshift Rows InvSubBytes AddRoundKey InvMixColumns InvShiftRows InvSubBytes AddRound Key Ciphertext

38 InvSubBytes: InvSubBytes is a similar operation as the SubBytes transformation, only the inverse of the S-box used for encryption is used. InvShiftRows: The InvShiftRows transformation is equal to the ShiftRows transformation, only the shift is to the right instead of to the left.

39

40 InvMixColumns : To invert the MixColumns transformation, the matrix used in Mixcolumns must be inverted. The InvMixColumns transformation then becomes:

41 Apply the Key Schedule scheme for encryption. Apply InvMixColumns to all RoundKeys except the first and the last one.